About

See what changed before updating an npm package.

What it does

Can I Update? is a free, open-source tool for comparing two versions of one public npm package. See changes to dependencies, Node requirements, exports, types, bundle estimates and known security advisories.

Where the evidence comes from

  • npm: Published package metadata supplies declared dependencies, Node requirements, exports and type mappings. Package archives supply file sizes and shipped changelogs. These do not prove how the package behaves in your application.
  • GitHub: Release notes and changelogs provide maintainer descriptions of changes for AI notes, when a supported repository and matching versions can be identified. They may omit changes.
  • OSV: This security advisory database supplies known issues matched to the selected versions. It is not a security audit or a scan of your project. No matches does not mean a package is safe.
  • Bundlephobia: Bundle and gzip size estimates describe the package on its own, not its size inside your application. Incomplete builds cannot be compared reliably.

Coverage and freshness

Sources can fail, be incomplete or exceed collection limits. Other evidence can still be shown when one source is missing. Missing or partial evidence means uncertainty, not “nothing changed,” “fixed” or “safe.”

A collection or retrieval date says when evidence was fetched, not when a package was released. Release dates describe publication; they do not show when we last checked a source.

Some evidence is cached, and upstream sources can lag or change. Reopening a comparison does not guarantee every source is current. AI notes may also be reused when the collected evidence matches.

Facts, claims and AI notes

A measured size, a dependency declared by a package and a maintainer's release-note claim are different kinds of evidence. AI notes interpret the collected evidence and cite sources; they are not independent verification.

AI notes can be wrong or miss important changes. The factual comparison remains usable without them. Check the sources and test your update.

What it doesn't do

  • It isn't a package manager. It doesn't install or update packages.
  • It doesn't inspect your project.
  • It doesn't guarantee an upgrade will work in your application.
  • It doesn't approve updates, give a safety score or provide a complete API compatibility analysis.

Get in touch

For questions or feedback, open an issue on our GitLab repository. You can also browse the source code.