Add update check to `hlx up` command

[Copilot]

Related Issues

Fixes adobe/helix-cli#2225

Description

Adds non-blocking version check against npm registry when running hlx up. Displays update notification if newer version available.

Changes

• src/update-check.js: Check npm registry /latest endpoint, compare versions with semver, display formatted notification box (Copyright 2025)
• src/up.cmd.js: Invoke update check asynchronously after banner, silent failure on errors
• test/update-check.test.js: Coverage for update available, up-to-date, network failures, timeouts, malformed responses (Copyright 2025)

Implementation

• 5-second timeout prevents blocking startup
• Falls back silently on network errors
• Uses existing getFetch utility and semver dependency (already in package.json, no new dependency added)

Example output when update available:

╭─────────────────────────────────────────────────────────────╮
│                                                             │
│   Update available! 1.0.0 → 16.16.1                         │
│   Run npm install -g @adobe/aem-cli to update                │
│                                                             │
╰─────────────────────────────────────────────────────────────╯

Original prompt

---

This section details on the original issue you should resolve

<issue_title>hlx up should check for updates</issue_title> <issue_description>probably using npm, eg:

$ npm show  @adobe/helix-cli version
14.24.9
```</issue_description>

## Comments on the Issue (you are @copilot in this section)

<comments>
</comments>

• Fixes adobe/helix-cli#2225

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[github-actions[bot]]

This PR will trigger no release when merged.

[trieloff]

@copilot review and address the comments raised on the pr

[Copilot]

do you know what year it is?

also, does this add semver as a real dependency?

Fixed the copyright year to 2025 in ae4f8bf. Regarding semver - it's already a dependency in package.json (version 7.7.3), so no new dependency was added.

[trieloff]

Review Comments Addressed

All review comments have been addressed in commit 986b799:

✅ Rate Limiting Implementation (addressing @tripodsan's comment)

• Implemented once-per-day update checking to avoid hitting npm registry on every hlx up
• Uses XDG base directories for cache storage (~/.cache/aem-cli/last-update-check)
• Falls back gracefully to ~/.cache if XDG is not available
• Handles file system errors silently to avoid blocking the command

✅ String.padEnd() Usage (addressing @tripodsan's comment)

• Replaced manual padding calculation with String.padEnd() for cleaner code
• Maintains the same visual formatting in the update notification box

✅ Dependencies

• Added xdg-basedir package for proper XDG base directory support
• Confirmed semver was already a dependency (not added by this PR)

✅ Testing

• Added comprehensive test coverage for rate limiting functionality
• All 13 update check tests passing
• Tests cover: rate limiting, XDG directories, error handling, and formatting

📋 Implementation Details

• Cache file: {XDG_CACHE_HOME}/aem-cli/last-update-check
• Rate limit: 24 hours between checks
• Graceful degradation: silently continues if cache operations fail
• Non-breaking: existing functionality preserved

The update check now respects user privacy and system conventions while maintaining the same user experience.

[adobe-bot]

:tada: This PR is included in version 16.16.7 :tada:

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot :package::rocket: