vibecoded lightweight local alternative to renovate dependency updater
- Go 99.8%
- Makefile 0.2%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
Nicolas Karolak
ca43564648
depup resolved only the root package.json, so pnpm/npm workspace members were never scanned and monorepos like a packages/* layout went partially unmanaged. Member manifests are discovered from the authoritative workspace declarations: pnpm-workspace.yaml "packages" globs and the root package.json "workspaces" field (string, array, or object form). Globs follow package-manager semantics: "*" matches one path segment, "**" any number, and "!" removes matches; node_modules and .git are never entered. Discovery is driven by these declarations rather than by walking the tree for package.json files, which would sweep in test fixtures and vendored code at a write boundary. Dependencies carry their manifest location; updates are grouped by manifest and applied where the manifest lives: pnpm commands run in each member directory (pnpm resolves workspace context from cwd), npm member installs run from the workspace root with -w. Groups run sequentially because workspace members share one lockfile. Specs with no resolvable registry version (workspace:*, catalog:, "*", "latest", git URLs, file: paths) are skipped. Registry packuments are memoized per run so members sharing a dependency (e.g. typescript) fetch once. Adds gopkg.in/yaml.v3 (no transitive dependencies) for parsing pnpm-workspace.yaml. |
||
| cmd/depup | ||
| docs | ||
| e2e | ||
| internal | ||
| .editorconfig | ||
| .gitignore | ||
| .rumdl.toml | ||
| .semrel.yaml | ||
| AGENTS.md | ||
| go.mod | ||
| go.sum | ||
| LICENSE | ||
| Makefile | ||
| prek.toml | ||
| README.md | ||
depup
Note
This project was AI-generated with Kimi-K2.6 hosted by Infomaniak. This is a personal project built to solve my own workflow needs. It is provided as-is; contributions are welcome but support is not guaranteed.
A lightweight, local dependency updater following the UNIX philosophy.
No branches, no pull requests — just scan, compare, and update in place.
Installation
With Go 1.20+:
go install git.sr.ht/~nka/depup/cmd/depup@latest
Or clone and build:
git clone https://git.sr.ht/~nka/depup depup
cd depup
make install
Usage
# scan and update all detected ecosystems
depup
# dry-run to preview changes
depup --dry-run
# target specific ecosystems
depup --only go,npm
# show help
depup --help
Review changes with git diff, then commit.