Dep Beacon for Zed

Dep Beacon brings npm dependency intelligence to Zed through the Language Server Protocol. Open `package.json`, `pnpm-workspace.yaml`, or `pnpm-workspace.yml` to see dependency signals in your editor.

Install

1. Open the command palette in Zed.
2. Run `zed: extensions`.
3. Search for `Dep Beacon` and select Install.
4. Open a supported manifest.

If the manifest was already open during installation or an extension update, focus it and run `editor: restart language server` once. Closing and reopening the manifest works too.

Features

• No settings are required after installation.
• Zed's diagnostics multi-buffer acts as an actionable dependency and security dashboard.
• Updates and security issues are visible through default Zed warnings and errors.
• Quick fixes apply patch, minor, major, and latest update targets.
• Bulk actions update all compatible dependencies or move the manifest to latest.
• Document links open dependency names on npm.
• Default and named pnpm catalogs resolve before dependency analysis.
• Optional OSV.dev checks add vulnerability severity to dependency diagnostics.

Dependency dashboard

Open a supported manifest and Dep Beacon starts automatically. Click the error and warning indicator in Zed's status bar or run `diagnostics: deploy` (`cmd-shift-m` on macOS or `ctrl-shift-m` on Linux and Windows) to see actionable dependencies from your open manifests in one editable multi-buffer.

Update dependencies

Place the cursor on an actionable dependency and open code actions with `cmd-.` or `ctrl-.`.

• Patch, minor, major, and latest actions update only the selected dependency.
• `Update all compatible dependencies` applies the highest available patch or minor targets without crossing a major version.
• `Update all dependencies to latest` may include breaking major-version updates.
• Bulk actions appear only when the selected dependency has an applicable manifest edit.

For a `catalog:` or named `catalog:<name>` dependency in `package.json`, the action edits its owning entry in `pnpm-workspace.yaml`.

Understand npm tags

npm can publish a version under another tag such as `next` while its `latest` tag still points to an older version. If the existing semver range already accepts that newer version, Dep Beacon explains the range and tag difference without offering a no-op edit or downgrade.

Optional inline status

No visual settings are required for the dashboard. If you also want compact signals such as `↑ 18.3.1 → 19.1.0`, `⚠ high risk`, and `✓ 19.1.0` beside every dependency, enable Zed's inlay hints.

{
  "inlay_hints": {
    "enabled": true,
    "show_other_hints": true
  }
}
       
  

Settings

Settings are optional. To override the defaults, configure the language server under `lsp.dep-beacon.settings` in your Zed settings file.

{
  "lsp": {
    "dep-beacon": {
      "settings": {
        "checkVulnerabilities": true,
        "includePrerelease": false,
        "registryUrl": "https://registry.npmjs.org",
        "showUpdateDiagnostics": true
      }
    }
  }
}

• `checkVulnerabilities` defaults to `true`.
• `includePrerelease` defaults to `false`.
• `registryUrl` defaults to the public npm registry.
• `showUpdateDiagnostics` defaults to `true`. Set it to `false` to hide dependency update warnings while keeping security and manifest errors visible.

Disabling update diagnostics does not disable dependency analysis. Hover details, code actions, and individual or bulk dependency upgrades remain available.

Source

The Zed adapter and language server are available in the Dep Beacon repository.