Every dependency update is a gamble. A patch release can ship a breaking change that silently corrupts your build, and most teams discover the breakage only after the upgrade lands. apiweiser-cli flips that sequence: it classifies each release before you touch anything, builds the migration codemod, and opens a pull request with the fix already applied.

How It Maps Every Real Call Site

Most dependency tools trace imports statically. If a package is imported somewhere, the tool assumes every call site uses it the same way. apiweiser-cli takes a different approach. It runs TypeScript's type checker over your entire codebase to resolve exactly how each dependency is called. Every link in a chained method call is tracked, including calls that pass through wrapped or reassigned values. If your code does something like const lib = require('pkg') and then calls lib.method() through an indirection, the tool still catches it.

This matters because import tracing misses real breakage. A type-checker resolution catches the cases that static analysis glosses over, and that difference determines whether a codemod fixes the actual call sites or only a fraction of them.

Classifying Releases Before Anything Breaks

apiweiser-cli watches each dependency's GitHub releases continuously. When a new version drops, it asks an LLM whether the release is breaking. That classification is not the final word. The tool waits until Renovate independently confirms the update is available, and Renovate cross-references each release against the OSV vulnerability database, so security patches surface the same way.

Only when both signals align does the pipeline activate. The tool does not act on guesses or rumors. It waits for an independent confirmation that the update exists and that it is classified as breaking.

The Codemod Registry Grows With Every Repo

The core efficiency mechanism is a codemod registry. When apiweiser-cli proposes a migration for a dependency, a coding agent builds and tests the codemod for that specific version transition. The result is cached under ~/.apiweiser-cli/codemods/, keyed by package name and version range.

For the next repo that uses the same dependency, the cached codemod is checked first. If it already covers all the call sites, the coding agent confirms and skips straight to opening the pull request. No tokens are burned rebuilding what already exists. If the cached codemod covers some call sites but not all, the agent extends the existing codemod rather than starting from scratch.

A concrete example: the chalk 4.1.2 to 5.0.0 migration was built once using vercel/pkg. The cached codemod covers default imports with zero edits needed on a project like ts-loader. For ts-loader, which uses namespace and require() patterns, the codemod was extended to add those call patterns. For a third repo whose call sites are already covered, the agent reused the codemod and moved directly to the PR.

The registry gets more capable with every repo it touches, not just bigger.

From Breaking Release to Open Pull Request

Once a release is classified as breaking and the codemod is ready, the pipeline executes automatically. apiweiser-cli bumps the dependency in package.json and the lockfile, applies the codemod for real, creates a branch, commits the changes, and opens a pull request against your repository.

You review the PR and merge it. That is the extent of your involvement. The coding agent built and tested the migration, the tool applied it, and the PR is waiting for your sign-off.

The installation is a single command. Run curl -fsSL https://apiweiser-cli-fe.vercel.app/install.sh | sh and the tool starts watching your dependencies immediately.

What This Changes For Development Teams

The conventional workflow has teams running upgrades reactively. A security advisory pushes a patch, a major version drops, and someone manually traces the breaking changes, writes migration code, and opens a PR. That process is slow and error-prone, especially for dependencies with subtle API changes buried behind a version bump.

apiweiser-cli compresses that into an automated sequence. The classification, the codemod generation, and the PR creation all happen before a human is asked to do anything. The coding agent does the repetitive work of updating call sites across a codebase, and the type-checker-backed analysis ensures the coverage is complete rather than guessed.

For teams maintaining large TypeScript or JavaScript codebases with dozens of dependencies, the cumulative effect is significant. Security upgrades stop waiting in a backlog. Breaking changes get migrated before they hit production. And each migration makes the next one cheaper because the codemod registry absorbs the work.