Package change reports
Every package change, and what it costs.
See exactly which packages a release changes on your devices, old → new, and what each change does to battery life: before rollout from the battery simulation, after it from real devices. And when a package you use publishes a new version, get its security and battery report before you decide.
Example · Planned
Packages in 1.4.2
Compared with 1.4.1, the release it replaces, with how many devices run each version as the rollout goes.
urequests 0.9 → 0.10
+6% radio · ≈ −3 weeks
ssd1306 1.0 → 1.1
no measurable change
MicroPython 1.28 → 1.29
−2% CPU · ≈ +1 week
Attribution is an estimate; when several packages change together, effects can't always be separated.
Example card · Planned
umqtt.simple 1.3.4 → 1.4.0 is out
A report for your product as soon as a package you use publishes a new version. Nothing ships without your approval.
Breaking changes
1 · main.py:48: keepalive default 120 → 60 s; pass keepalive=120
Security
1 advisory fixed (CVE-2026-00000, Example) · your code calls the affected connect(); update recommended
In your code
MQTT without TLS · net.py:12; use ssl=True on port 8883
Battery
+11% radio · ≈ −6 weeks
Known issues
2 open reports against 1.4.0 (reconnect loop) · fix merged, not yet released
Recommendation
Wait for 1.4.1, or update with keepalive=120
Static checks catch common issues; they don't prove your code is secure.
The upstream report covers advisories fixed or introduced, supply-chain signals worth a look (a new maintainer, new network hosts in the code, an unexplained jump in size), the battery impact of swapping in just that package, and a recommendation: update, update with care, or hold. It also compares the package's API between the two versions (removed or renamed functions, new required parameters, changed defaults) and shows the exact lines of your code to change, with a suggested fix. It lists the issues reported upstream against the new version and, opt-in and aggregated, how that version is behaving on other otalite fleets. It comes with a draft release, or a pull request that bumps the version. You decide per update: accept, skip this version, snooze, pin, or ignore the package; high and critical security advisories can't be silenced.
Recommended
A person reviews every update, and a rollout still needs your passkey.
Lighter option
Auto-start a canary wave when the report is clean. The danger: a compromised upstream release reaches real devices without anyone looking, and we offer no protection against that.