FAQ
The questions people ask before trusting a tool with their upgrades.
No. It reads your files and parses them. Package tarballs are downloaded and read in memory: only
their package.json, type declarations and changelog. No install, no lifecycle scripts, nothing
from the packages ever runs.
No. radius talks to your npm registry, to api.github.com and to raw.githubusercontent.com, only
to fetch package metadata and release notes. See
what leaves your machine.
No, and that's on purpose. It's deterministic: the same inputs give the same verdicts, and every verdict comes with the rule that produced it. It's built to be used by AI agents, which is a different thing. See For AI agents.
No, it completes them. They notice updates and open pull requests. radius tells you which of those pull requests you need to read. The GitHub Action puts the answer right on the pull request.
Please don't. Quiet means nothing you use changed according to the types and the release notes. A behaviour change nobody wrote down is invisible to any tool that reads notes. Quiet plus green tests is the combination to trust.
JavaScript and TypeScript projects with npm, pnpm, Yarn (classic, berry, Plug'n'Play) or Bun. One
package.json or a monorepo with many. Plain JavaScript works too: without types, radius relies on
the release notes, and says so.
No. Run it at the root: every package.json is read, and each installed version of a dependency is
briefed once, with the manifests that declare it. To focus on one package, pass its folder: radius ./packages/api.
Yes. radius reads the registry, scoped registries and _authToken entries from your .npmrc, just
like npm. Release notes still come from GitHub, when the package points to a GitHub repository.
Usually because radius can't see how it's used: it's run from a script (eslint), named in a
config file (a Babel plugin), or it's a framework used through file conventions (next). Those are
listed under "cannot see how you use these". See what radius cannot see.
By default radius stays on your version's line (same major), skips versions younger than a day, and
never goes above the latest tag. Newer majors show up as "also available". Use --latest, or
package@version, to analyse something else.
That's the bug that matters most, so thank you in advance: please open a "wrong verdict" issue with the package, the two versions and what broke.
Nothing. The CLI, the engine and the GitHub Action are open source under the MIT license.