Reports which overrides look SafeToRemove when an upstream parent already ships the fixed transitive — so you can review before you delete.
Flags SafeToRemove when the parent already ships the fixed transitive — report in CI, you decide.
[
{
"packageName": "tough-cookie",
"overriddenVersion": "4.1.3",
"status": "SafeToRemove",
"suggestedParentUpgrade": null,
"advisoryId": "GHSA-72xf-g2v4-qvf3",
"reason": "@sailshq/[email protected] already declares [email protected]. Removing the override changes nothing."
}
]After-only — parent already pins 4.1.3. Pastoralist --remove-unused still keeps the pin.
No repo access · package.json only · cancel anytime
Complements Dependabot / Renovate / Snyk →Reads every overrides, resolutions, and pnpm.overrides entry in one pass — no config.
Checks npm to see whether the parent dependency has already moved past the patched version on its own.
Cross-references the OSV database for the advisory that prompted each override in the first place.
They tell you a transitive dependency is vulnerable and propose an upgrade. When no parent release exists yet, you pin the safe version yourself — and from that moment nothing is watching the pin. Backpatch is the other end of that incident.
How it fits alongside them →After the parent already ships the pin
After-only fixture
"dependencies": {
"@sailshq/request": "2.88.3"
},
"overrides": {
"tough-cookie": "4.1.3"
}GHSA-72xf-g2v4-qvf3. @sailshq/[email protected] already declares [email protected].
Backpatch reports SafeToRemove — removal changes nothing. Review in CI; you decide.
Pastoralist --remove-unused still keeps the pin. That is the gap.
Contrast — exact pin still needed
Exact pin — contrast
"dependencies": {
"@cypress/request": "2.88.12"
},
"overrides": {
"tough-cookie": "4.1.3"
}GHSA-72xf-g2v4-qvf3. @cypress/[email protected] ships tough-cookie@^4.1.3. The override is still an exact pin of 4.1.3.
Backpatch reports StillNeeded — removing the pin would move the installed version. Review whether it is still earning its place.
Choose the capacity your team needs. Move between plans or cancel any time from the dashboard.
For individual maintainers.
CI report · SafeToRemove status · you decide.
14-day trial · $0 due today
For shared codebases.
For everything else.
No repo access · package.json only · cancel anytime
The package.json you send, and a lockfile only if you choose to include one. No repository access, no credentials, no source code — the analysis only needs dependency names and version ranges.
Not the file. We hold it for the length of the request and drop it. What persists is a per-day count of requests per key and which endpoint was called — that is what your usage dashboard reads.
We never store recoverable API keys, so we cannot read yours back. Full detail in the privacy policy.