Upstream Radar

Know which upstream changes actually matter to your coding-agent projects.

Always-on vulnerability and breaking-change impact monitoring for DeepSeek Harness plugins, with a native DSH adapter and a vendor-neutral task bridge for Codex, Claude Code, and other coding agents.

---

Vulnerability scanners tell you that a package is affected. Release bots tell you that a new version exists. They usually do not tell you:

• which plugin brought that package into a project;
• which exact dependency path is affected when multiple versions coexist;
• whether the vulnerable feature is reachable in this repository;
• whether the available upgrade breaks Node.js, DSH, the plugin entrypoint, or its bundle;
• which coding agent should investigate, and how to avoid handing untrusted advisory text control of that agent.

Upstream Radar closes that gap.

flowchart LR
    feeds["OSV advisories
npm releases"] --> match["Exact name@version match"]
    match --> graph["Installed dependency path"]
    graph --> incident["Project-specific incident
new · updated · resolved"]
    incident --> dsh["Native DSH follow-up"]
    incident --> outbox["Durable task outbox"]
    outbox --> codex["Codex"]
    outbox --> claude["Claude Code"]
    outbox --> other["Other coding agents"]

See it in 60 seconds

git clone https://github.com/MicroMilo/upstream-radar.git
cd upstream-radar
corepack enable
pnpm install --frozen-lockfile
pnpm test
pnpm run showcase:radar

The upstream-radar commands below refer to the package binary. From an unlinked source checkout, run the equivalent command as node dist/src/cli.js ... after pnpm build.

The network-free showcase starts from this installed graph:

plugin@1.0.0
├── framework@2.4.7
│   ├── parser@3.2.1
│   └── archive@1.8.0
└── logger@4.0.2
    └── parser@2.9.0

When a new advisory affects only parser@2.9.0, the result is routed through the exact path: