Introduction

Which changes in a dependency update land on code you actually wrote. In one command.

A dependency update comes in. Maybe Renovate opened it, maybe Dependabot, maybe your AI agent just ran pnpm up. The changelog is 40 entries long. Which of them matter to you?

That's the only question radius answers. It reads your project, compares the update's types and release notes with the code that uses the package, and gives you one of three words:

Verdict	Means	Exit code
quiet	Nothing you use changed, and no note mentions it.	`0`
review	Here are the exact lines concerned, or what radius can't see.	`1`
blocked	An export you call was removed.	`2`

npx dep-radius

No account, no config file, no build step. Any package manager, one package.json or fifty, TypeScript or plain JavaScript.

What it looks like

schemakit  3.1.4 → 3.2.0  minor  published 3d ago   REVIEW
  surface changes ......... 12
  changes you touch ....... 0
  notes mentioning you .... 1  of 18, notes for 1/1 versions (github-release)

  3.2.0  The email pattern no longer accepts quoted local parts
    you use: email
    src/signup/schema.ts:14
    src/billing/contact.ts:9  (via src/lib/validation.ts)

38 with an update  31 quiet · 7 review · 0 blocked  · 12 up to date

Out of 18 release notes, one mentions something this project uses, and radius shows the two lines where it's used, even the one that goes through a local re-export file. The other 31 updates are quiet: nothing to read.

Made for agents, pleasant for humans

AI agents are great at upgrading dependencies and terrible at reading 40 changelogs cheaply. radius gives them a stable --json brief, honest exit codes, and a --since mode for "I just bumped things, what did I break?". Humans get the same brief as a terminal report or a pull request comment.

Quickstart

Run it on your project in under a minute.

For AI agents

The loop, the JSON, and a snippet for your AGENTS.md.

GitHub Action

One comment on every pull request that changes a dependency.

How it decides

Quiet, review, blocked, and why "quiet" is hard to earn.

The one promise

A wrong quiet is the only bug that really hurts, so radius is built to avoid it. Anything it can't see (a package used only from a script, a config string, a name passed around whole) pushes the verdict towards review, never towards quiet. When in doubt, it tells you what it couldn't see.