bumpless

1 回目 · bumpless/projectrun 01

7/44

更新が 44 こ、PR が 7 こ ＝44 bumps, 7 PRs

  • PR を開くopens a PR
  • 脆弱性の修正fixes an advisory

Bumpless reads every outdated dependency before it touches your repo: the release notes, the security advisories, and the lines of your code that use it. Then it groups the bumps.

Install on GitHub Free. $5 of analysis a month.

束 1 · そのままマージgroup 1 · safe to merge

7/44

One PR you can merge without reading.

Every bump where nothing in the notes touches your code: type packages, patch fixes, additive minors. The part of the version that changes is in bold, so a major never hides in a list.

Bump 3 dependencies (safe to merge)

@sentry/nextjs11.8.011.9.0minorNext.js trace meta-tag fix for cacheComponents; span origin renames
@types/bun1.4.31.4.4patchNot used directly here; no release notes, advisories or metadata changes.
stripe23.0.023.0.1patchFixes lastResponse.statusCode for fetch; webhook secret validation tightened

束 2 · さっと確認group 2 · worth a quick look

11/44

One PR, with exactly what to glance at.

Low risks that might touch your code, each pointing at the file and line it would touch. Nothing to research, just something to look at.

What to glance at

next 16.4.2 → 16.4.3

Server bootstrap change around standalone React could affect server rendering; the repo uses App Router server components (connection, cacheLife).

@clerk/testing 2.2.49 → 2.2.50

Transitive @clerk/backend and @clerk/shared bumps could change the Playwright helpers used across the e2e suite apps/web/tests/e2e/fixtures.ts:1

束 3 · じっくり確認group 3 · worth looking into

26/44

Its own PR, with the reasons.

Majors, 0.x releases, security fixes, new install scripts, and anything with a medium or high risk. Each PR says what you gain, what could break, what it assumed, and which changelogs it read.

Bump stripe to 23.0.1 (worth looking into)

high · affects this repo: yespayment_method_types is removed from PaymentIntentCreateParams. The repo passes payment_method_types: ["card"] in two places.

Assumptions to check

The removal listed in 22.7.0-beta.1 carries into 23.0.0, since the 23.0.0 notes are empty.

4/4 · 一回の流れa run

find+read+judge+open

  1. findEvery package.json and lockfile, monorepos included. Only versions out for at least 3 days.
  2. readRelease notes and the CHANGELOG, OSV advisories, engine and install-script changes, and every import or script that uses the package.
  3. judgeDeepSeek V4.1 Flash on Boundless inference rates each risk against your code. Code, not the model, decides the group.
  4. openLockfiles regenerated with your pinned package manager and --ignore-scripts. PRs update in place, and your CI checks them.

更新 44 こを読む費用what reading 44 bumps cost

$0.02

Free while we build it: $5 of analysis per account each month, up to 20 repos. No card.

Install Bumpless on GitHub

Any account, private repos included. Runs on install, every morning, and after you merge a dependency change.