I built a tool that tells you which lines an npm upgrade will break

说明与用途

Bumpscan 自动比较 npm 包的 API 并扫描项目，只显示升级后会破坏的代码行，简化并加速依赖项更新。

问题

Dependency upgrades are postponed because developers cannot predict which parts of their code will break without actually upgrading and running the build.

结果

Bumpscan reduces upgrade uncertainty by pinpointing exactly which lines will break, enabling faster and safer dependency updates.

工作流

• 1. Run bumpscan with the target package version (e.g., npx bumpscan express@5).
• 2. Bumpscan downloads both the current and target versions from npm.
• 3. It extracts and compares the type definitions (.d.ts) of both versions to identify removed, renamed, or changed API elements.
• 4. Bumpscan parses the project source code to find all usages of the package and reports only the changes that actually affect the code.
• 5. Optional: use --fix to automatically rewrite safe renames in the code.
• 6. For CI integration, add the bumpscan GitHub Action to comment on Dependabot or Renovate PRs with the breaking lines.

证据

Bumpscan reads the version you use today (from node_modules or package.json), resolves the version you want, and downloads both from npm.

来源

It parses your source and follows every place you use the package: imports, require(), chains like axios.create().get(), local variables, constructor calls, and even the parameters of callbacks you pass in.

来源

Bumpscan ships as a GitHub Action that comments on dependency pull requests.

来源