Count PatchulaVants to update your deps.

He never sleeps. Neither do your CVEs. A modern dependency updater with strong defaults.

One run, every repository

Repositories are scanned concurrently, and each package is looked up once per batch however many repositories use it. Unchanged work is skipped through validators and receipts.

How it works

Real lockfiles

npm, pnpm, Yarn, Bun, Cargo, Go, Terraform, uv, Poetry, NuGet, Bundler, Composer and mise locks are regenerated with the real tools, installed by mise into a store the Count keeps between runs.

Lockfiles

Typed configuration

Policy is written in Pkl against a published schema. Unknown fields are errors with a file and line, not a silently ignored typo.

Configuration

Batch it yourself

Tick a box on any update PR and the Count moves it into one batch PR with the version you reviewed, then closes the original. Untick to send it back.

Batching

Built in Rust

One native binary. Against Renovate 44.173.1 on six large public repositories, the Count was 6.1 times faster cold and 18.5 times faster warm, using a fraction of the memory.

Benchmarks

The server is MIT too

The GitHub App server, with webhooks, scheduled sweeps and warm caches, ships in the same MIT-licensed binary as the CLI. No paid edition, no feature gates, no licence key.

Server mode

What it does

Point the Count at some repositories with a token and a small Pkl file. He reads their manifests through the GitHub API, looks up newer versions, and opens one pull request per update, each with a regenerated lockfile, release notes and a verified commit signed by GitHub.

patchula run --dry-run sweepies/my-app   # look first
patchula run sweepies/my-app             # then let him bite

pkl

// .github/patchula.pkl
amends "../Patchula.pkl"

prs { dashboard = true }
rules {
  new Rule {
    select { updates { "patch" } }
    apply { merge = true }
  }
}

Supported ecosystems include npm, pnpm, Yarn and Bun, GitHub Actions, mise, Cargo, Go, Docker and Compose, Kubernetes, Kustomize, Flux and Helm, Terraform, Python (requirements, PEP 621, uv and Poetry), Maven and Gradle, NuGet, Bundler, Composer, pre-commit and devcontainers. The compatibility matrix lists what is covered and what is not.