dependency upgrade

The problem

Running a standard outdated check tells you what needs updating, but not how to do it safely. Blindly upgrading everything at once leads to broken builds, while manual triage wastes hours checking dependency graphs and changelogs.

What it does

• Analyzes lockfiles to build a full transitive dependency graph and compute the blast radius for every package.
• Groups upgrades into three distinct batches based on SemVer risk levels: patch, minor, and major.
• Identifies duplicate transitive versions that cause bloated bundles and state-management bugs.
• Calculates which packages are most "entangled" to prioritize isolated testing for high-impact changes.

Frameworks & tools

Supports Node.js (package-lock.json v1, v2, v3) and Python (requirements.txt). Built with Python 3.8+ using standard library only.

Why this beats prompting it yourself

General LLMs cannot accurately parse large, complex JSON lockfiles to calculate transitive dependencies or identify graph cycles without hallucinating connections. This tool performs deterministic graph analysis to ensure your upgrade plan is based on the actual architecture of your project, not a guess.

Use cases

• Planning a quarterly dependency maintenance sprint for a large monorepo.
• Identifying and collapsing duplicate library versions to reduce bundle size.
• Determining the safest order of operations for a major framework migration.
• Reviewing a security audit to see which CVE fixes carry the highest breaking risk.

Known limitations

Python requirements.txt analysis lacks graph data, so blast radius calculations are unavailable for that format. The graph analysis requires a lockfile to function offline.