dependency-news

A CLI tool to discover and summarize dependency updates from your package.json file. Use entirely at your own risk.

Features

• 🔍 Discovers dependencies from package.json
• 📡 Resolves latest versions from npm registry
• 📝 Finds changelogs from GitHub releases or CHANGELOG.md files
• 🤖 Summarizes changes using OpenAI's LLM

Installation and usage

Just run npx dependency-news.

Configuration

API Keys

OpenAI API Key

You can provide your OpenAI API key in one of two ways:

1. Environment variable (recommended):

   export DEP_NEWS_OPENAI_KEY=your-api-key-here

2. Config file: Create a .dependency-news.json file. Don't check it in to your repo! (Will change this to live in e.g. ~/.config soon...)

   {
     "openai": {
       "apiKey": "your-api-key-here"
     }
   }

GitHub Token

A GitHub token is essential for packages with more than a few dependencies.

You can provide your GitHub token in one of two ways:

1. Environment variable (recommended):

   export DEP_NEWS_GITHUB_TOKEN=your-github-token-here

2. Config file:

   {
     "github": {
       "token": "your-github-token-here"
     }
   }

Creating a GitHub token:

Go to https://github.com/settings/personal-access-tokens. Your token doesn't need any scopes unless you have private dependencies.