Replace update-notifier-cjs with a zero-dependency equivalent (removes 46 packages)

[HeversonSilva-gif]

update-notifier-cjs pulls 46 packages into superstatic's dependency tree to check
whether a newer version has been published. That is 46 packages to resolve, audit and
trust, in service of one request to the registry and a box drawn on stderr. It is also
a fork that exists only because upstream update-notifier went ESM-only, and its last
release was January 2025.

I would like to propose replacing it with nano-update-notifier, which implements the
same public API — same options, same notifier.update shape, same suppression rules —
on Node.js built-ins alone, with no runtime dependencies. It ships both ESM and CommonJS
entry points, so the existing require keeps working.

The change is two lines: the manifest entry, and

-const updateNotifier = require("update-notifier-cjs");
+const updateNotifier = require("nano-update-notifier");

in src/bin/server.ts.

Measured

Against nano-update-notifier@1.1.0 at superstatic 4bd82b9, on Node 22.14.0 and
npm 10.9.2. Every row is a real run — npm ci on a clean checkout, then the two-line
change, then npm install:

Dependency delta	added 1 package, and removed 46 packages — npm's own words. 536 installed entries down to 491
npm run build	clean, exit 0
npm run lint	994 problems, 0 errors — identical to the same run before the change
npm run test-unit	181 passing, 10 pending, 19 failing — identical to the run before the change, and the set of failing test titles diffs empty against it

Those 46 entries are 39 distinct package names. Five of them — camelcase,
graceful-fs, semver, strip-json-comments and type-fest — are nested copies whose
name survives elsewhere in the tree, and ini goes from three paths at once. I lead
with 46 because that is what npm install prints; the 39 below is the list of names.

The 19 failures are pre-existing on my machine, all trailing slash cases, which look
like Windows path handling rather than anything related to this change. What matters is
that the swap does not move them.

The 39 names: @pnpm/config.env-replace, @pnpm/network.ca-file, @pnpm/npm-conf,
ansi-align, boxen, ci-info, cli-boxes, config-chain, configstore,
crypto-random-string, deep-extend, dot-prop, escape-goat, global-dirs,
has-yarn, import-lazy, ini, is-ci, is-installed-globally, is-npm, is-obj,
is-yarn-global, isomorphic-fetch, minimist, node-fetch, proto-list, pupa,
rc, registry-auth-token, registry-url, semver-diff, tr46, unique-string,
update-notifier-cjs, webidl-conversions, whatwg-fetch, whatwg-url,
widest-line, xdg-basedir.

The rendered notification is not byte-identical, and here is exactly how

I rendered the notification through superstatic's own call — updateCheckInterval of
one week, shouldNotifyInNpmScript: true — under both libraries and diffed the output.
Eight lines on each side. Lines 2 through 7, the borders, the padding and both text
lines, are byte-identical. Lines 1 and 8 are the blank margin lines, and they differ:

• update-notifier-cjs renders through boxen 5, which emits a yellow-open escape
  immediately followed by a yellow-close on those lines.
• nano-update-notifier replicates boxen 7, which emits nothing.

Each of those two lines is 10 bytes under update-notifier-cjs — the escape pair
ESC[33m ESC[39m with nothing between them — and 0 bytes here, so the whole output
differs by 20 bytes and nothing else. On the run I measured that was 601 bytes against
581. Both render as a blank line in any terminal, and stripping ANSI makes the two
byte-equal. I would rather state that than claim an equality I cannot support.

How compatibility is held

Differential test suites run update-notifier, boxen, wrap-ansi, semver and
string-width as oracles: the full box option matrix, notification rendering with
colour enabled, ANSI-aware wrapping, and fuzzed version comparison. 300 tests, green on
Ubuntu, Windows and macOS across Node 18, 22 and 24. The package is published from a
GitHub Actions release through npm trusted publishing, with SLSA provenance attached.

Not verified

test-integration, and any run on Linux or macOS — I measured on Windows.

Two things worth raising

Disclosure: I wrote nano-update-notifier. That is why this is an issue rather than
a pull request. CONTRIBUTING asks for discussion before a larger contribution, and a
proposal to adopt my own package deserves that more than most. If this is not something
you want to take on, saying so costs you nothing and I will not push it.

I understand the Google CLA is needed before anything can merge, and I am happy to sign
it. CONTRIBUTING notes it is not required until after review, so I am raising the idea
first rather than signing speculatively.

[HeversonSilva-gif]

Closing one of the two gaps I listed under "Not verified" — I've now run
test-integration as well, at 4bd82b9 on Node 22.14.0.

Clean npm ci, npm run build, then the integration suite; then the two-line change,
npm install, npm run build, and the suite again:

	baseline	after
npm run test-integration exit	0	0
result	33 passing, 5 pending, 0 failing	33 passing, 5 pending, 0 failing
distinct failing titles	0	0
npm run build	exit 0	exit 0

Nothing moves. Combined with the unit run in the original post, both suites are now
covered rather than one.

npm install restated the dependency figure on its own:

added 1 package, and removed 46 packages

Still not verified: any run on Linux or macOS. I measured on Windows throughout, so if
the swap has a platform-specific wrinkle, CI would be where it shows up rather than
anything I have run.

[HeversonSilva-gif]

Housekeeping: everything above was measured against nano-update-notifier@1.1.0, and
1.2.0 has since been published. Flagging it so the version in this issue is not
mistaken for the one you would install.

1.2.0 is a types-only change, and it exists because of a different proposal. It
narrows the declared Update["type"] from string to the union
@types/update-notifier declares, and defaults the config store's get() type parameter
to any to match configstore. Minor rather than patch because a narrowed union rejects
assignments that used to compile. No runtime behaviour changed.

Neither of those affects this repository — I re-ran the dependency delta against the
published 1.2.0 and the lockfile diff is identical: 46 removed, 1 added, 536 → 491
entries, same list of names.

The suite is now 309 tests rather than the 300 quoted above; the extra ones pin the type
contract that 1.2.0 fixed.