DepMatrix
Know before you upgrade.
Simulate a dependency upgrade before you commit to it. Drop in a manifest and see the breaking changes, CVEs, licence problems and compatibility issues across Node, PHP, Python, Go and Java — free, with no sign-up to start.
- built for
- Engineers
- Platform teams
- Tech leads
- Consultancies
Why this exists
Why DepMatrix exists
An upgrade looks free right up until the moment you run it. The version number moved by one, the changelog says “minor internal changes”, and the diff in your lockfile is four thousand lines you did not write and will not read.
So the decision gets made the expensive way. You bump it, you push it, CI goes red or — worse — CI goes green and something breaks in staging a week later, and now the question is whether to fix forward or unpick an upgrade that six other packages have already resolved against.
DepMatrix moves that discovery earlier. Give it the manifest and it simulates the upgrade: what breaks, which CVEs you would inherit or shed, which licences changed while you were not looking, and whether the engine version you are targeting is survivable. It is free to start and needs no account, because a tool you have to sign up for in order to evaluate is a tool you evaluate later.
How it works
Manifest in, answers out.
Upload a manifest
Drop in package.json, composer.json, requirements.txt, go.mod, pom.xml or build.gradle — or paste the contents straight in. No account needed to run the first analysis.
Analyse the dependencies
Metadata is pulled from the registries and cross-checked against vulnerability data, so what you are looking at reflects what would actually resolve rather than what you declared.
Review the risks
CVEs, breaking changes and licence issues in one view, per dependency, while the upgrade is still a hypothesis rather than a merged commit.
Export and share
Download an optimised manifest, or share the report with the people who have to sign the upgrade off. The argument goes better with a document.
Capabilities
What it actually does.
Upgrade simulation
See what a version bump does before you make it. The whole point is to find the breaking change in a browser tab, not in CI on a Friday.
CVE detection
Known vulnerabilities surfaced per dependency in the same pass, so security is not a separate tool and a separate afternoon.
Breaking-change alerts
Flags the upgrades that will not be a drop-in — which is what lets you merge the ones that are without ceremony.
AI changelog analysis
Reads a dependency's changelog and tells you what it means for your code, instead of leaving you to diff release notes across six minor versions.
Engine version simulator
Check a runtime or engine version change against the whole tree before committing to it — usually the upgrade with the widest blast radius.
Licence assessment
Per-manifest licence review, so a relicensing event four levels deep does not turn into a legal question the week you ship.
Under the hood
Specifications.
- Ecosystems
- npm · Composer · pip · Go · Maven · Gradle
- Also on Pro
- NuGet
- Input
- Upload a manifest or paste it
- Guest
- Free — npm analysis, no account
- Free account
- npm · Composer · pip · 5 saved reports
- Pro
- $79/year · 450 credits a month
- Extra credits
- $10 for 500, one-off
- Output
- Optimised manifest · shareable report
Questions
The ones people actually ask.
Do I need an account?
No. Guest mode analyses package.json with no sign-up at all. A free account adds Composer and Python, saved reports, sharing and manifest export.
Which ecosystems are supported?
npm, Composer, pip, Go modules, Maven and Gradle, plus NuGet on Pro. If it has a manifest and a registry, it is in scope.
What are credits for?
The per-dependency work: AI changelog analysis costs one credit per dependency, licence assessment one credit per manifest. Package analysis itself is free on every tier. Pro includes 450 credits a month, and another 500 are $10 as a one-off rather than a subscription.
Does this replace Dependabot or Renovate?
No — it answers a different question. Those tell you an upgrade exists and open the pull request. DepMatrix tells you what that upgrade will break before you take it. They work well together.
What if I only want to check one package?
Paste a manifest with just that dependency in it. The analysis is per manifest, so a one-line file is a perfectly valid input.