bumpmap

Dependency upgrade plans with risk classes, changelog links — and the honest positioning: Renovate and Dependabot open the PR; this is about landing it.

$ bumpmap plan requirements.txt
== requirements.txt
  [MAJOR   ] pydantic     1.10.13  -> 2.7.4
            major jump 1.10.13 -> 2.7.4: read the changelog's breaking changes and plan code changes before bumping
  [MINOR   ] requests     2.31.0   -> 2.32.3
            changelog: https://requests.readthedocs.io/en/latest/community/updates/

2 dependencies: major 1, minor 1

Risk classes: latest, minor (same major — usually safe), major (the real work), unpinned (pin first). Exit 1 on any major — CI-gateable. --from-cache pypi.json for offline runs; --json for agents. Changelog links are pulled from each package's PyPI metadata.

Commands

bumpmap plan <pyproject.toml | requirements.txt> [--json] [--from-cache cache.json]

Parses pyproject.toml (project.dependencies + optional-dependencies) and requirements*.txt (comments, -e, git/url lines skipped). Python 3.11+, stdlib only.

Install: pip install bumpmap — or from this repo: pip install "git+https://github.com/juzorei/bumpmap#subdirectory=tools/bumpmap"

The companion agent skill lives in skills/dependency-upgrade: the loop that lands a breaking major — changelog → blast radius → bump → tests → fix → commit, one dependency per commit. Skills: npx skills add juzorei/bumpmap.