Your agent upgraded a dependency. What changed for your code?
Release notes describe changes like a new default or a stricter check. The code still compiles and the tests still pass, so nobody notices. radius reads the notes, finds where your code is affected, and gives your agent the files and lines to check.
npx dep-radius --since HEAD --jsonNo AI inside. Your code stays on your machine. Free and open source.
> Upgrade zod to 4.5 and make sure nothing breaks. ● Bash pnpm up zod@4.5.0● Bash npx dep-radius --since HEAD --json └ exit 1 zod 4.4.3 → 4.5.0 review 4.5.0 ⚠️ String length counts code points src/feedback/schema.ts:5 z.string().min(10).max(2000)● Read src/feedback/schema.ts● Edit src/feedback/schema.test.ts + five emoji under .min(10)● Bash pnpm test src/feedback └ ✓ 4 passed ● .min(10) now counts an emoji as one character, so a five-emoji message is rejected. Test added, behaviour confirmed, upgrade done.
An example. The note, the line and the verdict are real radius output for zod 4.4.3 → 4.5.0.
Why the usual checks miss it
It compiles
The compiler catches a removed function. It doesn't catch a function that works differently.
The tests pass
zod 4.5 counts an emoji as one character in .min(). If no test uses emoji, nothing fails.
The notes said it
The change was in the release notes. Nobody checked them against your code.
Files and lines, not a summary
- Your agent upgrades a dependency.
- It runs
npx dep-radius --since HEAD --json. - radius reads the release notes and the types of both versions, and finds every place your code uses the package.
- It returns the notes that affect your code, with the files and lines.
- Your agent opens those lines, fixes them, and runs the tests.
Same project, same versions: same answer, every time.
The agent guide →## Dependency upgrades
After you change a dependency version,
run this before you say you're done:
npx dep-radius --since HEAD --json
- Exit 0: nothing this project uses changed.
Run the tests.
- Exit 1 or 2: open each file and line it
lists. Fix what the change breaks. Run or
add tests for those files. Run it again.
- Exit 3: radius failed. Say so.
Tests are still required.How I use it
I don't run radius myself. Claude Code does. The instructions above are in my projects' CLAUDE.md.
When Claude Code upgrades a dependency, it runs radius, opens the lines, and runs the tests for those files. Then it tells me the upgrade is done. I read its summary, not the changelogs.
Nothing your code uses changed. Merge. This is rare: about one update in ten.
Some notes may affect your code. Here are the lines, and the notes radius couldn't place.
Something your code calls was removed. Here is every place that calls it.
Does it work?
radius is tested on 51 real release notes that changed behaviour. For each one, the lines it should find were written down before it ran.
When radius can't link a change to your code, it says review, never quiet.
For the others, radius still says review. It just can't point at the line.
Out of 451 upgrades in three open source projects. Quiet is rare, so you can trust it.
Questions
Why not let the agent read the changelog?
It can, but it guesses which files a note affects, and may miss some. It can give a different answer next time. radius finds every place your code uses the package and gives the same answer every time.
Is it an AI?
No. It reads your code with the TypeScript parser, compares type files, and reads release notes. No model, no guessing.
Does my code leave my machine?
No. radius only downloads information about packages: versions, package files, release notes. It never installs or runs them.
What can it miss?
A change nobody wrote in the notes. That's why your agent still runs the tests.
Why is almost everything review?
Most releases contain a fix written in plain words. radius can't prove it doesn't affect you, so it shows it to you. You read a few lines, not the whole changelog.
What do I need to set it up?
Nothing. npx dep-radius. No account, no config. Works with npm, pnpm, Yarn, Bun and monorepos. MIT licensed.
The same answer, on the pull request
Renovate or Dependabot opens a pull request. The GitHub Action adds a comment with the verdict and the lines. It fails the check if something your code calls was removed.
radius doesn't replace these bots. They tell you an update exists. radius tells you what it changes for your code.
Set up the Action →on: pull_request
permissions:
contents: read
pull-requests: write
jobs:
brief:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: prakticode/dep-radius@v0A real run, on vercel/commerce
Four of its dependencies, not edited: a changed function with the five lines that use it, a release note with the one line it affects, a quiet update, and a package radius can't see into.
npx dep-radius @types/react sonner @headlessui/react geist at commit 1df2cf6, recorded with an earlier version of radius.
Try it after your next upgrade.
npx dep-radius --since HEAD --json