Count Patchula

Count Patchula vants to update your deps. He never sleeps. Neither do your CVEs.

A modern dependency updater with strong defaults.

Get started · Documentation · Coming from Renovate · Benchmarks

The Count reads your repositories' manifests, looks up newer versions, and opens one pull request per update, with release notes. One process handles the whole batch: repositories run concurrently, and every package is looked up once however many repositories use it.

Get started

mise use -g --minimum-release-age 0 packslip:sweepies/count-patchula

Other ways to install him are on the installation page.

Invite the Count into a repository with patchula.pkl:

amends "PatchulaConfig.pkl"

That is a complete config: every default applies, including a dependency dashboard issue. Then, with a GitHub App installation token in PATCHULA_TOKEN:

patchula run --dry-run acme/my-app   # look first
patchula run acme/my-app             # then let him bite

Lockfile tools, and the versions of the tools in mise.toml, come from mise, so it needs to be on the PATH. See getting started.

The CLI is the quickest way to try him, and the GitHub Action runs him on a schedule. The recommended way to run him is the GitHub App server: one long-running process keeps every cache warm, batches work across repositories, and acts on PR checkboxes the moment you tick them. It idles cheaply between batches, so usage-billed hosts such as Railway suit it well. Each release publishes it as a container image, ghcr.io/sweepies/count-patchula, for linux/amd64 and linux/arm64. Once it is up, patchula run --remote runs on it from your machine, signed in with GitHub, with no token or toolchain of your own.

What you get

• Real lockfiles for npm, pnpm, Yarn, Bun, Cargo, Go, Terraform, uv, Poetry, NuGet, Bundler, Composer and mise, regenerated with the real tools. npm, pnpm and Yarn Classic locks go through aube, which is ten to twenty times faster than npm and pnpm at it, and about thirty times faster than Yarn Classic.
• Managers for JavaScript, GitHub Actions, mise, Rust, Go, Docker, Compose, Kubernetes, Kustomize, Flux, Helm, Terraform, Python, Maven, Gradle, .NET, Ruby, PHP, pre-commit, devcontainers, Woodpecker CI, GitLab CI, Nix flakes, APM, and your own regexes, plus notices for new Copier template versions.
• Typed configuration in Pkl. A typo is an error with a line number, not a silently ignored key.
• Careful defaults: exact pins or locked ranges, digest-pinned actions and images, a 24-hour release-age wait, and nothing auto-merges until you say so, except CA root bundles and other reference data, which are only useful while current.
• Security fixes first: every dependency with an exact version is checked against OSV.dev, and a fix skips the release-age wait, schedule windows and PR limits.
• A batch PR you fill by ticking a box on any update PR, keeping the version you reviewed.
• A dependency dashboard, schedule windows, PR limits, grouping and auto-merge behind check gates.
• A GitHub App server in the same MIT-licensed binary: webhooks, scheduled sweeps, a priority queue, several installations at once and a JSON API for dashboards, where Renovate keeps its reporting API and worker scaling for its paid Enterprise Edition.
• A terminal UI (patchula tui) to browse updates, and in a checkout, pick some and write them into your files. patchula apply writes them without asking, for scripts and pre-commit hooks.

How fast

Against Renovate 44.173.1 on six large public repositories (mastodon, sentry, grafana, monica, jellyfin, kafka), each tool alone on the same c7i.xlarge:

	Count Patchula	Renovate
All six, cold	150.5 s	920.6 s	6.1× faster
All six, warm	14.8 s	274.3 s	18.5× faster
Peak memory, grafana cold	494 MB	3.6 GB	7.3× less

The benchmarks page has the method and every run.

Coming from Renovate

The compatibility matrix lists every manager, datasource and feature, and migrating a config maps renovate.json options onto Pkl.

Development

Install mise, then mise trust and mise install.

mise run build          # build the workspace
mise run test           # offline tests, including the real lockfile tool tests
mise run lint           # every hk check, Clippy (warnings denied) included
mise run hooks:install  # the pre-commit hook
mise run ci             # every check CI runs, in parallel
mise run docs:dev       # the documentation site for this checkout

Builds go through mr boxington for a shared Cargo cache. Tests never touch the network: they replay HTTP fixtures the Count recorded himself. Tools only the tests need, like the lockfile engines, are task-scoped, so a plain mise install does not fetch them.

Count Patchula is an independent project under the MIT licence.

Thanks

Count Patchula would not exist without @jdx. His work inspired it, and it is built on his tools at every step: mise installs every toolchain and lockfile engine, aube writes the npm and pnpm locks, mr boxington caches the builds, usage generates the CLI reference and completions, tak runs the benchmarks, communique writes the release notes, and packslip signs the releases. Thank you, Jeff.

License

MIT