evaluate_dependency_change

app.repopilot/repopilot · Verify this server

CALL immediately before adding or upgrading an npm dependency, while you still have the package name and target version in hand. Answers "is this specific version safe to take on" from registry metadata, advisory deltas, provenance, license, and repository evidence, and returns blockers, warnings, a recommendation, and a verification plan. The minimum call is {"change":{"name":"lodash"}} — everything else is optional, including the target version, which defaults to the latest published version exactly as `npm install <pkg>` would. Give the target as an exact version, a dist-tag, or a SemVer range; it resolves to one exact version, reported in change.to_version. Add the optional `project` snapshot to also get Node/peer/license compatibility. Common alias and case-variant field names are repaired rather than rejected, and every repair, default, and resolution is listed in input_adjustments — read it to see what was actually evaluated. Rejections are correctable: they name the field, why it failed, and a working example. Evaluates only; never installs or edits anything.