Explain any lockfile change: what bumped, what's breaking, what's newly
vulnerable, how old every incoming version is — before you merge. Runs entirely in your
browser (WebAssembly); nothing you paste or drop leaves it, except queries to the public
forge / OSV.dev / deps.dev APIs.
GitHub repo ·
install the CLI ·
29 lockfile formats · GitHub / GitLab / Bitbucket / Gitea / Azure DevOps URLs
(Codeberg blocks cross-origin browser requests — use the CLI for those)
Try:
·
·
old lockfile drop it here, or click to pick
new lockfile drop it here, or click to pick
package-lock.json, Cargo.lock, uv.lock, go.mod, pnpm-lock.yaml, Gemfile.lock,
.terraform.lock.hcl, renv.lock … or two CycloneDX/SPDX JSON SBOMs. One side may carry a
suffix (Cargo.lock.orig).
Options & API token
The token is sent only to the forge the URL points at, never anywhere else.