Changes.Watch
Know what changed in your dev stack before it affects you.
Audit your stack →

Catch deprecations before they surprise your build.

Changes.Watch Deprecation Scan is the planned privacy-first CI check for npm, pnpm, and Yarn projects. It will match exact installed packages to registry warnings and human-verified vendor migration deadlines from the public Changes.Watch catalog.

Not installable yet.

The repository name and major-version identifier are reserved, but a public, tested ChangesWatch/deprecation-scan@v1 release does not exist yet. The examples below document the intended v1 contract; do not add them to a live workflow until this page is marked Beta and links to the published repository.

Intended minimal workflow

The first release will be warn-only by default and require only read access to repository contents. No write token, pull-request permission, or secret is planned.

# Planned — do not install until the v1 release is published.
name: Changes.Watch deprecation scan

on:
  pull_request:

permissions:
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ChangesWatch/deprecation-scan@v1
        with:
          upcoming-days: 30
          fail-on: never

Find deadlines even when dependencies do not change

A scheduled workflow will re-check the daily catalog for new vendor notices and approaching deadlines. The manual trigger makes rollout and troubleshooting easier.

# Planned — do not install until the v1 release is published.
name: Weekly deprecation scan

on:
  schedule:
    - cron: "0 8 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ChangesWatch/deprecation-scan@v1
        with:
          fail-on: never

Inputs

path.

Repository directory to scan.

config.changes-watch.json

Optional service and policy configuration.

upcoming-days30

Window for upcoming verified migration deadlines.

include-transitivetrue

Inspect resolved transitive packages when a lockfile is available.

fail-onnever

The first release reports findings without blocking the workflow.

Outputs

deadline-passed-count

Verified deprecations whose effective date has passed.

upcoming-count

Verified deadlines inside the configured upcoming window.

deprecated-package-count

Exact installed packages marked deprecated.

scan-complete

Whether all required local and fixed network sources completed.

report-path

Runner-local path to the structured scan report.

JavaScript monorepos

The MVP targets package.json, package-lock.json, pnpm-lock.yaml, Yarn lockfiles, npm/pnpm/Yarn workspaces, and common monorepo layouts. Lockfiles provide exact versions; manifest-only ranges will be reported as unresolved.

Evidence, not guesses

Job summaries will separate passed deadlines, upcoming deadlines, registry deprecations, unknown dates, and incomplete scans. Vendor findings retain their official source and Changes.Watch detail link.

Repository files stay inside the GitHub runner.

The scanner will read manifests and lockfiles locally. It will not upload repository files or package manifests to Changes.Watch. Network access will be limited to the fixed public Changes.Watch catalog and supported package registries, with bounded requests, timeouts, schema validation, and no package-manager lifecycle scripts.