DepsHub vs Updatecli

DepsHub automates dependency updates and adds license checks and vulnerability scanning for software projects. Its Autopilot checks for newer versions and opens pull requests; the feature page says AI updates can handle major updates automatically. Smart scheduling is intended to keep dependencies reasonably fresh while limiting unnecessary changes, and Autopilot supports monorepos and multi-language projects. DepsHub monitors license changes, provides license details, and can export an SBOM in CycloneDX format. It scans for known vulnerabilities and says it integrates with popular security advisories. Listed integrations include GitHub, GitLab, Bitbucket, Linear, Jira, and Zapier. The pricing FAQ lists JavaScript, Python, Go, Rust, Java, and PHP as supported languages. The Open Source plan is free for open-source repositories, and the homepage also describes free access for personal projects. Professional costs $19 a month per code contributor and includes unlimited public and private repositories, team members, security alerts, and integrations. DepsHub lists Linux, macOS, Windows, web, and self-hosted deployment.

Updatecli uses YAML manifests to retrieve values, check conditions, update files, and create pull or merge requests. Pipelines run source, condition, and target stages in that order; a target is skipped when its condition is not met. The tool runs as a single statically linked binary without a runtime dependency, server, or database, and releases are available for Linux, macOS, and Windows as well as in container images. Autodiscovery can scan repositories and create manifests for ecosystems including Dockerfiles, Helm, Terraform, npm, and Go. Plugins cover sources, conditions, targets, source-control systems, and actions, with integrations for GitHub, GitLab, Gitea, Azure DevOps, Bitbucket, Jenkins, Docker, Maven, and HTTP APIs. The GitHub SCM plugin can clone a repository and push changes to a working branch; opening a pull request requires a separate action. Manifests can be packaged as OCI artifacts for reuse. Updatecli is free and Apache-2.0 licensed. Udash reporting is experimental, requires the `--experimental` flag, and may change without the usual deprecation cycle.