[RRFC] make npm update useful for modern package management

Motivation ("The Why")

Today, I wouldn't be surprised if updating packages is more common than installing packages. The npm install DX is pretty good, but npm update is sorely lacking to the point that we've collectively built a lot of tools to try to help.

IMO the growth of tooling in this space is a result of the lack of strong update management being a norm in the package management tools we rely on at the root. I'd really like to see npm be able to support the average (modern) user's dependency update requirements, rather than those users reach to third-party tooling to achieve good dependency updates.

Example

• open up any project older than 1 month and try to update dependencies. it's going to be rough. it should be better.

How

Current Behaviour

• npm update
  • does something but good luck figuring out if your dependencies are actually as up to date as is possible. they're probably not.

Desired Behaviour

• user runs npm update
  • npm does a fresh fetch of dependencies outside of what's already resolved in node_modules and pacakge-lock.json
    • tell user what modules are different
    • allow -y flag for auto-apply
    • let users interactively update dependencies if the -y flag is missing

a different way to look at this:

• GitHub Actions workflow runs npm update -y
  • set up to automatically PR changes applied to package.json if anything changes
  • I should never have to see a Dependabot PR if this workflow were to run and be merged prior to Dependabot being triggered, since npm update would have already updated everything.

yet another way to look at this:

• Dependabot should be able to adopt npm update with limited additional configuration to power their JavaScript update tooling.

References

• https://github.com/npm/rfcs/issues/555 is similar but not fundamentally the same as this

Start by reading the requested behavior in issue #571 and compare it with the related npm RFC in issue #555. Run npm update on a project with existing package.json and package-lock.json to examine the current result; done would require agreeing on fresh dependency resolution, change reporting, interactive updates, and the proposed -y behavior.