I built a tool that tells you which lines an npm upgrade will break

Description and use

Bumpscan automatically compares npm package APIs and scans the project, showing only the lines of code that will break after an upgrade, speeding up and simplifying dependency updates.

Problem

Dependency upgrades are postponed because developers cannot predict which parts of their code will break without actually upgrading and running the build.

Outcome

Bumpscan reduces upgrade uncertainty by pinpointing exactly which lines will break, enabling faster and safer dependency updates.

Workflow

• 1. Run bumpscan with the target package version (e.g., npx bumpscan express@5).
• 2. Bumpscan downloads both the current and target versions from npm.
• 3. It extracts and compares the type definitions (.d.ts) of both versions to identify removed, renamed, or changed API elements.
• 4. Bumpscan parses the project source code to find all usages of the package and reports only the changes that actually affect the code.
• 5. Optional: use --fix to automatically rewrite safe renames in the code.
• 6. For CI integration, add the bumpscan GitHub Action to comment on Dependabot or Renovate PRs with the breaking lines.

Evidence

Bumpscan reads the version you use today (from node_modules or package.json), resolves the version you want, and downloads both from npm.

Source

It parses your source and follows every place you use the package: imports, require(), chains like axios.create().get(), local variables, constructor calls, and even the parameters of callbacks you pass in.

Source

Bumpscan ships as a GitHub Action that comments on dependency pull requests.

Source