ripedeps.sh

Command line

One bash script, three tools you already have: bash, curl and jq. It asks the API for a plan and prints the diff. You decide whether to apply it.

Get the script

Download it, read it, then run it. It is a plain shell script of about 150 lines, and it never writes any file other than temporary ones that it deletes.

terminal

curl -fsSLO https://ripedeps.com/ripedeps.sh
less ripedeps.sh        # read it first
chmod +x ripedeps.sh

Requirements: bash 3.2 or newer (the macOS default is fine), curl and jq. The script is version 1.0.0; its SHA-256 is:

sha256

85141f5bed745348905a2fe56a6248ec021104a0375f423f303ac013bbedff07

terminal

shasum -a 256 ripedeps.sh   # macOS
sha256sum ripedeps.sh       # Linux

Privacy. Uploaded package.json files and the resulting recommendations are stored for analysis and for improving the algorithm. Do not send files that contain secrets. --help prints this notice too. Details.

Usage

synopsis

ripedeps.sh [options] <package.json | https://url/to/package.json | ->

The default output is a unified diff that patch -p1 applies. Warnings go to standard error, so the diff on standard output stays clean:

terminal

./ripedeps.sh --min-age 7 package.json | patch -p1

Settings you do not pass fall back to the ripedeps entry of the file, then to the defaults (minimum age 0, step minor). By default the diff also adds that ripedeps entry to your file; use --skip-adoptconfig to leave it out.

Options

Option	Meaning
`--focus <list>`	Only upgrade these packages and their direct neighbours. Comma-separated, repeatable.
`--min-age <days>`	Minimum age of a version in days, 0–365. Recommended: 7.
`--max-bump <level>`	patch, minor or major. Default: minor.
`--skip-adoptconfig`	Do not write the effective settings into the ripedeps entry of package.json.
`--json`	Print the full plan as JSON. Errors are printed as their JSON error object.
`--host <url>`	API host. Default: https://api.ripedeps.com.
`-h, --help`	Show the help text, including the privacy notice.

Input forms

Argument	What happens
`package.json`	A file path. The text is sent to the API.
`-`	Read the text from standard input.
`https://…`	The service downloads the file itself. Use the raw file URL. Only https is accepted.

Examples

Look first, apply later

terminal

./ripedeps.sh --min-age 7 package.json

The everyday workflow

terminal

git switch -c chore/upgrades
./ripedeps.sh --min-age 7 package.json | patch -p1
npm install && npm test
git commit -am "chore: upgrade dependencies"

Ripedeps produced the diff. Applying it, testing and committing are your steps.

Only a vulnerable package, or a family

You do not have to upgrade everything. Name the package and only it moves, plus the neighbours it needs. Need the fix today? Use a gate of 0 days. Ripedeps does not know which packages are vulnerable, so you name them.

terminal

./ripedeps.sh --focus axios --min-age 0 --skip-adoptconfig package.json | patch -p1

terminal

./ripedeps.sh --focus '@trpc/*' --focus react --min-age 7 package.json | patch -p1

Patch releases only

terminal

./ripedeps.sh --max-bump patch --min-age 14 package.json | patch -p1

From standard input, or a URL

terminal

git show main:package.json | ./ripedeps.sh --min-age 7 -
./ripedeps.sh https://raw.githubusercontent.com/owner/repo/main/package.json

The decisions and explanations

status is the decision for a package and explanation its reason. This prints the reason of every package that is not already current:

terminal

./ripedeps.sh --json --min-age 7 package.json | jq -r '.packages[] | select(.status != "current") | .explanation'

Every package.json in a monorepo

terminal

for f in packages/*/package.json; do
  ./ripedeps.sh --min-age 7 "$f" | (cd "$(dirname "$f")" && patch -p1)
done

Two people working on laptops at a marble table

Output and exit codes

Standard output: the diff, or with --json the full plan. The JSON has the same shape as the API response.
Standard error: warnings (warning: …) and error messages.

Exit code	Meaning
`0`	Success. The diff (or the JSON) is on standard output.
`1`	Usage or local error: bad flag, unreadable file, missing curl or jq, network failure.
`2`	The API returned an error. The message is on standard error (or the JSON error object with --json).
`3`	The plan timed out. Run it again: the package data loaded so far is cached.

In CI

Exit code 3 means "try again", so one retry is worthwhile on a cold cache. A step that fails when upgrades are pending, with the explanations in the log:

ci step

curl -fsSLO https://ripedeps.com/ripedeps.sh
plan() { bash ripedeps.sh --json --min-age 7 --skip-adoptconfig package.json > plan.json; }
plan || { [ $? -eq 3 ] && plan; } || exit 1
jq -r '.packages[] | select(.status == "upgrade") | .explanation' plan.json
jq -e '[.packages[] | select(.status == "upgrade")] | length == 0' plan.json

For a complete weekly pull-request workflow see the API recipes. For AI assistants see the MCP server.