Dependabot for APIs
Watches provider API changes, matches them to your repos, and opens one verified PR — including breaks that never show up in package.json.
Why package bots miss this
Providers retire models and reject parameters without bumping your lockfile.
Watch, match, fix, prove
Connect repos once. We track provider changes, match call sites, apply the safest fix, and verify before opening a PR.
What shows up in your day
An exposure map, quiet days when nothing hits you, and one readable pull request when something does.
Providers
Anthropic, OpenAI, Vercel AI SDK. Wrappers like LangChain and LiteLLM count too.
Questions
What is Patchbase?
Patchbase keeps third-party API integrations working by watching provider changes, matching them to your repos, and opening verified pull requests. It covers the breaks Dependabot misses: deprecations and API changes that never show up in package.json.
How is Patchbase different from Dependabot?
Dependabot watches package versions in your lockfile. Many API breaks never change a package version. Patchbase watches provider changes and opens a PR when you are affected.
Why does Dependabot miss API breaks?
Dependabot fires when a dependency version changes. If the provider turns something off and package.json is unchanged, no bot runs.
Does Patchbase merge pull requests automatically?
No. Auto-merge is off by default and opt-in per repository.
Which providers does Patchbase cover?
Today: Anthropic, OpenAI, and Vercel AI SDK. Coverage stays narrow on purpose.
vs Dependabot · Docs