Skip to content
DepDelta for GitHub

Know what a dependency update breaks before you merge

The DepDelta GitHub app reviews every pull request that changes a dependency, from Dependabot, Renovate or anyone, and comments with breaking changes, security fixes, removed APIs and where your code uses them.

Install on GitHubSee an example

Free while in beta. Works alongside Dependabot and Renovate. On GitLab, Bitbucket or another host? Run it from CI

What a review looks like

depdelta bot commented

DepDelta review: 🔴 Breaking

org.jetbrains.exposed:exposed-kotlin-datetime 0.40.1 → 0.61.0

2 breaking changes.

This repo appears to use

  • src/main/kotlin/db/Tables.kt:25 · CurrentDateTime (changed: check this use)

Must act

  • Breaking · 0.42.0 · Remove unnecessary parentheses for functions.
  • Deprecated · 0.42.0 · Raise deprecation levels of API elements.

API changes (from published JVM bytecode)

  • removed method CurrentDateTime.invoke(): CurrentDateTime
  • removed ctor CurrentTimestamp()
  • changed final class CurrentDateTime extends Function → final class CurrentDateTime extends CurrentTimestampBase
  • changed method KotlinInstantColumnType.notNullValueToDB(Object): Object → method KotlinInstantColumnType.notNullValueToDB(Instant): Object
  • and 12 more

Every change in the range on DepDelta

DepDelta🔴 Breaking: exposed-kotlin-datetime 0.40.1 → 0.61.0Action required
A real review, on an example repository. The comment is edited in place on every push.

How it works

  1. 1Install it on the repositories you chooseOne click on GitHub. The most recently updated open pull requests get reviewed straight away.
  2. 2A dependency pull request opensDependabot, Renovate or a person changes a version in a manifest or lockfile.
  3. 3DepDelta comments and sets a checkOne comment, edited in place on every push, and a check that asks for action when an update breaks something.

What it can access, and why

Contents Read
Read the manifests and lockfiles a pull request changes and, when an update removes or changes APIs, its code to find where they're used. Read in memory, never stored, never run.
Pull requests Read and write
Read the pull request and post the review comment.
Checks Read and write
Set the DepDelta check on the pull request's commit.
Metadata Read
Required by GitHub for every app: repository names and basic details.

It never pushes code or changes anything but its own comment and check. The privacy policy has the details.

Install scripts

Reviews flag packages that newly run code when installed: a new package with an install script, or an update that gains one. Packages that always had one, like esbuild, aren't news. Add a .depdelta.yml at the repository root to choose how much that matters.

.depdelta.yml
install_scripts: warn        # off | warn (default) | block
allow_install_scripts:       # never flagged
  - esbuild
  - sharp
warn
The default. Each package that newly runs code at install is flagged in the review.
block
Flagged too, and the GitHub check asks for action; from CI, depdelta exits 1 so the job fails. Until the package is allowed or removed.
off
Install-time code is left out of the review. Lockfile counts and new dependencies still show.

An npm install script, a pnpm build step, a Python package built from source (no wheel), a Composer plugin, or a Cargo build script. Read at the change's head commit. A file DepDelta can't read falls back to the defaults, and the review says why.

Questions

Which ecosystems does it review?

npm, PyPI, Maven, Composer, Cargo, RubyGems, pub.dev, NuGet, Go. Finding where your code uses removed or changed APIs works for npm packages that ship types, PyPI packages, Maven packages, Composer packages, gems, pub packages, NuGet packages and Go modules, in TypeScript, JavaScript, Python, Java, Kotlin, PHP, Ruby, Dart, C# and Go.

Does it work on private repositories?

Yes. Their code is read only to review dependency pull requests, in memory, and never stored or run. Only the lines that use changed APIs are kept, for a day.

Does it replace Dependabot or Renovate?

Not yet. It reviews the pull requests they (or you) open. Opening its own update pull requests is planned.

Will it block my merges?

No. A breaking update's check asks for action without failing, so it only blocks a merge if your branch protection requires the DepDelta check. With install_scripts: block in .depdelta.yml, new install-time code asks for action too.

Does it check install scripts?

Yes. npm's package-lock, pnpm (before v9), uv, Poetry and Composer lockfiles record it. For yarn, pnpm 9, older package-locks, Pipfile.lock and Cargo.lock, DepDelta asks the registry about the packages a change adds or updates, up to 50 per review, and says how many it checked. RubyGems and pub aren't checked yet, and the review says so rather than staying silent. Go, Gradle and NuGet run no code at install.

What does it cost?

Nothing while DepDelta is in beta.

How do I remove it?

Uninstall it in your GitHub settings under Applications. It stops reviewing at once; its past comments stay on your pull requests.

Review your next dependency update
Install on GitHubYour reviewed pull requests