Git Submodule Update Checker for Contract Libraries

WHAT IT DOES

Git Submodule Update Checker for Contract Libraries parses your .gitmodules file and current submodule commit hashes, then queries GitHub (or GitLab) APIs to fetch the latest commit SHA for each referenced repository. It compares current pinned commits against upstream defaults (main/master branches) and reports which submodules have newer commits available. The tool presents a clear visual dashboard showing each submodule's path, URL, current hash, latest commit, and update status. It helps maintainers of smart contract projects stay aware of dependency updates without manually cloning and git-fetching each submodule. All processing is local; no data leaves your environment except API requests to the respective git hosting platforms.

HOW TO USE

Paste the contents of your .gitmodules file into the first text area. Then paste your current submodule commit hashes—one per line with format "path hash"—into the second text area. Click "Check for updates" to initiate the scan. The tool parses the .gitmodules structure, extracts each submodule's path and remote URL, and queries the GitHub API for the latest commit on the default branch. Results appear as a scrollable list of submodules, each tagged with status: "Up to date" (current matches latest), "Update available" (newer commit exists), "Error" (API fetch failed), or "Manual check" (non-GitHub repository). A summary section shows total submodules and how many have updates available, enabling quick assessment of dependency freshness.

TECHNICAL MECHANISM: GITMODULES PARSING AND BRANCH-AWARE API FETCHING

The tool implements a robust .gitmodules parser that handles standard git-config formatting, including quoted submodule names, path/url key-value pairs, and inline comments. It normalizes repository URLs to extract owner/repo slugs for GitHub and GitLab endpoints. For GitHub, the tool attempts to fetch the default branch commit via the GitHub API—first trying "main", then falling back to "master" if the primary branch request fails. This mirrors Git's own branch resolution behavior. The API responses are cached per session, and the tool includes basic retry logic for transient network failures. Unlike a manual git fetch which requires a local repository clone, this tool operates purely on the .gitmodules specification and the current hash list, making it lightweight and suitable for CI/CD pipelines or quick dependency reviews. The comparison logic performs a strict string match between the current hash and the latest commit SHA; any divergence triggers an "Update available" status. All API requests are made directly from the browser, with no intermediate server, preserving user privacy.

WHAT IT CANNOT SEE

Cannot automatically determine if a newer commit is safe to update to; it only reports availability, not security or compatibility. Cannot detect submodule changes that are not reflected in the remote repository (e.g., unpushed local commits). Cannot validate that the submodule commit corresponds to a tagged release or audited version—it only checks against the default branch tip. Cannot check for transitive submodule dependencies (submodules within submodules). Cannot verify that the submodule is actually used in the contract build process or compile step. Cannot detect local modifications to submodules that are not committed. Cannot access private repositories without configured credentials or authentication tokens—API requests will fail for private repos. Cannot determine compatibility between the submodule update and the parent contract code; a newer library version may introduce breaking changes. Cannot detect if the submodule is pinned to a specific branch other than main/master.

PLEASE NOTE

EVM chains only. This tool does not interact with any blockchain; it reads local configuration and public git APIs. It is read-only and does not modify your submodules or repository.