GitHub Action · 5 minutes

Action quickstart

Know when a security override may no longer be needed. Backpatch reports which overrides look SafeToRemove when an upstream parent already ships the fixed transitive — report in CI, you decide.

Default fail-on: never — report-only. Review before you delete, not a delete guarantee.

After-only fixture

@sailshq/[email protected] already declares exact [email protected]. Backpatch reports SafeToRemove — removal changes nothing. Pastoralist --remove-unused still keeps the pin. That is the gap.

14-day trial · $0 due today

Four steps

  1. 01

    Get a Pro trial key

    Start the 14-day Pro trial. Checkout issues the key on the success screen — copy it then; we cannot show it again.

  2. 02

    Add the secret

    In the repo: Settings → Secrets and variables → Actions → New repository secret. Name it BACKPATCH_API_KEY.

  3. 03

    Paste the workflow

    Save the YAML below as .github/workflows/backpatch.yml, commit, then Actions → Override cleanup → Run workflow.

  4. 04

    Read the job summary

    The step writes a table of every override. Default fail-on: never means the job stays green — you review; you decide.

Paste the workflow

Copy-paste as .github/workflows/backpatch.yml. fail-on: never is the first-run path — the job reports, it does not fail the build.

name: Override cleanup

on:
  workflow_dispatch:

jobs:
  backpatch:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: cridertechnologies/backpatch-action@v1
        with:
          api-key: ${{ secrets.BACKPATCH_API_KEY }}
          fail-on: never

See it run →

Need a lockfile for more precise results? Pass lockfile: package-lock.json (or yarn.lock) on the Action. Full inputs are in the Action README.

Read the job summary

Open the workflow run and scroll to the job summary. Each override is SafeToRemove, StillNeeded, NeedsMajorUpgrade, or Unknown. Treat SafeToRemove as a review queue — re-resolve the lockfile and run your tests before you delete anything.

Nothing is sent except the package.json (and a lockfile only if you pass one). No repository access, no source.

Start the 5-minute try

Pro includes the hosted API the Action calls. Cancel any time during the trial — $0 due today.

14-day trial · $0 due today