Web tool

Upgrade a package.json

Upload, paste or link your file, choose how long new releases should wait, and read the recommendation. Nothing is written anywhere: you copy the diff or the new file.

Recommendation

Package	Change	Step	Status	Released

Diff

How to use it

Three ways to bring your file

Upload. Pick a package.json from disk. It is read in your browser and sent to the planner.
Paste. Paste the text of the file. Formatting and indentation are preserved in the diff.
URL. Give the raw file URL, for example from GitHub. The service downloads it (https only, port 443). The controls are not pre-filled from the file in this mode.

a raw file URL

https://raw.githubusercontent.com/owner/repo/main/package.json

The controls

Hold back new releases for

A version must be at least this many days old before it can be proposed. Start with 7 days; use 14 or 30 for cautious projects. 0 means "the newest that qualifies, however new".

Largest step

patch keeps the same major.minor, minor keeps the same major, and majorlifts the limit. The step is measured from the version in your file.

Focus: upgrade only what you need

You do not have to upgrade everything. If a vulnerability is announced for one package, or a family of packages, enter just that and only it moves, together with the packages its newest versions refer to. Everything else stays as it is. Separate names with commas. A bare name such as trpc also matches@trpc/*.

focus

axios

a family and a package

@trpc/*, react

Ripedeps does not know which packages are vulnerable, so you name them. Need the fix today? Choose "no minimum" as the age for that run.

Remember the ripedeps settings

Off by default. When on, the new file gets a ripedeps entry with the settings used, so later runs (also from the API, MCP or CLI) start from the same limits:

package.json

"ripedeps": {
  "minAgeDays": 7,
  "maxBump": "minor"
}

If your file already has such an entry, the age and step controls are pre-filled from it. focus is never stored in the file.

Reading the result

Ripedeps ranks the possible version combinations in a fixed order (see Ranking), then shows its decision for every package as a status badge, and an explanationin the line under it.

Status	Meaning
upgrade	The range moves to a newer version. The explanation says the step, the age and whether it is the newest that qualifies.
held	A newer version exists but is not proposed: too young, too big a step, needs a newer Node, or it would break a peer or aligned dependency.
current	Already the newest version that qualifies.
outside-focus	Not part of the focus, left unchanged.
skipped	Not a plain semver range (a tag, URL, workspace or git reference), or the package is unknown.

Under the table you get the unified diff. Copy it and apply it with patch -p1, or copy or download the complete new file. Ripedeps never changes anything on your side by itself.

apply a copied diff

pbpaste | patch -p1   # macOS
xclip -o | patch -p1  # Linux

Privacy. Uploaded package.json files and the resulting recommendations are stored for analysis and for improving the algorithm. Do not send files that contain secrets. Details.

Prefer your terminal or an AI assistant? See the command line, the API and the MCP server.