Whatsdiff
A powerful CLI tool to help you understand what has been added, removed, or updated in your PHP and JavaScript dependencies after a composer or npm update.
FreeCLIOpen Source218 impressions#1044 of its week
Whatsdiff is a CLI that shows added, removed, or updated PHP and JavaScript dependencies after composer or npm updates.
- for
- Developers using Composer or npm who need clear dependency change insight.
- license
- MIT
Key features
- Lockfile diff — Shows line-by-line changes in composer.lock or package-lock.json after updates.
- Commit/branch comparison — Compares dependencies across two commits, branches, or tags.
- Release notes lookup — Aggregates and displays release notes for each version bump from GitHub.
- Security advisory audit — Lists known security advisories affecting the changed packages.
- Zero-config usage — Runs in any git repository with a lockfile, no setup or sign-up required.
Use cases
- Verify safety of a dependency update before merging
- Generate a concise changelog from lockfile changes
- Audit newly added packages for security issues
- Compare dependency sets between feature branches
- Quickly understand version bumps after npm or composer update
Whatsdiff FAQ
Which files does Whatsdiff analyze?+
It works with composer.lock for PHP and package-lock.json for JavaScript projects.
Do I need to configure anything before using Whatsdiff?+
No configuration or sign-up is required; just run the CLI in a git repo containing a lockfile.
Can I compare dependencies between two branches?+
Yes, the `between` command lets you compare across commits, branches, or tags.
Does Whatsdiff provide release notes for updated packages?+
Yes, it aggregates release notes from GitHub for each version bump.
Is there a security audit feature?+
Whatsdiff can list known security advisories affecting the changed dependencies.
Summarized by DevHunt from whatsdiff.app · Oct 2, 2026. Details may change; check the official site.
.png?width=64)
