Depfu vs Updatecli

Depfu is an online service for keeping software dependencies up to date. It connects to GitHub and GitLab repositories through their APIs and opens pull requests with updates and related information; users decide whether to merge them. Supported ecosystems are Ruby Bundler, JavaScript npm, Yarn and pnpm, PHP Composer, and Elixir Hex. Update settings can be configured individually, grouped into recurring requests, or limited to security updates. Security vulnerability updates take priority, and Depfu syncs with open-source databases and GitHub security alerts. The service keeps no more than seven dependency update pull requests open at once. Depfu says it accesses repositories through provider APIs without cloning them, and that traffic to and inside its service is encrypted with SSL/TLS. Enterprise runs on customer infrastructure with GitHub Enterprise or self-hosted GitLab, keeping code in the customer’s network. That deployment requires a Linux machine or VM supporting Docker, with at least two CPU cores and 8 GB of RAM. A free plan covers public and personal account repositories. Paid plans start at $29 a month; a 21-day trial is listed.

Updatecli uses YAML manifests to retrieve values, check conditions, update files, and create pull or merge requests. Pipelines run source, condition, and target stages in that order; a target is skipped when its condition is not met. The tool runs as a single statically linked binary without a runtime dependency, server, or database, and releases are available for Linux, macOS, and Windows as well as in container images. Autodiscovery can scan repositories and create manifests for ecosystems including Dockerfiles, Helm, Terraform, npm, and Go. Plugins cover sources, conditions, targets, source-control systems, and actions, with integrations for GitHub, GitLab, Gitea, Azure DevOps, Bitbucket, Jenkins, Docker, Maven, and HTTP APIs. The GitHub SCM plugin can clone a repository and push changes to a working branch; opening a pull request requires a separate action. Manifests can be packaged as OCI artifacts for reuse. Updatecli is free and Apache-2.0 licensed. Udash reporting is experimental, requires the `--experimental` flag, and may change without the usual deprecation cycle.