Ripedeps
Menu
ToolHow it worksAPIMCPCLIPrivacy
Deterministic Node.js dependency upgrades

Upgrade Node.js npm packages without the gamble.

Ripedeps recommends the newest versions that are old enough to trust, aligned with each other and within the step you allow. You get a ranked, explained plan: a diff and the reason for every decision. Upgrade everything, or just the one package that needs it. No AI at runtime.

  • Free forever
  • No price, no fees
  • No account, no API key
Try it on your package.jsonHow it works
Try it

Paste a package.json. Get a diff.

Runs on live registry data. Pick how big a step may be, minor by default. Need just one package? The full tool has a focus field, and adds upload and URL.

package.json
Load an example:

Uploaded package.json files and the resulting recommendations are stored for analysis and for improving the algorithm. Do not send files that contain secrets. Privacy

The problem

Updating npm packages is a bad choice between two bad choices.

Stay put and known vulnerabilities pile up. Chase the latest and you install whatever was published this morning, including what an attacker published this morning.

Hands untangling a long silver chain, standing for tangled dependency versions
Never update

Safe until it isn't

Fixes you never take, and a jump so large that nobody wants to review it when the vulnerability finally arrives.

package.json
"axios": "^1.6.0"
Let it ripen

The newest version that is old enough

Recent, but not brand new. Aligned with your other packages and inside the step size you set. The middle path.

ripedeps
"minAgeDays": 7,
"maxBump": "minor"
Always the latest

Fast, and exposed

Sophos reports that axios 1.14.1 and 0.30.4 were published after a maintainer account takeover and installed a remote access trojan.Read the report.

terminal
npm install axios@latest
Three hourglasses with yellow, orange and green sand standing in grass
Age gate

Let new releases ripen.

A short waiting period keeps brand-new versions out of your tree while the registry and the community have a chance to react. You choose how long. Seven days is a good start.

Ripedeps is not a vulnerability scanner. If you need a fix today, run it with a gate of 0 days or with a focus on that one package.

Age gate timelineThree releases of one package. With a 7-day age gate the newest release, 2 days old, is held back and the 11-day-old release is recommended.too young: inside the gateage gate: 7 days1.4.026 days old1.5.011 days old1.6.02 days oldrecommendedoldertoday
Example: three releases and a 7-day age gate. The newest version is not proposed yet.
Two stacks of glossy tiles connected by a row of small bridge pieces
Aligned upgrades

One version per package, moved together.

A package is only moved to a version that agrees with its neighbours: peer ranges are respected and the packages you list do not end up in several versions. When the newest version of one package would break another, it waits.

The result is a plan you can apply in one go, with @types and engines.node taken into account.

Peer constraint exampleThe newest next requires react ^19 but the project has react 18. Upgrading next alone would break the peer constraint, so Ripedeps keeps next at the newest version that still accepts react 18.Newest of everythingRipedepsnextnewestreactproject has 18.xpeer asks ^19, react is 18:the upgrade would breaknextstill accepts 18react18.x, unchangedpeer holds,alignment keptIllustrative versions
Alignment beats freshness: a package is held back when its newest version would break a constraint.
How it decides

Rank, decide, explain.

Three steps turn registry data into a plan you can review: the versions are ranked, each package gets a decision, and every decision comes with its explanation. All of it is plain code, so the same input gives the same answer.

1 · Ranking

Candidates are ranked, not guessed

Every allowed combination is compared in a fixed order: fewest peer violations, then fewest misaligned dependencies, then the least lag behind the newest version. Alignment always beats freshness.

How it works →2 · Decision

Every package gets a verdict

Upgrade, held, current, outside the focus or skipped, with the chosen version next to the best candidate. A newer version that is not taken is named.

How it works →3 · Explanation

Every verdict says why

One sentence per package plus structured reasons: age gate, step limit, engines, peer or dependency. Built from templates, so it is stable and testable.

How it works →
decision and explanation (real output, 7-day gate, minor steps)
upgrade  next 15.0.0 -> 15.5.28 (minor step, 9 days old, age gate 7); newest version that qualifies; not taken: next@16.4.3 is a major step from 15.0.0, above the allowed minor level
held     react held at 18.3.1; not taken: react@19.3.1 is a major step from 18.3.1, above the allowed minor level
Focus

Only the package you need.

A vulnerability is announced for one package? You do not have to upgrade everything. Name the package, or a whole family, and Ripedeps plans just that, plus the neighbours it needs to stay consistent. The rest of your file stays exactly as it is.

  • No full upgrade needed
  • One package or a family like @trpc/*
  • Tool, API, MCP and CLI

Ripedeps does not know which packages are vulnerable: you name them. Need the fix today? Run it with a gate of 0 days for that package.

A small tower of red and blue dice on a white background
focus: axios (real output, the rest is untouched)
@@ -2,7 +2,7 @@   "name": "my-app",
   "version": "1.0.0",
   "dependencies": {
-    "axios": "^1.6.0",+    "axios": "^1.20.0",     "express": "^4.18.2",
     "lodash": "^4.17.20",
     "zod": "^3.22.0"
web tool: Focus field
axios
API
{ "packageJson": "…", "focus": ["axios"], "skipAdoptConfig": true }
CLI
./ripedeps.sh --focus axios --skip-adoptconfig package.json | patch -p1
MCP: just ask your agent
Upgrade only axios, I need the fix now.
What you get

Heuristic where it helps, deterministic where it matters.

The same input and the same registry data always produce the same plan. No AI model is involved at runtime, so there is nothing to hallucinate: every version, range and sentence comes from registry data and fixed rules.

  • Zero hallucinations
  • Same input, same plan
  • Ranked, decided, explained
  • Explanations from templates, not from a model

Age gate

New releases wait N days before they are proposed. Brand-new versions are the least reviewed ones.

How it works →

One version, moved together

Peer and dependency ranges between your packages are respected, so next and react move as a team.

How it works →

Upgrade only what you need

A vulnerable package? Name it, or a whole family like @trpc/*. Only it and the neighbours it needs move.

How it works →

@types follow

Existing @types entries are matched to the version of the package they describe.

How it works →

Respects engines.node

Versions that need a newer Node than your engines field allows are not proposed.

How it works →

Every change explained

One plain sentence per package: the decision, how old the version is, and what held the newest one back.

How it works →
Four ways in

Use it where you already work.

Web, API, AI assistant or terminal: the same planner answers all of them.

Web tool

Upload, paste or link a package.json and read the recommendation in your browser.

diff
-    "zod": "^3.22.0"+    "zod": "^3.25.76"
Open the tool →

REST API

One JSON endpoint for pipelines and scripts. Documented, schema-backed, CORS-enabled.

terminal
curl -X POST https://api.ripedeps.com/plan \
  -H 'content-type: application/json' -d @request.json
API reference →

MCP server

Let your AI agent ask for the plan and the reasons, then do its own work: apply, test, explain. We only suggest.

terminal
claude mcp add --transport http ripedeps \
  https://mcp.ripedeps.com/mcp
MCP guide →

Command line

A single bash script that needs only curl and jq. It prints a diff you can pipe into patch.

terminal
curl -fsSLO https://ripedeps.com/ripedeps.sh
bash ripedeps.sh --min-age 7 package.json | patch -p1
CLI guide →
Pricing

Free. Forever.

No price, no tiers, no trial, no fees. The web tool, the API, the MCP server and the script are free to use, today and later, without an account or an API key.

Fair-use rate limits protect the service for everyone.

Your repository stays yours

We plan. You apply.

Ripedeps never writes to your machine and never commits to your repository. It returns a diff, the full new file and the reasons; applying them is up to you or your agent.

What happens to your package.jsonYou send the file to the Ripedeps service. It asks the public npm registry for the packages it lists and returns a diff, the new file and explanations. Nothing is written to your machine and nothing is committed.You or your agentapplies the changeRipedepsplans, never writesnpm registrypublic package datapackage.jsondiff + whynamesstored for analysisfile, result, settingsnot stored: IP, headers,user agent, identity
The service plans; it never touches your repository. See the privacy page for the exact list.
  • No accounts
  • No cookies or analytics on this site
  • No IP addresses or headers stored
  • Privacy page in plain English

The files you send and the recommendations are stored for analysis and for improving the algorithm. Do not send files that contain secrets. Read the privacy page.

Take the next upgrade with a plan.

Paste your package.json and see what Ripedeps would change, and why. It is free, forever.

Open the toolRead the API docs
A Node.js sticker held between two fingers
A {json} sticker held between two fingers
An npm sticker held between two fingers

Made for the Node.js and npm ecosystem.