Backpatch checks whether an upstream dependency update now includes the safe transitive version — so your team can remove stale npm overrides, Yarn resolutions, and pnpm.overrides with confidence.
[
{
"packageName": "tough-cookie",
"overriddenVersion": "4.1.3",
"status": "SafeToRemove",
"suggestedParentUpgrade": "upgrade request to 2.89.0",
"advisoryId": "GHSA-72xf-g2v4-qvf3",
"reason": "[email protected] already ships [email protected]"
}
]Reads every overrides, resolutions, and pnpm.overrides entry in one pass — no config.
Checks npm to see whether the parent dependency has already moved past the patched version on its own.
Cross-references the OSV database for the advisory that prompted each override in the first place.
They tell you a transitive dependency is vulnerable and propose an upgrade. When no parent release exists yet, you pin the safe version yourself — and from that moment nothing is watching the pin. Backpatch is the other end of that incident.
How it fits alongside them →One override, before and after
Added during the incident
"overrides": {
"tough-cookie": "4.1.3"
}GHSA-72xf-g2v4-qvf3. request had no fixed release yet.
Eight months later
[email protected] ships [email protected] on its own.
Upgrade the parent, delete the override.
Nothing in your toolchain told you this. That is the gap.
Choose the capacity your team needs. Move between plans or cancel any time from the dashboard.
For individual maintainers.
For shared codebases.
For everything else.
The package.json you send, and a lockfile only if you choose to include one. No repository access, no credentials, no source code — the analysis only needs dependency names and version ranges.
Not the file. We hold it for the length of the request and drop it. What persists is a per-day count of requests per key and which endpoint was called — that is what your usage dashboard reads.
We never store recoverable API keys, so we cannot read yours back. Full detail in the privacy policy.