FAQ
The questions people ask before they try it, with short answers and a link to the details.
The idea
Ripedeps proposes the newest versions that are old enough, within the step you choose and aligned with each other, and it explains every decision. Here are the first questions.
Why not just take the latest version?
The newest release has been seen by the fewest people. Ripedeps waits a few days first, so a broken or hijacked release has time to be noticed. Why let releases ripen explains the reasoning.
What does "7 days" mean?
A version has to be at least that many days old before it can be proposed. The web tool starts with 7 days; the API and the script accept 0 to 365. See choosing the days.
How is it different from Dependabot or Renovate?
Those tools watch repositories and open pull requests. Ripedeps plans one package.json and explains every decision; it can run next to them. See the comparison.
Is there AI in it?
No. The planner is deterministic code and the explanations are built from templates. An AI agent can call it through the MCP server, but no model makes a decision. See the pipeline.
Does the same input always give the same answer?
The same file and the same registry data at the same moment give the same result. A release published in between, or refreshed registry data, can change it.
What goes in
Does it read my lockfile?
No. The only input is package.json. Lockfiles are neither read nor written.
Does it check for vulnerabilities?
No. Ripedeps has no vulnerability data. It reduces your exposure to brand-new releases; it does not tell you which versions are affected by a known problem. If you need a fix now, run it with a gate of 0 days or with a focus on that package.
Does it propose prereleases?
No. Only stable versions are proposed.
Does it change my ^ and ~?
No. The prefix you chose stays. A change raises the lower bound of the range. See the output.
Does it open pull requests or edit my files?
No. It returns a diff and the complete new package.json, and you apply them yourself, for example with patch. Nothing is written to your machine or committed to your repository. See the command line.
Reading the result
Why was a package held?
A newer version exists but was not taken: it is too young, too big a step, needs a newer Node, or would break a peer or an aligned dependency. The explanation names the first reason. See decisions.
Why is a package "outside focus"?
When you enter a focus, only those packages move, together with what they need. The rest stay as they are and are listed with that status. See focus.
Why did @types/node jump a major version?
@types/node follows your engines.node, not the newest types. If your file allows Node 20, the types are aligned to 20. See @types and engines.node.
Why was a package skipped?
Ranges that are not plain semver are left alone, and the reason is given: for example a git or file reference, a workspace or a *. See what is read.
What is the "ripedeps" entry in package.json?
An optional entry that keeps your settings, minAgeDays and maxBump, with the project. A value you send with the request wins over the entry, and the entry wins over the default. The web tool does not add the entry to the new file unless you tick "Remember the ripedeps settings in package.json". See the web tool and the request parameters.
The service
What do you keep of my package.json?
Nothing of its content. After a completed plan one record with numbers only is kept, such as the file size and the number of dependencies and changes. See privacy for the complete list.
Is it free?
Yes. No account, no API key, no tiers. Fair-use rate limits protect the service for everyone; the figures are in limits and errors.
The first call was slow, or ended with an error. What now?
A cold cache can make the first plan for a project take a while. A plan has 60 seconds; if it runs out you get plan_timeout (HTTP 504). Call again: the data loaded so far is cached and the second call is much faster.
Can I use it in CI or from an AI agent?
Yes. There are the REST API, the command line script and the MCP server. They all use the same parameters.
Not answered here? How it works goes through the algorithm step by step, or write to privacy@ripedeps.com for privacy questions.