Dependabot and Renovate are great at one job: changing the version number. For patch and minor releases, that's usually the whole job.

For a major version, it's maybe 5% of it.

What a major version actually changes

Here's the OpenAI Python SDK going from 0.x to 1.x. The version bump is one line:

- openai==0.28.1 + openai==1.51.0

The code that breaks is everywhere else:

- import openai - openai.api_key = os.environ["OPENAI_API_KEY"] - resp = openai.ChatCompletion.create(model=MODEL, messages=msgs) - text = resp["choices"][0]["message"]["content"] + from openai import OpenAI + client = OpenAI() + resp = client.chat.completions.create(model=MODEL, messages=msgs) + text = resp.choices[0].message.content

Module-level calls became a client. Dict access became attributes. Every call site has to move, and the bump PR touches none of them. So CI goes red, and the PR waits until somebody has an afternoon.

Two jobs, one automated

  1. Bump the version. Automated for years.
  2. Migrate the call sites. Still done by hand: read the migration guide, grep, rewrite, run the tests, repeat.

The second job is the expensive one, and it's the reason old majors pile up.

Doing the second job safely

If you automate the migration, the order of operations matters more than the model:

  1. Read the vendor's migration guide for the exact before and after.
  2. Find call sites with structural search, not with an LLM. A tool like ast-grep matches code by syntax tree, so the set of files touched is deterministic and reviewable.
  3. Rewrite only those call sites.
  4. Run the project's own typecheck, build and tests, before and after.
  5. Open a pull request only if they pass. Never push to the default branch.

That's the pipeline Versyka runs. It works alongside Dependabot rather than replacing it: Dependabot keeps bumping, and Versyka adds an impact note to those PRs saying what the change touches in your code, then handles the majors that need code changes.

A quick way to see your own backlog

Paste a package.json or requirements.txt into the upgrade check to see which SDKs are major versions behind, with links to the release notes. No sign-up.