Introduction

radius tells your AI agent which changes in a dependency upgrade affect your code, with the files and lines.

The problem

Your agent upgrades zod from 4.4.3 to 4.5.0.

The code compiles.
The tests pass.
The agent says it's done.

But the release notes say: ".min() now counts an emoji as one character." Your feedback form uses z.string().min(10). A message with five emoji used to pass. Now it's rejected.

Nothing failed, because nothing checked the release notes against your code.

What radius does

After an upgrade, radius:

Reads the release notes of every version in between.
Compares the type files of the old and new versions.
Finds every place your code uses the package.
Tells you which changes affect your code, and on which lines.

npx dep-radius --since HEAD --json

For the zod upgrade, it prints:

zod  4.4.3 → 4.5.0  minor   REVIEW
  4.5.0  ⚠️ String length counts code points
    you use: string, max, min
    src/feedback/schema.ts:5  (via src/lib/zod.ts)

This is real output, shortened. radius found the line even though the file imports zod through another file, src/lib/zod.ts.

The three answers

Answer	Means	Exit code
quiet	Nothing your code uses changed. You can merge.	`0`
review	Some changes may affect your code. Here are the lines to check.	`1`
blocked	Something your code calls was removed. Here is every place that calls it.	`2`

Quiet is rare: about one update in ten. If radius can't prove an update is safe, it says review.

Where to use it

In your AI agent

The instructions to paste into CLAUDE.md or AGENTS.md.

On pull requests

A comment on each Renovate or Dependabot pull request.

In your terminal

Run npx dep-radius in your project.

Does it work?

Tested on 51 real release notes, with every miss listed.

What radius is not

It doesn't replace your tests. It only knows what the release notes say.
It doesn't replace Renovate or Dependabot. They tell you an update exists. radius tells you what it changes for your code.
It isn't an AI. It gives the same answer every time for the same project and versions.
It doesn't send your code anywhere. It only downloads information about packages.