ruckup

One command to check and update dependencies across Cargo, Docker, GitHub Actions, npm, and Python — all at once.

ruckup auto-detects your project's manifest files and checks every dependency against its upstream registry. Run it in any repo — even polyglot monorepos — and get a unified view of what's outdated. Then apply updates interactively or all at once.

Installation

cargo

cargo install ruckup

npm / pnpm / yarn / bun

npm install -g ruckup
# or
pnpm add -g ruckup
# or
yarn global add ruckup
# or
bun add -g ruckup

pip / uv / pipx

pip install ruckup
# or
uv tool install ruckup
# or
pipx install ruckup

Pre-built binaries

Download the latest binary for your platform from the GitHub Releases page, extract it, and place it on your PATH.

Build from source

git clone https://github.com/ruckc/ruckup.git
cd ruckup
cargo install --path .

Features

• Auto-detection — scans the current directory for all supported manifest files
• Multi-ecosystem — one tool for Cargo, Docker, GitHub Actions, npm, and Python
• Interactive updates — multi-select prompt lets you pick exactly what to bump
• Bulk updates — --all flag skips prompts and applies everything
• Flexible filtering — scope work to a specific ecosystem or package name
• Upgrade intelligence reports — generate text/markdown/html/pdf reports with SCM diff links, changelog links, security resources, and supply-chain deltas where available
• Lockfile-aware — respects npm peer dependency constraints
• Configurable — per-project .ruckuprc plus global config and env var overrides

Supported Manifests

Usage

Usage: ruckup [OPTIONS] [COMMAND]

Commands:
  check   Check for available dependency updates (default)
  update  Interactively select and apply dependency updates
  list    List detected dependency files and their dependencies
  report  Generate upgrade intelligence reports

Options:
  -o, --only <ONLY>      Comma-separated list of ecosystems to check
                         (cargo, docker, github-actions, npm, pyproject, requirements)
  -f, --filter <FILTER>  Filter to specific dependency names
  -h, --help             Print help
  -V, --version          Print version

check is the default command, so ruckup and ruckup check are equivalent.

Examples

# Check everything in the current directory
ruckup

# Check only Cargo dependencies
ruckup --only cargo

# Check only GitHub Actions workflow pins
ruckup check --only github-actions

# Check npm packages and filter to a specific name
ruckup check --only npm --filter react

# Check multiple ecosystems at once
ruckup check --only cargo,npm --filter serde,clap

# List all detected dependencies without hitting registries
ruckup list

# Interactively choose which updates to apply
ruckup update

# Apply all available updates without prompts
ruckup update --all

# Generate a markdown report for all upgrade candidates
ruckup report

# Generate HTML + PDF reports and open in your browser
ruckup report --format html,pdf --open

# Generate a scoped report for one ecosystem + dependency
ruckup report --only npm --filter react --format text,markdown

Upgrade Intelligence Report Coverage

Update shortcut

During interactive ruckup update, press r before selecting packages to generate and open a consolidated HTML report across all detected plugins and their pending upgrades.

Configuration

Configuration is resolved in this order (later entries win):

1. Built-in defaults
2. ~/.ruckuprc (global)
3. ./.ruckuprc (project)
4. RUCKUP_* environment variables

Both TOML and JSON formats are supported for .ruckuprc.

Settings

Example .ruckuprc

preserve_range = true
cargo_concurrency = 5
npm_concurrency = 16
pypi_concurrency = 10
github_actions_concurrency = 8
docker_concurrency = 8

Environment variable examples

RUCKUP_PRESERVE_RANGE=false ruckup update --all
RUCKUP_NPM_CONCURRENCY=8 ruckup check --only npm
RUCKUP_DOCKER_CONCURRENCY=4 ruckup check --only docker

Notes

• Docker support targets Docker Hub images with semver-like tags; unsupported registries and floating tags are listed but not upgraded.
• npm output includes peer dependency conflict reporting so you can see what is blocking an upgrade.
• GitHub Actions updates rewrite pinned uses: owner/repo@ref references; floating refs like stable are left alone.
• Python detection only activates for pyproject.toml files that declare Python dependencies.
• requirements.txt packaging directives (editable installs, direct URLs, pip flags) are intentionally ignored.
• Supply-chain deltas are generated where upstream metadata is available (currently strongest for npm, crates.io, and PyPI packages).

License

MIT — see LICENSE.