unstale

You don't know what you don't know. Neither do your agents.

unstale finds what changed in your dependencies and where your code needs it. It reads the release notes, migration guides and advisories for your installed versions, and hands Claude Code, Codex or Cursor a cited list.

It finds 4x as many upstream changes that apply to your code as Claude Code alone, using 1/16 of the tokens. How we measured

changes indexed
135,315+
packages covered
3,145+
Explore your stack

Get started

Run in your project directory.

npx @unstale/cli init

Free and open source.

Install with Homebrew
brew install vuca-dev/tap/unstale

Then run in your project:

unstale init

Example output of unstale init on a Next.js and Prisma app

my-app — unstale init
$ npx @unstale/cli init✓ my-app · Personal setup readyNext: run unstale-review in your coding agent · copyable prompt below.Mapped 119 direct dependencies from pnpm-lock.yaml and checked local references.Security · 31 advisory fixes match installed versions; each is noted on its upgrade. Upgrades to review · 3 shortlisted1. next 16.2.1 → 16.4.2 picks up 37 security fixes, 90 bug fixes, 5 performance changes, 20 behaviour changes2. prisma 6.19.3 → 7.10.0 picks up 8 security fixes, 82 bug fixes, 8 performance changes · unlocks 52 optional capabilities Capabilities to explore · 8 shortlisted1. next · available on 16.2.1 — updateTag provides Server Actions with read-your-writes cache expiration and immediate refresh semantics.   Reference (unverified): `next/cache` in src/entities/user/model/update-user.action.ts NEXT · Paste this prompt into your coding agentUse .unstale/skills/review/SKILL.md to review this repository. Rank upgrades and capabilities by likely impact. Recommend what to do first, with affected files and trade-offs. Return proposals only; do not edit files.

Found with unstale

What you get

How it works

  1. Read your lockfile. JavaScript, TypeScript and Python projects.
  2. Find what applies. Track your dependencies for upstream changes that matter to your code.
  3. Review with your agent. Run the unstale-review skill to see what changed, where it matters, and what to do next.

Your code stays on your machine

unstale receives public package names; OSV receives package names and versions for advisory checks. No client telemetry.

Network details

Public package names (like pkg:npm/next) to fetch the changes that apply. Not your code, file paths, versions or any ID. The service, hosted on Cloudflare, sees your IP address. It keeps it in memory only, to apply rate limits and count each address once per package, and never writes it to storage. Daily aggregate coverage-request outcome counts are kept for up to 90 UTC days, without addresses, package lists or individual request histories. To check advisories, the CLI sends the package names and versions your lockfiles resolve to OSV, as npm audit would, and it reads the public npm and PyPI registries.

AGPL-3.0 · GitHub

Explore your stack