What problem does it solve? Keeping project dependencies current is tedious and risky: security vulnerabilities pile up, major version bumps break builds, and teams lack a consistent process for batching, testing, and tracking updates across different package ecosystems. ## Core Features & Use Cases - Multi-Ecosystem Detection: Automatically detects npm/bun/pnpm, uv/poetry, and Cargo projects from lockfiles and runs the correct audit and outdated-package commands. - Security-First Workflow: Prioritizes vulnerability fixes into their own PRs, then batches patch and minor updates while isolating risky major upgrades. - Risk Assessment & Grouping: Scores each update 1-5 using changelog analysis and groups related packages (React core, Radix UI, Tokio, FastAPI) to reduce PR noise. - Outcome Learning: Logs update results to a JSONL history file so past migrations and failures inform future risk scores. - Use Case: Run the analyzer in a repository with a bun.lock file to get a categorized report of vulnerabilities and outdated packages, then execute grouped updates with standardized PR titles and bodies. ## Quick Start Ask the assistant to analyze and update the outdated dependencies in this project, starting with any security vulnerabilities.
