Know which dependency updates touch your code.
radius compares each update's types and release notes with the code that actually uses the package. You get one word per update, quiet, review or blocked, and the exact lines behind it.
npx dep-radiusNo account. No config file. Free and open source.
schemakit 3.1.4 → 3.2.0 minor published 3d ago REVIEW surface changes ......... 12 changes you touch ....... 0 notes mentioning you .... 1 of 18 3.2.0 The email pattern no longer accepts quoted local parts you use: email src/signup/schema.ts:14 src/billing/contact.ts:9 (via src/lib/validation.ts) quiet (31) merge without reading react, vitest, date-fns and 28 more 38 with an update 31 quiet · 7 review · 0 blocked
Nothing you use changed, and no release note mentions it. Merge without reading.
Here are the lines concerned, or what radius couldn't see. Two minutes, not forty changelogs.
An export you call was removed. You'll know before the build does.
Two relevant lines instead of forty changelogs
Agents upgrade dependencies all day. Reading every release note burns tokens, skipping them breaks things. radius gives your agent a stable JSON brief, honest exit codes, and --since HEAD for "I just bumped things, what did I break?".
Paste the instructions into AGENTS.md and you're done.
The agent guide →## Dependency updates
After changing a dependency version, run:
npx dep-radius --since HEAD --json
- 0, quiet: nothing used changed. Run the tests.
- 1, review: open each site in types.touched
and notes.matched, adapt, run radius again.
- 2, blocked: an export in use was removed.
Fix those sites first.The brief, right where the update is
Renovate or Dependabot opens the pull request, the GitHub Action comments with the verdict and the lines concerned, and edits that comment on every push. No install step: radius reads the lockfile.
Quiet and green? Auto-merge it. Blocked? The check fails before anyone merges.
Set up the Action →on: pull_request
permissions:
contents: read
pull-requests: write
jobs:
brief:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: prakticode/dep-radius@v0Two nets, never merged into one reassuring number
Each update is checked twice, independently. Anything radius can't see pushes towards review, never towards quiet.
The type surface
Both versions' declarations, compared export by export with its own TypeScript compiler, matched against the names your code uses, through re-export files and values built elsewhere.
The release notes
Every version between yours and the target, from the package, its GitHub releases or its changelog. Only the entries that name something you use are kept.
What it can't see
Packages run from scripts, named in config files, passed around whole. Listed plainly, so nothing is quiet by accident.