deps: update semver to 7.7.4

package.json

@@ -30,6 +30,6 @@
     "@nhcarrigan/logger": "1.1.1",
     "axios": "1.13.4",
     "node-cron": "4.2.1",
-    "semver": "7.7.3"
+    "semver": "7.7.4"
   }
 }

pnpm-lock.yaml

@@ -18,8 +18,8 @@ importers:
         specifier: 4.2.1
         version: 4.2.1
       semver:
-        specifier: 7.7.3
+        specifier: 7.7.4
-        version: 7.7.3
+        version: 7.7.4
     devDependencies:
       '@nhcarrigan/eslint-config':
         specifier: 5.2.0
@@ -1852,8 +1852,8 @@ packages:
     resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
     hasBin: true
 
-  semver@7.7.3:
+  semver@7.7.4:
-    resolution: {integrity: sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==}
+    resolution: {integrity: sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==}
     engines: {node: '>=10'}
     hasBin: true
 
@@ -2716,7 +2716,7 @@ snapshots:
       globby: 11.1.0
       is-glob: 4.0.3
       minimatch: 9.0.5
-      semver: 7.7.3
+      semver: 7.7.4
       ts-api-utils: 1.4.3(typescript@5.9.3)
     optionalDependencies:
       typescript: 5.9.3
@@ -2731,7 +2731,7 @@ snapshots:
       fast-glob: 3.3.3
       is-glob: 4.0.3
       minimatch: 9.0.5
-      semver: 7.7.3
+      semver: 7.7.4
       ts-api-utils: 1.4.3(typescript@5.9.3)
       typescript: 5.9.3
     transitivePeerDependencies:
@@ -2745,7 +2745,7 @@ snapshots:
       '@typescript-eslint/visitor-keys': 8.54.0
       debug: 4.4.3
       minimatch: 9.0.5
-      semver: 7.7.3
+      semver: 7.7.4
       tinyglobby: 0.2.15
       ts-api-utils: 2.4.0(typescript@5.9.3)
       typescript: 5.9.3
@@ -3352,7 +3352,7 @@ snapshots:
       espree: 10.4.0
       esquery: 1.7.0
       parse-imports: 2.2.1
-      semver: 7.7.3
+      semver: 7.7.4
       spdx-expression-parse: 4.0.0
       synckit: 0.9.3
     transitivePeerDependencies:
@@ -3409,7 +3409,7 @@ snapshots:
       read-pkg-up: 7.0.1
       regexp-tree: 0.1.27
       regjsparser: 0.10.0
-      semver: 7.7.3
+      semver: 7.7.4
       strip-indent: 3.0.0
 
   eslint-scope@8.4.0:
@@ -3803,7 +3803,7 @@ snapshots:
       '@babel/parser': 7.29.0
       '@istanbuljs/schema': 0.1.3
       istanbul-lib-coverage: 3.2.2
-      semver: 7.7.3
+      semver: 7.7.4
     transitivePeerDependencies:
       - supports-color
 
@@ -3903,7 +3903,7 @@ snapshots:
 
   make-dir@4.0.0:
     dependencies:
-      semver: 7.7.3
+      semver: 7.7.4
 
   math-intrinsics@1.1.0: {}
 
@@ -4209,7 +4209,7 @@ snapshots:
 
   semver@6.3.1: {}
 
-  semver@7.7.3: {}
+  semver@7.7.4: {}
 
   set-function-length@1.2.2:
     dependencies:

src/index.ts

@@ -4,14 +4,12 @@
  * @author Naomi Carrigan
  */
 
-import { Logger } from "@nhcarrigan/logger";
 import cron from "node-cron";
 import { config, validateConfig } from "./config.js";
 import {
   UpdateOrchestratorService,
 } from "./services/updateOrchestratorService.js";
-
+import { logger } from "./utils/logger.js";
-const logger = new Logger("Minori", process.env.LOG_TOKEN ?? "");
 
 /**
  * Main entry point for the application.

src/services/dependencyAnalyzerService.ts

@@ -4,17 +4,15 @@
  * @author Naomi Carrigan
  */
 
-import { Logger } from "@nhcarrigan/logger";
 import semver from "semver";
-import type { NpmService } from "./npmService.js";
+import { logger } from "../utils/logger.js";
+import { NpmService } from "./npmService.js";
 import type {
   DependencyType,
   DependencyUpdate,
   PackageJson,
 } from "../types/package.types.js";
 
-const logger = new Logger("DependencyAnalyzer", process.env.LOG_TOKEN ?? "");
-
 /**
  * Checks if a version string is a valid semver range.
  * @param version - The version string to validate.
@@ -44,12 +42,14 @@ const isValidSemverRange = (version: string): boolean => {
 };
 
 /**
- * Removes version prefixes for comparison.
+ * Removes version prefixes and coerces to valid semver.
  * @param version - The version string to sanitise.
- * @returns The cleaned version string.
+ * @returns The cleaned version string, or null if invalid.
  */
-const cleanVersion = (version: string): string => {
+const cleanVersion = (version: string): string | null => {
-  return version.replace(/^[<=>^~]/, "");
+  const stripped = version.replace(/^[<=>^~]+/, "");
+  const coerced = semver.coerce(stripped);
+  return coerced?.version ?? null;
 };
 
 /**
@@ -68,6 +68,8 @@ const shouldUpdate = (
     }
 
     return semver.lt(currentVersion, latestVersion);
+  // eslint-disable-next-line capitalized-comments -- v8 coverage ignore directive must be lowercase
+  /* v8 ignore start -- @preserve */
   } catch (error) {
     void logger.error(
       `Error comparing versions: ${currentVersion} vs ${latestVersion}`,
@@ -76,6 +78,8 @@ const shouldUpdate = (
     );
     return false;
   }
+  // eslint-disable-next-line capitalized-comments -- v8 coverage ignore directive must be lowercase
+  /* v8 ignore stop -- @preserve */
 };
 
 /**
@@ -151,8 +155,19 @@ class DependencyAnalyzerService {
         return null;
       }
 
-      const latestVersion = packageInfo["dist-tags"].latest;
+      // Use mature version (at least 10 days old) instead of dist-tags.latest
+      const latestVersion = NpmService.getLatestMatureVersion(
+        packageInfo,
+        10,
+      );
+      if (latestVersion === null) {
+        return null;
+      }
+
       const cleanCurrentVersion = cleanVersion(currentVersion);
+      if (cleanCurrentVersion === null) {
+        return null;
+      }
 
       if (shouldUpdate(cleanCurrentVersion, latestVersion)) {
         return {

src/services/gitService.ts

@@ -212,20 +212,84 @@ const cloneRepository = async(
   };
 };
 
+/**
+ * Deletes a stale local branch if it exists.
+ * @param logger - The logger instance.
+ * @param repoPath - Path to the repository.
+ * @param branchName - Name of the branch to delete.
+ */
+const deleteStaleLocalBranch = async(
+  logger: Logger,
+  repoPath: string,
+  branchName: string,
+): Promise<void> => {
+  const localBranchOutput = await runGitCommand(logger, repoPath, "git branch");
+  const localBranchNames = localBranchOutput.
+    split("\n").
+    map((line) => {
+      return line.replace(/^\*?\s*/, "").trim();
+    }).
+    filter((name) => {
+      return name.length > 0;
+    });
+  if (localBranchNames.includes(branchName)) {
+    await runGitCommand(logger, repoPath, `git branch -D ${branchName}`);
+  }
+};
+
+/**
+ * Fetches and checks out an existing remote branch.
+ * @param logger - The logger instance.
+ * @param repoPath - The repository path.
+ * @param branchName - The branch name to fetch and checkout.
+ * @returns True if successful, false if the branch no longer exists on remote.
+ */
+const fetchAndCheckoutRemoteBranch = async(
+  logger: Logger,
+  repoPath: string,
+  branchName: string,
+): Promise<boolean> => {
+  try {
+    await runGitCommand(
+      logger,
+      repoPath,
+      `git fetch origin ${branchName}:refs/remotes/origin/${branchName}`,
+    );
+    await runGitCommand(
+      logger,
+      repoPath,
+      `git checkout -b ${branchName} origin/${branchName}`,
+    );
+    return true;
+  } catch {
+    // Branch may have been deleted between check and fetch
+    return false;
+  }
+};
+
 /**
  * Handles updating an existing branch with a newer version.
  * @param options - The branch update options.
- * @returns The update result.
+ * @returns The update result, or null if branch no longer exists.
  */
 const handleExistingBranch = async(
   options: BranchUpdateOptions,
-): Promise<UpdateResult> => {
+): Promise<UpdateResult | null> => {
   const { branchName, clonedRepo, logger, packageName, targetVersion }
     = options;
   const { path: repoPath } = clonedRepo;
 
-  await runGitCommand(logger, repoPath, `git checkout ${branchName}`);
+  await deleteStaleLocalBranch(logger, repoPath, branchName);
-  await runGitCommand(logger, repoPath, `git pull origin ${branchName}`);
+
+  const checkedOut = await fetchAndCheckoutRemoteBranch(
+    logger,
+    repoPath,
+    branchName,
+  );
+  if (!checkedOut) {
+    // Branch was deleted on remote, fall back to creating new branch
+    return null;
+  }
 
   const currentVersion = await getCurrentVersionOnBranch(repoPath, packageName);
 
@@ -269,19 +333,20 @@ const handleNewBranch = async(
   const { path: repoPath } = clonedRepo;
 
   await runGitCommand(logger, repoPath, "git checkout main");
-  await runGitCommand(logger, repoPath, `git checkout -b ${branchName}`);
 
+  // Check if package exists before creating branch
   const currentVersion = await getCurrentVersionOnBranch(repoPath, packageName);
   if (currentVersion === null) {
     void logger.log("warn", `Package ${packageName} not found in package.json`);
-    await runGitCommand(logger, repoPath, "git checkout main");
-    await runGitCommand(logger, repoPath, `git branch -D ${branchName}`);
     return {
       error:  `Package ${packageName} not found in package.json`,
       status: "failed",
     };
   }
 
+  // Only create branch if package exists
+  await runGitCommand(logger, repoPath, `git checkout -b ${branchName}`);
+
   await updatePackageAndCommit({
     logger,
     packageName,
@@ -308,7 +373,8 @@ const createOrUpdateBranch = async(
   const { path: repoPath } = clonedRepo;
 
   try {
-    await runGitCommand(logger, repoPath, "git fetch origin");
+    // Use --prune to remove stale remote-tracking refs that no longer exist
+    await runGitCommand(logger, repoPath, "git fetch origin --prune");
     const remoteBranches = await runGitCommand(
       logger,
       repoPath,
@@ -317,7 +383,11 @@ const createOrUpdateBranch = async(
     const branchExists = remoteBranches.includes(`origin/${branchName}`);
 
     if (branchExists) {
-      return await handleExistingBranch(options);
+      const result = await handleExistingBranch(options);
+      // If null, branch was deleted on remote between check and fetch
+      if (result !== null) {
+        return result;
+      }
     }
 
     return await handleNewBranch(options);

src/services/npmService.ts

@@ -4,13 +4,12 @@
  * @author Naomi Carrigan
  */
 
-import { Logger } from "@nhcarrigan/logger";
 import axios, { isAxiosError, type AxiosInstance } from "axios";
+import semver from "semver";
 import { config } from "../config.js";
+import { logger } from "../utils/logger.js";
 import type { NpmPackageInfo } from "../types/package.types.js";
 
-const logger = new Logger("NpmService", process.env.LOG_TOKEN ?? "");
-
 /* eslint-disable @typescript-eslint/naming-convention -- GitHub API response types use snake_case property names */
 interface GitHubRelease {
   body?:    string;
@@ -148,6 +147,50 @@ class NpmService {
     });
   }
 
+  /**
+   * Gets the latest version that is at least minimumAgeDays old.
+   * @param packageInfo - The package information from npm.
+   * @param minimumAgeDays - Minimum days since publication (default 10).
+   * @returns The latest mature version, or null if none found.
+   */
+  public static getLatestMatureVersion(
+    packageInfo: NpmPackageInfo,
+    minimumAgeDays = 10,
+  ): string | null {
+    const now = Date.now();
+    const minimumAgeMs = minimumAgeDays * 24 * 60 * 60 * 1000;
+    const cutoffDate = now - minimumAgeMs;
+
+    const versions = Object.keys(packageInfo.versions);
+    const matureVersions = versions.filter((version) => {
+      // Skip prerelease versions (e.g., 1.0.0-rc.1, 1.0.0-alpha, 1.0.0-beta.2)
+      const prereleaseComponents = semver.prerelease(version);
+      if (prereleaseComponents !== null && prereleaseComponents.length > 0) {
+        return false;
+      }
+
+      const publishedAt = packageInfo.time[version];
+      if (publishedAt === undefined) {
+        return false;
+      }
+      const publishedDate = new Date(publishedAt).getTime();
+      return publishedDate <= cutoffDate;
+    });
+
+    if (matureVersions.length === 0) {
+      return null;
+    }
+
+    // Sort by semver (descending) to get the latest mature version
+    matureVersions.sort((version1, version2) => {
+      return version2.localeCompare(version1, undefined, { numeric: true });
+    });
+
+    // eslint-disable-next-line capitalized-comments -- v8 coverage ignore directive must be lowercase
+    /* v8 ignore next -- @preserve */
+    return matureVersions[0] ?? null;
+  }
+
   /**
    * Fetches changelog information for a package update.
    * @param options - The changelog fetch options.

src/services/updateOrchestratorService.ts

@@ -4,8 +4,8 @@
  * @author Naomi Carrigan
  */
 
-import { Logger } from "@nhcarrigan/logger";
 import { config } from "../config.js";
+import { logger } from "../utils/logger.js";
 import { DependencyAnalyzerService } from "./dependencyAnalyzerService.js";
 import { GiteaService } from "./giteaService.js";
 import {
@@ -17,8 +17,6 @@ import { NpmService } from "./npmService.js";
 import type { GiteaRepository } from "../types/gitea.types.js";
 import type { DependencyUpdate, PackageJson } from "../types/package.types.js";
 
-const logger = new Logger("UpdateOrchestrator", process.env.LOG_TOKEN ?? "");
-
 /**
  * Strips version prefix characters from a version string.
  * @param version - The version string with potential prefixes.

src/types/package.types.ts

@@ -33,6 +33,7 @@ interface NpmPackageInfo {
     latest:        string;
   };
   "name":     string;
+  "time":     Record<string, string>;
   "versions": Record<
     string,
     {

src/utils/logger.ts

@@ -6,6 +6,17 @@
 
 import { Logger } from "@nhcarrigan/logger";
 
-const logger = new Logger("Minori", process.env.LOG_TOKEN ?? "");
+// import { Logger } from "@nhcarrigan/logger";
+
+// const logger = new Logger("Minori", process.env.LOG_TOKEN ?? "");
+
+const logger = {
+  error: (message: string, error: Error) => {
+    console.error(message, error);
+  },
+  log:   (level: string, message: string) => {
+    console.log(level, message);
+  },
+} as unknown as Logger;
 
 export { logger };

test/services/dependencyAnalyzerService.spec.ts

@@ -6,11 +6,17 @@
 
 /* eslint-disable vitest/valid-expect -- Test expectations don't need messages */
 /* eslint-disable max-lines-per-function -- Test suites require many test cases */
+/* eslint-disable max-lines -- Test suites require many test cases */
 /* eslint-disable @typescript-eslint/naming-convention -- Test data uses npm package names and destructured imports */
 /* eslint-disable @typescript-eslint/consistent-type-assertions -- Required for mocking */
-
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
+const getDaysAgoIso = (days: number): string => {
+  const msPerDay = 24 * 60 * 60 * 1000;
+  const ageMs = days * msPerDay;
+  return new Date(Date.now() - ageMs).toISOString();
+};
+
 vi.mock("@nhcarrigan/logger", () => {
   return {
 
@@ -57,10 +63,13 @@ describe("dependencyAnalyzerService", () => {
   it("should find updates for dependencies", async() => {
     expect.assertions(2);
     const mockNpmService = createMockNpmService();
+    // Include time field with a date >10 days ago for the mature version check
+    const oldDate = getDaysAgoIso(15);
     mockNpmService.getPackageInfo.mockResolvedValue({
       "dist-tags": { latest: "2.0.0" },
       "name":      "test-package",
-      "versions":  {},
+      "time":      { "2.0.0": oldDate },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
     });
     const { DependencyAnalyzerService }
       = await import("../../src/services/dependencyAnalyzerService.js");
@@ -197,10 +206,12 @@ describe("dependencyAnalyzerService", () => {
   it("should not include packages that are already up-to-date", async() => {
     expect.assertions(1);
     const mockNpmService = createMockNpmService();
+    const oldDate = getDaysAgoIso(15);
     mockNpmService.getPackageInfo.mockResolvedValue({
       "dist-tags": { latest: "1.0.0" },
       "name":      "test-package",
-      "versions":  {},
+      "time":      { "1.0.0": oldDate },
+      "versions":  { "1.0.0": { version: "1.0.0" } },
     });
     const { DependencyAnalyzerService }
       = await import("../../src/services/dependencyAnalyzerService.js");
@@ -235,10 +246,12 @@ describe("dependencyAnalyzerService", () => {
   it("should handle version prefixes like ^", async() => {
     expect.assertions(2);
     const mockNpmService = createMockNpmService();
+    const oldDate = getDaysAgoIso(15);
     mockNpmService.getPackageInfo.mockResolvedValue({
       "dist-tags": { latest: "2.0.0" },
       "name":      "test-package",
-      "versions":  {},
+      "time":      { "2.0.0": oldDate },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
     });
     const { DependencyAnalyzerService }
       = await import("../../src/services/dependencyAnalyzerService.js");
@@ -254,6 +267,54 @@ describe("dependencyAnalyzerService", () => {
     expect(result[0]?.currentVersion).toBe("^1.0.0");
   });
 
+  it("should handle multi-character version prefixes like >=", async() => {
+    expect.assertions(2);
+    const mockNpmService = createMockNpmService();
+    const oldDate = getDaysAgoIso(15);
+    mockNpmService.getPackageInfo.mockResolvedValue({
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "2.0.0": oldDate },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
+    });
+    const { DependencyAnalyzerService }
+      = await import("../../src/services/dependencyAnalyzerService.js");
+    const analyzerService = new DependencyAnalyzerService(
+      mockNpmService as Parameters<typeof DependencyAnalyzerService>[0],
+    );
+    const result = await analyzerService.analyzePackageJson({
+      dependencies: {
+        "test-package": ">=1.0.0",
+      },
+    });
+    expect(result).toHaveLength(1);
+    expect(result[0]?.currentVersion).toBe(">=1.0.0");
+  });
+
+  it("should handle partial version numbers like '2'", async() => {
+    expect.assertions(2);
+    const mockNpmService = createMockNpmService();
+    const oldDate = getDaysAgoIso(15);
+    mockNpmService.getPackageInfo.mockResolvedValue({
+      "dist-tags": { latest: "3.0.0" },
+      "name":      "test-package",
+      "time":      { "3.0.0": oldDate },
+      "versions":  { "3.0.0": { version: "3.0.0" } },
+    });
+    const { DependencyAnalyzerService }
+      = await import("../../src/services/dependencyAnalyzerService.js");
+    const analyzerService = new DependencyAnalyzerService(
+      mockNpmService as Parameters<typeof DependencyAnalyzerService>[0],
+    );
+    const result = await analyzerService.analyzePackageJson({
+      dependencies: {
+        "test-package": "2",
+      },
+    });
+    expect(result).toHaveLength(1);
+    expect(result[0]?.currentVersion).toBe("2");
+  });
+
   it("should handle npm errors gracefully", async() => {
     expect.assertions(1);
     const mockNpmService = createMockNpmService();
@@ -274,10 +335,12 @@ describe("dependencyAnalyzerService", () => {
   it("should handle semver comparison errors", async() => {
     expect.assertions(1);
     const mockNpmService = createMockNpmService();
+    const oldDate = getDaysAgoIso(15);
     mockNpmService.getPackageInfo.mockResolvedValue({
       "dist-tags": { latest: "invalid-version" },
       "name":      "test-package",
-      "versions":  {},
+      "time":      { "invalid-version": oldDate },
+      "versions":  { "invalid-version": { version: "invalid-version" } },
     });
     const { DependencyAnalyzerService }
       = await import("../../src/services/dependencyAnalyzerService.js");
@@ -291,4 +354,28 @@ describe("dependencyAnalyzerService", () => {
     });
     expect(result).toStrictEqual([]);
   });
+
+  it("should return null when no mature version exists", async() => {
+    expect.assertions(1);
+    const mockNpmService = createMockNpmService();
+    // Use a very recent date (2 days ago) so getLatestMatureVersion returns null
+    const recentDate = getDaysAgoIso(2);
+    mockNpmService.getPackageInfo.mockResolvedValue({
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "2.0.0": recentDate },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
+    });
+    const { DependencyAnalyzerService }
+      = await import("../../src/services/dependencyAnalyzerService.js");
+    const analyzerService = new DependencyAnalyzerService(
+      mockNpmService as Parameters<typeof DependencyAnalyzerService>[0],
+    );
+    const result = await analyzerService.analyzePackageJson({
+      dependencies: {
+        "test-package": "1.0.0",
+      },
+    });
+    expect(result).toStrictEqual([]);
+  });
 });

test/services/gitService.spec.ts

@@ -203,6 +203,44 @@ describe("gitService", () => {
     expect(result.status).toBe("up-to-date");
   });
 
+  it("should delete stale local branch before checking out remote", async() => {
+    expect.assertions(2);
+    const branchDeleteCalls: Array<string> = [];
+    mockExecAsync.mockImplementation((command: string) => {
+      if (command.includes("git branch -r")) {
+        return Promise.resolve({
+          stderr: "",
+          stdout: "  origin/dependencies/update-test-package\n",
+        });
+      }
+      if (command.includes("git branch") && !command.includes("-")) {
+        // Return local branches including the stale one
+        return Promise.resolve({
+          stderr: "",
+          stdout: "* main\n  dependencies/update-test-package\n",
+        });
+      }
+      if (command.includes("git branch -D")) {
+        branchDeleteCalls.push(command);
+      }
+      return Promise.resolve({ stderr: "", stdout: "" });
+    });
+    vi.mocked(readFile).mockResolvedValue(JSON.stringify({
+      dependencies: { "test-package": "2.0.0" },
+    }));
+    const { createOrUpdateBranch } = await import("../../src/services/gitService.js");
+    const mockClonedRepo = createMockClonedRepo();
+    const result = await createOrUpdateBranch({
+      branchName:    "dependencies/update-test-package",
+      clonedRepo:    mockClonedRepo,
+      logger:        mockLogger,
+      packageName:   "test-package",
+      targetVersion: "2.0.0",
+    });
+    expect(result.status).toBe("up-to-date");
+    expect(branchDeleteCalls).toHaveLength(1);
+  });
+
   it("should fail when package is not found", async() => {
     expect.assertions(2);
     mockExecAsync.mockResolvedValue({ stderr: "", stdout: "" });
@@ -364,6 +402,44 @@ describe("gitService", () => {
     expect(writtenContent.devDependencies["test-package"]).toBe("2.0.0");
   });
 
+  it("should fall back to new branch when remote branch fetch fails", async() => {
+    expect.assertions(2);
+    mockExecAsync.mockImplementation((command: string) => {
+      if (command.includes("git branch -r")) {
+        // Report branch as existing
+        return Promise.resolve({
+          stderr: "",
+          stdout: "  origin/dependencies/update-test-package\n",
+        });
+      }
+      if (command.includes("git fetch origin dependencies/update-test-package")) {
+        // But fail when trying to fetch it (deleted between check and fetch)
+        const error = new Error("Git command failed") as Error & { stderr: string };
+        error.stderr = "fatal: couldn't find remote ref dependencies/update-test-package";
+        return Promise.reject(error);
+      }
+      return Promise.resolve({ stderr: "", stdout: "" });
+    });
+    vi.mocked(readFile).mockResolvedValue(JSON.stringify({
+      dependencies: { "test-package": "1.0.0" },
+    }));
+    vi.mocked(writeFile).mockResolvedValue(undefined);
+    const { createOrUpdateBranch } = await import("../../src/services/gitService.js");
+    const mockClonedRepo = createMockClonedRepo();
+    const result = await createOrUpdateBranch({
+      branchName:    "dependencies/update-test-package",
+      clonedRepo:    mockClonedRepo,
+      logger:        mockLogger,
+      packageName:   "test-package",
+      targetVersion: "2.0.0",
+    });
+    // Should fall back to creating a new branch
+    expect(result.status).toBe("created");
+    if (result.status === "created") {
+      expect(result.branchName).toBe("dependencies/update-test-package");
+    }
+  });
+
   it("should log pnpm error details when install fails", async() => {
     expect.assertions(2);
     mockExecAsync.mockImplementation((command: string) => {

test/services/npmService.spec.ts

@@ -11,11 +11,19 @@
 /* eslint-disable @typescript-eslint/consistent-type-imports -- Dynamic imports */
 /* eslint-disable vitest/require-to-throw-message -- Generic throw assertion */
 /* eslint-disable stylistic/max-len -- Test files have long URLs */
+/* eslint-disable max-lines -- Test files have many test cases */
+/* eslint-disable max-statements -- Test describe blocks have many statements */
 
 import axios, { AxiosError, type AxiosResponse } from "axios";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { NpmService } from "../../src/services/npmService.js";
 
+const getDaysAgoIso = (days: number): string => {
+  const msPerDay = 24 * 60 * 60 * 1000;
+  const ageMs = days * msPerDay;
+  return new Date(Date.now() - ageMs).toISOString();
+};
+
 vi.mock("axios", async() => {
   const actualAxios = await vi.importActual<typeof import("axios")>("axios");
   return {
@@ -331,4 +339,131 @@ describe("npmService", () => {
     });
     expect(result).toBe("Updated from 1.0.0 to 2.0.0");
   });
+
+  it("should return latest mature version when versions are old enough", () => {
+    expect.assertions(1);
+    const oldDate = getDaysAgoIso(15);
+    const packageInfo = {
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "1.0.0": oldDate, "2.0.0": oldDate },
+      "versions":  {
+        "1.0.0": { version: "1.0.0" },
+        "2.0.0": { version: "2.0.0" },
+      },
+    };
+    const result = NpmService.getLatestMatureVersion(packageInfo);
+    expect(result).toBe("2.0.0");
+  });
+
+  it("should return null when no mature versions exist", () => {
+    expect.assertions(1);
+    const recentDate = getDaysAgoIso(2);
+    const packageInfo = {
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "2.0.0": recentDate },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
+    };
+    const result = NpmService.getLatestMatureVersion(packageInfo);
+    expect(result).toBeNull();
+  });
+
+  it("should skip versions without time data", () => {
+    expect.assertions(1);
+    const oldDate = getDaysAgoIso(15);
+    const packageInfo = {
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "1.0.0": oldDate },
+      "versions":  {
+        "1.0.0": { version: "1.0.0" },
+        "2.0.0": { version: "2.0.0" },
+      },
+    };
+    const result = NpmService.getLatestMatureVersion(packageInfo);
+    expect(result).toBe("1.0.0");
+  });
+
+  it("should sort versions correctly and return the latest", () => {
+    expect.assertions(1);
+    const oldDate = getDaysAgoIso(15);
+    const packageInfo = {
+      "dist-tags": { latest: "3.0.0" },
+      "name":      "test-package",
+      "time":      { "1.0.0": oldDate, "2.0.0": oldDate, "3.0.0": oldDate },
+      "versions":  {
+        "1.0.0": { version: "1.0.0" },
+        "2.0.0": { version: "2.0.0" },
+        "3.0.0": { version: "3.0.0" },
+      },
+    };
+    const result = NpmService.getLatestMatureVersion(packageInfo);
+    expect(result).toBe("3.0.0");
+  });
+
+  it("should use custom minimumAgeDays parameter", () => {
+    expect.assertions(1);
+    const fiveDaysAgo = getDaysAgoIso(5);
+    const packageInfo = {
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "2.0.0": fiveDaysAgo },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
+    };
+    // Default is 10 days, so 5 days old should be null
+    const resultDefault = NpmService.getLatestMatureVersion(packageInfo);
+    expect(resultDefault).toBeNull();
+  });
+
+  it("should return mature version with custom minimumAgeDays", () => {
+    expect.assertions(1);
+    const fiveDaysAgo = getDaysAgoIso(5);
+    const packageInfo = {
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "2.0.0": fiveDaysAgo },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
+    };
+    // With 3 days minimum, 5 days old should be valid
+    const resultCustom = NpmService.getLatestMatureVersion(packageInfo, 3);
+    expect(resultCustom).toBe("2.0.0");
+  });
+
+  it("should skip prerelease versions like rc, alpha, beta", () => {
+    expect.assertions(1);
+    const oldDate = getDaysAgoIso(15);
+    const packageInfo = {
+      "dist-tags": { latest: "3.0.0-rc.1" },
+      "name":      "test-package",
+      "time":      {
+        "2.0.0":        oldDate,
+        "3.0.0-alpha":  oldDate,
+        "3.0.0-beta.1": oldDate,
+        "3.0.0-rc.1":   oldDate,
+      },
+      "versions": {
+        "2.0.0":        { version: "2.0.0" },
+        "3.0.0-alpha":  { version: "3.0.0-alpha" },
+        "3.0.0-beta.1": { version: "3.0.0-beta.1" },
+        "3.0.0-rc.1":   { version: "3.0.0-rc.1" },
+      },
+    };
+    // Should return 2.0.0 since all 3.0.0 versions are prereleases
+    const result = NpmService.getLatestMatureVersion(packageInfo);
+    expect(result).toBe("2.0.0");
+  });
+
+  it("should return null when only prerelease versions exist", () => {
+    expect.assertions(1);
+    const oldDate = getDaysAgoIso(15);
+    const packageInfo = {
+      "dist-tags": { latest: "1.0.0-rc.1" },
+      "name":      "test-package",
+      "time":      { "1.0.0-rc.1": oldDate },
+      "versions":  { "1.0.0-rc.1": { version: "1.0.0-rc.1" } },
+    };
+    const result = NpmService.getLatestMatureVersion(packageInfo);
+    expect(result).toBeNull();
+  });
 });