Skip to content
A tool that checks npm dependencies and sends a github pull request should updates be available
Branch: master
Clone or download

Latest commit

Fetching latest commit…
Cannot retrieve the latest commit at this time.


Type Name Latest commit message Commit time
Failed to load latest commit information.


Build Status Dependency Status devDependency Status

A simple shell script that checks out a list of github repositories, checks their package.json and sends a PR for every minor or major version update available. Your build server will check whether everything is alright and all you have to do is merge green PRs. For added ease of use just set it up as a cron job or as a daily task on your build server.

Node 4.0.0 or more recent only, sorry.

Screenshot of PR with changelog in Github

$ npm install dependency-updater -g
$ dependency-updater --username my-github-user --password my-github-password myname/myrepository anothername/another-repository


dependency-updater [options] repository1 [repository2 [repository3 [...]]]

Repositories are of the format "username/repository" or "organisation/repository".

--username      Github username. Can also be provided via GITHUB_USERNAME
--password      Github password. Can also be provided via GITHUB_PASSWORD
--token         Github oauth token. Can also be provided via GITHUB_TOKEN
--client-id     Github client id. Can also be provided via GITHUB_CLIENT_ID
--secret        Github secret. Can also be provided via GITHUB_SECRET
--logbook       A file to keep track of already opened pull requests. Defaults to ~/.dependency-updater-logbook.json

At least one of those credentials needs to be provided:

  • username and password
  • oauth token
  • client id and secret

The easiest way to create an oauth token for yourself is via You only need "repo" and "public_repo" permissions

Multiple package.json per repository

In case you have a package with more than one package.json (or just one, but in a different location) you can add a file called .dependency-updater.json to the root of your repository:

    "paths": ["folder/one/package.json", "folder/two/package.json"]


If you want to clean up all "dependency-updater" branches you can use this command:

$ git branch -a | grep "dependency-updater" | cut -d / -f 3 | xargs -I BRANCH /bin/bash -c "git push origin --delete BRANCH"
You can’t perform that action at this time.