Built by one person (hi, I'm Jeff). If something's wrong, open an issue and I'll see it.
what it is
The after-the-bump layer.
Version-bump PRs, from Dependabot, Renovate, or a manual bump, leave the hard work on you: breaking changes, failed tests, risky rollbacks. Upshift is the part that comes after the bump. It explains what changed, suggests code fixes, runs your tests, and rolls back automatically when a test fails. (Rollback needs a test script. If you don't have one, the CLI tells you and skips the gate.)
Dependabot hands you the chore list. Upshift helps you actually finish it.
guardrails first
Not another autonomous coding agent.
Upshift is built for review and safety, not for turning it loose on your repo. Run your existing test command. Restore package.json and the lockfile on failure. Use upshift fix --dry-run to preview AI edits before anything is applied. Major upgrades prompt before they run, and you can wire an approval webhook or block high-risk upgrades in .upshiftrc.json. Self-healing code fixes should be reviewed, not applied blindly.
own the model too
Point it at a model you run.
The AI features call an OpenAI-compatible API. Set OPENAI_API_KEY for the hosted one, or point OPENAI_BASE_URL at any local server (LM Studio, Ollama, whatever you run) and skip the bill entirely. Your dependency graph never has to leave your machine.
Published and real:
upshift-cli is on npm (v0.5.6), Apache-2.0, built by one person. It goes deepest on Node (npm, yarn, pnpm, especially React and Next.js upgrades). Python, Ruby, and Go are scan-only for now, treat AI fix and migrate as Node-first. It complements the bots you already run, it does not replace org-wide PR automation.