Your dependencies publish breaking changes. Patchline publishes the fix.

Changelogs are published. Nobody reads them.

• the problem

  Breaking changes land in prose, not in your repo

  Providers announce deprecations in changelogs, spec diffs, and release notes. The burden of noticing — and migrating — falls entirely on you, days before the effective date.

• the gap

  Dependabot bumps versions. It can't rewrite a call site.

  Version bumpers update your lockfile. When currency becomes required or an endpoint disappears, the code change is still yours to find and write. Full comparison.

• the fix

  Changes propagate themselves

  Patchline turns a provider's change event into a repo-specific artifact: a blast-radius report naming every affected file:line, or — when its confidence gates pass — the migration itself, as a PR you review and merge. Never auto-merged.

From their changelog to your pull request

• 1 · detect

  Every change, classified

  Changelogs, OpenAPI spec diffs, and SDK releases from Stripe, OpenAI, and Anthropic are normalized into change events and classified breaking, behavioral, or additive. One historical ingest run captured 623 real changes.

• 2 · match

  Your blast radius, not their changelog

  Binding-aware static analysis of your repo (TypeScript and Python) maps every SDK call site. Each change event is matched against your code with a confidence score — you hear about the three changes that touch you, not the three hundred that don't.

• 3 · patch

  The fix, test-validated, with provenance

  For opted-in repos, the migration agent writes the minimal diff, runs your test suite against it in a network-isolated sandbox, and opens a PR carrying the upstream evidence, affected call sites, test output, and its own confidence math. Below the bar? You get a migration guide instead.

Built to be trusted with a codebase

• read-only

  Minimal GitHub permissions

  Contents read-only; write access only to issues and PR branches. Your source is indexed in a temporary directory and deleted — never retained.

• test-gated

  No unvalidated change becomes a PR

  Two hard gates: the patch must apply cleanly and your tests must pass in the sandbox. A failed suite always downgrades to a report, whatever the confidence score says.

• provenance

  Every claim carries its evidence

  Reports and PRs link the upstream changelog entry or spec diff, list every affected call site, and show the validation output. Nothing asks to be taken on faith.

Onboarding design partners now

Teams with 5–50 external API dependencies get the most out of Patchline. Install takes ten minutes; the first report usually explains itself.