depfix

Dependabot for APIs. Automatically detects breaking API/SDK changes, finds every affected line in your code, generates fixes, runs your tests, and opens a PR.

The problem

Over 30% of service downtime traces back to external API/package changes going unnoticed. Breaking changes ship with little warning. Changelogs don't get read. Teams discover the breakage in production.

Dependabot bumps version numbers. depfix fixes your code.

How it works

watch → scan → plan → apply → PR

Quick start

pip install depfix

# Scan a repo for OpenAI breaking changes
depfix scan --repo your-org/your-app --provider openai

# Generate a fix plan (no PR yet)
depfix plan your-org/your-app --provider stripe

# Apply fixes and open a PR
depfix apply your-org/your-app --provider sentry

GitHub Action

Add to .github/workflows/depfix.yml:

name: depfix
on:
  schedule:
    - cron: '0 8 * * 1'  # every Monday at 8am
  workflow_dispatch:

jobs:
  depfix:
    runs-on: ubuntu-latest
    steps:
      - uses: bedilk/depfix-agents@main
        with:
          provider: openai,stripe,sentry
          mode: apply
          api-key: ${{ secrets.GOOGLE_API_KEY }}

Supported providers

27+ providers out of the box. depfix auto-discovers new providers from npm, PyPI, and RubyGems.

Supported ecosystems

What makes depfix different

• Finds call-sites, not just version numbers. depfix traces imports to actual API usage across your codebase.
• Verified fixes. Every generated fix runs your test suite before and after. Broken fixes never reach a PR.
• Deterministic where possible. OpenAPI diffs and semver comparisons don't need an LLM. Only actual code rewrites use one.
• 27+ providers. Not just OpenAI and Stripe. Real coverage across the APIs developers actually use.
• Honest confidence. Every finding has a confidence level (HIGH/MEDIUM/LOW). depfix doesn't guess.

CLI reference

depfix init                          # set up local database and integrations
depfix watch --once                  # poll feeds for new changes
depfix scan --repo org/app --provider stripe  # find affected call-sites
depfix plan org/app --provider stripe         # generate verified fixes
depfix apply org/app --provider stripe        # open a PR with the fixes
depfix eval --no-llm                          # run deterministic test corpus

Configuration

All config is via environment variables or .env file:

See .env.example for the full list.

Self-hosted

git clone https://github.com/bedilk/depfix-agents
cd depfix-agents
python -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
cp .env.example .env  # edit with your keys
depfix init

Docker:

docker compose up -d --build
docker compose exec app depfix scan --repo org/app --provider openai

Testing

make test        # 893 unit tests, no network
make lint        # ruff check
make typecheck   # mypy
make eval        # deterministic eval corpus (CI gate, 91%+)

Built by

Bedil Karimov and Tohir Saidzoda

We spent a year working with 50+ API vendors. The pattern was consistent: API communication is broken. Breaking changes ship with little warning. Useful features quietly launch and go unnoticed.

The infrastructure for automated code changes exists now. What was missing is the application layer connecting API providers to their customers' codebases. That's depfix.

License

MIT