What's New

The products What's New tracks release notes for, with slugs, categories and platforms. Filter by category and/or a name query.

Full-catalog search across product names and release history. Returns matching products and releases with permalinks.

A product's newest releases with notes. Pass since_version (the version you run) to get only what shipped after it, with per-category change counts.

Before or after upgrading dependencies — package.json / lockfile / requirements changes, npm update, pip install -U, a Gradle version catalog, go.mod, a workflow's actions — pass each package with the version you run and the version you are moving to. Returns every tracked release in between with the vendor's own breaking-change, deprecation, migration and security sections verbatim, the categorized change list, CVE ids and deterministic signals (major bump, removed/deprecated items, breaking mentions) — including breaking changes shipped in minor or patch versions. Pass repository (from the package's own package.json) for scoped or renamed packages; it makes the match exact. A Maven/Gradle, Go, NuGet or GitHub Actions package goes by its purl (e.g. pkg:maven/com.squareup.okhttp3/okhttp), or by its own coordinate as the name (group:artifact, a module path, owner/repo@ref), and is matched exactly or not at all. A Maven, Go or NuGet package this server does not track is checked against deps.dev after the answer and counted, to decide what to track next; pass recordMisses: false for private packages.

For a whole project's outdated report — npm/pnpm outdated --json (current → from, wanted, latest), ncu --format installedVersion, pip or uv pip list --outdated --format json (version → from, latest_version → latest), go list -m -u -json all (Version → from, Update.Version → latest), cargo outdated, dotnet list package --outdated, a Gradle versions report — pass each package with the version installed and, where the tool gives them, wanted and latest. Answers what the project is missing, most exposed first: per package, the security releases, CVE ids and fixes it does not have, split into toWanted (from → wanted: reachable by an update within the declared range, no manifest edit) and toLatest (→ latest: needs the range changed), with the cost of moving beside them (major bump, breaking mentions, removed/deprecated) and a few of the fixes themselves. Counts are deterministic over every tracked release; no model judged anything. Up to 100 packages a call. Pass repository (from the package's own package.json) for scoped or renamed packages; a Maven, Go or NuGet package goes by its purl. For the vendor's own breaking-change and migration sections, call upgrade_notes on the packages worth moving. A Maven, Go or NuGet package this server does not track is checked against deps.dev after the answer and counted; pass recordMisses: false for private packages.