Compare two package.json, requirements.txt, or go.mod manifests and classify direct dependency additions, removals, version movement, range changes, prerelease changes, and deterministic risk flags.