dependency-news

A CLI tool to discover and summarize dependency updates from your package.json file — or for arbitrary dependencies, no package.json required. Use at your own risk.

Features

• 🔍 Discovers dependencies from package.json, or accepts them as arguments
• 📡 Resolves latest versions from npm registry
• 📝 Finds changelogs from GitHub releases or CHANGELOG.md files
• 🤖 Summarizes changes using OpenAI's LLM into structured, categorized items (breaking / security / deprecation / feature / fix / performance), sized to the scale of the upgrade — breaking and security changes are always kept

Installation and usage

Run npx dependency-news from a project containing a package.json to summarize updates for every dependency.

Checking specific dependencies

Pass one or more dependency names as positional arguments to limit the run to those packages:

npx dependency-news wrangler vitest

Checking dependencies without a package.json

If you specify an explicit version for every argument with name@version, the tool skips reading package.json entirely:

npx dependency-news [email protected] @scope/[email protected]

Controlling LLM cost

For huge changelogs, --max-lookback <n> caps how much of it is processed: changelog data is summarized in chunks of roughly 8,000 characters, newest first, and anything beyond n chunks (default 8) is skipped.

Configuration

OpenAI API Key

You can provide your OpenAI API key in one of two ways:

1. Environment variable (recommended):

   export DEP_NEWS_OPENAI_KEY=your-api-key-here

2. Config file: Create a .dependency-news.json file. Don't check it in to your repo! (Will change this to live in e.g. ~/.config soon...)

   {
     "openai": {
       "apiKey": "your-api-key-here"
     }
   }

GitHub Token

A GitHub token is essential for packages with more than a few dependencies. It doesn't need any scopes unless you have private dependencies. Create a token at https://github.com/settings/personal-access-tokens.

You can provide your GitHub token in one of two ways:

1. Environment variable (recommended):

   export DEP_NEWS_GITHUB_TOKEN=your-github-token-here

2. Config file:

   {
     "github": {
       "token": "your-github-token-here"
     }
   }