I built a tool that tells you which lines an npm upgrade will break
Every project I work on has the same quiet backlog: dependency upgrades that nobody wants to start. Not because upgrading is hard. Because the only honest answer to "will this break us?" is "change the version, run the build, and find out." The changelog tells you what changed in the library. It doesn't tell you what changed for your code . So I built bumpscan , a CLI that answers that question…
A reporter has developed a tool called bumpscan that helps developers identify which lines of code may be affected when upgrading npm dependencies. The tool answers the question "will this break us?" by comparing the public API of the current and target versions of a package, and then scanning the developer's codebase to find any changes that actually touch the code.
The process consists of three steps: downloading both versions of the package, comparing their type definitions to find removed, renamed, or changed exports, and analyzing the developer's code to locate affected lines. The tool highlights breaking changes, risky changes (those requiring updates to CI or server environments), and safe changes that do not impact the code.
Key findings from the tool's development include cases where "removed" often meant "moved," changes in function signatures, and packages with their types residing in separate dependencies. bumpscan is written in JavaScript, works with TypeScript, and can handle monorepos. It is MIT-licensed and available on GitHub, and it provides a GitHub Action that can be integrated into Dependabot or Renovate PR workflows to automatically flag breaking changes in the codebase.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
