SemVer majors you didn't see coming, deprecated npm packages, postinstall-script supply-chain attacks, transitive churn that drifts your package-lock.json overnight, and an `npm audit` feed that flags hundreds of CVEs you can never keep up with. Brackmoor files a Fix-up PR when a contract test pins the breakage — or a Rollback PR when stepping back is the only safe move.
Each one is a Fix-up PR when a contract test pins the contract — or a Rollback PR when stepping back is the only safe move. Same loop as the home page, tuned to this ecosystem.
SemVer majors routinely hide inside your dependency closure — eslint-config-*, babel-*, webpack-*, npm-check-updates-driven bumps. Brackmoor opens the PR, decides Fix-up vs Rollback from the contract test, and writes the smallest patch that returns CI to green.
When a maintainer deprecates an npm package (the DEPRECATED banner inside `npm view`), every dependabot-driven upgrade still lands on it — until someone reads every release page. Brackmoor catches the deprecation ripple, opens a Fix-up PR that swaps to the recommended successor, and keeps the lockfile honest.
npm postinstall scripts are the supply-chain foothold of choice (event-stream, ua-parser-js, the recent x-family). Brackmoor parses the lifecycle script diff, flags any new or altered postinstall, and refuses to upgrade until the review is green.
`npm audit` produces a long tail of CVE rows you cannot triage by hand. Brackmoor deduplicates against your active dependency closure, surfaces the ones reachable from runtime code rather than devDeps-only, and pre-files Fix-up PRs for each one with its reproducer pinned.
Every npm surface Brackmoor watched the day before ends up here — what was yanked, what was deprecated, what broke, and what was repaired. Posted to #ops-digest in Slack before standup, so the team starts the day already in step.
Morning ops digest — 3 changes ran, 1 broke, 1 repaired.
pip is live today. Cargo · Go modules · Ruby are on the roadmap — drop your email below to be notified when each one ships.
The waitlist is not a sales funnel. Each ecosystem cohort opens as the agent stabilizes — drop your email and we'll keep you in the loop.
If you already have a npm repo and a cron (or CI matrix) in mind, skip the queue and we will spin up a tenant by hand. Most pilots ship the first morning digest within 48 hours.