DepMatrix
Know before you upgrade.
Simulate a dependency upgrade before you commit to it. Drop in a manifest and see the breaking changes, CVEs, licence problems and compatibility issues across Node, PHP, Python, Go and Java — free, with no sign-up to start.
Made for Engineers, Platform teams, Tech leads, Consultancies
- react-dom18.3.1 → 19.0.0Breaking: ReactDOM.render removed
- next14.2.5 → 15.0.3Breaking: request APIs are now async
- @testing-library/react14.3.1 → 16.0.1Needs @testing-library/dom as a peer
- Breaking
- 3
- CVEs resolved
- 1
- Licence changes
- 0
Why it exists
An upgrade looks free right up until the moment you run it. The version number moved by one, the changelog says “minor internal changes”, and the diff in your lockfile is four thousand lines you did not write and will not read.
So the decision gets made the expensive way. You bump it, you push it, CI goes red or — worse — CI goes green and something breaks in staging a week later, and now the question is whether to fix forward or unpick an upgrade that six other packages have already resolved against.
DepMatrix moves that discovery earlier. Give it the manifest and it simulates the upgrade: what breaks, which CVEs you would inherit or shed, which licences changed while you were not looking, and whether the engine version you are targeting is survivable. It is free to start and needs no account, because a tool you have to sign up for in order to evaluate is a tool you evaluate later.
Manifest in, answers out.
Upload a manifest
Drop in package.json, composer.json, requirements.txt, go.mod, pom.xml or build.gradle — or paste the contents straight in. No account needed to run the first analysis.
Analyse the dependencies
Metadata is pulled from the registries and cross-checked against vulnerability data, so what you are looking at reflects what would actually resolve rather than what you declared.
Review the risks
CVEs, breaking changes and licence issues in one view, per dependency, while the upgrade is still a hypothesis rather than a merged commit.
Export and share
Download an optimised manifest, or share the report with the people who have to sign the upgrade off. The argument goes better with a document.
What it does
- Upgrade simulation
- See what a version bump does before you make it. The whole point is to find the breaking change in a browser tab, not in CI on a Friday.
- CVE detection
- Known vulnerabilities surfaced per dependency in the same pass, so security is not a separate tool and a separate afternoon.
- Breaking-change alerts
- Flags the upgrades that will not be a drop-in — which is what lets you merge the ones that are without ceremony.
- AI changelog analysis
- Reads a dependency's changelog and tells you what it means for your code, instead of leaving you to diff release notes across six minor versions.
- Engine version simulator
- Check a runtime or engine version change against the whole tree before committing to it — usually the upgrade with the widest blast radius.
- Licence assessment
- Per-manifest licence review, so a relicensing event four levels deep does not turn into a legal question the week you ship.
Details
- Ecosystems
- npm · Composer · pip · Go · Maven · Gradle
- Also on Pro
- NuGet
- Input
- Upload a manifest or paste it
- Guest
- Free — npm analysis, no account
- Free account
- npm · Composer · pip · 5 saved reports
- Pro
- $79/year · 450 credits a month
- Extra credits
- $10 for 500, one-off
- Output
- Optimised manifest · shareable report
Questions
Do I need an account?
No. Guest mode analyses package.json with no sign-up at all. A free account adds Composer and Python, saved reports, sharing and manifest export.
Which ecosystems are supported?
npm, Composer, pip, Go modules, Maven and Gradle, plus NuGet on Pro. If it has a manifest and a registry, it is in scope.
What are credits for?
The per-dependency work: AI changelog analysis costs one credit per dependency, licence assessment one credit per manifest. Package analysis itself is free on every tier. Pro includes 450 credits a month, and another 500 are $10 as a one-off rather than a subscription.
Does this replace Dependabot or Renovate?
No — it answers a different question. Those tell you an upgrade exists and open the pull request. DepMatrix tells you what that upgrade will break before you take it. They work well together.
What if I only want to check one package?
Paste a manifest with just that dependency in it. The analysis is per manifest, so a one-line file is a perfectly valid input.