Ecosystems & APIs
Ecosystems and APIs
Six package ecosystems, each read with a tool built for its language, plus the APIs and models your code calls and the runtimes it is pinned to.
npmTypeScript declarations
PyPIgriffe
Goapidiff
Cargocargo-semver-checks
RubyGemsPrism
Maven · GradlejapicmpEvery ecosystem follows the same loop: inventory, next version, API diff, your lines, upgrade, verify. What differs is the tool at each step, and those tools are picked per language, not shared.
| npm | PyPI | Go | Cargo | RubyGems | Maven · Gradle | |
|---|---|---|---|---|---|---|
| API diff | TypeScript declarations (TS 6.0.3) | griffe 2.4.1 | apidiff | cargo-semver-checks 0.51.0 | Prism | japicmp 0.26.3 |
| Finds your lines with | TypeScript type checker | jedi | go/types | syntax search | Prism | imports, then your compiled classes |
| Resolution | type | type | type | syntax | syntax | syntax, then type during the fix |
| Lockfile regenerated by | npm, pnpm, yarn, bun | uv, Poetry, Pipenv, pip-compile | go get, go mod tidy | cargo update --precise | bundle lock --conservative | Gradle --update-locks |
| Checks in the sandbox | typecheck, build (from CI), tests | mypy or pyright, pytest | build, vet, test | build, test | Zeitwerk, Sorbet or Steep, tests | test-compile and verify, or testClasses and test |
| Sandbox image | Node 18–24, the repo's version | Python 3.10–3.13 (uv), the repo's version | Go 1.27.2, the toolchain directive via GOTOOLCHAIN | Rust 1.99.1, a rust-toolchain channel via rustup | Ruby 4.0.9; pinned or lockfile-required versions via rv | JDK 21, with 17 and 25 |
| Docs for the agent | Context7, at the indexed version closest to your target | Context7, then the target wheel's signatures and docstrings | the target module's source | docs.rs | the gem's README and lib | japicmp and the sources jar |
What is the same everywhere
- Registry data comes from deps.dev, with the npm registry as a fallback for npm. Advisories come from OSV, cross-checked with GitHub's advisory database, plus ruby-advisory-db for gems. Every locked version is checked, direct and transitive.
- The next version is the newest stable release that is at least 7 days old, respects your npm overrides and resolutions, and isn't deprecated or yanked. Majors are allowed. Security fixes skip the cooldown.
- Only majors are diffed. A minor or patch upgrade is a plain bump that the sandbox decides.
- Packages are read, never run. Teire checks each tarball's integrity and unpacks it with its own extractor (links and
..paths refused) on the worker. Your code and its dependencies install and run only in the sandbox. - Release notes are read by Nemotron. Each item must quote the fetched text word for word, or it is dropped. They come from the package itself and from its repository on GitHub, GitLab or Bitbucket, found from the package's metadata (npm's
user/reposhorthand andhomepage, PyPI's project URLs, a Go module'sgo-importtag, a POM's<scm>or its parent's), at the target's tag:v1.2.3,1.2.3,name-1.2.3,name-v1.2.3,release/1.2.3and the other common spellings.
Type level or syntax level
Teire says not affected only when every use was resolved by type. Where the search is syntax-level (Cargo, RubyGems, and Maven/Gradle until the fix compiles your code), a repository that doesn't use the change reads inconclusive. The sandbox then decides. Across the six clean repositories in the evaluation, none was called affected.