Upstream：为依赖仓库提供发布情报的开源工具

Release intel for the repos you depend on.

Upstream reads every changelog in your stack, flags what breaks, estimates the upgrade effort and rates the project.

What it does

Digest - every release across your stack, summarized into what changed, what breaks and how much work the upgrade is.
Breaking radar - breaking changes and deprecations surfaced first.
Repo reports - a five-part rating, an AI guide to the project, and alternatives lined up against it.
Your key, your model - bring a key for any of eight providers, or run on the shared one.
On your schedule - daily, weekly, biweekly, monthly or every N days, in your own time zone, delivered by email.

Stack

Tech	Why
	App Router, server components
	UI
	No `any`, no non-null assertions
	Styling
	Components, built on Base UI
	ORM
	Serverless Postgres
	GitHub OAuth, JWT sessions
	Structured LLM output
	Boundary validation
	Lint and format
	Package manager
	Hosting and scheduling

No Redis, no queues, no Docker, no monorepo.

Quick start

pnpm install
cp .env.example .env   # then fill it in
pnpm db:push
pnpm dev

Every variable is documented in .env.example, including how to obtain each key. The minimum to boot: DATABASE_URL, AUTH_SECRET, a GitHub OAuth app, and one AI provider key.

Scripts

Command	Does
`pnpm dev`	Dev server
`pnpm db:push`	Push the schema to Neon
`pnpm ingest`	Fetch releases for every catalogue repo
`pnpm summarize`	Summarize un-summarized releases
`pnpm sync`	A full manual run, recorded in `runs`
`pnpm check:schedule`	Assert the digest date maths
`pnpm typecheck`	`tsc --noEmit`
`pnpm lint`	`biome check`

How it works

Summaries are deduped by content hash. A summary is keyed on the sha256 of the release body, not the release id, so identical notes across repos or re-runs are summarized once, ever. That is what keeps the project inside free-tier LLM quota.

Repos are a shared catalogue; a stack is one user's slice of it. Ingestion and summary dedupe stay global while every view is scoped to the person asking.

The cron tick is project-wide, the schedule is per user. Vercel Cron cannot fire per user, so /api/cron/ingest runs hourly and isDigestDue() decides whose digest is due, reading the hour in each user's own IANA zone.

Model ids are never trusted. gemini-2.5-flash was retired mid-project and broke every summary silently. Keys and models are now probed with a live call before they are saved.

More detail, and the traps worth not reintroducing, live in AGENTS.md.

Status

Working: ingestion, summarization, auth, per-user stacks, digest with filters, repo reports, BYOK across eight providers, search, scheduled runs, email delivery, account erase.

Not built yet: an eval harness, Playwright E2E, read state, non-GitHub-Release changelogs, and rate-limit backoff.

License

MIT