Catch deprecations before they surprise your build.
Changes.Watch Deprecation Scan is a privacy-first CI check for npm, pnpm, and Yarn projects. It matches exact installed packages to registry warnings and human-verified vendor migration deadlines from the public Changes.Watch catalog.
Install ChangesWatch/deprecation-scan@v1.
The public beta is tested in GitHub Actions and released as immutable v1.0.5, with v1 maintained as the supported major tag. It is warn-only by default and needs only contents: read.
Minimal pull-request workflow
The beta is warn-only by default and requires only read access to repository contents. It never needs a write token, pull-request permission, or secret.
name: Changes.Watch deprecation scan
on:
pull_request:
permissions:
contents: read
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: ChangesWatch/deprecation-scan@v1
with:
upcoming-days: 30
fail-on: neverFind deadlines even when dependencies do not change
A scheduled workflow will re-check the daily catalog for new vendor notices and approaching deadlines. The manual trigger makes rollout and troubleshooting easier.
name: Weekly deprecation scan
on:
schedule:
- cron: "0 8 * * 1"
workflow_dispatch:
permissions:
contents: read
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: ChangesWatch/deprecation-scan@v1
with:
fail-on: neverInputs
path.Repository directory to scan.
config.changes-watch.jsonOptional bounded project config for the upcoming window and transitive checks.
upcoming-days30Window for upcoming verified migration deadlines.
include-transitivetrueInspect resolved transitive packages when a lockfile is available.
fail-onneverThe first release reports findings without blocking the workflow.
Outputs
deadline-passed-countVerified deprecations whose effective date has passed.
upcoming-countVerified deadlines inside the configured upcoming window.
deprecated-package-countExact installed packages marked deprecated.
scan-completeWhether all required local and fixed network sources completed.
report-pathRunner-local path to the structured scan report.
JavaScript monorepos
The MVP targets package.json, package-lock.json, pnpm-lock.yaml, Yarn lockfiles, npm/pnpm/Yarn workspaces, and common monorepo layouts. Lockfiles provide exact versions; manifest-only ranges will be reported as unresolved.
Evidence, not guesses
Job summaries will separate passed deadlines, upcoming deadlines, registry deprecations, unknown dates, and incomplete scans. Verified vendor findings retain their official source and Changes.Watch detail link; registry-only warnings link to an explicitly labeled npm status page instead of claiming editorial verification.
Repository files stay inside the GitHub runner.
The scanner will read manifests and lockfiles locally. It will not upload repository files or package manifests to Changes.Watch. Network access will be limited to the fixed public Changes.Watch catalog and supported package registries, with bounded requests, timeouts, schema validation, and no package-manager lifecycle scripts.