feat: add dependency updater command

.github/workflows/magento-compatibility.yml

@@ -55,20 +55,20 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           path: mageforge
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
         with:
           php-version: ${{ matrix.php-version }}
           extensions: mbstring, intl, gd, xml, soap, zip, bcmath, pdo_mysql, curl, sockets
           tools: composer:v2
 
       - name: Cache Composer packages
         id: composer-cache
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: ~/.composer/cache/files
           key: ${{ runner.os }}-composer-${{ matrix.magento-version }}-${{ hashFiles('**/composer.json') }}
@@ -147,6 +147,7 @@ jobs:
           bin/magento mageforge:theme:inspector --help
           bin/magento mageforge:hyva:compatibility:check --help
           bin/magento mageforge:hyva:tokens --help
+          bin/magento mageforge:dependencies:update --help
 
           echo "Verify command aliases work:"
           bin/magento m:s:v --help
@@ -162,6 +163,7 @@ jobs:
           bin/magento frontend:clean --help
           bin/magento hyva:check --help
           bin/magento hyva:tokens --help
+          bin/magento dependencies:update --help
 
       - name: Test Summary
         run: |

docs/commands_reference.md

@@ -4,17 +4,18 @@ Complete reference of all CLI commands provided by the MageForge module.
 
 ## Quick Overview
 
-| Group      | Command                              | Description                                         | Aliases          |
-| ---------- | ------------------------------------ | --------------------------------------------------- | ---------------- |
-| **Theme**  | `mageforge:theme:list`               | List all available Magento themes                   | `frontend:list`  |
-| **Theme**  | `mageforge:theme:build`              | Build selected themes (CSS/TailwindCSS)             | `frontend:build` |
-| **Theme**  | `mageforge:theme:watch`              | Watch theme files and auto-rebuild                  | `frontend:watch` |
-| **Theme**  | `mageforge:theme:clean`              | Clean static files and cache directories            | `frontend:clean` |
-| **Theme**  | `mageforge:theme:inspector`          | Manage Frontend Inspector (enable/disable/status)   | —                |
-| **Hyvä**   | `mageforge:hyva:tokens`              | Generate Hyvä design tokens                         | `hyva:tokens`    |
-| **Hyvä**   | `mageforge:hyva:compatibility:check` | Check modules for Hyvä compatibility issues         | `hyva:check`     |
-| **System** | `mageforge:system:version`           | Show current and latest module version              | `system:version` |
-| **System** | `mageforge:system:check`             | Display system information (PHP, Node.js, DB, etc.) | `system:check`   |
+| Group            | Command                              | Description                                         | Aliases               |
+| ---------------- | ------------------------------------ | --------------------------------------------------- | --------------------- |
+| **Theme**        | `mageforge:theme:list`               | List all available Magento themes                   | `frontend:list`       |
+| **Theme**        | `mageforge:theme:build`              | Build selected themes (CSS/TailwindCSS)             | `frontend:build`      |
+| **Theme**        | `mageforge:theme:watch`              | Watch theme files and auto-rebuild                  | `frontend:watch`      |
+| **Theme**        | `mageforge:theme:clean`              | Clean static files and cache directories            | `frontend:clean`      |
+| **Theme**        | `mageforge:theme:inspector`          | Manage Frontend Inspector (enable/disable/status)   | —                     |
+| **Dependencies** | `mageforge:dependencies:update`      | Update the Node.js dependencies of themes           | `dependencies:update` |
+| **Hyvä**         | `mageforge:hyva:tokens`              | Generate Hyvä design tokens                         | `hyva:tokens`         |
+| **Hyvä**         | `mageforge:hyva:compatibility:check` | Check modules for Hyvä compatibility issues         | `hyva:check`          |
+| **System**       | `mageforge:system:version`           | Show current and latest module version              | `system:version`      |
+| **System**       | `mageforge:system:check`             | Display system information (PHP, Node.js, DB, etc.) | `system:check`        |
 
 ---
 
@@ -124,6 +125,41 @@ bin/magento mageforge:theme:inspector status
 
 ---
 
+## Dependencies Commands
+
+### `mageforge:dependencies:update`
+
+Updates the Node.js dependencies (npm packages) of one or more themes. Works with all themes that ship their own `package.json`, e.g. Hyvä and TailwindCSS themes (`web/tailwind/package.json`). For standard Magento themes (e.g. `Magento/luma`) the Node.js setup in the Magento root is updated instead, since that is what builds their assets.
+
+```bash
+bin/magento mageforge:dependencies:update <theme-code> [<theme-code> ...]
+bin/magento mageforge:dependencies:update Vendor/theme
+bin/magento mageforge:dependencies:update Vendor/theme --dry-run
+bin/magento mageforge:dependencies:update Vendor/theme --latest
+```
+
+**Arguments:**
+
+- `themeCodes` — One or more theme codes in format `Vendor/theme`. Accepts wildcards like `Vendor/*`. If omitted, an interactive prompt lets you select themes.
+
+**Options:**
+
+- `--dry-run` — Only show the outdated packages without changing anything.
+- `-l, --latest` — Update packages beyond their semver ranges to the latest available versions. This rewrites `package.json` and may pull in breaking changes.
+
+**Behavior:**
+
+- Shows a table of all outdated packages (current, wanted, latest version and dependency type) per theme.
+- By default runs a safe `npm update`: packages are only updated within the semver ranges defined in `package.json` (`package.json` itself stays untouched).
+- With `--latest`, outdated packages are updated to their latest released versions, grouped by dependency type (`dependencies`, `devDependencies`, ...).
+- Installs `node_modules` first if missing, so the report is meaningful.
+- Themes installed in `vendor/` (managed by Composer) are skipped with an explanation.
+- Standard Magento themes (Luma-based, no own `package.json`) fall back to the `package.json` in the Magento root (copied from `package.json.sample`), which powers their Grunt build. The root setup is shared, so it is updated at most once per run; if the Magento root has no `package.json`, the theme is skipped with a setup hint. Note that with `--latest` this major-bumps Grunt tooling used by **all** standard themes.
+- Other themes without their own `package.json` are skipped.
+- After a successful update, a hint reminds you to rebuild the affected themes with `mageforge:theme:build`.
+
+---
+
 ## Hyvä Commands
 
 ### `mageforge:hyva:tokens`
@@ -210,6 +246,7 @@ mageforge:theme:build         → Build theme assets
 mageforge:theme:watch         → Watch & auto-rebuild
 mageforge:theme:clean         → Clean static files
 mageforge:theme:inspector     → Manage inspector tool
+mageforge:dependencies:update → Update theme Node.js dependencies
 mageforge:hyva:tokens         → Generate Hyvä design tokens
 mageforge:hyva:compatibility:check → Check Hyvä compatibility
 mageforge:system:version      → Show module version