Know what changes before your agent upgrades a dependency.

What the advisory checks

Example: Chalk 4.1.2 to 5.0.0

This response is generated from the same package advisory engine used by the API and MCP tool.

{
  "found": true,
  "registry": "npm",
  "packageName": "chalk",
  "fromVersion": "4.1.2",
  "toVersion": "5.0.0",
  "versionsCrossed": [
    "5.0.0"
  ],
  "breakingCount": 2,
  "advisories": [
    {
      "id": "npm:chalk:4.1.2->5.0.0:RUNTIME_REQUIREMENT_RAISED:engines.node",
      "registry": "npm",
      "packageName": "chalk",
      "fromVersion": "4.1.2",
      "toVersion": "5.0.0",
      "severity": "breaking",
      "changeType": "RUNTIME_REQUIREMENT_RAISED",
      "description": "chalk 5.0.0 raised its runtime requirement from \">=10\" to \"^12.17.0 || ^14.13 || >=16.0.0\". Older runtimes are no longer supported.",
      "evidenceField": "engines.node",
      "evidenceBefore": ">=10",
      "evidenceAfter": "^12.17.0 || ^14.13 || >=16.0.0",
      "migrationHint": "Confirm the deployment runtime satisfies the new floor before upgrading."
    },
    {
      "id": "npm:chalk:4.1.2->5.0.0:MODULE_FORMAT_CHANGED:type",
      "registry": "npm",
      "packageName": "chalk",
      "fromVersion": "4.1.2",
      "toVersion": "5.0.0",
      "severity": "breaking",
      "changeType": "MODULE_FORMAT_CHANGED",
      "description": "chalk 5.0.0 changed module format from \"commonjs (undeclared)\" to \"module\". CommonJS require() of this package will now fail.",
      "evidenceField": "type",
      "evidenceAfter": "module",
      "migrationHint": "Convert the call site to import(), or pin to the last CommonJS release."
    },
    {
      "id": "npm:chalk:4.1.2->5.0.0:DEPENDENCY_REMOVED:dependencies.ansi-styles",
      "registry": "npm",
      "packageName": "chalk",
      "fromVersion": "4.1.2",
      "toVersion": "5.0.0",
      "severity": "risky",
      "changeType": "DEPENDENCY_REMOVED",
      "description": "chalk 5.0.0 no longer depends on \"ansi-styles\". Code relying on it being transitively installed will break.",
      "evidenceField": "dependencies.ansi-styles",
      "evidenceBefore": "^4.1.0",
      "migrationHint": "Add ansi-styles as a direct dependency if the project imports it."
    },
    {
      "id": "npm:chalk:4.1.2->5.0.0:DEPENDENCY_REMOVED:dependencies.supports-color",
      "registry": "npm",
      "packageName": "chalk",
      "fromVersion": "4.1.2",
      "toVersion": "5.0.0",
      "severity": "risky",
      "changeType": "DEPENDENCY_REMOVED",
      "description": "chalk 5.0.0 no longer depends on \"supports-color\". Code relying on it being transitively installed will break.",
      "evidenceField": "dependencies.supports-color",
      "evidenceBefore": "^7.1.0",
      "migrationHint": "Add supports-color as a direct dependency if the project imports it."
    },
    {
      "id": "npm:chalk:4.1.2->5.0.0:MAJOR_VERSION_BUMP:version",
      "registry": "npm",
      "packageName": "chalk",
      "fromVersion": "4.1.2",
      "toVersion": "5.0.0",
      "severity": "informational",
      "changeType": "MAJOR_VERSION_BUMP",
      "description": "chalk went from 4.1.2 to 5.0.0 — the publisher signalled a major release.",
      "evidenceField": "version",
      "evidenceBefore": "4.1.2",
      "evidenceAfter": "5.0.0",
      "migrationHint": "Read the changelog: a major bump may carry changes not visible in registry metadata."
    }
  ]
}

Call it from an MCP agent

{
  "name": "factreason_package_upgrade_advisory",
  "arguments": {
    "registry": "npm",
    "name": "chalk",
    "from": "4.1.2",
    "to": "5.0.0"
  }
}

Every result remains scoped to registry metadata. The agent should still read the package changelog for behavioural changes that publishers did not encode in npm or PyPI metadata.

Questions agents and maintainers ask