Free macOS menu bar app
PumpBar
Outdated dependencies, checked and upgraded from the macOS menu bar
Add your npm and Flutter projects once. PumpBar checks them for outdated packages on a schedule and pumps the versions up with a click — validated, one dependency at a time.
v2.2.1 · 13.3 MB · macOS · Apple silicon · free for personal and public use
What it does
Dependency upgrades from your menu bar
- npm, pnpm, yarn, bun, and Flutter / Dart projects
- Yellow when updates wait, blue while upgrading, red if a run failed
- Validated upgrades via dep-up-surgeon, with dry run and undo
Version history
PumpBar release notes
Every published version, newest first.
v2.2.1
Current9 Nov 2026- "checked …" shows the time of the check. Beside Check all now, and on each project's first submenu line, it said `checked just now` for hours: the menu is only rebuilt at the next check. It now shows the time, `checked 14:05` (`yesterday 14:05`, `Nov 7, 14:05`), which stays true. The same goes for a project's `Last upgrade` and `cancelled` lines.
- Upgrade all's "N of M" reaches M. When a check found a queued project up to date before its turn, Upgrade all skipped it but still counted it, so the header stopped at `Upgrading 2 of 3` and never showed 3 of 3. A skipped project now leaves the count.
v2.2.0
8 Nov 2026- A menu bar icon drawn from the PumpBar logo. The box with an arrow rising out of it, inside the ring, as on entelxcore.com, instead of a generic system symbol. When nothing needs attention it still takes the menu bar's own color, light or dark, and it is tinted when updates wait or a run fails, as before.
- A clearer menu. Each project is one row: a status dot (orange with updates waiting, red when its last run or its check failed, a half dot in your accent color while it upgrades, gray when up to date), the name, and its state in a right-aligned column, such as `7 updates`, `3 of 7 · stripe` or `up to date`. The header, with the app's logo, sums it up (`5 projects · 16 updates · 1 check failed`). When the last check ran now shows on the right of Check all now, and Stop after this project shows how many are queued.
- The new teal logo. The app's icon is now the teal PumpBar logo from entelxcore.com.
- Projects are no longer checked twice at launch. The periodic check's timer fired as soon as it started, right after the check PumpBar runs at launch. It now first fires one interval later.
v2.1.0
8 Nov 2026- Cancel run. While a run is in progress (an upgrade, a retry, security fixes, a dry run, Doctor, undo or `pub`), the project's submenu offers Cancel run next to Show live log…; installing or updating dep-up-surgeon offers Cancel install under its menu item. PumpBar sends SIGTERM to the whole run, so dep-up-surgeon rolls back the step in progress, and SIGKILL to whatever is still running 10 seconds later; the menu stays responsive meanwhile. The log says “[PumpBar] Cancelled by you”, and the run counts as cancelled, not failed: no red icon, no alert or notification, only a quiet “⊘ Upgrade cancelled” line in the submenu until the next run. A cancelled upgrade is checked again, since the steps before the one rolled back are kept.
- Cancel and stop queue during Upgrade all cancels the project in progress and drops the ones waiting; Cancel run on that project moves on to the next one. The summary counts cancelled projects apart from failed ones, and is not shown when every project was cancelled.
- Quitting during a run cancels it instead of leaving it running. Since 2.0.2 a run has its own session, so Quit left it going with nobody reading its output or recording how it ended. Quit now says what is running, cancels it the way Cancel run does, waits for it to stop (at most the grace period and a few seconds), records it and quits. When PumpBar ends some other way (logout, the self-update restart), what is still running gets SIGTERM instead of being left running.
- History. Each project has a History submenu with its last 10 runs, newest first (“Today 14:02 · Upgrade · 7 upgraded · 12 min”), with failures, cancelled runs and Doctor findings marked. Each opens its log in the log window, in a window of its own so a live run's stays where it is. PumpBar used to keep one last-run record per project; the one saved by 2.0 becomes the first History entry.
- Logs are kept per project. Only the newest 40 logs were kept across all projects, so two Upgrade all runs on 20 projects removed every older log. The logs of each project's last 10 runs are now kept, and a run's log is removed when it falls out of History. Other logs (dep-up-surgeon installs, removed projects, runs from before 2.1) keep the newest 40.
- Open last log works after a restart for any kind of run: it opens the newest History entry's log, where it only knew the last upgrade's.
v2.0.3
7 Nov 2026- The menu bar icon no longer disappears on a light menu bar. The idle icon and its badge were drawn in white, so with a light wallpaper (or Reduce Transparency) they vanished. When nothing needs attention the icon is now a template image that macOS draws in the menu bar's own color and redraws when that changes; the badge uses the system label color. The blue, red, yellow and orange states and the update dot keep their colors.
- Settings and projects survive a save that is cut short. `state.json` was rewritten in place, so a crash or a full disk mid-write left it empty or half written, and the next save erased the project list. It is now written to a temporary file in the same folder, flushed to disk and renamed over the old one; a failed write leaves the previous file untouched.
- Doctor's findings no longer count as a failed run. `dep-up-surgeon doctor` exits 2 when a check is red, which turned the project red with “last run failed” and a “diagnosing failed” alert. Its report is now shown as a result: the overall verdict, then each yellow or red check with its hint. Only a doctor that could not run at all is a failure.
- Only upgrades set or clear “last run failed”. A successful Dry run, Doctor or pub get marked the project as last run OK, clearing the red state of an upgrade that had really failed; a failed one turned it red. They now leave that state alone and show their result in their dialog.
- Upgrade actions say why they wait while a project is being checked. Clicking one during a check did nothing. The project's submenu now greys its upgrade actions out with “Checking for updates — try again in a moment”, and a click from a menu opened before the check started says the same in an alert.
- The Notifications setting now covers finished runs and dep-up-surgeon installs, as the README says. With it off, PumpBar still notified when an upgrade finished and when dep-up-surgeon was installed or updated.
- “Stop after this project” only shows while Upgrade all has projects left. A single upgrade from a project's submenu showed “Stop after this project (0 queued)”, and clicking it left every later run showing a disabled “Stopping after this project…”. Single runs no longer show it, a stray Stop is cleared when a single run ends, and Upgrade all still waits until no run is in progress.
- Open in editor falls through to the next editor, then Finder. `open -a Cursor` fails without an error when Cursor is not installed, so a VS Code user without the `code` command got nothing. PumpBar now checks the result and tries Visual Studio Code, then reveals the folder in Finder.
- dep-up-surgeon is looked up in the Node that “Update dep-up-surgeon” installs into. nvm's `default` alias was only followed when it named an exact version, so `lts/*`, `node` or `22` were ignored, and installed versions were sorted as text, putting v24.9.0 above v24.21.0. PumpBar now resolves the alias chain the way `nvm use default` does (`default` → `lts/*` → `lts/jod` → v22.23.4, `22` → the newest 22.x) and compares versions as numbers.
- A live log window left open from an earlier run no longer gets the next run's result. When the next run finished, its ✓ / ✗ line and title were added to whichever window was open for the project, even one still showing the previous log. Only the window showing that run's log is marked.
- Security fixes only counts the packages with advisories. Its progress said “1 of 23” when two packages were vulnerable, because the total was every outdated package. The total now comes from the run's own audit line: the outdated packages it names (“1 of 2”).
v2.0.2
7 Nov 2026- A run that hangs without printing anything now times out. The 3-hour limit on an upgrade was only checked when the run printed a new line, so a validator test that never exits kept the project “upgrading” and the Upgrade all queue stuck forever. The limit is now enforced by a timer whether or not the run prints. When it is reached, PumpBar sends SIGTERM to the whole run, npx and the test runner included, so dep-up-surgeon can roll back the step in progress, and only kills what is still running 10 seconds later. Before, it killed just the direct child, which skipped the rollback and could leave npx running.
- New updates for a project now send a notification. A project that was up to date never notified when it gained updates, which is the usual case, and when several projects gained updates in one check only the first was notified, the rest never. Now each project notifies once when it gains updates it did not have before, listing them; what a project already has at its first check after launch (or after it is added) does not notify, and the same updates are never announced twice.
- Launch at login no longer starts a second PumpBar, or quits the one you are using. Turning it on loaded the login item right away, and since it starts at load, a second PumpBar appeared next to the first; turning it off unloaded the item, which stops PumpBar when it was the copy started at login. The setting now only adds or removes the login item, which macOS uses at the next login.
- A failed update no longer leaves PumpBar closed. If installing the update failed after PumpBar quit, nothing reopened it. The installer now reopens the installed PumpBar whenever it cannot finish, and an update that could not be installed at all (PumpBar opened from a temporary location macOS uses for downloads, or an Applications folder this user cannot write) is refused before PumpBar quits, with a message saying why.
- “Update took too long … was cancelled” now really cancels. The download kept going after that message and could quit PumpBar and install minutes later. A cancelled update now stops, and the timeout only counts time without download progress, so a slow connection is no longer cut off.
- An update containing more than one PumpBar.app is refused. The signature check and the installer each picked a bundle on their own; with exactly one allowed, the installer can only install the bundle that was checked.
v2.0.1
7 Nov 2026- Upgrade all no longer spins the CPU while a project is still being checked. The queue waits 3 seconds and looks again, but a rumps timer fires as soon as it starts, so that wait ended at once and the queue retried tens of thousands of times a second until the check finished. It now really waits.
v2.0.0
7 Nov 2026- Signed with Developer ID and notarized by Apple. PumpBar was ad-hoc signed, so macOS blocked the first launch until quarantine was cleared in Terminal or the app was opened with right-click → Open. It is now signed with ENTELXCORE's Developer ID Application certificate, with the hardened runtime, and notarized and stapled by Apple: it opens with a double-click like any other app. Because the signature now stays the same from version to version, access you grant it under Privacy & Security carries over to updates instead of being lost with each new build.
- Opens on macOS 13 and later, as the README says. Release builds were made with Homebrew's Python, which is built for the Mac's own macOS, so 0.1.8 needed macOS 27 to open at all. Releases are now built with Python from python.org, the app declares macOS 13 as its minimum, and `release.sh` checks every bundled binary against it before publishing.
- Updates must be signed by the PumpBar developer. Check for Updates… now unpacks the downloaded zip and checks, before PumpBar quits, that the app inside is signed with ENTELXCORE's Developer ID. A tampered or broken download ends in an “Update failed” alert and the current version keeps running.
v0.1.8
10 Oct 2026- PumpBar tells you when dep-up-surgeon is out of date. Every project check (at launch, on the check interval, and Check now) also compares the dep-up-surgeon PumpBar runs with npm's latest; when it's behind, the menu shows Update dep-up-surgeon to x.y.z… where Install dep-up-surgeon… appears when it's missing. Until now an old global copy kept running silently.
- Installing or updating dep-up-surgeon asks npm for the exact version with `--prefer-online`, then checks which version is on PATH. For a few minutes after a release npm's cache can still say `latest` is the previous version, and `npm install -g dep-up-surgeon@latest` quietly reinstalled that one; now that shows as Update failed with the reason.
v0.1.7
9 Oct 2026- Live progress while an upgrade runs. A project being upgraded shows how far along it is — “◐ flixflex 15 of 20 · stripe” in the menu, “Validating stripe · 15 of 20 done” in its submenu — read from the log the run already writes. A 25-minute run across 20 packages is no longer indistinguishable from a hung one, and the menu header counts the queue position.
- Upgrade all projects… runs the safest action for every project that has something to do, one at a time so they never compete for CPU: the validated step-by-step upgrade for npm projects (held-back packages skipped), `pub upgrade` within constraints for Flutter / Dart. Projects where only held-back or major-only packages are left are not queued. The biggest jobs run first, Stop after this project ends the queue without killing the run in progress, and one summary at the end replaces a dialog per project.
- You now see when a PumpBar update is out. When the background check finds a new version, the “Update available” dialog (Install & restart… / Not now) now opens by itself, in front of other windows, once per version. Until now it only posted a notification, which macOS never showed.
- Notifications go through Apple's current API (UNUserNotificationCenter). rumps used the deprecated NSUserNotificationCenter, whose notifications current macOS drops without an error. macOS only shows them for Developer ID signed apps; this ad-hoc build logs the reason to its error log instead.
- HTTPS works on Macs without Homebrew: the bundled OpenSSL only looked for certificates in Homebrew's folder, so requests (update checks included) failed certificate verification there. macOS's own `/etc/ssl/cert.pem` is now trusted as well.
v0.1.6
9 Oct 2026- Built with current dependencies: `packaging` 26.3, PyInstaller hooks 2026.8. `requirements.txt` now allows `packaging` 26.x (was capped below 26).
v0.1.5
9 Oct 2026- Add Projects… takes a whole folder. Pick `~/Desktop/projects` instead of each repo: PumpBar looks two levels deep, lists every project it found (name and kind) and adds the ones you don't track yet. Dependency caches, build output and hidden folders are skipped, and a folder that is itself a project is never split into its workspace members — a monorepo root stays one project.
v0.1.4
8 Oct 2026- A held-back upgrade is retried when something that could unblock it moves. What blocks an upgrade is usually another package: `eslint@10` failed until `eslint-config-next` shipped a compatible `eslint-plugin-react`, and `react@19.3` was blocked by `@react-three/fiber`'s peer range until 9.8.1 widened it. PumpBar now records what held each upgrade back (its linked-group mates and the package that declared the blocking peer range) and drops the hold-back as soon as one of them is upgraded, so the next run tries it again. Previously only a new version of the blocked package itself could clear it.
- A hold-back also expires after 14 days, in case what blocked it was fixed deeper in the tree where PumpBar can't see it.
- Failures that name no package — a workspace target that crashed (`[target:<label>]`, new in dep-up-surgeon 4.2), a registry lookup that failed — are shown in the submenu and counted in the run summary (“· 1 failed”) instead of silently making the run look smaller.
- Policy skips show the rule that capped them (dep-up-surgeon 4.2: “policy allows no newer version: maxVersion <=16”) instead of a generic “frozen by policy”.
- Held-back records written by 0.1.3 are re-tried once, since they predate the information needed to unblock them.
v0.1.3
17 Sep 2026- Flutter / Dart: packages that only `pub upgrade --major-versions` can move no longer count as updates. `pub upgrade` can't move them, so a project where only those are left shows up to date · N major instead of keeping the badge lit and reporting “No dependencies changed.” on every run.
- Picking pub upgrade (within constraints) when only those are left now says so, lists them, and offers Upgrade majors instead of a run that changes nothing.
- A `pub upgrade` that changed nothing says “Nothing changed.” plus how many packages need new constraints in `pubspec.yaml`, and its notification no longer claims the project was upgraded.
- The menu bar header says “Up to date · N held back” instead of “All up to date” while packages are held back or need `--major-versions`.
v0.1.2
17 Sep 2026- Held back packages for npm projects: PumpBar keeps dep-up-surgeon's report after each run and lists the upgrades that didn't work, with the reason (`lint failed after upgrade`, a blocking peer range, `held back with react`). They no longer count as updates, so the badge clears once everything that can move has moved; a newer release makes a package an update again. A package that only failed together with a breaking group mate (e.g. an `eslint-config-next` patch next to `eslint@10`) is not held back: the next run tries it alone. Runs started from a terminal are picked up from `last-run.json`.
- The validated upgrade skips held-back packages (`--ignore`) instead of repeating the same failures. When nothing else is outdated it says “Nothing new to try” and offers Retry held-back packages….
- The submenu shows the last upgrade (“Last upgrade 3h ago — prettier 3.9.6 → 3.9.7 · 4 held back”), warns when a validator script was already failing before the run (it then only catches crashes), and lists the run's uncommitted files. The dirty-tree warning recognizes those files as the last upgrade's own changes.
- Fixed: a run that dep-up-surgeon stopped at pre-flight (the project already fails its build / tests) showed as a successful “0 upgraded” run with an “upgraded” notification. It now fails with the failing command and its output.
- Fixed: fatal dep-up-surgeon errors (`{"error": …}`) were replaced by “exited with 1”; the actual message is shown.
- Fixed: a JSON report larger than the pipe buffer could hang the run while PumpBar waited for stderr.
- Show live log… follows npm runs with dep-up-surgeon 4.1+ (`--progress`); with older versions the log says it stays quiet until the report arrives.
- Flutter / Dart: packages that need `pub upgrade --major-versions` get their own section, and the `pub upgrade` confirmation says how many it can reach.
v0.1.1
16 Sep 2026- Show live log… in a project's submenu while an upgrade runs: a console window follows the run's log as it is written (spinner lines collapse, colors stripped), keeps your scroll position while you read, and flips to done / failed with the summary when the run ends. One window per project; closing it does not stop the run.
- Auto-check for PumpBar updates every 6 hours (was 12). A failed check (offline right after login, server error) is retried up to 3 times, 10 minutes apart, instead of waiting for the next interval.
- Source installs need Python 3.10+: `install.sh` skips Apple's bundled 3.9 and rebuilds a virtualenv created with it (the .app is unaffected).
- The first silent update check really waits a minute after launch. rumps timers fire as soon as they start, so it used to run immediately — twice — often before Wi-Fi was up after login.
v0.1.0
14 Sep 2026- First release: menu-bar dependency upgrader for npm and Flutter / Dart projects (no Dock icon)
- Add project folders with the native picker; auto-detects `package.json` (npm / pnpm / yarn / bun) and `pubspec.yaml` (Flutter or plain Dart)
- Periodic outdated check (default every 6 hours; 1 / 3 / 12 / 24 in Settings) via `dep-up-surgeon outdated --json` and `pub outdated --json`
- Yellow icon + badge when projects have updates waiting, blue while an upgrade runs, red when the last run failed
- npm projects: Upgrade (validate each step), Upgrade (skip validation), Upgrade --force, Security fixes only, Dry run, Doctor, Undo last run — all through dep-up-surgeon
- Flutter / Dart projects: `pub upgrade`, `pub upgrade --major-versions`, `pub get`
- Git dirty-tree warning before mutating runs; optional `--git-commit` for npm upgrades
- Per-run logs in the app's logs folder; "Open last log" per project
- One-click "Install dep-up-surgeon…" when the CLI is missing (falls back to `npx` in the meantime)
- Launch at login, notifications, and PumpBar self-update plumbing (ENTELXCORE free-tools manifest)
More free tools
