deps: update vitest to 4.1.0

## Summary
Minori now automatically merges dependency update PRs when they meet safety criteria, reducing manual work whilst maintaining safety for potentially breaking changes.

## Changes
- ✨ Add version comparison utility to detect major version bumps
- ✨ Add Gitea service methods for checking commit status and merging PRs
- ✨ Add auto-merge logic that checks:
  - Is it a major version bump? (if yes, skip auto-merge)
  - Did CI checks pass? (if no, skip auto-merge)
  - If both conditions pass → auto-merge! 🎉
- ✅ Add comprehensive tests for all new functionality
- 📊 Maintain ~94% test coverage

## How It Works
When Minori processes a dependency update:
1. Check if a PR already exists for that dependency
2. If it exists, verify:
   - **Not a major version bump** (major bumps need manual review)
   - **CI status = "success"** (all checks must pass)
3. If both conditions are met → automatically merge the PR and delete the branch

## Test Plan
- [x] All 114 tests passing
- [x] New tests for version comparison utility
- [x] New tests for Gitea service extensions
- [x] Build successful
- [x] Linting clean

---
✨ This PR was created with help from Hikari~ 🌸

Co-authored-by: Naomi Carrigan <commits@nhcarrigan.com>
Reviewed-on: #5
Co-authored-by: Hikari <hikari@nhcarrigan.com>
Co-committed-by: Hikari <hikari@nhcarrigan.com>

package.json

@@ -20,11 +20,11 @@
     "@types/node": "25.2.0",
     "@types/node-cron": "3.0.11",
     "@types/semver": "7.7.1",
-    "@vitest/coverage-istanbul": "^4.0.18",
+    "@vitest/coverage-istanbul": "4.0.18",
-    "@vitest/coverage-v8": "^4.0.18",
+    "@vitest/coverage-v8": "4.0.18",
     "eslint": "9.39.2",
     "typescript": "5.9.3",
-    "vitest": "^4.0.18"
+    "vitest": "4.1.0"
   },
   "dependencies": {
     "@nhcarrigan/logger": "1.1.1",

pnpm-lock.yaml

@@ -23,7 +23,7 @@ importers:
     devDependencies:
       '@nhcarrigan/eslint-config':
         specifier: 5.2.0
-        version: 5.2.0(@typescript-eslint/utils@8.54.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)(playwright@1.58.1)(react@19.2.4)(typescript@5.9.3)(vitest@4.0.18(@types/node@25.2.0))
+        version: 5.2.0(@typescript-eslint/utils@8.54.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)(playwright@1.58.1)(react@19.2.4)(typescript@5.9.3)(vitest@4.1.0(@types/node@25.2.0)(vite@7.3.1(@types/node@25.2.0)))
       '@nhcarrigan/typescript-config':
         specifier: 4.0.0
         version: 4.0.0(typescript@5.9.3)
@@ -37,11 +37,11 @@ importers:
         specifier: 7.7.1
         version: 7.7.1
       '@vitest/coverage-istanbul':
-        specifier: ^4.0.18
+        specifier: 4.0.18
-        version: 4.0.18(vitest@4.0.18(@types/node@25.2.0))
+        version: 4.0.18(vitest@4.1.0(@types/node@25.2.0)(vite@7.3.1(@types/node@25.2.0)))
       '@vitest/coverage-v8':
-        specifier: ^4.0.18
+        specifier: 4.0.18
-        version: 4.0.18(vitest@4.0.18(@types/node@25.2.0))
+        version: 4.0.18(vitest@4.1.0(@types/node@25.2.0)(vite@7.3.1(@types/node@25.2.0)))
       eslint:
         specifier: 9.39.2
         version: 9.39.2
@@ -49,8 +49,8 @@ importers:
         specifier: 5.9.3
         version: 5.9.3
       vitest:
-        specifier: ^4.0.18
+        specifier: 4.1.0
-        version: 4.0.18(@types/node@25.2.0)
+        version: 4.1.0(@types/node@25.2.0)(vite@7.3.1(@types/node@25.2.0))
 
 packages:
 
@@ -719,14 +719,14 @@ packages:
       vitest:
         optional: true
 
-  '@vitest/expect@4.0.18':
+  '@vitest/expect@4.1.0':
-    resolution: {integrity: sha512-8sCWUyckXXYvx4opfzVY03EOiYVxyNrHS5QxX3DAIi5dpJAAkyJezHCP77VMX4HKA2LDT/Jpfo8i2r5BE3GnQQ==}
+    resolution: {integrity: sha512-EIxG7k4wlWweuCLG9Y5InKFwpMEOyrMb6ZJ1ihYu02LVj/bzUwn2VMU+13PinsjRW75XnITeFrQBMH5+dLvCDA==}
 
-  '@vitest/mocker@4.0.18':
+  '@vitest/mocker@4.1.0':
-    resolution: {integrity: sha512-HhVd0MDnzzsgevnOWCBj5Otnzobjy5wLBe4EdeeFGv8luMsGcYqDuFRMcttKWZA5vVO8RFjexVovXvAM4JoJDQ==}
+    resolution: {integrity: sha512-evxREh+Hork43+Y4IOhTo+h5lGmVRyjqI739Rz4RlUPqwrkFFDF6EMvOOYjTx4E8Tl6gyCLRL8Mu7Ry12a13Tw==}
     peerDependencies:
       msw: ^2.4.9
-      vite: ^6.0.0 || ^7.0.0-0
+      vite: ^6.0.0 || ^7.0.0 || ^8.0.0-0
     peerDependenciesMeta:
       msw:
         optional: true
@@ -736,18 +736,24 @@ packages:
   '@vitest/pretty-format@4.0.18':
     resolution: {integrity: sha512-P24GK3GulZWC5tz87ux0m8OADrQIUVDPIjjj65vBXYG17ZeU3qD7r+MNZ1RNv4l8CGU2vtTRqixrOi9fYk/yKw==}
 
-  '@vitest/runner@4.0.18':
+  '@vitest/pretty-format@4.1.0':
-    resolution: {integrity: sha512-rpk9y12PGa22Jg6g5M3UVVnTS7+zycIGk9ZNGN+m6tZHKQb7jrP7/77WfZy13Y/EUDd52NDsLRQhYKtv7XfPQw==}
+    resolution: {integrity: sha512-3RZLZlh88Ib0J7NQTRATfc/3ZPOnSUn2uDBUoGNn5T36+bALixmzphN26OUD3LRXWkJu4H0s5vvUeqBiw+kS0A==}
 
-  '@vitest/snapshot@4.0.18':
+  '@vitest/runner@4.1.0':
-    resolution: {integrity: sha512-PCiV0rcl7jKQjbgYqjtakly6T1uwv/5BQ9SwBLekVg/EaYeQFPiXcgrC2Y7vDMA8dM1SUEAEV82kgSQIlXNMvA==}
+    resolution: {integrity: sha512-Duvx2OzQ7d6OjchL+trw+aSrb9idh7pnNfxrklo14p3zmNL4qPCDeIJAK+eBKYjkIwG96Bc6vYuxhqDXQOWpoQ==}
 
-  '@vitest/spy@4.0.18':
+  '@vitest/snapshot@4.1.0':
-    resolution: {integrity: sha512-cbQt3PTSD7P2OARdVW3qWER5EGq7PHlvE+QfzSC0lbwO+xnt7+XH06ZzFjFRgzUX//JmpxrCu92VdwvEPlWSNw==}
+    resolution: {integrity: sha512-0Vy9euT1kgsnj1CHttwi9i9o+4rRLEaPRSOJ5gyv579GJkNpgJK+B4HSv/rAWixx2wdAFci1X4CEPjiu2bXIMg==}
+
+  '@vitest/spy@4.1.0':
+    resolution: {integrity: sha512-pz77k+PgNpyMDv2FV6qmk5ZVau6c3R8HC8v342T2xlFxQKTrSeYw9waIJG8KgV9fFwAtTu4ceRzMivPTH6wSxw==}
 
   '@vitest/utils@4.0.18':
     resolution: {integrity: sha512-msMRKLMVLWygpK3u2Hybgi4MNjcYJvwTb0Ru09+fOyCXIgT5raYP041DRRdiJiI3k/2U6SEbAETB3YtBrUkCFA==}
 
+  '@vitest/utils@4.1.0':
+    resolution: {integrity: sha512-XfPXT6a8TZY3dcGY8EdwsBulFCIw+BeeX0RZn2x/BtiY/75YGh8FeWGG8QISN/WhaqSrE2OrlDgtF8q5uhOTmw==}
+
   acorn-jsx@5.3.2:
     resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
     peerDependencies:
@@ -1004,6 +1010,9 @@ packages:
   es-module-lexer@1.7.0:
     resolution: {integrity: sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==}
 
+  es-module-lexer@2.0.0:
+    resolution: {integrity: sha512-5POEcUuZybH7IdmGsD8wlf0AI55wMecM9rVBTI/qEAy2c1kTOm3DjFYjrBdI2K3BaJjJYfYFeRtM0t9ssnRuxw==}
+
   es-object-atoms@1.1.1:
     resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
     engines: {node: '>= 0.4'}
@@ -1928,6 +1937,9 @@ packages:
   std-env@3.10.0:
     resolution: {integrity: sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==}
 
+  std-env@4.0.0:
+    resolution: {integrity: sha512-zUMPtQ/HBY3/50VbpkupYHbRroTRZJPRLvreamgErJVys0ceuzMkD44J/QjqhHjOzK42GQ3QZIeFG1OYfOtKqQ==}
+
   stop-iteration-iterator@1.1.0:
     resolution: {integrity: sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ==}
     engines: {node: '>= 0.4'}
@@ -2108,20 +2120,21 @@ packages:
       yaml:
         optional: true
 
-  vitest@4.0.18:
+  vitest@4.1.0:
-    resolution: {integrity: sha512-hOQuK7h0FGKgBAas7v0mSAsnvrIgAvWmRFjmzpJ7SwFHH3g1k2u37JtYwOwmEKhK6ZO3v9ggDBBm0La1LCK4uQ==}
+    resolution: {integrity: sha512-YbDrMF9jM2Lqc++2530UourxZHmkKLxrs4+mYhEwqWS97WJ7wOYEkcr+QfRgJ3PW9wz3odRijLZjHEaRLTNbqw==}
     engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
     hasBin: true
     peerDependencies:
       '@edge-runtime/vm': '*'
       '@opentelemetry/api': ^1.9.0
       '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0
-      '@vitest/browser-playwright': 4.0.18
+      '@vitest/browser-playwright': 4.1.0
-      '@vitest/browser-preview': 4.0.18
+      '@vitest/browser-preview': 4.1.0
-      '@vitest/browser-webdriverio': 4.0.18
+      '@vitest/browser-webdriverio': 4.1.0
-      '@vitest/ui': 4.0.18
+      '@vitest/ui': 4.1.0
       happy-dom: '*'
       jsdom: '*'
+      vite: ^6.0.0 || ^7.0.0 || ^8.0.0-0
     peerDependenciesMeta:
       '@edge-runtime/vm':
         optional: true
@@ -2471,7 +2484,7 @@ snapshots:
       '@jridgewell/resolve-uri': 3.1.2
       '@jridgewell/sourcemap-codec': 1.5.5
 
-  '@nhcarrigan/eslint-config@5.2.0(@typescript-eslint/utils@8.54.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)(playwright@1.58.1)(react@19.2.4)(typescript@5.9.3)(vitest@4.0.18(@types/node@25.2.0))':
+  '@nhcarrigan/eslint-config@5.2.0(@typescript-eslint/utils@8.54.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)(playwright@1.58.1)(react@19.2.4)(typescript@5.9.3)(vitest@4.1.0(@types/node@25.2.0)(vite@7.3.1(@types/node@25.2.0)))':
     dependencies:
       '@eslint-community/eslint-plugin-eslint-comments': 4.4.1(eslint@9.39.2)
       '@eslint/compat': 1.2.4(eslint@9.39.2)
@@ -2480,7 +2493,7 @@ snapshots:
       '@stylistic/eslint-plugin': 2.12.1(eslint@9.39.2)(typescript@5.9.3)
       '@typescript-eslint/eslint-plugin': 8.19.0(@typescript-eslint/parser@8.19.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)(typescript@5.9.3)
       '@typescript-eslint/parser': 8.19.0(eslint@9.39.2)(typescript@5.9.3)
-      '@vitest/eslint-plugin': 1.1.24(@typescript-eslint/utils@8.54.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)(typescript@5.9.3)(vitest@4.0.18(@types/node@25.2.0))
+      '@vitest/eslint-plugin': 1.1.24(@typescript-eslint/utils@8.54.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)(typescript@5.9.3)(vitest@4.1.0(@types/node@25.2.0)(vite@7.3.1(@types/node@25.2.0)))
       eslint: 9.39.2
       eslint-plugin-deprecation: 3.0.0(eslint@9.39.2)(typescript@5.9.3)
       eslint-plugin-import: 2.31.0(@typescript-eslint/parser@8.19.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)
@@ -2493,7 +2506,7 @@ snapshots:
       playwright: 1.58.1
       react: 19.2.4
       typescript: 5.9.3
-      vitest: 4.0.18(@types/node@25.2.0)
+      vitest: 4.1.0(@types/node@25.2.0)(vite@7.3.1(@types/node@25.2.0))
     transitivePeerDependencies:
       - '@typescript-eslint/utils'
       - eslint-import-resolver-typescript
@@ -2800,7 +2813,7 @@ snapshots:
       '@typescript-eslint/types': 8.54.0
       eslint-visitor-keys: 4.2.1
 
-  '@vitest/coverage-istanbul@4.0.18(vitest@4.0.18(@types/node@25.2.0))':
+  '@vitest/coverage-istanbul@4.0.18(vitest@4.1.0(@types/node@25.2.0)(vite@7.3.1(@types/node@25.2.0)))':
     dependencies:
       '@istanbuljs/schema': 0.1.3
       '@jridgewell/gen-mapping': 0.3.13
@@ -2812,11 +2825,11 @@ snapshots:
       magicast: 0.5.1
       obug: 2.1.1
       tinyrainbow: 3.0.3
-      vitest: 4.0.18(@types/node@25.2.0)
+      vitest: 4.1.0(@types/node@25.2.0)(vite@7.3.1(@types/node@25.2.0))
     transitivePeerDependencies:
       - supports-color
 
-  '@vitest/coverage-v8@4.0.18(vitest@4.0.18(@types/node@25.2.0))':
+  '@vitest/coverage-v8@4.0.18(vitest@4.1.0(@types/node@25.2.0)(vite@7.3.1(@types/node@25.2.0)))':
     dependencies:
       '@bcoe/v8-coverage': 1.0.2
       '@vitest/utils': 4.0.18
@@ -2828,28 +2841,28 @@ snapshots:
       obug: 2.1.1
       std-env: 3.10.0
       tinyrainbow: 3.0.3
-      vitest: 4.0.18(@types/node@25.2.0)
+      vitest: 4.1.0(@types/node@25.2.0)(vite@7.3.1(@types/node@25.2.0))
 
-  '@vitest/eslint-plugin@1.1.24(@typescript-eslint/utils@8.54.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)(typescript@5.9.3)(vitest@4.0.18(@types/node@25.2.0))':
+  '@vitest/eslint-plugin@1.1.24(@typescript-eslint/utils@8.54.0(eslint@9.39.2)(typescript@5.9.3))(eslint@9.39.2)(typescript@5.9.3)(vitest@4.1.0(@types/node@25.2.0)(vite@7.3.1(@types/node@25.2.0)))':
     dependencies:
       '@typescript-eslint/utils': 8.54.0(eslint@9.39.2)(typescript@5.9.3)
       eslint: 9.39.2
     optionalDependencies:
       typescript: 5.9.3
-      vitest: 4.0.18(@types/node@25.2.0)
+      vitest: 4.1.0(@types/node@25.2.0)(vite@7.3.1(@types/node@25.2.0))
 
-  '@vitest/expect@4.0.18':
+  '@vitest/expect@4.1.0':
     dependencies:
       '@standard-schema/spec': 1.1.0
       '@types/chai': 5.2.3
-      '@vitest/spy': 4.0.18
+      '@vitest/spy': 4.1.0
-      '@vitest/utils': 4.0.18
+      '@vitest/utils': 4.1.0
       chai: 6.2.2
       tinyrainbow: 3.0.3
 
-  '@vitest/mocker@4.0.18(vite@7.3.1(@types/node@25.2.0))':
+  '@vitest/mocker@4.1.0(vite@7.3.1(@types/node@25.2.0))':
     dependencies:
-      '@vitest/spy': 4.0.18
+      '@vitest/spy': 4.1.0
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
@@ -2859,24 +2872,35 @@ snapshots:
     dependencies:
       tinyrainbow: 3.0.3
 
-  '@vitest/runner@4.0.18':
+  '@vitest/pretty-format@4.1.0':
     dependencies:
-      '@vitest/utils': 4.0.18
+      tinyrainbow: 3.0.3
+
+  '@vitest/runner@4.1.0':
+    dependencies:
+      '@vitest/utils': 4.1.0
       pathe: 2.0.3
 
-  '@vitest/snapshot@4.0.18':
+  '@vitest/snapshot@4.1.0':
     dependencies:
-      '@vitest/pretty-format': 4.0.18
+      '@vitest/pretty-format': 4.1.0
+      '@vitest/utils': 4.1.0
       magic-string: 0.30.21
       pathe: 2.0.3
 
-  '@vitest/spy@4.0.18': {}
+  '@vitest/spy@4.1.0': {}
 
   '@vitest/utils@4.0.18':
     dependencies:
       '@vitest/pretty-format': 4.0.18
       tinyrainbow: 3.0.3
 
+  '@vitest/utils@4.1.0':
+    dependencies:
+      '@vitest/pretty-format': 4.1.0
+      convert-source-map: 2.0.0
+      tinyrainbow: 3.0.3
+
   acorn-jsx@5.3.2(acorn@7.4.1):
     dependencies:
       acorn: 7.4.1
@@ -3228,6 +3252,8 @@ snapshots:
 
   es-module-lexer@1.7.0: {}
 
+  es-module-lexer@2.0.0: {}
+
   es-object-atoms@1.1.1:
     dependencies:
       es-errors: 1.3.0
@@ -4298,6 +4324,8 @@ snapshots:
 
   std-env@3.10.0: {}
 
+  std-env@4.0.0: {}
+
   stop-iteration-iterator@1.1.0:
     dependencies:
       es-errors: 1.3.0
@@ -4479,22 +4507,22 @@ snapshots:
       '@types/node': 25.2.0
       fsevents: 2.3.3
 
-  vitest@4.0.18(@types/node@25.2.0):
+  vitest@4.1.0(@types/node@25.2.0)(vite@7.3.1(@types/node@25.2.0)):
     dependencies:
-      '@vitest/expect': 4.0.18
+      '@vitest/expect': 4.1.0
-      '@vitest/mocker': 4.0.18(vite@7.3.1(@types/node@25.2.0))
+      '@vitest/mocker': 4.1.0(vite@7.3.1(@types/node@25.2.0))
-      '@vitest/pretty-format': 4.0.18
+      '@vitest/pretty-format': 4.1.0
-      '@vitest/runner': 4.0.18
+      '@vitest/runner': 4.1.0
-      '@vitest/snapshot': 4.0.18
+      '@vitest/snapshot': 4.1.0
-      '@vitest/spy': 4.0.18
+      '@vitest/spy': 4.1.0
-      '@vitest/utils': 4.0.18
+      '@vitest/utils': 4.1.0
-      es-module-lexer: 1.7.0
+      es-module-lexer: 2.0.0
       expect-type: 1.3.0
       magic-string: 0.30.21
       obug: 2.1.1
       pathe: 2.0.3
       picomatch: 4.0.3
-      std-env: 3.10.0
+      std-env: 4.0.0
       tinybench: 2.9.0
       tinyexec: 1.0.2
       tinyglobby: 0.2.15
@@ -4504,17 +4532,7 @@ snapshots:
     optionalDependencies:
       '@types/node': 25.2.0
     transitivePeerDependencies:
-      - jiti
-      - less
-      - lightningcss
       - msw
-      - sass
-      - sass-embedded
-      - stylus
-      - sugarss
-      - terser
-      - tsx
-      - yaml
 
   which-boxed-primitive@1.1.1:
     dependencies:

src/index.ts

@@ -4,14 +4,12 @@
  * @author Naomi Carrigan
  */
 
-import { Logger } from "@nhcarrigan/logger";
 import cron from "node-cron";
 import { config, validateConfig } from "./config.js";
 import {
   UpdateOrchestratorService,
 } from "./services/updateOrchestratorService.js";
-
+import { logger } from "./utils/logger.js";
-const logger = new Logger("Minori", process.env.LOG_TOKEN ?? "");
 
 /**
  * Main entry point for the application.

src/services/dependencyAnalyzerService.ts

@@ -4,17 +4,15 @@
  * @author Naomi Carrigan
  */
 
-import { Logger } from "@nhcarrigan/logger";
 import semver from "semver";
-import type { NpmService } from "./npmService.js";
+import { logger } from "../utils/logger.js";
+import { NpmService } from "./npmService.js";
 import type {
   DependencyType,
   DependencyUpdate,
   PackageJson,
 } from "../types/package.types.js";
 
-const logger = new Logger("DependencyAnalyzer", process.env.LOG_TOKEN ?? "");
-
 /**
  * Checks if a version string is a valid semver range.
  * @param version - The version string to validate.
@@ -44,12 +42,14 @@ const isValidSemverRange = (version: string): boolean => {
 };
 
 /**
- * Removes version prefixes for comparison.
+ * Removes version prefixes and coerces to valid semver.
  * @param version - The version string to sanitise.
- * @returns The cleaned version string.
+ * @returns The cleaned version string, or null if invalid.
  */
-const cleanVersion = (version: string): string => {
+const cleanVersion = (version: string): string | null => {
-  return version.replace(/^[<=>^~]/, "");
+  const stripped = version.replace(/^[<=>^~]+/, "");
+  const coerced = semver.coerce(stripped);
+  return coerced?.version ?? null;
 };
 
 /**
@@ -68,6 +68,8 @@ const shouldUpdate = (
     }
 
     return semver.lt(currentVersion, latestVersion);
+  // eslint-disable-next-line capitalized-comments -- v8 coverage ignore directive must be lowercase
+  /* v8 ignore start -- @preserve */
   } catch (error) {
     void logger.error(
       `Error comparing versions: ${currentVersion} vs ${latestVersion}`,
@@ -76,6 +78,8 @@ const shouldUpdate = (
     );
     return false;
   }
+  // eslint-disable-next-line capitalized-comments -- v8 coverage ignore directive must be lowercase
+  /* v8 ignore stop -- @preserve */
 };
 
 /**
@@ -151,8 +155,19 @@ class DependencyAnalyzerService {
         return null;
       }
 
-      const latestVersion = packageInfo["dist-tags"].latest;
+      // Use mature version (at least 10 days old) instead of dist-tags.latest
+      const latestVersion = NpmService.getLatestMatureVersion(
+        packageInfo,
+        10,
+      );
+      if (latestVersion === null) {
+        return null;
+      }
+
       const cleanCurrentVersion = cleanVersion(currentVersion);
+      if (cleanCurrentVersion === null) {
+        return null;
+      }
 
       if (shouldUpdate(cleanCurrentVersion, latestVersion)) {
         return {

src/services/gitService.ts

@@ -212,20 +212,84 @@ const cloneRepository = async(
   };
 };
 
+/**
+ * Deletes a stale local branch if it exists.
+ * @param logger - The logger instance.
+ * @param repoPath - Path to the repository.
+ * @param branchName - Name of the branch to delete.
+ */
+const deleteStaleLocalBranch = async(
+  logger: Logger,
+  repoPath: string,
+  branchName: string,
+): Promise<void> => {
+  const localBranchOutput = await runGitCommand(logger, repoPath, "git branch");
+  const localBranchNames = localBranchOutput.
+    split("\n").
+    map((line) => {
+      return line.replace(/^\*?\s*/, "").trim();
+    }).
+    filter((name) => {
+      return name.length > 0;
+    });
+  if (localBranchNames.includes(branchName)) {
+    await runGitCommand(logger, repoPath, `git branch -D ${branchName}`);
+  }
+};
+
+/**
+ * Fetches and checks out an existing remote branch.
+ * @param logger - The logger instance.
+ * @param repoPath - The repository path.
+ * @param branchName - The branch name to fetch and checkout.
+ * @returns True if successful, false if the branch no longer exists on remote.
+ */
+const fetchAndCheckoutRemoteBranch = async(
+  logger: Logger,
+  repoPath: string,
+  branchName: string,
+): Promise<boolean> => {
+  try {
+    await runGitCommand(
+      logger,
+      repoPath,
+      `git fetch origin ${branchName}:refs/remotes/origin/${branchName}`,
+    );
+    await runGitCommand(
+      logger,
+      repoPath,
+      `git checkout -b ${branchName} origin/${branchName}`,
+    );
+    return true;
+  } catch {
+    // Branch may have been deleted between check and fetch
+    return false;
+  }
+};
+
 /**
  * Handles updating an existing branch with a newer version.
  * @param options - The branch update options.
- * @returns The update result.
+ * @returns The update result, or null if branch no longer exists.
  */
 const handleExistingBranch = async(
   options: BranchUpdateOptions,
-): Promise<UpdateResult> => {
+): Promise<UpdateResult | null> => {
   const { branchName, clonedRepo, logger, packageName, targetVersion }
     = options;
   const { path: repoPath } = clonedRepo;
 
-  await runGitCommand(logger, repoPath, `git checkout ${branchName}`);
+  await deleteStaleLocalBranch(logger, repoPath, branchName);
-  await runGitCommand(logger, repoPath, `git pull origin ${branchName}`);
+
+  const checkedOut = await fetchAndCheckoutRemoteBranch(
+    logger,
+    repoPath,
+    branchName,
+  );
+  if (!checkedOut) {
+    // Branch was deleted on remote, fall back to creating new branch
+    return null;
+  }
 
   const currentVersion = await getCurrentVersionOnBranch(repoPath, packageName);
 
@@ -269,19 +333,20 @@ const handleNewBranch = async(
   const { path: repoPath } = clonedRepo;
 
   await runGitCommand(logger, repoPath, "git checkout main");
-  await runGitCommand(logger, repoPath, `git checkout -b ${branchName}`);
 
+  // Check if package exists before creating branch
   const currentVersion = await getCurrentVersionOnBranch(repoPath, packageName);
   if (currentVersion === null) {
     void logger.log("warn", `Package ${packageName} not found in package.json`);
-    await runGitCommand(logger, repoPath, "git checkout main");
-    await runGitCommand(logger, repoPath, `git branch -D ${branchName}`);
     return {
       error:  `Package ${packageName} not found in package.json`,
       status: "failed",
     };
   }
 
+  // Only create branch if package exists
+  await runGitCommand(logger, repoPath, `git checkout -b ${branchName}`);
+
   await updatePackageAndCommit({
     logger,
     packageName,
@@ -308,7 +373,8 @@ const createOrUpdateBranch = async(
   const { path: repoPath } = clonedRepo;
 
   try {
-    await runGitCommand(logger, repoPath, "git fetch origin");
+    // Use --prune to remove stale remote-tracking refs that no longer exist
+    await runGitCommand(logger, repoPath, "git fetch origin --prune");
     const remoteBranches = await runGitCommand(
       logger,
       repoPath,
@@ -317,7 +383,11 @@ const createOrUpdateBranch = async(
     const branchExists = remoteBranches.includes(`origin/${branchName}`);
 
     if (branchExists) {
-      return await handleExistingBranch(options);
+      const result = await handleExistingBranch(options);
+      // If null, branch was deleted on remote between check and fetch
+      if (result !== null) {
+        return result;
+      }
     }
 
     return await handleNewBranch(options);

src/services/giteaService.ts

@@ -6,7 +6,9 @@
 
 import axios, { isAxiosError, type AxiosInstance } from "axios";
 import { config } from "../config.js";
+import { logger } from "../utils/logger.js";
 import type {
+  GiteaCombinedStatus,
   GiteaFile,
   GiteaPullRequest,
   GiteaRepository,
@@ -142,6 +144,87 @@ class GiteaService {
     );
     return data;
   }
+
+  /**
+   * Gets the combined commit status for a specific commit by querying the Gitea API for all status checks.
+   * @param owner - The repository owner.
+   * @param repo - The repository name.
+   * @param sha - The commit SHA to check.
+   * @returns The combined status of all checks (pending, success, error, or failure).
+   */
+  public async getCommitStatus(
+    owner: string,
+    repo: string,
+    sha: string,
+  ): Promise<GiteaCombinedStatus> {
+    const { data } = await this.client.get<GiteaCombinedStatus>(
+      `/repos/${owner}/${repo}/commits/${sha}/status`,
+    );
+    return data;
+  }
+
+  /**
+   * Merges a pull request.
+   * @param owner - The repository owner.
+   * @param repo - The repository name.
+   * @param index - The pull request index number.
+   * @returns True if the merge was successful, false otherwise.
+   */
+  public async mergePullRequest(
+    owner: string,
+    repo: string,
+    index: number,
+  ): Promise<boolean> {
+    try {
+      await this.client.post(
+        `/repos/${owner}/${repo}/pulls/${String(index)}/merge`,
+        {
+          /* eslint-disable @typescript-eslint/naming-convention -- Gitea API uses snake_case */
+          Do:                        "merge",
+          MergeMessageField:         "",
+          MergeTitleField:           "",
+          delete_branch_after_merge: true,
+          force_merge:               true,
+          head_commit_id:            "",
+          merge_when_checks_succeed: false,
+          /* eslint-enable @typescript-eslint/naming-convention -- End Gitea API */
+        },
+      );
+      return true;
+    } catch (error) {
+      if (isAxiosError(error)) {
+        await logger.log(
+          "warn",
+          `Merge failed with status ${String(error.response?.status)}: ${JSON.stringify(error.response?.data)}`,
+        );
+        return false;
+      }
+      throw error;
+    }
+  }
+
+  /**
+   * Deletes a repository branch by name.
+   * @param owner - The repository owner.
+   * @param repo - The repository name.
+   * @param branch - The branch name to remove.
+   * @returns True if successful, false otherwise.
+   */
+  public async deleteBranch(
+    owner: string,
+    repo: string,
+    branch: string,
+  ): Promise<boolean> {
+    try {
+      await this.client.delete(`/repos/${owner}/${repo}/branches/${branch}`);
+      return true;
+    } catch (error) {
+      if (isAxiosError(error)) {
+        return false;
+      }
+      throw error;
+    }
+  }
 }
 
 export { GiteaService };

src/services/npmService.ts

@@ -4,13 +4,12 @@
  * @author Naomi Carrigan
  */
 
-import { Logger } from "@nhcarrigan/logger";
 import axios, { isAxiosError, type AxiosInstance } from "axios";
+import semver from "semver";
 import { config } from "../config.js";
+import { logger } from "../utils/logger.js";
 import type { NpmPackageInfo } from "../types/package.types.js";
 
-const logger = new Logger("NpmService", process.env.LOG_TOKEN ?? "");
-
 /* eslint-disable @typescript-eslint/naming-convention -- GitHub API response types use snake_case property names */
 interface GitHubRelease {
   body?:    string;
@@ -148,6 +147,50 @@ class NpmService {
     });
   }
 
+  /**
+   * Gets the latest version that is at least minimumAgeDays old.
+   * @param packageInfo - The package information from npm.
+   * @param minimumAgeDays - Minimum days since publication (default 10).
+   * @returns The latest mature version, or null if none found.
+   */
+  public static getLatestMatureVersion(
+    packageInfo: NpmPackageInfo,
+    minimumAgeDays = 10,
+  ): string | null {
+    const now = Date.now();
+    const minimumAgeMs = minimumAgeDays * 24 * 60 * 60 * 1000;
+    const cutoffDate = now - minimumAgeMs;
+
+    const versions = Object.keys(packageInfo.versions);
+    const matureVersions = versions.filter((version) => {
+      // Skip prerelease versions (e.g., 1.0.0-rc.1, 1.0.0-alpha, 1.0.0-beta.2)
+      const prereleaseComponents = semver.prerelease(version);
+      if (prereleaseComponents !== null && prereleaseComponents.length > 0) {
+        return false;
+      }
+
+      const publishedAt = packageInfo.time[version];
+      if (publishedAt === undefined) {
+        return false;
+      }
+      const publishedDate = new Date(publishedAt).getTime();
+      return publishedDate <= cutoffDate;
+    });
+
+    if (matureVersions.length === 0) {
+      return null;
+    }
+
+    // Sort by semver (descending) to get the latest mature version
+    matureVersions.sort((version1, version2) => {
+      return version2.localeCompare(version1, undefined, { numeric: true });
+    });
+
+    // eslint-disable-next-line capitalized-comments -- v8 coverage ignore directive must be lowercase
+    /* v8 ignore next -- @preserve */
+    return matureVersions[0] ?? null;
+  }
+
   /**
    * Fetches changelog information for a package update.
    * @param options - The changelog fetch options.

src/services/updateOrchestratorService.ts

@@ -4,8 +4,12 @@
  * @author Naomi Carrigan
  */
 
-import { Logger } from "@nhcarrigan/logger";
 import { config } from "../config.js";
+import { logger } from "../utils/logger.js";
+import {
+  isMajorVersionBump,
+  stripVersionPrefix,
+} from "../utils/versionComparison.js";
 import { DependencyAnalyzerService } from "./dependencyAnalyzerService.js";
 import { GiteaService } from "./giteaService.js";
 import {
@@ -17,17 +21,6 @@ import { NpmService } from "./npmService.js";
 import type { GiteaRepository } from "../types/gitea.types.js";
 import type { DependencyUpdate, PackageJson } from "../types/package.types.js";
 
-const logger = new Logger("UpdateOrchestrator", process.env.LOG_TOKEN ?? "");
-
-/**
- * Strips version prefix characters from a version string.
- * @param version - The version string with potential prefixes.
- * @returns The version without prefix characters.
- */
-const stripVersionPrefix = (version: string): string => {
-  return version.replace(/^[<=>^~]*/, "");
-};
-
 /**
  * Generates the body content for a PR.
  * @param update - The dependency update information.
@@ -144,6 +137,103 @@ class UpdateOrchestratorService {
     await logger.log("info", "Dependency update check complete!");
   }
 
+  /**
+   * Attempts to merge an existing PR after checking CI status.
+   * @param repo - The repository information.
+   * @param update - The dependency update details.
+   * @param matchingPR - The existing PR with head SHA and number.
+   * @param matchingPR.head - The PR head information.
+   * @param matchingPR.head.sha - The commit SHA to check.
+   * @param matchingPR.number - The PR number for merging.
+   * @returns True if merge was attempted, false otherwise.
+   */
+  private async attemptPRMerge(
+    repo: GiteaRepository,
+    update: DependencyUpdate,
+    matchingPR: { head: { sha: string }; number: number },
+  ): Promise<boolean> {
+    const commitStatus = await this.giteaService.getCommitStatus(
+      config.giteaOrg,
+      repo.name,
+      matchingPR.head.sha,
+    );
+
+    if (commitStatus.state !== "success") {
+      await logger.log(
+        "info",
+        `    PR exists for ${update.packageName} but CI status is ${commitStatus.state}, skipping auto-merge...`,
+      );
+      return true;
+    }
+
+    await logger.log(
+      "info",
+      `    Auto-merging PR for ${update.packageName} (CI passed, non-major bump)...`,
+    );
+
+    const merged = await this.giteaService.mergePullRequest(
+      config.giteaOrg,
+      repo.name,
+      matchingPR.number,
+    );
+
+    if (merged) {
+      await logger.log(
+        "info",
+        `    Successfully merged PR for ${update.packageName}`,
+      );
+      return true;
+    }
+
+    await logger.log(
+      "warn",
+      `    Failed to merge PR for ${update.packageName}`,
+    );
+    return true;
+  }
+
+  /**
+   * Checks if an existing PR can be auto-merged based on CI status and version bump type.
+   * @param repo - The repository information.
+   * @param update - The dependency update details.
+   * @param branchName - The branch name for the PR.
+   * @returns True if the PR exists and was handled, false otherwise.
+   */
+  private async checkAndMergeExistingPR(
+    repo: GiteaRepository,
+    update: DependencyUpdate,
+    branchName: string,
+  ): Promise<boolean> {
+    const existingPRs = await this.giteaService.listPullRequests(
+      config.giteaOrg,
+      repo.name,
+      "open",
+    );
+
+    const matchingPR = existingPRs.find((pr) => {
+      return pr.head.ref === branchName;
+    });
+
+    if (matchingPR === undefined) {
+      return false;
+    }
+
+    const isMajorBump = isMajorVersionBump(
+      update.currentVersion,
+      update.latestVersion,
+    );
+
+    if (isMajorBump) {
+      await logger.log(
+        "info",
+        `    PR exists for ${update.packageName} but is a major version bump, skipping auto-merge...`,
+      );
+      return true;
+    }
+
+    return await this.attemptPRMerge(repo, update, matchingPR);
+  }
+
   /**
    * Creates or updates a PR for a dependency update.
    * @param repo - The repository information.
@@ -159,6 +249,16 @@ class UpdateOrchestratorService {
       = `${config.prBranchPrefix}${update.packageName.replaceAll(/[/@]/g, "-")}`;
 
     try {
+      const existingPRMerged = await this.checkAndMergeExistingPR(
+        repo,
+        update,
+        branchName,
+      );
+
+      if (existingPRMerged) {
+        return;
+      }
+
       const result = await createOrUpdateBranch({
         branchName:    branchName,
         clonedRepo:    clonedRepo,

src/types/gitea.types.ts

@@ -39,6 +39,33 @@ interface GiteaPullRequest {
   state:  "closed" | "open";
   title:  string;
 }
+
+interface GiteaCommitStatus {
+  context:     string;
+  created_at:  string;
+  description: string;
+  id:          number;
+  state:       "error" | "failure" | "pending" | "success" | "warning";
+  target_url:  string;
+  updated_at:  string;
+  url:         string;
+}
+
+interface GiteaCombinedStatus {
+  commit_url:  string;
+  repository:  GiteaRepository;
+  sha:         string;
+  state:       "error" | "failure" | "pending" | "success" | "warning";
+  statuses:    Array<GiteaCommitStatus>;
+  total_count: number;
+  url:         string;
+}
 /* eslint-enable @typescript-eslint/naming-convention -- End Gitea API types */
 
-export type { GiteaFile, GiteaPullRequest, GiteaRepository };
+export type {
+  GiteaCombinedStatus,
+  GiteaCommitStatus,
+  GiteaFile,
+  GiteaPullRequest,
+  GiteaRepository,
+};

src/types/package.types.ts

@@ -33,6 +33,7 @@ interface NpmPackageInfo {
     latest:        string;
   };
   "name":     string;
+  "time":     Record<string, string>;
   "versions": Record<
     string,
     {

src/utils/logger.ts

@@ -4,8 +4,22 @@
  * @author Naomi Carrigan
  */
 
-import { Logger } from "@nhcarrigan/logger";
+import type { Logger } from "@nhcarrigan/logger";
 
-const logger = new Logger("Minori", process.env.LOG_TOKEN ?? "");
+// Import { Logger } from "@nhcarrigan/logger";
+
+// Const logger = new Logger("Minori", process.env.LOG_TOKEN ?? "");
+
+/* eslint-disable no-console -- Temporary mock logger for development */
+/* eslint-disable @typescript-eslint/consistent-type-assertions -- Mock logger requires type assertion */
+const logger = {
+  error: (message: string, error: Error) => {
+    console.error(message, error);
+  },
+  log: (level: string, message: string) => {
+    console.log(level, message);
+  },
+} as unknown as Logger;
+/* eslint-enable no-console, @typescript-eslint/consistent-type-assertions -- Re-enable rules after mock logger */
 
 export { logger };

src/utils/versionComparison.ts

@@ -0,0 +1,64 @@
+/**
+ * @copyright NHCarrigan
+ * @license Naomi's Public License
+ * @author Naomi Carrigan
+ */
+
+/**
+ * Strips version prefix characters from a version string.
+ * @param version - The version string with potential prefixes.
+ * @returns The version without prefix characters.
+ */
+const stripVersionPrefix = (version: string): string => {
+  return version.replace(/^[<=>^~]*/, "");
+};
+
+/**
+ * Parses a semantic version string into its components.
+ * @param version - The version string to parse (e.g., "1.2.3").
+ * @returns An object with major, minor, and patch numbers, or null if invalid.
+ */
+const parseVersion = (
+  version: string,
+): { major: number; minor: number; patch: number } | null => {
+  const cleaned = stripVersionPrefix(version);
+  const parts = cleaned.split(".");
+
+  if (parts.length < 3) {
+    return null;
+  }
+
+  const major = Number.parseInt(parts[0] ?? "0", 10);
+  const minor = Number.parseInt(parts[1] ?? "0", 10);
+  const patchPart = parts[2] ?? "0";
+  const patch = Number.parseInt(patchPart.split("-")[0] ?? "0", 10);
+
+  if (Number.isNaN(major) || Number.isNaN(minor) || Number.isNaN(patch)) {
+    return null;
+  }
+
+  return { major, minor, patch };
+};
+
+/**
+ * Determines if a version update is a major version bump.
+ * A major bump occurs when the major version number increases.
+ * @param fromVersion - The current version.
+ * @param toVersion - The target version.
+ * @returns True if this is a major version bump, false otherwise.
+ */
+const isMajorVersionBump = (
+  fromVersion: string,
+  toVersion: string,
+): boolean => {
+  const from = parseVersion(fromVersion);
+  const to = parseVersion(toVersion);
+
+  if (from === null || to === null) {
+    return false;
+  }
+
+  return to.major > from.major;
+};
+
+export { isMajorVersionBump, stripVersionPrefix };

test/services/dependencyAnalyzerService.spec.ts

@@ -6,11 +6,17 @@
 
 /* eslint-disable vitest/valid-expect -- Test expectations don't need messages */
 /* eslint-disable max-lines-per-function -- Test suites require many test cases */
+/* eslint-disable max-lines -- Test suites require many test cases */
 /* eslint-disable @typescript-eslint/naming-convention -- Test data uses npm package names and destructured imports */
 /* eslint-disable @typescript-eslint/consistent-type-assertions -- Required for mocking */
-
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
+const getDaysAgoIso = (days: number): string => {
+  const msPerDay = 24 * 60 * 60 * 1000;
+  const ageMs = days * msPerDay;
+  return new Date(Date.now() - ageMs).toISOString();
+};
+
 vi.mock("@nhcarrigan/logger", () => {
   return {
 
@@ -57,10 +63,13 @@ describe("dependencyAnalyzerService", () => {
   it("should find updates for dependencies", async() => {
     expect.assertions(2);
     const mockNpmService = createMockNpmService();
+    // Include time field with a date >10 days ago for the mature version check
+    const oldDate = getDaysAgoIso(15);
     mockNpmService.getPackageInfo.mockResolvedValue({
       "dist-tags": { latest: "2.0.0" },
       "name":      "test-package",
-      "versions":  {},
+      "time":      { "2.0.0": oldDate },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
     });
     const { DependencyAnalyzerService }
       = await import("../../src/services/dependencyAnalyzerService.js");
@@ -197,10 +206,12 @@ describe("dependencyAnalyzerService", () => {
   it("should not include packages that are already up-to-date", async() => {
     expect.assertions(1);
     const mockNpmService = createMockNpmService();
+    const oldDate = getDaysAgoIso(15);
     mockNpmService.getPackageInfo.mockResolvedValue({
       "dist-tags": { latest: "1.0.0" },
       "name":      "test-package",
-      "versions":  {},
+      "time":      { "1.0.0": oldDate },
+      "versions":  { "1.0.0": { version: "1.0.0" } },
     });
     const { DependencyAnalyzerService }
       = await import("../../src/services/dependencyAnalyzerService.js");
@@ -235,10 +246,12 @@ describe("dependencyAnalyzerService", () => {
   it("should handle version prefixes like ^", async() => {
     expect.assertions(2);
     const mockNpmService = createMockNpmService();
+    const oldDate = getDaysAgoIso(15);
     mockNpmService.getPackageInfo.mockResolvedValue({
       "dist-tags": { latest: "2.0.0" },
       "name":      "test-package",
-      "versions":  {},
+      "time":      { "2.0.0": oldDate },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
     });
     const { DependencyAnalyzerService }
       = await import("../../src/services/dependencyAnalyzerService.js");
@@ -254,6 +267,54 @@ describe("dependencyAnalyzerService", () => {
     expect(result[0]?.currentVersion).toBe("^1.0.0");
   });
 
+  it("should handle multi-character version prefixes like >=", async() => {
+    expect.assertions(2);
+    const mockNpmService = createMockNpmService();
+    const oldDate = getDaysAgoIso(15);
+    mockNpmService.getPackageInfo.mockResolvedValue({
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "2.0.0": oldDate },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
+    });
+    const { DependencyAnalyzerService }
+      = await import("../../src/services/dependencyAnalyzerService.js");
+    const analyzerService = new DependencyAnalyzerService(
+      mockNpmService as Parameters<typeof DependencyAnalyzerService>[0],
+    );
+    const result = await analyzerService.analyzePackageJson({
+      dependencies: {
+        "test-package": ">=1.0.0",
+      },
+    });
+    expect(result).toHaveLength(1);
+    expect(result[0]?.currentVersion).toBe(">=1.0.0");
+  });
+
+  it("should handle partial version numbers like '2'", async() => {
+    expect.assertions(2);
+    const mockNpmService = createMockNpmService();
+    const oldDate = getDaysAgoIso(15);
+    mockNpmService.getPackageInfo.mockResolvedValue({
+      "dist-tags": { latest: "3.0.0" },
+      "name":      "test-package",
+      "time":      { "3.0.0": oldDate },
+      "versions":  { "3.0.0": { version: "3.0.0" } },
+    });
+    const { DependencyAnalyzerService }
+      = await import("../../src/services/dependencyAnalyzerService.js");
+    const analyzerService = new DependencyAnalyzerService(
+      mockNpmService as Parameters<typeof DependencyAnalyzerService>[0],
+    );
+    const result = await analyzerService.analyzePackageJson({
+      dependencies: {
+        "test-package": "2",
+      },
+    });
+    expect(result).toHaveLength(1);
+    expect(result[0]?.currentVersion).toBe("2");
+  });
+
   it("should handle npm errors gracefully", async() => {
     expect.assertions(1);
     const mockNpmService = createMockNpmService();
@@ -274,10 +335,12 @@ describe("dependencyAnalyzerService", () => {
   it("should handle semver comparison errors", async() => {
     expect.assertions(1);
     const mockNpmService = createMockNpmService();
+    const oldDate = getDaysAgoIso(15);
     mockNpmService.getPackageInfo.mockResolvedValue({
       "dist-tags": { latest: "invalid-version" },
       "name":      "test-package",
-      "versions":  {},
+      "time":      { "invalid-version": oldDate },
+      "versions":  { "invalid-version": { version: "invalid-version" } },
     });
     const { DependencyAnalyzerService }
       = await import("../../src/services/dependencyAnalyzerService.js");
@@ -291,4 +354,28 @@ describe("dependencyAnalyzerService", () => {
     });
     expect(result).toStrictEqual([]);
   });
+
+  it("should return null when no mature version exists", async() => {
+    expect.assertions(1);
+    const mockNpmService = createMockNpmService();
+    // Use a very recent date (2 days ago) so getLatestMatureVersion returns null
+    const recentDate = getDaysAgoIso(2);
+    mockNpmService.getPackageInfo.mockResolvedValue({
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "2.0.0": recentDate },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
+    });
+    const { DependencyAnalyzerService }
+      = await import("../../src/services/dependencyAnalyzerService.js");
+    const analyzerService = new DependencyAnalyzerService(
+      mockNpmService as Parameters<typeof DependencyAnalyzerService>[0],
+    );
+    const result = await analyzerService.analyzePackageJson({
+      dependencies: {
+        "test-package": "1.0.0",
+      },
+    });
+    expect(result).toStrictEqual([]);
+  });
 });

test/services/gitService.spec.ts

@@ -203,6 +203,44 @@ describe("gitService", () => {
     expect(result.status).toBe("up-to-date");
   });
 
+  it("should delete stale local branch before checking out remote", async() => {
+    expect.assertions(2);
+    const branchDeleteCalls: Array<string> = [];
+    mockExecAsync.mockImplementation((command: string) => {
+      if (command.includes("git branch -r")) {
+        return Promise.resolve({
+          stderr: "",
+          stdout: "  origin/dependencies/update-test-package\n",
+        });
+      }
+      if (command.includes("git branch") && !command.includes("-")) {
+        // Return local branches including the stale one
+        return Promise.resolve({
+          stderr: "",
+          stdout: "* main\n  dependencies/update-test-package\n",
+        });
+      }
+      if (command.includes("git branch -D")) {
+        branchDeleteCalls.push(command);
+      }
+      return Promise.resolve({ stderr: "", stdout: "" });
+    });
+    vi.mocked(readFile).mockResolvedValue(JSON.stringify({
+      dependencies: { "test-package": "2.0.0" },
+    }));
+    const { createOrUpdateBranch } = await import("../../src/services/gitService.js");
+    const mockClonedRepo = createMockClonedRepo();
+    const result = await createOrUpdateBranch({
+      branchName:    "dependencies/update-test-package",
+      clonedRepo:    mockClonedRepo,
+      logger:        mockLogger,
+      packageName:   "test-package",
+      targetVersion: "2.0.0",
+    });
+    expect(result.status).toBe("up-to-date");
+    expect(branchDeleteCalls).toHaveLength(1);
+  });
+
   it("should fail when package is not found", async() => {
     expect.assertions(2);
     mockExecAsync.mockResolvedValue({ stderr: "", stdout: "" });
@@ -364,6 +402,44 @@ describe("gitService", () => {
     expect(writtenContent.devDependencies["test-package"]).toBe("2.0.0");
   });
 
+  it("should fall back to new branch when remote branch fetch fails", async() => {
+    expect.assertions(2);
+    mockExecAsync.mockImplementation((command: string) => {
+      if (command.includes("git branch -r")) {
+        // Report branch as existing
+        return Promise.resolve({
+          stderr: "",
+          stdout: "  origin/dependencies/update-test-package\n",
+        });
+      }
+      if (command.includes("git fetch origin dependencies/update-test-package")) {
+        // But fail when trying to fetch it (deleted between check and fetch)
+        const error = new Error("Git command failed") as Error & { stderr: string };
+        error.stderr = "fatal: couldn't find remote ref dependencies/update-test-package";
+        return Promise.reject(error);
+      }
+      return Promise.resolve({ stderr: "", stdout: "" });
+    });
+    vi.mocked(readFile).mockResolvedValue(JSON.stringify({
+      dependencies: { "test-package": "1.0.0" },
+    }));
+    vi.mocked(writeFile).mockResolvedValue(undefined);
+    const { createOrUpdateBranch } = await import("../../src/services/gitService.js");
+    const mockClonedRepo = createMockClonedRepo();
+    const result = await createOrUpdateBranch({
+      branchName:    "dependencies/update-test-package",
+      clonedRepo:    mockClonedRepo,
+      logger:        mockLogger,
+      packageName:   "test-package",
+      targetVersion: "2.0.0",
+    });
+    // Should fall back to creating a new branch
+    expect(result.status).toBe("created");
+    if (result.status === "created") {
+      expect(result.branchName).toBe("dependencies/update-test-package");
+    }
+  });
+
   it("should log pnpm error details when install fails", async() => {
     expect.assertions(2);
     mockExecAsync.mockImplementation((command: string) => {

test/services/giteaService.spec.ts

@@ -6,11 +6,16 @@
 
 /* eslint-disable vitest/valid-expect -- Test expectations don't need messages */
 /* eslint-disable max-lines-per-function -- Test suites require many test cases */
+/* eslint-disable max-lines -- Test suites naturally have many cases */
+/* eslint-disable max-statements -- Test suites naturally have many statements */
 /* eslint-disable @typescript-eslint/consistent-type-assertions -- Required for mocking */
 /* eslint-disable @typescript-eslint/consistent-type-imports -- Dynamic imports */
 /* eslint-disable @typescript-eslint/naming-convention -- Environment variables and Gitea API format */
 /* eslint-disable max-nested-callbacks -- Vitest structure requires nested callbacks */
 /* eslint-disable vitest/require-to-throw-message -- Generic throw assertion */
+/* eslint-disable vitest/prefer-to-be-truthy -- toBe(true) is clearer for boolean functions */
+/* eslint-disable vitest/prefer-to-be-falsy -- toBe(false) is clearer for boolean functions */
+/* eslint-disable stylistic/max-len -- Test files have long object literals */
 
 import axios, { AxiosError, type AxiosResponse } from "axios";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
@@ -24,6 +29,7 @@ vi.mock("axios", async() => {
     default:    {
       create: vi.fn(() => {
         return {
+          delete: vi.fn(),
           get:    vi.fn(),
           post:   vi.fn(),
         };
@@ -69,6 +75,8 @@ describe("giteaService", () => {
   let mockGet: ReturnType<typeof vi.fn>;
   // eslint-disable-next-line @typescript-eslint/init-declarations -- Reassigned in beforeEach
   let mockPost: ReturnType<typeof vi.fn>;
+  // eslint-disable-next-line @typescript-eslint/init-declarations -- Reassigned in beforeEach
+  let mockDelete: ReturnType<typeof vi.fn>;
   const originalEnvironment = process.env;
 
   beforeEach(() => {
@@ -77,7 +85,9 @@ describe("giteaService", () => {
 
     mockGet = vi.fn();
     mockPost = vi.fn();
+    mockDelete = vi.fn();
     vi.mocked(axios.create).mockReturnValue({
+      delete: mockDelete,
       get:    mockGet,
       post:   mockPost,
     } as unknown as ReturnType<typeof axios.create>);
@@ -306,4 +316,69 @@ describe("giteaService", () => {
       { params: { state: "closed" } },
     );
   });
+
+  it("should get commit status", async() => {
+    expect.assertions(2);
+    const mockStatus = {
+      commit_url:  "https://git.nhcarrigan.com/api/v1/repos/owner/repo/commits/abc123",
+      repository:  createMockRepository({ id: 1, name: "test-repo" }),
+      sha:         "abc123",
+      state:       "success",
+      statuses:    [],
+      total_count: 0,
+      url:         "https://git.nhcarrigan.com/api/v1/repos/owner/repo/commits/abc123/status",
+    };
+    mockGet.mockResolvedValueOnce({ data: mockStatus });
+    const result = await giteaService.getCommitStatus("owner", "repo", "abc123");
+    expect(result).toStrictEqual(mockStatus);
+    expect(mockGet).toHaveBeenCalledWith("/repos/owner/repo/commits/abc123/status");
+  });
+
+  it("should merge a pull request successfully", async() => {
+    expect.assertions(2);
+    mockPost.mockResolvedValueOnce({ data: {} });
+    const result = await giteaService.mergePullRequest("owner", "repo", 1);
+    expect(result).toBe(true);
+    expect(mockPost).toHaveBeenCalledWith("/repos/owner/repo/pulls/1/merge", {
+      Do:                        "merge",
+      MergeMessageField:         "",
+      MergeTitleField:           "",
+      delete_branch_after_merge: true,
+      force_merge:               false,
+      head_commit_id:            "",
+      merge_when_checks_succeed: false,
+    });
+  });
+
+  it("should return false when merge fails", async() => {
+    expect.assertions(1);
+    const axiosError = new AxiosError("Merge conflict");
+    mockPost.mockRejectedValueOnce(axiosError);
+    const result = await giteaService.mergePullRequest("owner", "repo", 1);
+    expect(result).toBe(false);
+  });
+
+  it("should delete a branch successfully", async() => {
+    expect.assertions(2);
+    mockDelete.mockResolvedValueOnce({ data: {} });
+    const result = await giteaService.deleteBranch(
+      "owner",
+      "repo",
+      "feature-branch",
+    );
+    expect(result).toBe(true);
+    expect(mockDelete).toHaveBeenCalledWith("/repos/owner/repo/branches/feature-branch");
+  });
+
+  it("should return false when branch deletion fails", async() => {
+    expect.assertions(1);
+    const axiosError = new AxiosError("Branch not found");
+    mockDelete.mockRejectedValueOnce(axiosError);
+    const result = await giteaService.deleteBranch(
+      "owner",
+      "repo",
+      "nonexistent-branch",
+    );
+    expect(result).toBe(false);
+  });
 });

test/services/npmService.spec.ts

@@ -11,11 +11,19 @@
 /* eslint-disable @typescript-eslint/consistent-type-imports -- Dynamic imports */
 /* eslint-disable vitest/require-to-throw-message -- Generic throw assertion */
 /* eslint-disable stylistic/max-len -- Test files have long URLs */
+/* eslint-disable max-lines -- Test files have many test cases */
+/* eslint-disable max-statements -- Test describe blocks have many statements */
 
 import axios, { AxiosError, type AxiosResponse } from "axios";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { NpmService } from "../../src/services/npmService.js";
 
+const getDaysAgoIso = (days: number): string => {
+  const msPerDay = 24 * 60 * 60 * 1000;
+  const ageMs = days * msPerDay;
+  return new Date(Date.now() - ageMs).toISOString();
+};
+
 vi.mock("axios", async() => {
   const actualAxios = await vi.importActual<typeof import("axios")>("axios");
   return {
@@ -331,4 +339,131 @@ describe("npmService", () => {
     });
     expect(result).toBe("Updated from 1.0.0 to 2.0.0");
   });
+
+  it("should return latest mature version when versions are old enough", () => {
+    expect.assertions(1);
+    const oldDate = getDaysAgoIso(15);
+    const packageInfo = {
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "1.0.0": oldDate, "2.0.0": oldDate },
+      "versions":  {
+        "1.0.0": { version: "1.0.0" },
+        "2.0.0": { version: "2.0.0" },
+      },
+    };
+    const result = NpmService.getLatestMatureVersion(packageInfo);
+    expect(result).toBe("2.0.0");
+  });
+
+  it("should return null when no mature versions exist", () => {
+    expect.assertions(1);
+    const recentDate = getDaysAgoIso(2);
+    const packageInfo = {
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "2.0.0": recentDate },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
+    };
+    const result = NpmService.getLatestMatureVersion(packageInfo);
+    expect(result).toBeNull();
+  });
+
+  it("should skip versions without time data", () => {
+    expect.assertions(1);
+    const oldDate = getDaysAgoIso(15);
+    const packageInfo = {
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "1.0.0": oldDate },
+      "versions":  {
+        "1.0.0": { version: "1.0.0" },
+        "2.0.0": { version: "2.0.0" },
+      },
+    };
+    const result = NpmService.getLatestMatureVersion(packageInfo);
+    expect(result).toBe("1.0.0");
+  });
+
+  it("should sort versions correctly and return the latest", () => {
+    expect.assertions(1);
+    const oldDate = getDaysAgoIso(15);
+    const packageInfo = {
+      "dist-tags": { latest: "3.0.0" },
+      "name":      "test-package",
+      "time":      { "1.0.0": oldDate, "2.0.0": oldDate, "3.0.0": oldDate },
+      "versions":  {
+        "1.0.0": { version: "1.0.0" },
+        "2.0.0": { version: "2.0.0" },
+        "3.0.0": { version: "3.0.0" },
+      },
+    };
+    const result = NpmService.getLatestMatureVersion(packageInfo);
+    expect(result).toBe("3.0.0");
+  });
+
+  it("should use custom minimumAgeDays parameter", () => {
+    expect.assertions(1);
+    const fiveDaysAgo = getDaysAgoIso(5);
+    const packageInfo = {
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "2.0.0": fiveDaysAgo },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
+    };
+    // Default is 10 days, so 5 days old should be null
+    const resultDefault = NpmService.getLatestMatureVersion(packageInfo);
+    expect(resultDefault).toBeNull();
+  });
+
+  it("should return mature version with custom minimumAgeDays", () => {
+    expect.assertions(1);
+    const fiveDaysAgo = getDaysAgoIso(5);
+    const packageInfo = {
+      "dist-tags": { latest: "2.0.0" },
+      "name":      "test-package",
+      "time":      { "2.0.0": fiveDaysAgo },
+      "versions":  { "2.0.0": { version: "2.0.0" } },
+    };
+    // With 3 days minimum, 5 days old should be valid
+    const resultCustom = NpmService.getLatestMatureVersion(packageInfo, 3);
+    expect(resultCustom).toBe("2.0.0");
+  });
+
+  it("should skip prerelease versions like rc, alpha, beta", () => {
+    expect.assertions(1);
+    const oldDate = getDaysAgoIso(15);
+    const packageInfo = {
+      "dist-tags": { latest: "3.0.0-rc.1" },
+      "name":      "test-package",
+      "time":      {
+        "2.0.0":        oldDate,
+        "3.0.0-alpha":  oldDate,
+        "3.0.0-beta.1": oldDate,
+        "3.0.0-rc.1":   oldDate,
+      },
+      "versions": {
+        "2.0.0":        { version: "2.0.0" },
+        "3.0.0-alpha":  { version: "3.0.0-alpha" },
+        "3.0.0-beta.1": { version: "3.0.0-beta.1" },
+        "3.0.0-rc.1":   { version: "3.0.0-rc.1" },
+      },
+    };
+    // Should return 2.0.0 since all 3.0.0 versions are prereleases
+    const result = NpmService.getLatestMatureVersion(packageInfo);
+    expect(result).toBe("2.0.0");
+  });
+
+  it("should return null when only prerelease versions exist", () => {
+    expect.assertions(1);
+    const oldDate = getDaysAgoIso(15);
+    const packageInfo = {
+      "dist-tags": { latest: "1.0.0-rc.1" },
+      "name":      "test-package",
+      "time":      { "1.0.0-rc.1": oldDate },
+      "versions":  { "1.0.0-rc.1": { version: "1.0.0-rc.1" } },
+    };
+    const result = NpmService.getLatestMatureVersion(packageInfo);
+    expect(result).toBeNull();
+  });
 });

test/services/updateOrchestratorService.spec.ts

@@ -18,6 +18,8 @@ const mockGiteaGetFileContent = vi.fn();
 const mockGiteaListOrgRepositories = vi.fn();
 const mockGiteaCreatePullRequest = vi.fn();
 const mockGiteaListPullRequests = vi.fn();
+const mockGiteaGetCommitStatus = vi.fn();
+const mockGiteaMergePullRequest = vi.fn();
 const mockNpmGetPackageChangelog = vi.fn();
 const mockNpmGetPackageInfo = vi.fn();
 const mockAnalyzePackageJson = vi.fn();
@@ -39,9 +41,11 @@ vi.mock("../../src/services/giteaService.js", () => {
 
     GiteaService: class MockGiteaService {
       public createPullRequest = mockGiteaCreatePullRequest;
+      public getCommitStatus = mockGiteaGetCommitStatus;
       public getFileContent = mockGiteaGetFileContent;
       public listOrgRepositories = mockGiteaListOrgRepositories;
       public listPullRequests = mockGiteaListPullRequests;
+      public mergePullRequest = mockGiteaMergePullRequest;
     },
   };
 });
@@ -221,6 +225,7 @@ describe("updateOrchestratorService", () => {
     const mockUpdates = [ createMockUpdate() ];
     mockGiteaListOrgRepositories.mockResolvedValue(mockRepos);
     mockGiteaGetFileContent.mockResolvedValue(mockFileContent);
+    mockGiteaListPullRequests.mockResolvedValue([]);
     mockAnalyzePackageJson.mockResolvedValue(mockUpdates);
     mockNpmGetPackageChangelog.mockResolvedValue("## Changelog");
     mockCloneRepository.mockResolvedValue(createMockClonedRepo());
@@ -267,6 +272,7 @@ describe("updateOrchestratorService", () => {
     const mockUpdates = [ createMockUpdate() ];
     mockGiteaListOrgRepositories.mockResolvedValue(mockRepos);
     mockGiteaGetFileContent.mockResolvedValue(mockFileContent);
+    mockGiteaListPullRequests.mockResolvedValue([]);
     mockAnalyzePackageJson.mockResolvedValue(mockUpdates);
     mockCloneRepository.mockResolvedValue(createMockClonedRepo());
     mockCreateOrUpdateBranch.mockResolvedValue({
@@ -289,6 +295,7 @@ describe("updateOrchestratorService", () => {
     const mockUpdates = [ createMockUpdate() ];
     mockGiteaListOrgRepositories.mockResolvedValue(mockRepos);
     mockGiteaGetFileContent.mockResolvedValue(mockFileContent);
+    mockGiteaListPullRequests.mockResolvedValue([]);
     mockAnalyzePackageJson.mockResolvedValue(mockUpdates);
     mockCloneRepository.mockResolvedValue(createMockClonedRepo());
     mockCreateOrUpdateBranch.mockResolvedValue({
@@ -312,6 +319,7 @@ describe("updateOrchestratorService", () => {
     const mockUpdates = [ createMockUpdate() ];
     mockGiteaListOrgRepositories.mockResolvedValue(mockRepos);
     mockGiteaGetFileContent.mockResolvedValue(mockFileContent);
+    mockGiteaListPullRequests.mockResolvedValue([]);
     mockAnalyzePackageJson.mockResolvedValue(mockUpdates);
     mockCloneRepository.mockResolvedValue(createMockClonedRepo());
     mockCreateOrUpdateBranch.mockResolvedValue({
@@ -354,6 +362,7 @@ describe("updateOrchestratorService", () => {
     const mockUpdates = [ createMockUpdate() ];
     mockGiteaListOrgRepositories.mockResolvedValue(mockRepos);
     mockGiteaGetFileContent.mockResolvedValue(mockFileContent);
+    mockGiteaListPullRequests.mockResolvedValue([]);
     mockAnalyzePackageJson.mockResolvedValue(mockUpdates);
     mockCloneRepository.mockResolvedValue(createMockClonedRepo());
     mockCreateOrUpdateBranch.mockResolvedValue({
@@ -377,6 +386,7 @@ describe("updateOrchestratorService", () => {
     const mockUpdates = [ createMockUpdate() ];
     mockGiteaListOrgRepositories.mockResolvedValue(mockRepos);
     mockGiteaGetFileContent.mockResolvedValue(mockFileContent);
+    mockGiteaListPullRequests.mockResolvedValue([]);
     mockAnalyzePackageJson.mockResolvedValue(mockUpdates);
     mockNpmGetPackageChangelog.mockResolvedValue("## Changelog");
     mockCloneRepository.mockResolvedValue(createMockClonedRepo());
@@ -426,6 +436,7 @@ describe("updateOrchestratorService", () => {
     const mockCleanup = vi.fn();
     mockGiteaListOrgRepositories.mockResolvedValue(mockRepos);
     mockGiteaGetFileContent.mockResolvedValue(mockFileContent);
+    mockGiteaListPullRequests.mockResolvedValue([]);
     mockAnalyzePackageJson.mockResolvedValue(mockUpdates);
     mockCloneRepository.mockResolvedValue(createMockClonedRepo(mockCleanup));
     mockCreateOrUpdateBranch.mockResolvedValue({

test/utils/versionComparison.spec.ts

@@ -0,0 +1,108 @@
+/**
+ * @copyright NHCarrigan
+ * @license Naomi's Public License
+ * @author Naomi Carrigan
+ */
+
+/* eslint-disable vitest/valid-expect -- Test expectations don't need messages */
+/* eslint-disable max-lines-per-function -- Test suites naturally have many cases */
+/* eslint-disable max-nested-callbacks -- Vitest structure requires nesting */
+/* eslint-disable vitest/prefer-to-be-truthy -- toBe(true) is clearer for boolean functions */
+/* eslint-disable vitest/prefer-to-be-falsy -- toBe(false) is clearer for boolean functions */
+
+import { describe, expect, it } from "vitest";
+import {
+  isMajorVersionBump,
+  stripVersionPrefix,
+} from "../../src/utils/versionComparison.js";
+
+describe("versionComparison", () => {
+  describe("stripVersionPrefix", () => {
+    it("should strip caret prefix", () => {
+      expect.assertions(1);
+      expect(stripVersionPrefix("^1.2.3")).toBe("1.2.3");
+    });
+
+    it("should strip tilde prefix", () => {
+      expect.assertions(1);
+      expect(stripVersionPrefix("~1.2.3")).toBe("1.2.3");
+    });
+
+    it("should strip greater than prefix", () => {
+      expect.assertions(1);
+      expect(stripVersionPrefix(">1.2.3")).toBe("1.2.3");
+    });
+
+    it("should strip less than prefix", () => {
+      expect.assertions(1);
+      expect(stripVersionPrefix("<1.2.3")).toBe("1.2.3");
+    });
+
+    it("should strip equals prefix", () => {
+      expect.assertions(1);
+      expect(stripVersionPrefix("=1.2.3")).toBe("1.2.3");
+    });
+
+    it("should strip multiple prefix characters", () => {
+      expect.assertions(1);
+      expect(stripVersionPrefix(">=1.2.3")).toBe("1.2.3");
+    });
+
+    it("should return version without prefix unchanged", () => {
+      expect.assertions(1);
+      expect(stripVersionPrefix("1.2.3")).toBe("1.2.3");
+    });
+  });
+
+  describe("isMajorVersionBump", () => {
+    it("should detect major version bump", () => {
+      expect.assertions(1);
+      expect(isMajorVersionBump("1.2.3", "2.0.0")).toBe(true);
+    });
+
+    it("should detect major version bump with prefixes", () => {
+      expect.assertions(1);
+      expect(isMajorVersionBump("^1.2.3", "^2.0.0")).toBe(true);
+    });
+
+    it("should not detect minor version bump as major", () => {
+      expect.assertions(1);
+      expect(isMajorVersionBump("1.2.3", "1.3.0")).toBe(false);
+    });
+
+    it("should not detect patch version bump as major", () => {
+      expect.assertions(1);
+      expect(isMajorVersionBump("1.2.3", "1.2.4")).toBe(false);
+    });
+
+    it("should handle version with pre-release tags", () => {
+      expect.assertions(1);
+      expect(isMajorVersionBump("1.2.3", "2.0.0-beta.1")).toBe(true);
+    });
+
+    it("should return false for invalid from version", () => {
+      expect.assertions(1);
+      expect(isMajorVersionBump("invalid", "2.0.0")).toBe(false);
+    });
+
+    it("should return false for invalid to version", () => {
+      expect.assertions(1);
+      expect(isMajorVersionBump("1.2.3", "invalid")).toBe(false);
+    });
+
+    it("should return false for both invalid versions", () => {
+      expect.assertions(1);
+      expect(isMajorVersionBump("invalid", "also-invalid")).toBe(false);
+    });
+
+    it("should handle 0.x.x to 1.x.x as major bump", () => {
+      expect.assertions(1);
+      expect(isMajorVersionBump("0.9.5", "1.0.0")).toBe(true);
+    });
+
+    it("should not detect same version as major bump", () => {
+      expect.assertions(1);
+      expect(isMajorVersionBump("1.2.3", "1.2.3")).toBe(false);
+    });
+  });
+});