Changes.Watch
Know what changed in your dev stack before it affects you.
Audit your stack →

Catch deprecations before they surprise your build.

Changes.Watch Deprecation Scan is a privacy-first CI check for npm, pnpm, and Yarn projects. It matches exact installed packages to registry warnings and human-verified vendor migration deadlines from the public Changes.Watch catalog.

Install ChangesWatch/deprecation-scan@v1.

The public beta is tested in GitHub Actions and released as immutable v1.0.5, with v1 maintained as the supported major tag. It is warn-only by default and needs only contents: read.

Minimal pull-request workflow

The beta is warn-only by default and requires only read access to repository contents. It never needs a write token, pull-request permission, or secret.

name: Changes.Watch deprecation scan

on:
  pull_request:

permissions:
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: ChangesWatch/deprecation-scan@v1
        with:
          upcoming-days: 30
          fail-on: never

Find deadlines even when dependencies do not change

A scheduled workflow will re-check the daily catalog for new vendor notices and approaching deadlines. The manual trigger makes rollout and troubleshooting easier.

name: Weekly deprecation scan

on:
  schedule:
    - cron: "0 8 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: ChangesWatch/deprecation-scan@v1
        with:
          fail-on: never

Inputs

path.

Repository directory to scan.

config.changes-watch.json

Optional bounded project config for the upcoming window and transitive checks.

upcoming-days30

Window for upcoming verified migration deadlines.

include-transitivetrue

Inspect resolved transitive packages when a lockfile is available.

fail-onnever

The first release reports findings without blocking the workflow.

Outputs

deadline-passed-count

Verified deprecations whose effective date has passed.

upcoming-count

Verified deadlines inside the configured upcoming window.

deprecated-package-count

Exact installed packages marked deprecated.

scan-complete

Whether all required local and fixed network sources completed.

report-path

Runner-local path to the structured scan report.

JavaScript monorepos

The MVP targets package.json, package-lock.json, pnpm-lock.yaml, Yarn lockfiles, npm/pnpm/Yarn workspaces, and common monorepo layouts. Lockfiles provide exact versions; manifest-only ranges will be reported as unresolved.

Evidence, not guesses

Job summaries will separate passed deadlines, upcoming deadlines, registry deprecations, unknown dates, and incomplete scans. Verified vendor findings retain their official source and Changes.Watch detail link; registry-only warnings link to an explicitly labeled npm status page instead of claiming editorial verification.

Repository files stay inside the GitHub runner.

The scanner will read manifests and lockfiles locally. It will not upload repository files or package manifests to Changes.Watch. Network access will be limited to the fixed public Changes.Watch catalog and supported package registries, with bounded requests, timeouts, schema validation, and no package-manager lifecycle scripts.