Codependence

One configuration for every dependency manager.

Codependence checks and updates dependency versions using one-to-many project policies with support for Node, Python, Go, Rust, Docker, GitHub Actions, and Helm.

This means you control how you update and why you update. Versus other tools, Codependence caters to a project's context vs a dependency's context.

Main use case

Pin what matters and update the rest

Suppose a project must stay on React ^19.0.0, but its other dependencies should keep moving. Add that policy to .codependencerc:

{
  "config": {
    "app": {
      "path": "package.json",
      "manager": "pnpm",
+      "mode": "precise",
+      "codependencies": [{ "react": "^19.0.0" }]
    }
  }
}

After adding "update": "codependence --update" to package.json as shown in Configuration, run:

npm run update

React stays pinned while lodash updates:

 "dependencies": {
   "react": "^19.0.0",
-  "lodash": "^4.17.20"
+  "lodash": "^4.17.21"
 }

The policy runs the same thing everywhere!—Locally in scripts or in CI; it's the same and you own it. See more recipes below!

Install

Runtime support

Codependence officially supports Node.js 24 and newer.

Node.js 20 and 22 are best-effort compatible: the CLI may work there, and CI runs non-blocking smoke checks, but failures below Node.js 24 do not block releases.

via npm in the project

npm install codependence

For direct CLI use:

npm install --global codependence

or via brew

brew install yowainwright/tap/codependence

It is a top priority to make this official to brew as quickly as possible for your security benefit!

Configuration

{
+  "scripts": {
+    "init": "codependence init",
+    "update": "codependence --update"
+  }
}

npm run init

That's it!

What `init` does

Finds package manifests.
Prompts you to seemlessly setup dependency policy and enforcement.
Creates or updates the configuration.

Note

Use init config [directory] for configuration only and init actions to generate GitHub Actions workflows.

For a JavaScript project, you can use a codependence dependency policy object in package.json. For larger or mixed-language projects, you can create Codependence config files for your project's dependency needs:

{
+  "codependence": "./.codependencerc"
}

The config path is relative to manifest files, e.g. package.json. Each entry in config represents one manifest and requires path and manager; name is optional.

Note

Editors can use the published configuration schema for validation and completion.

Seemless Maintenance

Once you're dependency policy is as you desire, all that's left is maintenance. AKA

npm run update

That's it but readme below for how you can be more nuanced about maintenance below!

CLI

Codependence, although it can be used with Node.js, or only ci, is a CLI-first policy tool.

The direct commands below assume the global npm or Homebrew install shown above.

Run codependence --help for every option.

Init

Codependence consists of just 1 commands, init.

Usage: codependence [command] [options]

Commands:
  init [directory]                  Run guided project setup
  init config [directory]           Create or update configuration only
  init actions [managers...]        Generate GitHub Actions workflows

Init has sub commands and there are options but that's it. This also hopefully feels pretty simple and understantable.

Option Reference

Configuration can live in package.json or a referenced .codependencerc. Use CLI flags for execution choices such as checking, updating, and output formatting.

From policy to result

The config defines the manifest and dependency policy. The CLI decides whether to check, preview, or write the result.

.codependencerc:

{
  "config": {
    "web": {
      "path": "package.json",
      "manager": "pnpm",
+      "codependencies": [{ "lodash": "4.17.21" }]
    }
  }
}

Check the policy and save a machine-readable report. The manifest is unchanged:

codependence --format json --outputFile dependency-report.json

The report describes the result and exit status:

{
  "status": "outdated",
  "exitCode": 1,
  "dependencies": [
    {
      "package": "lodash",
      "current": "4.17.20",
      "latest": "4.17.21",
      "isPinned": true,
      "severity": "patch",
      "canAutoUpdate": true
    }
  ],
  "summary": {
    "totalPackages": 1,
    "outdated": 1,
    "upToDate": 0
  }
}

The actual report also includes a runtime-dependent duration value.

Apply the same policy with --update:

codependence --update

The approved manifest entry changes as follows:

-  "lodash": "4.17.20"
+  "lodash": "4.17.21"

Use --dryRun with --update to show that change without writing it:

codependence --update --dryRun

{
+  "update": true,
+  "dryRun": true
}

The same policy can run in GitHub Actions. The workflow reads .codependencerc and turns the update result into a pull request:

name: Update dependencies

on:
  schedule:
    - cron: "0 9 * * 1"
  workflow_dispatch:

jobs:
  dependencies:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: yowainwright/codependence@v1
        with:
          targets: pnpm
          version: 11.21.0
          pull-request: true
          token: ${{ secrets.CODEPENDENCE_TOKEN }}
          post-update-command: pnpm install

`config`

Type: Record<string, CodependenceManifest>

Each key identifies one manifest. Every entry requires a direct path and a manager; name is optional. Policy fields apply only to that manifest.

{
+  "config": {
+    "web": {
+      "name": "@project/web",
+      "path": "packages/web/package.json",
+      "manager": "pnpm",
+      "codependencies": ["typescript"]
+    },
+    "actions": {
+      "path": ".github/workflows/update.yml",
+      "manager": "github-actions",
+      "mode": "precise"
+    }
+  }
}

`codependencies`

Type: Array<string | Record<string, string>> Default: undefined

Defines the packages controlled by policy. String entries name a package; object entries name a package with an exact version or range. In verbose mode, listed packages are checked or updated. In precise mode, listed packages are held back while the rest can update.

{
+  "codependencies": ["lodash", { "react": "^19.0.0" }]
}

Check or update only listed packages:

{
+  "mode": "verbose",
+  "codependencies": ["lodash"],
+  "update": true
}

codependence --mode verbose --codependencies lodash --update

 "dependencies": {
-  "lodash": "^4.17.20",
+  "lodash": "^4.17.21",
   "react": "^19.0.0"
 }

Pin listed packages and update the rest:

{
+  "mode": "precise",
+  "codependencies": [{ "react": "^19.0.0" }],
+  "update": true
}

codependence --mode precise --codependencies react --update

 "dependencies": {
   "react": "^19.0.0",
-  "lodash": "^4.17.20"
+  "lodash": "^4.17.21"
 }

Note

--codependencies accepts package names. Use config when a package needs an exact version or range.

Manifest fields

Define the manifest file, dependency manager, and optional name.

{
+  "config": {
+    "web": {
+      "path": "packages/web/package.json",
+      "manager": "pnpm",
+      "name": "@project/web"
+    }
+  }
}

`update`

Type: boolean Default: false

Applies approved dependency changes to manifest files. When false, Codependence only checks and reports.

{
+  "update": true
}

Run the same behavior from the CLI:

codependence --update

With mode: "precise", listed packages stay pinned and unlisted packages can update.

{
+  "mode": "precise",
+  "codependencies": [{ "react": "^19.0.0" }],
+  "update": true
}

 "dependencies": {
   "react": "^19.0.0",
-  "lodash": "^4.17.20"
+  "lodash": "^4.17.21"
 }

Note

Use dryRun: true or --dryRun to preview the same update without writing files.

`rootDir`

Type: string Default: "./"

Set the manifest search directory. The default is "./".

{
+  "rootDir": "packages/web"
}

`ignore`

Type: Array<string>

Provide glob patterns to skip. An explicit array replaces the default ignores.

{
+  // Replaces the default ignore patterns.
+  "ignore": ["examples/**", "fixtures/**"]
}

`debug`

Type: boolean Default: false

Enable diagnostic logging. The default is false.

{
+  "debug": true
}

`silent`

Type: boolean Default: false

Suppress normal output while preserving errors. The default is false.

{
+  "silent": true
}

`--config`

Type: string Default: undefined

Use a specific configuration file instead of auto-discovery.

codependence --config ./config/.codependencerc

`searchPath`

Type: string Default: undefined

Set where configuration discovery starts.

codependence --searchPath ./services/api

`yarnConfig`

Type: boolean Default: false

Enable Yarn configuration support. The default is false.

codependence --yarnConfig

`permissive`

Type: boolean Default: undefined

Treats listed codependencies as pins. When true, Codependence holds those packages back and updates everything else. This is equivalent to mode: "precise".

{
+  "permissive": true,
+  "codependencies": ["react"],
+  "update": true
}

Run the same behavior from the CLI:

codependence --permissive --codependencies react --update

The listed package stays unchanged while unlisted packages can update:

 "dependencies": {
   "react": "^19.0.0",
-  "lodash": "^4.17.20"
+  "lodash": "^4.17.21"
 }

Note

Prefer mode: "precise" in new config. permissive remains supported for compatibility.

`level`

Type: "patch" | "minor" | "major" Default: "major"

Limits how far an approved update can move. patch stays within the same minor version, minor stays within the same major version, and major allows any version change.

{
+  "level": "minor",
+  "update": true
}

Run the same behavior from the CLI:

codependence --level minor --update

With level: "minor", a minor update can apply:

 "dependencies": {
-  "example-lib": "^1.2.0"
+  "example-lib": "^1.3.0"
 }

A major update is skipped by the same policy:

 "dependencies": {
   "example-lib": "^1.2.0"
 }

Note

Exact-version providers can ignore semver level gates when their versions do not follow semver.

`mode`

Type: "verbose" | "precise" Default: inferred from codependencies and permissive

Controls how codependencies is interpreted. verbose means "only work on the listed packages." precise means "hold back the listed packages and work on everything else."

{
+  "mode": "verbose"
}

Use verbose to update only the listed package:

{
+  "mode": "verbose",
+  "codependencies": ["lodash"],
+  "update": true
}

codependence --mode verbose --codependencies lodash --update

 "dependencies": {
-  "lodash": "^4.17.20",
+  "lodash": "^4.17.21",
   "react": "^19.0.0"
 }

Use precise to pin the listed package and update the rest:

{
+  "mode": "precise",
+  "codependencies": ["react"],
+  "update": true
}

codependence --mode precise --codependencies react --update

 "dependencies": {
   "react": "^19.0.0",
-  "lodash": "^4.17.20"
+  "lodash": "^4.17.21"
 }

Note

If mode is omitted, Codependence defaults to verbose when codependencies are listed and precise when no codependencies are listed.

`dryRun`

Type: boolean Default: false

Shows what update would change without writing manifest or lockfile changes.

{
+  "update": true,
+  "dryRun": true
}

Run the same behavior from the CLI:

codependence --update --dryRun

Previewing an update reports the same candidate change without applying it:

 "dependencies": {
   "react": "^19.0.0",
-  "lodash": "^4.17.20"
+  "lodash": "^4.17.21"
 }

`interactive`

Type: boolean Default: false

Prompts you to choose which update candidates to apply. It only runs with update: true; dryRun skips the prompt because no files are written.

{
+  "update": true,
+  "interactive": true
}

Run the same behavior from the CLI:

codependence --update --interactive

The CLI prompts for the packages to update:

Select packages to update:

Selected packages update; unselected packages stay unchanged.

 "dependencies": {
-  "lodash": "^4.17.20",
+  "lodash": "^4.17.21",
   "react": "^19.0.0"
 }

`watch`

Type: boolean Default: false

Runs Codependence continuously from the CLI. It checks immediately, then re-checks the configured targets every 30 seconds until stopped.

{
+  "watch": true
}

Run the same behavior from the CLI:

codependence --watch

Watch mode prints the active loop and each check result:

Watch mode enabled - checking every 30 seconds...
Press Ctrl+C to stop

[10:15:30 AM] Checking dependencies...
All dependencies checked (10:15:30 AM)

If a check is still running when the next interval starts, Codependence skips that interval.

`noCache`

Type: boolean Default: false

Bypasses the in-memory version cache for registry lookups. Use it when you need fresh dependency metadata during a run.

{
+  "noCache": true
}

Run the same behavior from the CLI:

codependence --noCache

The check resolves versions from the provider instead of reusing cached results:

No cache hits (first run)

`format`

Type: "json" | "markdown" | "table" Default: undefined

Controls structured CLI output. When set, Codependence prints the selected format instead of the normal spinner output.

{
+  "format": "json"
}

Run the same behavior from the CLI:

codependence --format json

JSON output includes the status, exit code, dependency list, and summary:

{
  "status": "outdated",
  "exitCode": 1,
  "dependencies": [
    {
      "package": "lodash",
      "current": "4.17.20",
      "latest": "4.17.21",
      "isPinned": true,
      "severity": "patch",
      "canAutoUpdate": true
    }
  ],
  "summary": {
    "totalPackages": 1,
    "outdated": 1,
    "upToDate": 0
  }
}

Use markdown for PR comments and table for terminal-readable output.

`outputFile`

Type: string Default: undefined

Writes formatted output to a file instead of stdout. Use it with format.

{
+  "format": "json",
+  "outputFile": "dependency-report.json"
}

Run the same behavior from the CLI:

codependence --format json --outputFile dependency-report.json

The CLI writes the report and prints the destination:

Output written to dependency-report.json

CI

GitHub Actions

The GitHub Action runs the same policy as the CLI from a workflow.

`init actions [managers...]`

Type: command Default: all configured manager areas

Generates scheduled workflow files from the configured manifests. Existing generated files are preserved unless --force is provided.

codependence init actions

The command creates stable workflow files for Node, Python, Go, Rust, Docker, and infrastructure targets such as GitHub Actions and Helm. Docker gets its own update-dependencies/docker pull-request branch.

`uses: yowainwright/codependence@v1`

Type: GitHub Action Default: check mode

Runs the configured policy without repeating it in workflow YAML.

- uses: actions/checkout@v4
- uses: yowainwright/codependence@v1

If dependencies are outdated, the action fails by default and sets outdated.

outdated: "true"

`targets`

Type: Array<"bun" | "npm" | "pnpm" | "yarn" | "go" | "rust" | "uv" | "docker" | "github-actions" | "helm"> Default: undefined

Limits the action to configured manager targets. Versioned targets need an exact tool version unless a Node package-manager version can be inferred from package.json.

 - uses: yowainwright/codependence@v1
   with:
+    targets: pnpm
+    version: 11.21.0

`version`

Type: string | Record<"bun" | "npm" | "pnpm" | "yarn" | "go" | "rust" | "uv", string> Default: inferred for Node package managers when possible

Pins the tool version installed before Codependence runs. Use one exact version for one versioned target, or manager=version entries for multiple targets.

 - uses: yowainwright/codependence@v1
   with:
+    targets: |
+      bun
+      go
+    version: |
+      bun=1.3.14
+      go=1.24.5

Invalid or missing versions fail before dependency checks run.

::error::pnpm requires an exact version

`with: Partial<Options>`

Type: Partial<Options> Default: CLI defaults

The action forwards policy inputs to the CLI, including codependencies, config, files, update, dryRun, permissive, mode, level, language, rootDir, ignore, silent, debug, yarnConfig, noCache, format, outputFile, and lockfile.

 - uses: yowainwright/codependence@v1
   with:
+    mode: precise
+    codependencies: react
+    update: true

This holds react back and updates the rest:

 "dependencies": {
   "react": "^19.0.0",
-  "lodash": "^4.17.20"
+  "lodash": "^4.17.21"
 }

`pull-request`

Type: "true" | "false" Default: "false"

Creates or updates a stable pull request for the selected targets. PR mode requires schedule or workflow_dispatch, targets, token, post-update-command, and a clean checkout.

 - uses: yowainwright/codependence@v1
   with:
+    targets: go
+    version: 1.24.5
+    pull-request: true
+    token: ${{ secrets.CODEPENDENCE_TOKEN }}
+    post-update-command: go mod tidy

The action exposes the created or updated pull request URL:

pull-request-url: "https://github.com/org/repo/pull/123"

`token` / `branch-prefix` / `draft`

Type: { token?: string; "branch-prefix"?: string; draft?: "true" | "false" } Default: undefined for token, "update-dependencies" for branch-prefix, "false" for draft

Configures pull-request creation. token must be a fine-grained PAT; branch-prefix controls the stable update branch; draft creates the pull request as a draft.

 - uses: yowainwright/codependence@v1
   with:
+    token: ${{ secrets.CODEPENDENCE_TOKEN }}
+    branch-prefix: update-dependencies
+    draft: true

`post-update-command`

Type: string Default: undefined

Runs after dependency files are edited in PR mode. Use it to regenerate lockfiles and any committed derived files.

 - uses: yowainwright/codependence@v1
   with:
+    post-update-command: pnpm install

`dockerhub-` / `ghcr-`

Type: Partial<Record<"dockerhub-username" | "dockerhub-token" | "ghcr-username" | "ghcr-token", string>> Default: undefined

Private Docker Hub images use dockerhub-username and dockerhub-token. Private GHCR images use ghcr-username and ghcr-token.

 - uses: yowainwright/codependence@v1
   with:
+    targets: docker
+    dockerhub-username: ${{ vars.DOCKERHUB_USERNAME }}
+    dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+    ghcr-username: ${{ github.actor }}
+    ghcr-token: ${{ secrets.GITHUB_TOKEN }}

`fail-on-outdated`

Type: "true" | "false" Default: "true"

Controls whether outdated dependencies fail the workflow. Set it to false when a later workflow step reads the outdated output.

 - uses: yowainwright/codependence@v1
+  id: deps
   with:
+    fail-on-outdated: false

The action can report outdated dependencies without failing the job:

outdated: "true"

`outdated` / `pull-request-url`

Type: { outdated: "true" | "false"; "pull-request-url"?: string } Default: undefined

The action exposes outdated for dependency status and pull-request-url when PR mode creates or updates a pull request.

steps.deps.outputs.outdated: "true"
steps.deps.outputs.pull-request-url: "https://github.com/org/repo/pull/123"

See the GitHub Action guide for lockfile policy and PAT permissions.

JavaScript server-side API

The Node API runs the same dependency policy from JavaScript or TypeScript.

`checkFiles(options?: CheckFiles)`

Type: (options?: CheckFiles) => Promise<VersionDiff[] | void> Default: {}

Checks the selected manifests. It throws when dependencies are out of date unless format or deferFailure is set.

 import { checkFiles } from "codependence";

 const diffs = await checkFiles({
+  mode: "verbose",
+  codependencies: ["lodash"],
+  format: "json",
 });

When diffs are collected, the call returns VersionDiff[].

[
  {
    package: "lodash",
    current: "4.17.20",
    latest: "4.17.21",
    isPinned: true,
    willUpdate: false,
  },
];

`codependence(options?: CheckFiles)`

Type: typeof checkFiles Default: {}

Alias for checkFiles. Use it when the call is intended to run a full Codependence policy rather than only inspect files.

 import { codependence } from "codependence";

 await codependence({
+  mode: "precise",
+  codependencies: ["react"],
+  update: true,
 });

This holds react back and writes the allowed update:

 "dependencies": {
   "react": "^19.0.0",
-  "lodash": "^4.17.20"
+  "lodash": "^4.17.21"
 }

`script(options?: CheckFiles)`

Type: (options?: CheckFiles) => Promise<void> Default: {}

Runs checkFiles and resolves without rethrowing checkFiles failures. Use checkFiles directly when the caller needs to handle failures.

 import { script } from "codependence";

 await script({
+  codependencies: ["lodash"],
 });

`schema`

Type: object Default: Codependence JSON schema

Exports the configuration schema used by Codependence.

import { schema } from "codependence";

`onProgress`

Type: (current: number, total: number, packageName: string) => void Default: undefined

Receives version-resolution progress while package metadata is fetched.

 await checkFiles({
+  codependencies: ["lodash", "react"],
+  onProgress: (current, total, packageName) => {
+    process.stdout.write(`${current}/${total} ${packageName}\n`);
+  },
 });

`deferFailure`

Type: boolean Default: false

Returns outdated diff data without throwing immediately. Pair it with format when the caller needs machine-readable results.

 const diffs = await checkFiles({
+  codependencies: ["lodash"],
+  format: "json",
+  deferFailure: true,
 });

Recipes

Read below to see different ways Codependence might help you!

Check deps without a config

Use CLI policy flags for a temporary check:

codependence --codependencies 'lodash' '{ "fs-extra": "10.0.1" }'

Match packages by name

Use * at the end of a package name to match a group:

codependence --codependencies '@foo/*' --update

Pin selected packages and update the rest

List the packages that should stay pinned

codependence --permissive --codependencies 'react' 'lodash' --update

Configure multiple manifests

You can configure multiple project manifests via a single or multiple codependence policy files.

Use a skey for each manifest.
name can distinguish manifests in the same directory.

{
  "config": {
    "web": {
      "name": "@project/web",
      "path": "packages/web/package.json",
      "manager": "pnpm",
      "mode": "precise"
-    }
+    },
+    "api": {
+      "path": "services/api/go.mod",
+      "manager": "go",
+      "mode": "precise"
+    }
  }
}

Multi-language, multi-package manager support (experimental)

Declare each ecosystem through a manifest entry in .codependencerc. The --language flag remains available for one-off runs:

codependence --language python

Use one supported language per run: nodejs, python, go, rust, docker, github-actions, or helm.

Supported managers

Languages

Language manifest updates

Non-Node providers remain experimental, but all managers can share one config dictionary.

Python requirements updates preserve comments, markers, hashes, and include directives.

Unversioned and URL-based requirements are left unchanged. After updating manifests, regenerate and commit ecosystem lockfiles with their native package managers.

Language	Package managers	Status	Manifest files
JavaScript	bun npm pnpm yarn	Supported	`package.json`
Python	conda pip pipenv poetry uv	Experimental	`requirements.txt`, `pyproject.toml`, `Pipfile`, `environment.yml`
Go	golang	Experimental	`go.mod`
Rust	cargo	Experimental	`Cargo.toml`

Operations

Containers	CI	Infrastructure
docker Experimental `Dockerfile`	github-actions Experimental `.github/workflows/.yml`, `.github/workflows/.yaml`	helm Experimental `Chart.yaml`, `**/Chart.yaml`

Note

Docker support is experimental.

The Docker provider supports explicit pins, latest tag resolution, and mode: "precise" for Docker Hub and GHCR images.

Tag resolution:

Selects the highest stable numeric tag that is at least as specific as the current tag and preserves its exact prefix and suffix. For example, 20-slim remains in the -slim family, and 3.19 does not switch to a date tag.
Resolves repeated images with different tag families independently.
Resolves FROM tags assembled from one Docker ARG without changing the composition.
Leaves digest-pinned images, scratch stages, unresolved variables, and unsupported registries unchanged.
Fails on mutable tags such as latest instead of guessing a version.

For authenticated registry access, set DOCKERHUB_USERNAME and DOCKERHUB_TOKEN for Docker Hub, or GHCR_USERNAME and GHCR_TOKEN for GHCR. Both GHCR values are required. Docker Hub PATs should be read-only; private GHCR packages require read:packages access.

Note

GitHub Actions support is experimental.

The GitHub Actions provider supports explicit pins, latest release resolution, and mode: "precise".

Latest versions resolve to immutable commit SHAs, and existing version comments are refreshed with the release tag.
Local and Docker actions remain unchanged.
Authenticated lookups use GITHUB_TOKEN or GH_TOKEN when available.
For private GHCR packages, the action falls back to its workflow token and retries anonymously when GHCR rejects that token for a public package.

Note

Helm support is experimental.

The Helm provider checks Chart.yaml dependency entries and updates explicit object pins in mode: "verbose". It ignores appVersion, local file:// dependencies, templates, digest refs, and dependencies without a version.

Note

Execution options such as update, dryRun, format, and noCache stay at the root.

Use --target pnpm or --target go to run only entries for those managers.

Policy Surface

Codependence currently focuses on package manifests and dependency sections. The same policy model can expand to other version surfaces over time.

Surface	Status	Purpose
`package.json` dependencies	Supported	Enforce dependency policy in Node.js projects and monorepos
Python, Go, and Rust manifests	Experimental	Apply the same check/update workflow outside Node.js
Dockerfiles	Experimental	Check base image versions
GitHub Actions workflows	Experimental	Check action refs in workflow YAML
Helm charts	Experimental	Check chart dependency versions in `Chart.yaml`
Local repository scans	Roadmap	Report drift across a directory of projects, such as `~/code`
Toolchain files	Roadmap	Keep `.nvmrc`, `.node-version`, `.tool-versions`, and `.mise.toml` aligned
Compose and other CI YAML	Roadmap	Check service images, actions, and runtime versions in pipeline files

Note

Codependencies are project dependencies that must stay current or match a specified version.

When a manifest cannot use latest directly, Codependence writes the resolved version required by its policy. Exact versions and supported ranges remain explicit in .codependencerc.

Why use Codependence?

Codependence is focused on one job: enforcing dependency version policy where your code actually runs.

Traditional dependency PRs vs. Codependence

Traditional providers optimize for immediate update discovery. Codependence optimizes for one intentional policy check.

Traditional providers	Codependence
Open PRs as dependency versions appear	Runs when the team chooses
Create a stream of provider-specific work	Reads one policy across supported manifests
Leave triage cadence to engineers	Produces one reviewable policy-driven change

Codependence flow:

flowchart LR
  Policy[Policy] --> Manifests[Manifests]
  Manifests --> Check[Check drift]
  Check --> Diff[One batched diff]

Read .codependencerc and target manifests.
Resolve only the versions allowed by policy.
Fail CI on drift or write one batched update diff.

It gives teams a small, explicit policy for versions that must stay current or pinned.
It can fail CI when dependency versions drift.
It can update only listed packages, or update everything except listed packages.
It manages multiple dependency managers and monorepo scopes from one .codependencerc.
It runs locally, from npm scripts, in GitHub Actions, or in other CI providers.
It exposes a Node API for custom workflows and internal tooling.

Why not use Codependence?

Codependence isn't for everybody or every repository. Here are some reasons why it might not be for you!

You only need hosted dependency PRs and are happy with Dependabot or Renovate.
You do not need local or CI enforcement for version drift.
You prefer manually pinning versions without automated checks.
You do not need package-specific or workspace-specific dependency policy.

Demos

In Action!

Codependence Cron: Codependence running off a GitHub Action cron job.
Codependence Monorepo: Codependence monorepo example.

Debugging

`private packages`

If there is a .npmrc file, there is no issue with Codependence monitoring private packages. However, if a yarn config is used, Codependence must be instructed to run version checks differently.

Fixes

With the CLI, add the --yarnConfig option.
With Node.js, add yarnConfig: true to your options or your config.
For other private package issues, submit an issue or pull request.

Development

The repository uses Node.js 26 and pnpm 11. mise installs the pinned development tools.

mise install
pnpm install
pnpm test

Release Strategy

Codependence publishes securely to npm with trusted publishing, provenance attestations, and immutable GitHub release assets. Stable releases also publish an audited, SHA256-pinned Homebrew formula through a protected environment and reviewed tap pull request.

0.3.1 compatibility

The v1 CLI keeps the final pre-1.0 contract from 0.3.1: the codependence and cdp binaries, pre-1.0 CLI flags, flat and embedded package.json policy, and listed-only codependencies behavior. The named script export retains the pre-1.0 non-throwing API. Use checkFiles or codependence when callers need v1 errors and version-diff results.

Contributing

Contributing is straightforward.

Issues

Include context and reproduction steps.
Submit a pull request when appropriate.

Pull Requests

Add a test or explain why one is not needed.
Update the README when behavior or documentation changes.
Use the pull request template.

Thank you!

Shoutouts

Thanks to Dev Wells and Steve Cox for the aligned code leading to this project. Thanks Navid for some great insights to improve the API!

Made by @yowainwright, MIT 2022-present

Name		Name	Last commit message	Last commit date
.github		.github
page		page
scripts		scripts
src		src
tests		tests
.codependencerc		.codependencerc
.dockerignore		.dockerignore
.editorconfig		.editorconfig
.env.example		.env.example
.gitattributes		.gitattributes
.gitignore		.gitignore
.mise.toml		.mise.toml
.oxlintrc.json		.oxlintrc.json
.release-it.cjs		.release-it.cjs
LICENSE		LICENSE
README.md		README.md
action.yml		action.yml
bun.lock		bun.lock
codecov.yml		codecov.yml
package.json		package.json
pnpm-lock.yaml		pnpm-lock.yaml
pnpm-workspace.yaml		pnpm-workspace.yaml
tsconfig.json		tsconfig.json
turbo.json		turbo.json

Latest commit

History

Folders and files

Repository files navigation

Codependence

One configuration for every dependency manager.

Main use case

Pin what matters and update the rest

Install

Runtime support

Configuration

What init does

Seemless Maintenance

CLI

Init

Option Reference

From policy to result

config

codependencies

Manifest fields

update

rootDir

ignore

debug

silent

--config

searchPath

yarnConfig

permissive

level

mode

dryRun

interactive

watch

noCache

format

outputFile

CI

GitHub Actions

init actions [managers...]

uses: yowainwright/codependence@v1

targets

version

with: Partial<Options>

pull-request

token / branch-prefix / draft

post-update-command

dockerhub-* / ghcr-*

fail-on-outdated

outdated / pull-request-url

JavaScript server-side API

checkFiles(options?: CheckFiles)

codependence(options?: CheckFiles)

script(options?: CheckFiles)

schema

onProgress

deferFailure

Recipes

Check deps without a config

Match packages by name

Pin selected packages and update the rest

Configure multiple manifests

Multi-language, multi-package manager support (experimental)

Supported managers

Languages

Language manifest updates

Operations

Policy Surface

Codependencies are project dependencies that must stay current or match a specified version.

Why use Codependence?

Traditional dependency PRs vs. Codependence

Why not use Codependence?

Demos

Debugging

private packages

Fixes

Development

Release Strategy

0.3.1 compatibility

Contributing

What `init` does

`config`

`codependencies`

`update`

`rootDir`

`ignore`

`debug`

`silent`

`--config`

`searchPath`

`yarnConfig`

`permissive`

`level`

`mode`

`dryRun`

`interactive`

`watch`

`noCache`

`format`

`outputFile`

`init actions [managers...]`

`uses: yowainwright/codependence@v1`

`targets`

`version`

`with: Partial<Options>`

`pull-request`

`token` / `branch-prefix` / `draft`

`post-update-command`

`dockerhub-` / `ghcr-`

`fail-on-outdated`

`outdated` / `pull-request-url`

`checkFiles(options?: CheckFiles)`

`codependence(options?: CheckFiles)`

`script(options?: CheckFiles)`

`schema`

`onProgress`

`deferFailure`

`private packages`