UpgradeGuard — AI Dependency Safety Agent

Modern software projects rely on constantly changing third-party dependencies, but upgrading them can unexpectedly break working applications. A version number alone cannot tell a developer whether an upgrade is safe. Developers often have to manually inspect changelogs, search their codebase for affected APIs, upgrade packages, debug failures, and determine whether a migration is actually complete. UpgradeGuard addresses this problem by letting developers rehearse dependency upgrades before changing their main codebase. A developer starts an Upgrade Audit from the UpgradeGuard interface. The system detects outdated, deprecated, and vulnerable dependencies, then installs candidate versions inside isolated Git worktrees and runs the project's real test suite. Instead of relying only on version semantics or AI predictions, UpgradeGuard produces execution-based evidence and classifies each dependency as SAFE or RISKY. When an upgrade is risky, IBM Bob becomes the reasoning and migration layer. Bob investigates where the dependency is actually used, identifies the relevant breaking change, determines what code is affected, creates a migration patch inside an isolated branch, and runs the tests again to verify the result. The developer sees the complete process through a focused dashboard: dependencies detected, versions being rehearsed, test results, risky changes, affected usage, migration status, and final verification evidence. Our demonstration uses a real Express 4 → Express 5 migration. The upgrade causes the project's tests to stop running because an existing legacy wildcard route is incompatible with the newer routing behavior. UpgradeGuard detects the failure during rehearsal rather than after changing the main branch. IBM Bob then provides the investigation and migration workflow, after which the project reaches 10/10 passing tests. The target users are developers and engineering teams maintaining JavaScript/Node.js applications. What makes UpgradeGuard different is the combination of deterministic software execution and agentic AI reasoning. Instead of asking an AI model to guess whether an upgrade will work, UpgradeGuard first creates real evidence. IBM Bob is then used specifically for the part automation scripts cannot reliably perform: understanding why the code broke and determining how to migrate it. The result is a repeatable workflow: Detect → Rehearse → Repair → Verify. UpgradeGuard turns dependency maintenance from a potentially disruptive manual task into an evidence-backed migration process.