I built a tool that tells you which lines an npm upgrade will break

Описание и применение

Bumpscan автоматически сравнивает API npm‑пакетов и сканирует проект, показывая только те строки кода, которые сломаются после обновления, ускоряя и упрощая процесс обновления зависимостей.

Задача

Dependency upgrades are postponed because developers cannot predict which parts of their code will break without actually upgrading and running the build.

Результат

Bumpscan reduces upgrade uncertainty by pinpointing exactly which lines will break, enabling faster and safer dependency updates.

Рабочий процесс

• 1. Run bumpscan with the target package version (e.g., npx bumpscan express@5).
• 2. Bumpscan downloads both the current and target versions from npm.
• 3. It extracts and compares the type definitions (.d.ts) of both versions to identify removed, renamed, or changed API elements.
• 4. Bumpscan parses the project source code to find all usages of the package and reports only the changes that actually affect the code.
• 5. Optional: use --fix to automatically rewrite safe renames in the code.
• 6. For CI integration, add the bumpscan GitHub Action to comment on Dependabot or Renovate PRs with the breaking lines.

Доказательства

Bumpscan reads the version you use today (from node_modules or package.json), resolves the version you want, and downloads both from npm.

Источник

It parses your source and follows every place you use the package: imports, require(), chains like axios.create().get(), local variables, constructor calls, and even the parameters of callbacks you pass in.

Источник

Bumpscan ships as a GitHub Action that comments on dependency pull requests.

Источник