David

Struggles with dependencies not published to npm or using SCM URLs, requiring additional flags like --error404 or --errorSCM to manage errors, as noted in the README.

Focuses solely on version updates without checking for vulnerabilities, unlike tools that combine version and security checks, limiting its utility for security-conscious teams.

Exclusively tied to the npm registry, making it unsuitable for projects using alternative package managers like Yarn or pnpm without significant workarounds.