Use Emendant alongside Dependabot

Are there tools like Dependabot that handle breaking API changes?

Yes. For supported TypeScript and JavaScript migrations, Emendant can complement Dependabot by finding affected source code and offering possible migration patches. Use Dependabot to propose the dependency update, then use Emendant to inspect supported API changes at specific call sites. Review the patches and run your project’s checks before merging.

Emendant covers changes in its feed. It does not cover every package or every breaking change, and it does not update dependency versions. Check supported projects and releases before you start.

What each tool contributes

Work	Dependabot	Emendant
Propose dependency updates	Opens version-update and security-update PRs.	Reads dependency versions to select relevant feed changes.
Help review an upgrade	Includes release notes and changelog information. Security updates may include a compatibility score.	Links supported changes to affected source locations and release evidence.
Prepare source changes	Review the update PR and its checks to assess compatibility.	Offers eligible deterministic patches; assisted fixes need a selected model provider. Some findings have no patch.
Check the result	GitHub recommends automated tests and acceptance checks before merging an update PR.	Runs discovered or configured typecheck and test commands against a patched copy when available, and reports the evidence grade.

GitHub documents version updates, Dependabot PRs, and security-update compatibility scores. A compatibility score reflects CI results from other public repositories for the same security update. It does not establish that your application’s API use is correct.

This workflow uses the Dependabot PR and the Emendant CLI together. You run the CLI in your checkout; this guide does not require a hosted integration.

1. Inspect the proposed dependency update

Read the Dependabot PR’s manifest and lockfile diff. Note the package, old version, target version, and any related provider packages that must move together. Read the upstream release notes and migration instructions for the releases you cross.

Use the relevant AI SDK, OpenAI Node SDK, or LangChain.js migration hub when covered. Emendant can report changes beyond the PR’s target version, so compare each finding’s release with that target.

2. Scan the supported source code

Run from the repository root, with Node.js 20 or later. Refresh the feed explicitly, then scan the package being updated. For example, for an openai update:

npx emendant feed update
npx emendant scan --package openai

On the base branch, before the version update, the default scan reports relevant changes ahead of the installed version as pending.

If you have checked out the Dependabot branch and its lockfile already names the new release, include adopted changes:

npx emendant scan --package openai --adopted

This includes old API uses even when the dependency version has already crossed the change’s release. An adopted finding can also be intentional compatibility code, so inspect it before editing. If Emendant cannot determine a version precisely, review the reported placement rather than assuming the finding applies to this update.

Read coverage warnings as well as findings. Exit code 1 means findings were reported; 2 means the command could not complete. See Run a scan for filters and output formats.

3. Review findings and possible patches

Use the explain command printed with a finding to read its evidence and migration guidance. Preview eligible patches before generating them:

npx emendant fix --package openai --dry-run

On an already updated Dependabot branch, use --adopted here too:

npx emendant fix --package openai --adopted --dry-run

A dry run checks edits in memory. It does not install the target release, run repository checks, or call a model. A finding can remain unfixed because no safe transform applies or because an assisted fix needs a model provider. See Fix a finding for those choices.

4. Generate patches and read the check results

Remove --dry-run to generate patches and run available verification. Keep the same package and adopted filters used in the preview:

npx emendant fix --package openai --adopted

Read .emendant/report.md and each offered patch. Emendant runs discovered or configured typecheck and test commands in a separate copy. For a pending change, verification also prepares the target SDK release. It does not update the dependency files in your working tree.

The report distinguishes test verified, typechecked, and structurally checked evidence. A check that did not run is not a pass. Failed or inconclusive verification can withhold a patch. Use the fix guide to interpret the result before applying an offered patch.

Apply reviewed source patches with the dependency update as one migration. Follow the patch application steps, then run your project’s typecheck, tests, lint, build, and any integration or runtime checks the change needs. Review the complete PR diff before merging.

5. Inspect the remaining manual work

A clean scan or passing checks cannot establish that the migration is complete. Review upstream instructions, report-only findings, skipped code, related package versions, and behavior that your tests do not exercise. See Known limitations.

The recorded AI SDK 6 to 7 migration of steel-dev/atlas shows this boundary. It records an offered rename patch, inconclusive verification runs, manual dependency work, and changes the scan did not report. One missed behavior change passed the typecheck and all 262 tests. This is evidence from one repository and release, not a general success rate.

The workflow is complete when you have reviewed the dependency update, the source changes, the checks that actually ran, and the remaining manual migration steps.

Sources

Dependabot comparison checked against GitHub’s official documentation on 2 November 2026:

Emendant behavior and coverage: scan guide, fix guide, supported projects, and the recorded migration.