deps: update @types/node to 25.2.3

This reverts commit bc88bbc5e3.

package.json

@@ -17,7 +17,7 @@
   "devDependencies": {
     "@nhcarrigan/eslint-config": "5.2.0",
     "@nhcarrigan/typescript-config": "4.0.0",
-    "@types/node": "25.2.0",
+    "@types/node": "25.2.3",
     "@types/node-cron": "3.0.11",
     "@types/semver": "7.7.1",
     "@vitest/coverage-istanbul": "^4.0.18",

pnpm-lock.yaml

@@ -23,13 +23,13 @@ importers:
     devDependencies:
       '@nhcarrigan/eslint-config':
         specifier: 5.2.0
-        version: 5.2.0(@typescript-eslint/utils@8.54.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)(playwright@1.58.1)(react@19.2.4)(typescript@5.9.3)(vitest@4.0.18(@types/node@25.2.0))
+        version: 5.2.0(@typescript-eslint/utils@8.54.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)(playwright@1.58.1)(react@19.2.4)(typescript@5.9.3)(vitest@4.0.18(@types/node@25.2.3))
       '@nhcarrigan/typescript-config':
         specifier: 4.0.0
         version: 4.0.0(typescript@5.9.3)
       '@types/node':
-        specifier: 25.2.0
-        version: 25.2.0
+        specifier: 25.2.3
+        version: 25.2.3
       '@types/node-cron':
         specifier: 3.0.11
         version: 3.0.11
@@ -38,10 +38,10 @@ importers:
         version: 7.7.1
       '@vitest/coverage-istanbul':
         specifier: ^4.0.18
-        version: 4.0.18(vitest@4.0.18(@types/node@25.2.0))
+        version: 4.0.18(vitest@4.0.18(@types/node@25.2.3))
       '@vitest/coverage-v8':
         specifier: ^4.0.18
-        version: 4.0.18(vitest@4.0.18(@types/node@25.2.0))
+        version: 4.0.18(vitest@4.0.18(@types/node@25.2.3))
       eslint:
         specifier: 9.39.2
         version: 9.39.2
@@ -50,7 +50,7 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^4.0.18
-        version: 4.0.18(@types/node@25.2.0)
+        version: 4.0.18(@types/node@25.2.3)
 
 packages:
 
@@ -572,8 +572,8 @@ packages:
   '@types/node-cron@3.0.11':
     resolution: {integrity: sha512-0ikrnug3/IyneSHqCBeslAhlK2aBfYek1fGo4bP4QnZPmiqSGRK+Oy7ZMisLWkesffJvQ1cqAcBnJC+8+nxIAg==}
 
-  '@types/node@25.2.0':
-    resolution: {integrity: sha512-DZ8VwRFUNzuqJ5khrvwMXHmvPe+zGayJhr2CDNiKB1WBE1ST8Djl00D0IC4vvNmHMdj6DlbYRIaFE7WHjlDl5w==}
+  '@types/node@25.2.3':
+    resolution: {integrity: sha512-m0jEgYlYz+mDJZ2+F4v8D1AyQb+QzsNqRuI7xg1VQX/KlKS0qT9r1Mo16yo5F/MtifXFgaofIFsdFMox2SxIbQ==}
 
   '@types/normalize-package-data@2.4.4':
     resolution: {integrity: sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA==}
@@ -2471,7 +2471,7 @@ snapshots:
       '@jridgewell/resolve-uri': 3.1.2
       '@jridgewell/sourcemap-codec': 1.5.5
 
-  '@nhcarrigan/eslint-config@5.2.0(@typescript-eslint/utils@8.54.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)(playwright@1.58.1)(react@19.2.4)(typescript@5.9.3)(vitest@4.0.18(@types/node@25.2.0))':
+  '@nhcarrigan/eslint-config@5.2.0(@typescript-eslint/utils@8.54.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)(playwright@1.58.1)(react@19.2.4)(typescript@5.9.3)(vitest@4.0.18(@types/node@25.2.3))':
     dependencies:
       '@eslint-community/eslint-plugin-eslint-comments': 4.4.1(eslint@9.39.2)
       '@eslint/compat': 1.2.4(eslint@9.39.2)
@@ -2480,7 +2480,7 @@ snapshots:
       '@stylistic/eslint-plugin': 2.12.1(eslint@9.39.2)(typescript@5.9.3)
       '@typescript-eslint/eslint-plugin': 8.19.0(@typescript-eslint/parser@8.19.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)(typescript@5.9.3)
       '@typescript-eslint/parser': 8.19.0(eslint@9.39.2)(typescript@5.9.3)
-      '@vitest/eslint-plugin': 1.1.24(@typescript-eslint/utils@8.54.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)(typescript@5.9.3)(vitest@4.0.18(@types/node@25.2.0))
+      '@vitest/eslint-plugin': 1.1.24(@typescript-eslint/utils@8.54.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)(typescript@5.9.3)(vitest@4.0.18(@types/node@25.2.3))
       eslint: 9.39.2
       eslint-plugin-deprecation: 3.0.0(eslint@9.39.2)(typescript@5.9.3)
       eslint-plugin-import: 2.31.0(@typescript-eslint/parser@8.19.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)
@@ -2493,7 +2493,7 @@ snapshots:
       playwright: 1.58.1
       react: 19.2.4
       typescript: 5.9.3
-      vitest: 4.0.18(@types/node@25.2.0)
+      vitest: 4.0.18(@types/node@25.2.3)
     transitivePeerDependencies:
       - '@typescript-eslint/utils'
       - eslint-import-resolver-typescript
@@ -2626,7 +2626,7 @@ snapshots:
 
   '@types/node-cron@3.0.11': {}
 
-  '@types/node@25.2.0':
+  '@types/node@25.2.3':
     dependencies:
       undici-types: 7.16.0
 
@@ -2800,7 +2800,7 @@ snapshots:
       '@typescript-eslint/types': 8.54.0
       eslint-visitor-keys: 4.2.1
 
-  '@vitest/coverage-istanbul@4.0.18(vitest@4.0.18(@types/node@25.2.0))':
+  '@vitest/coverage-istanbul@4.0.18(vitest@4.0.18(@types/node@25.2.3))':
     dependencies:
       '@istanbuljs/schema': 0.1.3
       '@jridgewell/gen-mapping': 0.3.13
@@ -2812,11 +2812,11 @@ snapshots:
       magicast: 0.5.1
       obug: 2.1.1
       tinyrainbow: 3.0.3
-      vitest: 4.0.18(@types/node@25.2.0)
+      vitest: 4.0.18(@types/node@25.2.3)
     transitivePeerDependencies:
       - supports-color
 
-  '@vitest/coverage-v8@4.0.18(vitest@4.0.18(@types/node@25.2.0))':
+  '@vitest/coverage-v8@4.0.18(vitest@4.0.18(@types/node@25.2.3))':
     dependencies:
       '@bcoe/v8-coverage': 1.0.2
       '@vitest/utils': 4.0.18
@@ -2828,15 +2828,15 @@ snapshots:
       obug: 2.1.1
       std-env: 3.10.0
       tinyrainbow: 3.0.3
-      vitest: 4.0.18(@types/node@25.2.0)
+      vitest: 4.0.18(@types/node@25.2.3)
 
-  '@vitest/eslint-plugin@1.1.24(@typescript-eslint/utils@8.54.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)(typescript@5.9.3)(vitest@4.0.18(@types/node@25.2.0))':
+  '@vitest/eslint-plugin@1.1.24(@typescript-eslint/utils@8.54.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)(typescript@5.9.3)(vitest@4.0.18(@types/node@25.2.3))':
     dependencies:
       '@typescript-eslint/utils': 8.54.0(eslint@9.39.2)(typescript@5.9.3)
       eslint: 9.39.2
     optionalDependencies:
       typescript: 5.9.3
-      vitest: 4.0.18(@types/node@25.2.0)
+      vitest: 4.0.18(@types/node@25.2.3)
 
   '@vitest/expect@4.0.18':
     dependencies:
@@ -2847,13 +2847,13 @@ snapshots:
       chai: 6.2.2
       tinyrainbow: 3.0.3
 
-  '@vitest/mocker@4.0.18(vite@7.3.1(@types/node@25.2.0))':
+  '@vitest/mocker@4.0.18(vite@7.3.1(@types/node@25.2.3))':
     dependencies:
       '@vitest/spy': 4.0.18
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
-      vite: 7.3.1(@types/node@25.2.0)
+      vite: 7.3.1(@types/node@25.2.3)
 
   '@vitest/pretty-format@4.0.18':
     dependencies:
@@ -4467,7 +4467,7 @@ snapshots:
       spdx-correct: 3.2.0
       spdx-expression-parse: 3.0.1
 
-  vite@7.3.1(@types/node@25.2.0):
+  vite@7.3.1(@types/node@25.2.3):
     dependencies:
       esbuild: 0.27.2
       fdir: 6.5.0(picomatch@4.0.3)
@@ -4476,13 +4476,13 @@ snapshots:
       rollup: 4.57.1
       tinyglobby: 0.2.15
     optionalDependencies:
-      '@types/node': 25.2.0
+      '@types/node': 25.2.3
       fsevents: 2.3.3
 
-  vitest@4.0.18(@types/node@25.2.0):
+  vitest@4.0.18(@types/node@25.2.3):
     dependencies:
       '@vitest/expect': 4.0.18
-      '@vitest/mocker': 4.0.18(vite@7.3.1(@types/node@25.2.0))
+      '@vitest/mocker': 4.0.18(vite@7.3.1(@types/node@25.2.3))
       '@vitest/pretty-format': 4.0.18
       '@vitest/runner': 4.0.18
       '@vitest/snapshot': 4.0.18
@@ -4499,10 +4499,10 @@ snapshots:
       tinyexec: 1.0.2
       tinyglobby: 0.2.15
       tinyrainbow: 3.0.3
-      vite: 7.3.1(@types/node@25.2.0)
+      vite: 7.3.1(@types/node@25.2.3)
       why-is-node-running: 2.3.0
     optionalDependencies:
-      '@types/node': 25.2.0
+      '@types/node': 25.2.3
     transitivePeerDependencies:
       - jiti
       - less

src/index.ts

@@ -4,14 +4,12 @@
  * @author Naomi Carrigan
  */
 
-import { Logger } from "@nhcarrigan/logger";
 import cron from "node-cron";
 import { config, validateConfig } from "./config.js";
 import {
   UpdateOrchestratorService,
 } from "./services/updateOrchestratorService.js";
-
-const logger = new Logger("Minori", process.env.LOG_TOKEN ?? "");
+import { logger } from "./utils/logger.js";
 
 /**
  * Main entry point for the application.

src/services/dependencyAnalyzerService.ts

@@ -4,17 +4,15 @@
  * @author Naomi Carrigan
  */
 
-import { Logger } from "@nhcarrigan/logger";
 import semver from "semver";
-import type { NpmService } from "./npmService.js";
+import { logger } from "../utils/logger.js";
+import { NpmService } from "./npmService.js";
 import type {
   DependencyType,
   DependencyUpdate,
   PackageJson,
 } from "../types/package.types.js";
 
-const logger = new Logger("DependencyAnalyzer", process.env.LOG_TOKEN ?? "");
-
 /**
  * Checks if a version string is a valid semver range.
  * @param version - The version string to validate.
@@ -44,12 +42,14 @@ const isValidSemverRange = (version: string): boolean => {
 };
 
 /**
- * Removes version prefixes for comparison.
+ * Removes version prefixes and coerces to valid semver.
  * @param version - The version string to sanitise.
- * @returns The cleaned version string.
+ * @returns The cleaned version string, or null if invalid.
  */
-const cleanVersion = (version: string): string => {
-  return version.replace(/^[<=>^~]/, "");
+const cleanVersion = (version: string): string | null => {
+  const stripped = version.replace(/^[<=>^~]+/, "");
+  const coerced = semver.coerce(stripped);
+  return coerced?.version ?? null;
 };
 
 /**
@@ -68,6 +68,8 @@ const shouldUpdate = (
     }
 
     return semver.lt(currentVersion, latestVersion);
+  // eslint-disable-next-line capitalized-comments -- v8 coverage ignore directive must be lowercase
+  /* v8 ignore start -- @preserve */
   } catch (error) {
     void logger.error(
       `Error comparing versions: ${currentVersion} vs ${latestVersion}`,
@@ -76,6 +78,8 @@ const shouldUpdate = (
     );
     return false;
   }
+  // eslint-disable-next-line capitalized-comments -- v8 coverage ignore directive must be lowercase
+  /* v8 ignore stop -- @preserve */
 };
 
 /**
@@ -151,8 +155,19 @@ class DependencyAnalyzerService {
         return null;
       }
 
-      const latestVersion = packageInfo["dist-tags"].latest;
+      // Use mature version (at least 10 days old) instead of dist-tags.latest
+      const latestVersion = NpmService.getLatestMatureVersion(
+        packageInfo,
+        10,
+      );
+      if (latestVersion === null) {
+        return null;
+      }
+
       const cleanCurrentVersion = cleanVersion(currentVersion);
+      if (cleanCurrentVersion === null) {
+        return null;
+      }
 
       if (shouldUpdate(cleanCurrentVersion, latestVersion)) {
         return {

src/services/gitService.ts

@@ -119,7 +119,7 @@ const runPnpmInstall = async(
   /* v8 ignore stop -- @preserve */
   /* eslint-enable capitalized-comments -- Re-enable rule */
   try {
-    await execAsync(`${pnpmPath} install --no-frozen-lockfile`, {
+    await execAsync(`${pnpmPath} install --no-frozen-lockfile --strict-peer-dependencies=false`, {
       cwd: repoPath,
       env: pnpmEnvironment,
     });
@@ -127,14 +127,6 @@ const runPnpmInstall = async(
     /* eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- Catch blocks receive unknown, cast needed to access stderr/stdout */
     const details = pnpmError as Error & { stderr?: string; stdout?: string };
 
-    // TEMPORARY DEBUG - print full error details to console
-    console.log("=== PNPM ERROR DEBUG ===");
-    console.log("stderr:", details.stderr);
-    console.log("stdout:", details.stdout);
-    console.log("message:", details.message);
-    console.log("full error:", pnpmError);
-    console.log("=== END DEBUG ===");
-
     /* eslint-disable capitalized-comments -- v8 coverage requires lowercase */
     /* v8 ignore next 5 -- @preserve */
     /* eslint-enable capitalized-comments -- Re-enable rule */
@@ -220,20 +212,84 @@ const cloneRepository = async(
   };
 };
 
+/**
+ * Deletes a stale local branch if it exists.
+ * @param logger - The logger instance.
+ * @param repoPath - Path to the repository.
+ * @param branchName - Name of the branch to delete.
+ */
+const deleteStaleLocalBranch = async(
+  logger: Logger,
+  repoPath: string,
+  branchName: string,
+): Promise<void> => {
+  const localBranchOutput = await runGitCommand(logger, repoPath, "git branch");
+  const localBranchNames = localBranchOutput.
+    split("\n").
+    map((line) => {
+      return line.replace(/^\*?\s*/, "").trim();
+    }).
+    filter((name) => {
+      return name.length > 0;
+    });
+  if (localBranchNames.includes(branchName)) {
+    await runGitCommand(logger, repoPath, `git branch -D ${branchName}`);
+  }
+};
+
+/**
+ * Fetches and checks out an existing remote branch.
+ * @param logger - The logger instance.
+ * @param repoPath - The repository path.
+ * @param branchName - The branch name to fetch and checkout.
+ * @returns True if successful, false if the branch no longer exists on remote.
+ */
+const fetchAndCheckoutRemoteBranch = async(
+  logger: Logger,
+  repoPath: string,
+  branchName: string,
+): Promise<boolean> => {
+  try {
+    await runGitCommand(
+      logger,
+      repoPath,
+      `git fetch origin ${branchName}:refs/remotes/origin/${branchName}`,
+    );
+    await runGitCommand(
+      logger,
+      repoPath,
+      `git checkout -b ${branchName} origin/${branchName}`,
+    );
+    return true;
+  } catch {
+    // Branch may have been deleted between check and fetch
+    return false;
+  }
+};
+
 /**
  * Handles updating an existing branch with a newer version.
  * @param options - The branch update options.
- * @returns The update result.
+ * @returns The update result, or null if branch no longer exists.
  */
 const handleExistingBranch = async(
   options: BranchUpdateOptions,
-): Promise<UpdateResult> => {
+): Promise<UpdateResult | null> => {
   const { branchName, clonedRepo, logger, packageName, targetVersion }
     = options;
   const { path: repoPath } = clonedRepo;
 
-  await runGitCommand(logger, repoPath, `git checkout ${branchName}`);
-  await runGitCommand(logger, repoPath, `git pull origin ${branchName}`);
+  await deleteStaleLocalBranch(logger, repoPath, branchName);
+
+  const checkedOut = await fetchAndCheckoutRemoteBranch(
+    logger,
+    repoPath,
+    branchName,
+  );
+  if (!checkedOut) {
+    // Branch was deleted on remote, fall back to creating new branch
+    return null;
+  }
 
   const currentVersion = await getCurrentVersionOnBranch(repoPath, packageName);
 
@@ -277,19 +333,20 @@ const handleNewBranch = async(
   const { path: repoPath } = clonedRepo;
 
   await runGitCommand(logger, repoPath, "git checkout main");
-  await runGitCommand(logger, repoPath, `git checkout -b ${branchName}`);
 
+  // Check if package exists before creating branch
   const currentVersion = await getCurrentVersionOnBranch(repoPath, packageName);
   if (currentVersion === null) {
     void logger.log("warn", `Package ${packageName} not found in package.json`);
-    await runGitCommand(logger, repoPath, "git checkout main");
-    await runGitCommand(logger, repoPath, `git branch -D ${branchName}`);
     return {
       error:  `Package ${packageName} not found in package.json`,
       status: "failed",
     };
   }
 
+  // Only create branch if package exists
+  await runGitCommand(logger, repoPath, `git checkout -b ${branchName}`);
+
   await updatePackageAndCommit({
     logger,
     packageName,
@@ -316,7 +373,8 @@ const createOrUpdateBranch = async(
   const { path: repoPath } = clonedRepo;
 
   try {
-    await runGitCommand(logger, repoPath, "git fetch origin");
+    // Use --prune to remove stale remote-tracking refs that no longer exist
+    await runGitCommand(logger, repoPath, "git fetch origin --prune");
     const remoteBranches = await runGitCommand(
       logger,
       repoPath,
@@ -325,7 +383,11 @@ const createOrUpdateBranch = async(
     const branchExists = remoteBranches.includes(`origin/${branchName}`);
 
     if (branchExists) {
-      return await handleExistingBranch(options);
+      const result = await handleExistingBranch(options);
+      // If null, branch was deleted on remote between check and fetch
+      if (result !== null) {
+        return result;
+      }
     }
 
     return await handleNewBranch(options);

src/services/npmService.ts

@@ -4,13 +4,12 @@
  * @author Naomi Carrigan
  */
 
-import { Logger } from "@nhcarrigan/logger";
 import axios, { isAxiosError, type AxiosInstance } from "axios";
+import semver from "semver";
 import { config } from "../config.js";
+import { logger } from "../utils/logger.js";
 import type { NpmPackageInfo } from "../types/package.types.js";
 
-const logger = new Logger("NpmService", process.env.LOG_TOKEN ?? "");
-
 /* eslint-disable @typescript-eslint/naming-convention -- GitHub API response types use snake_case property names */
 interface GitHubRelease {
   body?:    string;
@@ -148,6 +147,50 @@ class NpmService {
     });
   }
 
+  /**
+   * Gets the latest version that is at least minimumAgeDays old.
+   * @param packageInfo - The package information from npm.
+   * @param minimumAgeDays - Minimum days since publication (default 10).
+   * @returns The latest mature version, or null if none found.
+   */
+  public static getLatestMatureVersion(
+    packageInfo: NpmPackageInfo,
+    minimumAgeDays = 10,
+  ): string | null {
+    const now = Date.now();
+    const minimumAgeMs = minimumAgeDays * 24 * 60 * 60 * 1000;
+    const cutoffDate = now - minimumAgeMs;
+
+    const versions = Object.keys(packageInfo.versions);
+    const matureVersions = versions.filter((version) => {
+      // Skip prerelease versions (e.g., 1.0.0-rc.1, 1.0.0-alpha, 1.0.0-beta.2)
+      const prereleaseComponents = semver.prerelease(version);
+      if (prereleaseComponents !== null && prereleaseComponents.length > 0) {
+        return false;
+      }
+
+      const publishedAt = packageInfo.time[version];
+      if (publishedAt === undefined) {
+        return false;
+      }
+      const publishedDate = new Date(publishedAt).getTime();
+      return publishedDate <= cutoffDate;
+    });
+
+    if (matureVersions.length === 0) {
+      return null;
+    }
+
+    // Sort by semver (descending) to get the latest mature version
+    matureVersions.sort((version1, version2) => {
+      return version2.localeCompare(version1, undefined, { numeric: true });
+    });
+
+    // eslint-disable-next-line capitalized-comments -- v8 coverage ignore directive must be lowercase
+    /* v8 ignore next -- @preserve */
+    return matureVersions[0] ?? null;
+  }
+
   /**
    * Fetches changelog information for a package update.
    * @param options - The changelog fetch options.

src/services/updateOrchestratorService.ts

@@ -4,8 +4,8 @@
  * @author Naomi Carrigan
  */
 
-import { Logger } from "@nhcarrigan/logger";
 import { config } from "../config.js";
+import { logger } from "../utils/logger.js";
 import { DependencyAnalyzerService } from "./dependencyAnalyzerService.js";
 import { GiteaService } from "./giteaService.js";
 import {
@@ -17,8 +17,6 @@ import { NpmService } from "./npmService.js";
 import type { GiteaRepository } from "../types/gitea.types.js";
 import type { DependencyUpdate, PackageJson } from "../types/package.types.js";
 
-const logger = new Logger("UpdateOrchestrator", process.env.LOG_TOKEN ?? "");
-
 /**
  * Strips version prefix characters from a version string.
  * @param version - The version string with potential prefixes.

src/types/package.types.ts

@@ -33,6 +33,7 @@ interface NpmPackageInfo {
     latest:        string;
   };
   "name":     string;
+  "time":     Record<string, string>;
   "versions": Record<
     string,
     {

src/utils/logger.ts

@@ -4,17 +4,19 @@
  * @author Naomi Carrigan
  */
 
+import { Logger } from "@nhcarrigan/logger";
+
 // import { Logger } from "@nhcarrigan/logger";
 
 // const logger = new Logger("Minori", process.env.LOG_TOKEN ?? "");
 
 const logger = {
-  error: (message: string) => {
-    console.error(message);
+  error: (message: string, error: Error) => {
+    console.error(message, error);
   },
-  log: (level: string, message: string) => {
-    console.log(`${level}: ${message}`);
+  log:   (level: string, message: string) => {
+    console.log(level, message);
   },
-};
+} as unknown as Logger;
 
 export { logger };

test/services/dependencyAnalyzerService.spec.ts

@@ -6,11 +6,17 @@
 
 /* eslint-disable vitest/valid-expect -- Test expectations don't need messages */
 /* eslint-disable max-lines-per-function -- Test suites require many test cases */
+/* eslint-disable max-lines -- Test suites require many test cases */
 /* eslint-disable @typescript-eslint/naming-convention -- Test data uses npm package names and destructured imports */
 /* eslint-disable @typescript-eslint/consistent-type-assertions -- Required for mocking */
-
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
+const getDaysAgoIso = (days: number): string => {
+  const msPerDay = 24 * 60 * 60 * 1000;
+  const ageMs = days * msPerDay;
+  return new Date(Date.now() - ageMs).toISOString();
+};
+
 vi.mock("@nhcarrigan/logger", () => {
   return {
 
@@ -57,10 +63,13 @@ describe("dependencyAnalyzerService", () => {
   it("should find updates for dependencies", async() => {
     expect.assertions(2);
     const mockNpmService = createMockNpmService();
+    // Include time field with a date >10 days ago for the mature version check
+    const oldDate = getDaysAgoIso(15);
     mockNpmService.getPackageInfo.mockResolvedValue({
       "dist-tags": { latest: "2.0.0" },
       "name":      "test-package",
-      "versions":  {},
+      "time":      { "2.0.0": oldDate },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
     });
     const { DependencyAnalyzerService }
       = await import("../../src/services/dependencyAnalyzerService.js");
@@ -197,10 +206,12 @@ describe("dependencyAnalyzerService", () => {
   it("should not include packages that are already up-to-date", async() => {
     expect.assertions(1);
     const mockNpmService = createMockNpmService();
+    const oldDate = getDaysAgoIso(15);
     mockNpmService.getPackageInfo.mockResolvedValue({
       "dist-tags": { latest: "1.0.0" },
       "name":      "test-package",
-      "versions":  {},
+      "time":      { "1.0.0": oldDate },
+      "versions":  { "1.0.0": { version: "1.0.0" } },
     });
     const { DependencyAnalyzerService }
       = await import("../../src/services/dependencyAnalyzerService.js");
@@ -235,10 +246,12 @@ describe("dependencyAnalyzerService", () => {
   it("should handle version prefixes like ^", async() => {
     expect.assertions(2);
     const mockNpmService = createMockNpmService();
+    const oldDate = getDaysAgoIso(15);
     mockNpmService.getPackageInfo.mockResolvedValue({
       "dist-tags": { latest: "2.0.0" },
       "name":      "test-package",
-      "versions":  {},
+      "time":      { "2.0.0": oldDate },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
     });
     const { DependencyAnalyzerService }
       = await import("../../src/services/dependencyAnalyzerService.js");
@@ -254,6 +267,54 @@ describe("dependencyAnalyzerService", () => {
     expect(result[0]?.currentVersion).toBe("^1.0.0");
   });
 
+  it("should handle multi-character version prefixes like >=", async() => {
+    expect.assertions(2);
+    const mockNpmService = createMockNpmService();
+    const oldDate = getDaysAgoIso(15);
+    mockNpmService.getPackageInfo.mockResolvedValue({
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "2.0.0": oldDate },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
+    });
+    const { DependencyAnalyzerService }
+      = await import("../../src/services/dependencyAnalyzerService.js");
+    const analyzerService = new DependencyAnalyzerService(
+      mockNpmService as Parameters<typeof DependencyAnalyzerService>[0],
+    );
+    const result = await analyzerService.analyzePackageJson({
+      dependencies: {
+        "test-package": ">=1.0.0",
+      },
+    });
+    expect(result).toHaveLength(1);
+    expect(result[0]?.currentVersion).toBe(">=1.0.0");
+  });
+
+  it("should handle partial version numbers like '2'", async() => {
+    expect.assertions(2);
+    const mockNpmService = createMockNpmService();
+    const oldDate = getDaysAgoIso(15);
+    mockNpmService.getPackageInfo.mockResolvedValue({
+      "dist-tags": { latest: "3.0.0" },
+      "name":      "test-package",
+      "time":      { "3.0.0": oldDate },
+      "versions":  { "3.0.0": { version: "3.0.0" } },
+    });
+    const { DependencyAnalyzerService }
+      = await import("../../src/services/dependencyAnalyzerService.js");
+    const analyzerService = new DependencyAnalyzerService(
+      mockNpmService as Parameters<typeof DependencyAnalyzerService>[0],
+    );
+    const result = await analyzerService.analyzePackageJson({
+      dependencies: {
+        "test-package": "2",
+      },
+    });
+    expect(result).toHaveLength(1);
+    expect(result[0]?.currentVersion).toBe("2");
+  });
+
   it("should handle npm errors gracefully", async() => {
     expect.assertions(1);
     const mockNpmService = createMockNpmService();
@@ -274,10 +335,12 @@ describe("dependencyAnalyzerService", () => {
   it("should handle semver comparison errors", async() => {
     expect.assertions(1);
     const mockNpmService = createMockNpmService();
+    const oldDate = getDaysAgoIso(15);
     mockNpmService.getPackageInfo.mockResolvedValue({
       "dist-tags": { latest: "invalid-version" },
       "name":      "test-package",
-      "versions":  {},
+      "time":      { "invalid-version": oldDate },
+      "versions":  { "invalid-version": { version: "invalid-version" } },
     });
     const { DependencyAnalyzerService }
       = await import("../../src/services/dependencyAnalyzerService.js");
@@ -291,4 +354,28 @@ describe("dependencyAnalyzerService", () => {
     });
     expect(result).toStrictEqual([]);
   });
+
+  it("should return null when no mature version exists", async() => {
+    expect.assertions(1);
+    const mockNpmService = createMockNpmService();
+    // Use a very recent date (2 days ago) so getLatestMatureVersion returns null
+    const recentDate = getDaysAgoIso(2);
+    mockNpmService.getPackageInfo.mockResolvedValue({
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "2.0.0": recentDate },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
+    });
+    const { DependencyAnalyzerService }
+      = await import("../../src/services/dependencyAnalyzerService.js");
+    const analyzerService = new DependencyAnalyzerService(
+      mockNpmService as Parameters<typeof DependencyAnalyzerService>[0],
+    );
+    const result = await analyzerService.analyzePackageJson({
+      dependencies: {
+        "test-package": "1.0.0",
+      },
+    });
+    expect(result).toStrictEqual([]);
+  });
 });

test/services/gitService.spec.ts

@@ -203,6 +203,44 @@ describe("gitService", () => {
     expect(result.status).toBe("up-to-date");
   });
 
+  it("should delete stale local branch before checking out remote", async() => {
+    expect.assertions(2);
+    const branchDeleteCalls: Array<string> = [];
+    mockExecAsync.mockImplementation((command: string) => {
+      if (command.includes("git branch -r")) {
+        return Promise.resolve({
+          stderr: "",
+          stdout: "  origin/dependencies/update-test-package\n",
+        });
+      }
+      if (command.includes("git branch") && !command.includes("-")) {
+        // Return local branches including the stale one
+        return Promise.resolve({
+          stderr: "",
+          stdout: "* main\n  dependencies/update-test-package\n",
+        });
+      }
+      if (command.includes("git branch -D")) {
+        branchDeleteCalls.push(command);
+      }
+      return Promise.resolve({ stderr: "", stdout: "" });
+    });
+    vi.mocked(readFile).mockResolvedValue(JSON.stringify({
+      dependencies: { "test-package": "2.0.0" },
+    }));
+    const { createOrUpdateBranch } = await import("../../src/services/gitService.js");
+    const mockClonedRepo = createMockClonedRepo();
+    const result = await createOrUpdateBranch({
+      branchName:    "dependencies/update-test-package",
+      clonedRepo:    mockClonedRepo,
+      logger:        mockLogger,
+      packageName:   "test-package",
+      targetVersion: "2.0.0",
+    });
+    expect(result.status).toBe("up-to-date");
+    expect(branchDeleteCalls).toHaveLength(1);
+  });
+
   it("should fail when package is not found", async() => {
     expect.assertions(2);
     mockExecAsync.mockResolvedValue({ stderr: "", stdout: "" });
@@ -364,6 +402,44 @@ describe("gitService", () => {
     expect(writtenContent.devDependencies["test-package"]).toBe("2.0.0");
   });
 
+  it("should fall back to new branch when remote branch fetch fails", async() => {
+    expect.assertions(2);
+    mockExecAsync.mockImplementation((command: string) => {
+      if (command.includes("git branch -r")) {
+        // Report branch as existing
+        return Promise.resolve({
+          stderr: "",
+          stdout: "  origin/dependencies/update-test-package\n",
+        });
+      }
+      if (command.includes("git fetch origin dependencies/update-test-package")) {
+        // But fail when trying to fetch it (deleted between check and fetch)
+        const error = new Error("Git command failed") as Error & { stderr: string };
+        error.stderr = "fatal: couldn't find remote ref dependencies/update-test-package";
+        return Promise.reject(error);
+      }
+      return Promise.resolve({ stderr: "", stdout: "" });
+    });
+    vi.mocked(readFile).mockResolvedValue(JSON.stringify({
+      dependencies: { "test-package": "1.0.0" },
+    }));
+    vi.mocked(writeFile).mockResolvedValue(undefined);
+    const { createOrUpdateBranch } = await import("../../src/services/gitService.js");
+    const mockClonedRepo = createMockClonedRepo();
+    const result = await createOrUpdateBranch({
+      branchName:    "dependencies/update-test-package",
+      clonedRepo:    mockClonedRepo,
+      logger:        mockLogger,
+      packageName:   "test-package",
+      targetVersion: "2.0.0",
+    });
+    // Should fall back to creating a new branch
+    expect(result.status).toBe("created");
+    if (result.status === "created") {
+      expect(result.branchName).toBe("dependencies/update-test-package");
+    }
+  });
+
   it("should log pnpm error details when install fails", async() => {
     expect.assertions(2);
     mockExecAsync.mockImplementation((command: string) => {

test/services/npmService.spec.ts

@@ -11,11 +11,19 @@
 /* eslint-disable @typescript-eslint/consistent-type-imports -- Dynamic imports */
 /* eslint-disable vitest/require-to-throw-message -- Generic throw assertion */
 /* eslint-disable stylistic/max-len -- Test files have long URLs */
+/* eslint-disable max-lines -- Test files have many test cases */
+/* eslint-disable max-statements -- Test describe blocks have many statements */
 
 import axios, { AxiosError, type AxiosResponse } from "axios";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { NpmService } from "../../src/services/npmService.js";
 
+const getDaysAgoIso = (days: number): string => {
+  const msPerDay = 24 * 60 * 60 * 1000;
+  const ageMs = days * msPerDay;
+  return new Date(Date.now() - ageMs).toISOString();
+};
+
 vi.mock("axios", async() => {
   const actualAxios = await vi.importActual<typeof import("axios")>("axios");
   return {
@@ -331,4 +339,131 @@ describe("npmService", () => {
     });
     expect(result).toBe("Updated from 1.0.0 to 2.0.0");
   });
+
+  it("should return latest mature version when versions are old enough", () => {
+    expect.assertions(1);
+    const oldDate = getDaysAgoIso(15);
+    const packageInfo = {
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "1.0.0": oldDate, "2.0.0": oldDate },
+      "versions":  {
+        "1.0.0": { version: "1.0.0" },
+        "2.0.0": { version: "2.0.0" },
+      },
+    };
+    const result = NpmService.getLatestMatureVersion(packageInfo);
+    expect(result).toBe("2.0.0");
+  });
+
+  it("should return null when no mature versions exist", () => {
+    expect.assertions(1);
+    const recentDate = getDaysAgoIso(2);
+    const packageInfo = {
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "2.0.0": recentDate },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
+    };
+    const result = NpmService.getLatestMatureVersion(packageInfo);
+    expect(result).toBeNull();
+  });
+
+  it("should skip versions without time data", () => {
+    expect.assertions(1);
+    const oldDate = getDaysAgoIso(15);
+    const packageInfo = {
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "1.0.0": oldDate },
+      "versions":  {
+        "1.0.0": { version: "1.0.0" },
+        "2.0.0": { version: "2.0.0" },
+      },
+    };
+    const result = NpmService.getLatestMatureVersion(packageInfo);
+    expect(result).toBe("1.0.0");
+  });
+
+  it("should sort versions correctly and return the latest", () => {
+    expect.assertions(1);
+    const oldDate = getDaysAgoIso(15);
+    const packageInfo = {
+      "dist-tags": { latest: "3.0.0" },
+      "name":      "test-package",
+      "time":      { "1.0.0": oldDate, "2.0.0": oldDate, "3.0.0": oldDate },
+      "versions":  {
+        "1.0.0": { version: "1.0.0" },
+        "2.0.0": { version: "2.0.0" },
+        "3.0.0": { version: "3.0.0" },
+      },
+    };
+    const result = NpmService.getLatestMatureVersion(packageInfo);
+    expect(result).toBe("3.0.0");
+  });
+
+  it("should use custom minimumAgeDays parameter", () => {
+    expect.assertions(1);
+    const fiveDaysAgo = getDaysAgoIso(5);
+    const packageInfo = {
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "2.0.0": fiveDaysAgo },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
+    };
+    // Default is 10 days, so 5 days old should be null
+    const resultDefault = NpmService.getLatestMatureVersion(packageInfo);
+    expect(resultDefault).toBeNull();
+  });
+
+  it("should return mature version with custom minimumAgeDays", () => {
+    expect.assertions(1);
+    const fiveDaysAgo = getDaysAgoIso(5);
+    const packageInfo = {
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "2.0.0": fiveDaysAgo },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
+    };
+    // With 3 days minimum, 5 days old should be valid
+    const resultCustom = NpmService.getLatestMatureVersion(packageInfo, 3);
+    expect(resultCustom).toBe("2.0.0");
+  });
+
+  it("should skip prerelease versions like rc, alpha, beta", () => {
+    expect.assertions(1);
+    const oldDate = getDaysAgoIso(15);
+    const packageInfo = {
+      "dist-tags": { latest: "3.0.0-rc.1" },
+      "name":      "test-package",
+      "time":      {
+        "2.0.0":        oldDate,
+        "3.0.0-alpha":  oldDate,
+        "3.0.0-beta.1": oldDate,
+        "3.0.0-rc.1":   oldDate,
+      },
+      "versions": {
+        "2.0.0":        { version: "2.0.0" },
+        "3.0.0-alpha":  { version: "3.0.0-alpha" },
+        "3.0.0-beta.1": { version: "3.0.0-beta.1" },
+        "3.0.0-rc.1":   { version: "3.0.0-rc.1" },
+      },
+    };
+    // Should return 2.0.0 since all 3.0.0 versions are prereleases
+    const result = NpmService.getLatestMatureVersion(packageInfo);
+    expect(result).toBe("2.0.0");
+  });
+
+  it("should return null when only prerelease versions exist", () => {
+    expect.assertions(1);
+    const oldDate = getDaysAgoIso(15);
+    const packageInfo = {
+      "dist-tags": { latest: "1.0.0-rc.1" },
+      "name":      "test-package",
+      "time":      { "1.0.0-rc.1": oldDate },
+      "versions":  { "1.0.0-rc.1": { version: "1.0.0-rc.1" } },
+    };
+    const result = NpmService.getLatestMatureVersion(packageInfo);
+    expect(result).toBeNull();
+  });
 });