In npm outdated, Current is what sits in node_modules, Wanted is the highest version your package.json range allows, and Latest is whatever the registry tags as latest. When Wanted equals Current but Latest is higher, your range is holding you back.
Reading the three columns
Current is the version installed right now.
Wanted is, in the npm documentation's words, the maximum version that satisfies the semver range in package.json. If you declared ^5.0.15 and version 6.0.1 exists, Wanted stays on the highest 5.x release.
Latest is the version carrying the latest dist-tag in the registry. That is usually the newest stable release, but the docs point out it is a tag and not always the numerically highest version. Maintainers can use tags such as latest and next to manage release channels.
The colours
npm colours rows to help triage.
- Red means a newer version matches your range. Running an update will move you.
- Yellow means a newer version exists outside your range, usually a new major or a new 0.x minor. Proceed with caution.
So red is the cheap, in range work. Yellow is the work that needs reading a changelog.
What to do with each case
Current below Wanted. You are behind your own range. An npm update will install the Wanted version. By default it leaves the range text in package.json alone. Adding the save option also updates the range.
Wanted equals Latest, Current equals both. Nothing to do.
Wanted below Latest. The newest release is outside your range. This is a decision, not a chore. Read the release notes, check whether the major version changed, and plan a branch for it.
Latest looks lower than Wanted. This happens when the latest tag points at a version that is not the highest. Check the package's own release notes before assuming a mistake.
Using it as a hygiene habit
A short weekly look at npm outdated is a cheap way to see drift. A few rules help it stay useful:
- Run it from a clean checkout with the lockfile applied, so Current reflects what CI builds.
- Treat red rows as routine and yellow rows as planned work.
- Do not update everything at once. Batch by risk so a failure points at a small set of changes.
If you use an update bot, this command is still worth knowing, because it shows you the same gap the bot is about to open pull requests for.
Safeguard's SBOM and dependency scanning adds the missing piece, which is whether an outdated package carries a known vulnerability. A free scan is available at gold.safeguard.sh/scan.
Quick check
Why does Wanted not show the newest version?
Wanted is limited by the range in package.json. A newer major usually sits outside it, which is what Latest shows.
Does npm update change package.json?
Not by default. It updates installed versions within the range. Use the save option if you want the range text updated as well.
Sources
Last reviewed: 19 October 2026.
