In npm outdated, wanted is the highest version that satisfies the range in your package.json, and latest is the version tagged latest in the registry. If wanted is ahead of what you have installed, a plain update is possible. If latest is a new major version, expect a real migration.
What the npm docs say
The npm documentation explains that the outdated command checks the registry to see whether installed packages are outdated. By default it shows only the direct dependencies of the root project and of configured workspaces, and the all flag includes the meta-dependencies. In the output, wanted is the maximum version that satisfies the semver range specified in package.json. Latest is the version tagged latest in the registry, and the docs note that this may or may not be the maximum version of the package.
That gives you three numbers per package: current, wanted and latest.
Turning the gap into a plan
| Current vs wanted | Wanted vs latest | Meaning | Action |
|---|---|---|---|
| Behind | Same | Range allows the newest | Update, test, ship |
| Behind | Latest is a new major | Range blocks a major | Update to wanted now, plan the major |
| Same | Latest is newer | You are at the edge of your range | Decide on a range change |
| Same | Same | Up to date | Nothing |
The second row is the common case. You can often take the safe update immediately and put the major migration on the roadmap.
Using it with your SBOM
Your SBOM records what is installed. Run the outdated check against the same project and compare. Components where installed is behind wanted are low effort wins and often close advisories. Components where latest is far ahead are your migration backlog. Record both sets in the ticket.
For transitive components, the direct dependency that brings them in sets the range, so you may not be able to move them yourself. See why is this package in my build.
Steps
- Run the outdated check, with the all flag when you also want transitive components.
- Export the SBOM and match component names.
- Apply the safe updates first, test, and regenerate the SBOM.
- Open tickets for the majors, with owners.
- Re-run next month and compare.
Cautions
- A range such as a caret allows minor and patch changes, and a minor release can still change behaviour. Test.
- The outdated check does not tell you about advisories. Use scanning for that.
- Lockfiles matter. Commit yours, so installs are repeatable. See commit a lockfile by ecosystem.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a fixed version is identified for a vulnerable component.
Safeguard's SBOM and dependency scanning show component versions and advisories together, and you can try the free scan.
Quick check
Is wanted always safe to install?
It satisfies your range, but still test. Minor and patch releases can change behaviour.
Does outdated show transitive packages?
Not by default. Use the all flag to include them.
Sources
Last reviewed: 19 October 2026.
