Breaking-change impact detection for SDK dependencies

Upstream breaks. Your code doesn’t.

Know before your build breaks.

Breakwater watches the SDKs you depend on, diffs every release, and tells you which files in which repos a breaking change actually touches — with a fix sketch for each one.

Start free See pricing

Free plan: 1 repository, 100 scans a month, no card.

What a finding looks like

Real output from the golden eval corpus that runs in CI, not a mock-up.

Highopenai@5.0.0Member OpenAI.chat.completions.create signature changedtier 2

src/llm.ts:6

const res = await client.chat.completions.create({

This call site uses the changed member directly and will not compile against the new signature.

Fix: update the call to the new signature and adjust the response handling.

Detected by a deterministic type-surface diff — source type-diff, confidence deterministic. No model was asked whether the export changed.

Evidence, not vibes

The core signal is a deterministic diff of the package's exported type surface. “Export X was removed” is a fact with a before/after signature, not a model's guess. Models are used where judgement is needed — parsing release notes, assessing impact — never as the source of truth.

Your files, not a changelog

Findings are a path and a line, a severity, an explanation and a fix sketch, in your repositories, on your default branch. The difference from every update bot is the possessive.

Cheap enough to always be on

The cascade spends nothing until it has to. Most scans resolve at Tier 0 on a single API read, clones are shallow and ephemeral, and the model only ever sees the top-ranked evidence. That is why watching 10 repositories continuously is $49 / month rather than an enterprise contract.

How a scan spends your money

Three tiers, cheapest first. Each one only runs if the one before it could not settle the question.

Tier 0

Does this repo even declare an affected range?

One manifest read. No clone, and nothing charged against your monthly scans — an org should never pay for a release of a package it does not use.

Tier 1

Does the affected symbol appear in the code?

A shallow, ephemeral clone and a text match, ranked by the quality of the evidence rather than the number of hits. The clone is deleted before the job ends.

Tier 2

Is this usage genuinely affected?

Only the top-ranked files reach a model, which judges each real usage and discards matches in comments, strings and already-migrated code.

Every scan records which tier resolved it, so the dashboard shows its work. Skips are never silent either: an exhausted quota or a repo outside your plan produces a row with the reason on it.

What we can show you today

77% / 100%: Precision and recall on the Tier 1 golden eval, with floors asserted in CI so a regression fails the build. Measured on an 8-case corpus — small, and we will say so until it is bigger.
3: Breaking majors the Vercel AI SDK shipped in about 30 months.Researched 2026-08.
404: What a cross-tenant identifier returns, not 403 — an id from another organization must not reveal that the row exists. Read only API keys and an append-only audit log come as standard.

Watch your first repository

Install the GitHub App on one repo and see what the last few releases of your SDKs actually touched. Free plan, no card.

Start free