Dependency maintenance for AI-built apps
pinwise reads your lockfile, picks the version that has survived 14 days in public, writes the ticket, and hands it to Claude Code, Cursor or Codex over MCP. Green only when a rescan proves the lockfile moved.
Fresh releases are where supply-chain attacks land. We only recommend versions that have been public for 14 days. You choose the window.
9 more packages are at their safe target.
The safe target is the newest stable release that has been public for at least 14 days. Fresh releases are where supply-chain attacks land, so the ecosystem gets time to notice. You choose the window.
Renovate and pnpm can enforce a minimum age. pinwise also tells you what changed, what breaks, and files the work.
10bumps5tickets
Not a pull request per bump. 10 outdated packages in this scan became 5 tickets, in dependency order, with the breaking changes for this repo already researched. Your agent reads one and starts typing.
# TDB-0001 · Close the Next.js middleware auth bypass Target released 2026-09-12; past the 14-day safe window. ## Advisories- GHSA-f82v-jwr5-mffw / CVE-2025-29927 (critical): middleware auth bypass via x-middleware-subrequest. Fixed in 14.2.25. ## Breaking changes for this repoNone on the 14.2 line. ## Files touchedmiddleware.ts · next.config.mjs · app/layout.tsx ## Work plan1. Pin next@14.2.33 in package.json.2. pnpm install; commit the regenerated lockfile.3. Add a test for a spoofed x-middleware-subrequest header. ## Test rulesNever delete, skip or loosen a test. Justify every change. ## Acceptance- [ ] lockfile resolves next@14.2.33- [ ] no advisories for next on rescan- [ ] middleware tests pass unchanged ## Report- next@14.2.3
+ next@14.2.33$ pnpm test
$ pnpm lint
$ pnpm typecheck
$ pnpm build
Test Files 42 passed (42)
Tests 318 passed (318)middleware.test.tsAdded a case for a spoofed x-middleware-subrequest header (CVE-2025-29927).$149 / month for up to 100 repos, with client workspaces and branded reports.
See the Agency plan| Repo | Score | Week | Open |
|---|---|---|---|
| vibehaus/storefront | 39Rotting | −6 | 5 |
| lumen/clinic-portal | 58Drifting | +4 | 3 |
| northwind/shop | 74Drifting | +11 | 2 |
| fieldnotes/app | 91Healthy | ±0 | 0 |
Sample digest. Scores use the same scorer as the public report.
No card for Free. Annual billing gets two months free. Agencies get their own plan.
$0/ mo
1 repo
See what is rotting.
$15/ mo
5 repos
Your agent works the queue.
$59/ mo
25 repos
A small team, many repos.
$149/ mo
100 repos
Thirty client repos, one digest.
Anything else: the ticket docs and the security page go deeper.
No. The GitHub App has read-only access to manifests and lockfiles. We never open pull requests, never push, and never run your code. Your agent makes the change on your machine; we only read the result.
Permissions and data handlingAnything that speaks MCP: Claude Code, Cursor, Codex, Copilot and Windsurf. One config block, then the agent can list, start and complete tickets itself.
MCP setup per agentSupported through the read-only GitHub App, on the repos you select. The free scanner on this page is for public repos only.
Fewer, researched, prioritised tickets instead of a pull request per bump; a safe window so you never land on a release younger than 14 days; verification by rescan; and an interface built for coding agents.
npm, pnpm and yarn lockfiles, PyPI, crates.io, Go modules, the Node runtime from .nvmrc or engines, and GitHub Actions pins. Anything else we detect is listed for manual review.
Manifests, lockfiles and scan results. Never source code. pinwise has no use for it and no way to run it.
Privacy policyYes, on Studio and above, along with GitHub Issues. Status syncs from us to Linear: when a rescan verifies the fix, the Linear issue closes too.
Compare plansPublic repos, about twenty seconds, nothing stored but manifests and lockfiles. The first ticket is on the house.