The GitHub app

A review on every pull request that changes a dependency.

Open GitHub app and press Install on GitHub.
Choose the repositories DepDelta may review.
That's it. DepDelta reviews recent open pull requests straight away, and every new one that changes a manifest or lockfile.

What a review looks like

It reviews pull requests from Dependabot, Renovate and people alike. The review is one comment, updated on every push, and a check:

depdelta bot commented

DepDelta review: 🔴 Breaking

org.jetbrains.exposed:exposed-kotlin-datetime 0.40.1 → 0.61.0

2 breaking changes.

This repo appears to use

src/main/kotlin/db/Tables.kt:25 · CurrentDateTime (changed: check this use)

Must act

Breaking · 0.42.0 · Remove unnecessary parentheses for functions.
Deprecated · 0.42.0 · Raise deprecation levels of API elements.

API changes (from published JVM bytecode)

removed method CurrentDateTime.invoke(): CurrentDateTime
removed ctor CurrentTimestamp()
changed final class CurrentDateTime extends Function → final class CurrentDateTime extends CurrentTimestampBase
changed method KotlinInstantColumnType.notNullValueToDB(Object): Object → method KotlinInstantColumnType.notNullValueToDB(Instant): Object
and 12 more

Every change in the range on DepDelta

DepDelta🔴 Breaking: exposed-kotlin-datetime 0.40.1 → 0.61.0Action required

A real review, on an example repository. The comment is edited in place on every push.

From the top, the comment holds:

The verdict for each update.
This repo appears to use: where your code calls something the update removed or changed.
Must act: the changes that need work.
API changes, supply chain notes (new dependencies, install-time code) and a link to the full comparison.

The check is named DepDelta: Breaking asks for action, Review needed and Unknown are neutral, and Safe passes. The check only blocks a merge if branch protection requires it. Re-run on the check reviews again. While release notes are still being read, the review checks back every 90 seconds for about half an hour.

Permissions

Permission	Why
Contents: read	To read manifests, lockfiles and code for the usage check. Read in memory, never run.
Pull requests: read and write	To post and update its comment.
Checks: read and write	To report the DepDelta check.
Metadata: read	Required by GitHub for every app.

Private repositories work. A review compares up to 10 updates; any more are listed as not reviewed. Signed in with GitHub connected, Updates lists your dependency pull requests and what each changes. To stop, uninstall the app in GitHub under Settings, Applications. Past comments stay.

Still stuck?

Ask us. A person reads every message and replies by email.

Ask a question