FAQ

No. It reads your code with the TypeScript parser, compares the type files of two versions, and splits release notes into entries. For the same project and versions, it always gives the same answer. It's made to be used by AI agents. See For AI agents.

It can. But the agent guesses which files a note affects, and it often misses code that uses the package through another file. Ask again and you may get a different answer. It also can't tell you what it didn't check.

radius finds every place your code uses the package, gives the same answer every time, and lists what it couldn't check. The agent then reads only those lines.

Any agent that can run a command and read JSON: Claude Code, Cursor, GitHub Copilot, Codex, Aider, or your own. The agent guide has the instructions to paste.

No. It reads your files. It downloads the two versions of each package and reads their package.json, type files and changelog in memory. Nothing is installed. Nothing from the package runs.

No. radius only talks to your npm registry, api.github.com and raw.githubusercontent.com, to get information about packages. See what leaves your machine.

No, it works with them. They tell you an update exists and open a pull request. radius tells you which changes in that update affect your code, and where. The GitHub Action posts that on their pull request.

Two things:

• A change nobody wrote in the notes. radius can't know about it. Your tests can.
• A change it can't link to your code. Then it says review instead of quiet, but it can't point at the exact line.

On the benchmark of 51 real changes, radius found the exact line for 25. It called none of them quiet.

Most releases include a fix written in plain words, like "Fix handling of empty values". radius can't prove that fix doesn't affect your code, so it shows it to you. You read a few lines, not the whole changelog.

On 451 real upgrades from three open source projects, about one in ten was quiet.

No. Quiet means nothing your code uses changed, according to the types and the release notes. A change nobody wrote down is still possible. Trust quiet and green tests together.

The first run downloads what it needs for each updated package. After that, everything comes from the cache, and a run takes about as long as reading your files. --since doesn't need anything installed.

• It has three direct dependencies: typescript, semver and @clack/prompts.
• It has no install scripts.
• Each release is published from GitHub Actions with npm provenance, which links it to its source.
• It sends no telemetry.
• The code is open source, MIT, on GitHub.

Yes. The JSON has a version, schemaVersion: 1. Version 1 only adds fields. Removing or renaming a field would mean version 2. The command itself is still 0.x, so options may change; every change is in the changelog.

JavaScript and TypeScript projects using npm, pnpm, Yarn (classic, berry, Plug'n'Play) or Bun. One package.json or a monorepo with many. Plain JavaScript works too: without types, radius uses the release notes only, and says so.

No. Run it once at the root. It reads every package.json. To look at one package, pass its folder: radius ./packages/api.

Yes. radius reads your registries and tokens from .npmrc, like npm does. Release notes still come from GitHub, when the package links to a GitHub repository.

Usually because radius can't see how it's used. For example, it runs from a script (eslint), it's named in a config file (a Babel plugin), or it's a framework that works through file names (next). These are listed under "cannot see how you use these". See what radius cannot see.

By default, radius stays on your major version, skips versions published less than a day ago, and never goes past the latest tag. Newer majors show up as "also available". Use --latest, or package@version, to check something else.

Please open a "wrong verdict" issue with the package, the two versions and what broke. It's the most useful report there is.

Nothing. The command, the library and the GitHub Action are free and open source, under the MIT license.