NPM Package Update Alerts
Watch an npm page or GitHub release for the dependency you cannot ignore.
NPM package update alerts watch a registry page or GitHub release for a dependency you cannot ignore.
Dependabot already nags your PRs. That is not this. This is the one library that can wreck production if a major lands, or the one you pin because the maintainer is a single human. You want the registry page or the GitHub release, in words, when the version line changes. You do not want 400 patch PRs from a bot.
Registry page or GitHub, pick the source of truth
npmjs.com/package/name shows the version you will actually install. GitHub Releases shows notes. Watch both if the package matters. Watch GitHub only if npm lags. The release playbook is GitHub release alerts. License file watches are open-source license monitoring. Advisories belong with CVE monitoring.
AyeWatch is not npm audit. It is not Socket. It does not inspect your lockfile. It watches the public URL or a topic you describe. "New major or breaking release of [package], or a security advisory on that package. Ignore tiny patches unless they are marked security."
Keep the list short
Three topics on Free Preview means three packages, or two packages and one advisory topic. That is the point. The critical path, not the whole graph. Pro is $9 a month if you need more. Paid webhooks can open the upgrade ticket. See webhook monitoring pipelines. Setup for builders is on the developers page. Do not recreate your lockfile as 200 monitors. You will ignore them the same way you ignore Dependabot.
Start a monitor in under a minute
Free Preview is six lifetime runs across three topics. No card.
Try AyeWatch freeMajors, licenses, and "deprecated"
The alerts that matter are major bumps, deprecation banners on the registry, and LICENSE changes. A daily patch on a noisy package will train you to ignore the feed. Say "majors and security only" in the rule. If the maintainer uses GitHub pre-releases, say whether you want those or only latest. A deprecated warning on the npm page is worth a ping even when the version did not bump.
Start with the package that already hurt
Everyone has one. Watch its npm page this week. When the version line moves, the alert should say what kind of bump it is and whether the notes mention a break. If that sentence is useful, add the next pin. Leave Dependabot on for the long tail. Use AyeWatch for the dependencies you would wake someone over.