Free macOS menu bar app
PumpBar
Outdated dependencies, checked and upgraded from the macOS menu bar
Add your npm and Flutter projects once. PumpBar checks them for outdated packages on a schedule and pumps the versions up with a click — validated, one dependency at a time.
v0.1.8 · 11.9 MB · macOS · Apple silicon · free for personal and public use
What it does
Dependency upgrades from your menu bar
- npm, pnpm, yarn, bun, and Flutter / Dart projects
- Yellow when updates wait, blue while upgrading, red if a run failed
- Validated upgrades via dep-up-surgeon, with dry run and undo
Install
Get PumpBar running in under a minute
Terminal install · PumpBar
After downloading the zip
Ad-hoc signed apps are not Apple-notarized. Paste these commands if Gatekeeper blocks launch — same flow across all tools.
1. Unzip into Applications
unzip -o "$HOME/Downloads/PumpBar-0.1.8-macos-arm64.zip" -d /Applications/2. Remove Gatekeeper quarantine (if macOS blocks launch)
xattr -dr com.apple.quarantine "/Applications/PumpBar.app"3. Open PumpBar
open -a "PumpBar"
Version history
PumpBar release notes
Every published version, newest first.
v0.1.8
Current10 Oct 2026- PumpBar tells you when dep-up-surgeon is out of date. Every project check (at launch, on the check interval, and Check now) also compares the dep-up-surgeon PumpBar runs with npm's latest; when it's behind, the menu shows Update dep-up-surgeon to x.y.z… where Install dep-up-surgeon… appears when it's missing. Until now an old global copy kept running silently.
- Installing or updating dep-up-surgeon asks npm for the exact version with `--prefer-online`, then checks which version is on PATH. For a few minutes after a release npm's cache can still say `latest` is the previous version, and `npm install -g dep-up-surgeon@latest` quietly reinstalled that one; now that shows as Update failed with the reason.
v0.1.7
9 Oct 2026- Live progress while an upgrade runs. A project being upgraded shows how far along it is — “◐ flixflex 15 of 20 · stripe” in the menu, “Validating stripe · 15 of 20 done” in its submenu — read from the log the run already writes. A 25-minute run across 20 packages is no longer indistinguishable from a hung one, and the menu header counts the queue position.
- Upgrade all projects… runs the safest action for every project that has something to do, one at a time so they never compete for CPU: the validated step-by-step upgrade for npm projects (held-back packages skipped), `pub upgrade` within constraints for Flutter / Dart. Projects where only held-back or major-only packages are left are not queued. The biggest jobs run first, Stop after this project ends the queue without killing the run in progress, and one summary at the end replaces a dialog per project.
- You now see when a PumpBar update is out. When the background check finds a new version, the “Update available” dialog (Install & restart… / Not now) now opens by itself, in front of other windows, once per version. Until now it only posted a notification, which macOS never showed.
- Notifications go through Apple's current API (UNUserNotificationCenter). rumps used the deprecated NSUserNotificationCenter, whose notifications current macOS drops without an error. macOS only shows them for Developer ID signed apps; this ad-hoc build logs the reason to its error log instead.
- HTTPS works on Macs without Homebrew: the bundled OpenSSL only looked for certificates in Homebrew's folder, so requests (update checks included) failed certificate verification there. macOS's own `/etc/ssl/cert.pem` is now trusted as well.
v0.1.6
9 Oct 2026- Built with current dependencies: `packaging` 26.3, PyInstaller hooks 2026.8. `requirements.txt` now allows `packaging` 26.x (was capped below 26).
v0.1.5
9 Oct 2026- Add Projects… takes a whole folder. Pick `~/Desktop/projects` instead of each repo: PumpBar looks two levels deep, lists every project it found (name and kind) and adds the ones you don't track yet. Dependency caches, build output and hidden folders are skipped, and a folder that is itself a project is never split into its workspace members — a monorepo root stays one project.
v0.1.4
8 Oct 2026- A held-back upgrade is retried when something that could unblock it moves. What blocks an upgrade is usually another package: `eslint@10` failed until `eslint-config-next` shipped a compatible `eslint-plugin-react`, and `react@19.3` was blocked by `@react-three/fiber`'s peer range until 9.8.1 widened it. PumpBar now records what held each upgrade back (its linked-group mates and the package that declared the blocking peer range) and drops the hold-back as soon as one of them is upgraded, so the next run tries it again. Previously only a new version of the blocked package itself could clear it.
- A hold-back also expires after 14 days, in case what blocked it was fixed deeper in the tree where PumpBar can't see it.
- Failures that name no package — a workspace target that crashed (`[target:<label>]`, new in dep-up-surgeon 4.2), a registry lookup that failed — are shown in the submenu and counted in the run summary (“· 1 failed”) instead of silently making the run look smaller.
- Policy skips show the rule that capped them (dep-up-surgeon 4.2: “policy allows no newer version: maxVersion <=16”) instead of a generic “frozen by policy”.
- Held-back records written by 0.1.3 are re-tried once, since they predate the information needed to unblock them.
v0.1.3
17 Sep 2026- Flutter / Dart: packages that only `pub upgrade --major-versions` can move no longer count as updates. `pub upgrade` can't move them, so a project where only those are left shows up to date · N major instead of keeping the badge lit and reporting “No dependencies changed.” on every run.
- Picking pub upgrade (within constraints) when only those are left now says so, lists them, and offers Upgrade majors instead of a run that changes nothing.
- A `pub upgrade` that changed nothing says “Nothing changed.” plus how many packages need new constraints in `pubspec.yaml`, and its notification no longer claims the project was upgraded.
- The menu bar header says “Up to date · N held back” instead of “All up to date” while packages are held back or need `--major-versions`.
v0.1.2
17 Sep 2026- Held back packages for npm projects: PumpBar keeps dep-up-surgeon's report after each run and lists the upgrades that didn't work, with the reason (`lint failed after upgrade`, a blocking peer range, `held back with react`). They no longer count as updates, so the badge clears once everything that can move has moved; a newer release makes a package an update again. A package that only failed together with a breaking group mate (e.g. an `eslint-config-next` patch next to `eslint@10`) is not held back: the next run tries it alone. Runs started from a terminal are picked up from `last-run.json`.
- The validated upgrade skips held-back packages (`--ignore`) instead of repeating the same failures. When nothing else is outdated it says “Nothing new to try” and offers Retry held-back packages….
- The submenu shows the last upgrade (“Last upgrade 3h ago — prettier 3.9.6 → 3.9.7 · 4 held back”), warns when a validator script was already failing before the run (it then only catches crashes), and lists the run's uncommitted files. The dirty-tree warning recognizes those files as the last upgrade's own changes.
- Fixed: a run that dep-up-surgeon stopped at pre-flight (the project already fails its build / tests) showed as a successful “0 upgraded” run with an “upgraded” notification. It now fails with the failing command and its output.
- Fixed: fatal dep-up-surgeon errors (`{"error": …}`) were replaced by “exited with 1”; the actual message is shown.
- Fixed: a JSON report larger than the pipe buffer could hang the run while PumpBar waited for stderr.
- Show live log… follows npm runs with dep-up-surgeon 4.1+ (`--progress`); with older versions the log says it stays quiet until the report arrives.
- Flutter / Dart: packages that need `pub upgrade --major-versions` get their own section, and the `pub upgrade` confirmation says how many it can reach.
v0.1.1
16 Sep 2026- Show live log… in a project's submenu while an upgrade runs: a console window follows the run's log as it is written (spinner lines collapse, colors stripped), keeps your scroll position while you read, and flips to done / failed with the summary when the run ends. One window per project; closing it does not stop the run.
- Auto-check for PumpBar updates every 6 hours (was 12). A failed check (offline right after login, server error) is retried up to 3 times, 10 minutes apart, instead of waiting for the next interval.
- Source installs need Python 3.10+: `install.sh` skips Apple's bundled 3.9 and rebuilds a virtualenv created with it (the .app is unaffected).
- The first silent update check really waits a minute after launch. rumps timers fire as soon as they start, so it used to run immediately — twice — often before Wi-Fi was up after login.
v0.1.0
14 Sep 2026- First release: menu-bar dependency upgrader for npm and Flutter / Dart projects (no Dock icon)
- Add project folders with the native picker; auto-detects `package.json` (npm / pnpm / yarn / bun) and `pubspec.yaml` (Flutter or plain Dart)
- Periodic outdated check (default every 6 hours; 1 / 3 / 12 / 24 in Settings) via `dep-up-surgeon outdated --json` and `pub outdated --json`
- Yellow icon + badge when projects have updates waiting, blue while an upgrade runs, red when the last run failed
- npm projects: Upgrade (validate each step), Upgrade (skip validation), Upgrade --force, Security fixes only, Dry run, Doctor, Undo last run — all through dep-up-surgeon
- Flutter / Dart projects: `pub upgrade`, `pub upgrade --major-versions`, `pub get`
- Git dirty-tree warning before mutating runs; optional `--git-commit` for npm upgrades
- Per-run logs in the app's logs folder; "Open last log" per project
- One-click "Install dep-up-surgeon…" when the CLI is missing (falls back to `npx` in the meantime)
- Launch at login, notifications, and PumpBar self-update plumbing (ENTELXCORE free-tools manifest)
More free tools
