When a transitive dependency gets patched, its parent usually catches up on its own. Backpatch checks npm and tells you which overrides, resolutions, and pnpm.overrides you can safely delete.
Free tier needs no key — 25 overrides per request, right away.
[
{
"packageName": "tough-cookie",
"overriddenVersion": "4.1.3",
"status": "SafeToRemove",
"suggestedParentUpgrade": "upgrade request to 2.89.0",
"advisoryId": "GHSA-72xf-g2v4-qvf3",
"reason": "[email protected] already ships [email protected]"
}
]Reads every overrides, resolutions, and pnpm.overrides entry in one pass — no config.
Checks npm to see whether the parent dependency has already moved past the patched version on its own.
Cross-references the OSV database for the advisory that prompted each override in the first place.
The free tier is real and anonymous. Paid plans raise the per-request and rate limits; your key is shown once, right after checkout.
For individual maintainers.
For shared codebases.
For everything else.