NPM Reforge

A browser tool for inspecting and safely upgrading package.json dependencies.

Drop in a Node.js project’s package.json. NPM Reforge checks the live npm registry, shows which packages are behind, and lets you choose what to upgrade before you change anything on disk.

The problem

Keeping JavaScript dependencies current is necessary and easy to get wrong.

• Outdated packages pile up. A typical project has dozens of dependencies. Checking them one by one is slow; ignoring them leaves security and bug fixes on the table.
• Not every update is equal. A patch might be a one-line install. A major bump can break the app. CLI tools like npm outdated list versions, but they don’t make that risk obvious.
• Blind upgrades are expensive. Updating everything at once, then hunting down what broke, is a common and frustrating loop.
• It’s hard to share the picture. Asking a teammate “should we bump these?” usually means screenshots, pasted terminal output, or sending the file around.

NPM Reforge is built for that gap: see the state of a project’s dependencies, understand the risk of each bump, pick what to take, and share the same view with someone else.

What it does

1. Scan a package.json
   Upload a file, drag it onto the page, or try a sample stack (React, Express, and similar). Both dependencies and devDependencies are checked.

2. Compare against the registry
   Each package is looked up on the npm registry so you see the version you have versus the latest release.

3. Sort updates by risk
   Changes are grouped the way semver intends:

   • Major — likely breaking
   • Minor — new features, usually compatible
   • Patch — bug and security fixes
   • Current — already up to date

4. Review before you apply
   Inspect bumps as a side-by-side or unified diff of package.json. Toggle packages on or off. Filter by major, minor, patch, or production vs. dev.

5. Take the change with you
   Download an updated package.json, or copy an install command for npm, yarn, pnpm, or bun — only for the packages you selected.

6. Share a scan, not a file
   Generate a link that encodes the scan and your selections in the URL. Anyone with the link sees the same results. Nothing is stored on a server.

Your file is processed in the browser. The only network request is to the public npm registry for version metadata.

Who it’s for

Anyone who maintains a Node.js, React, Next.js, or Express project and wants a clearer picture before running npm update — especially when reviewing upgrades with a teammate.