Know what you
just shipped.
composer update rewrites four thousand lines of lockfile and tells you nothing. whatsdiff reads that diff, fetches the release notes behind every version bump, and names the security advisories you just inherited. In your terminal, in CI, and in whatever AI you code with.
A lockfile diff is not a changelog.
Git shows you every byte that moved: reordered hashes, shifted dist URLs, re-serialised autoload maps. None of it answers the only question you have, which is whether the thing you are about to merge is safe.
One tool, the whole dependency question.
Run it in any git repository holding a composer.lock or a
package-lock.json. Nothing to configure, nothing to sign up for.
What changed in composer.lock and package-lock.json since your last commit.
→ docsCompare dependencies across two commits, branches, or release tags.
→ docsRead the release notes behind every version bump, aggregated from GitHub.
→ docsKnown security advisories affecting what you have installed, both ecosystems at once.
→ docsDid this one package change? Prints true or false, sets the exit code. For scripts.
→ docsBrowse every change and its changelog in a full interactive terminal interface.
→ docsRead and write whatsdiff's own settings, including how long results stay cached.
→ docsThe MCP server, installed alongside. Four registry tools for your AI assistant.
→ docsIt reads the release notes so you don't have to.
A version number tells you a package moved. It doesn't tell you that a component dropped PHP 8.1, or that a method you call now behaves differently. whatsdiff walks every version between the two you have and pulls the actual notes.
whatsdiff tui puts the package list and its changelog side by side in your terminal.
Catch the advisory in the pull request, not in production.
audit resolves every installed version against the advisory registries,
filters by the ranges that actually affect you, and works out the lowest safe upgrade
for each one.
--from and --to report the advisories a branch adds, so your pipeline stops re-flagging the backlog.
--fail-on=high lets low findings through and blocks the ones that matter.
One question, one exit code.
check asks whether a single package moved and exits with a matching
code, so a shell script can decide for itself. Skip the rebuild, the restart, and
the downtime that comes with them when nothing changed.
# only rebuild assets when a JS dep moved whatsdiff check vite --is-updated --quiet \ && npm run build # fail the job on a new high-severity advisory whatsdiff audit --from=origin/main --fail-on=high
- exit 0
- The condition is true
- exit 1
- The condition is false
- exit 2
- Not a git repository, or bad input
Your assistant stops guessing at version numbers.
The same install ships whatsdiff-mcp, a Model Context Protocol server
that gives Claude, ChatGPT, Cursor or Zed four tools that read Packagist and npm
directly.
you → which Livewire versions work with Laravel 11? tool → find_compatible_versions package: livewire/livewire against: illuminate/support ^11.0 ✓ livewire/livewire 3.x requires ^11.0 answered from the registry, not from memory
- find_compatible_versions
- What works with what
- get_release_notes
- Aggregated notes between two versions
- get_available_upgrades
- Latest patch, minor and major from where you are
- get_dependency_constraints
- What a specific version requires
Unolia
whatsdiff, bundled in
You'll forget to run it.
Unolia won't.
whatsdiff is a command you type, so it only tells you things on the days you remember to ask. Unolia runs it across every project you maintain, on every deploy and on a schedule, then comes to you when something moves.
The CLI and the MCP server stay free and MIT-licensed. Automation is the part you pay for.
Find out what you shipped.
Installs the CLI and the MCP server together. Run it in any repository with a lockfile. There is nothing else to set up.
On a CI runner, or a machine you're only visiting once, run it through cpx instead and install nothing at all.