Pulse

GitHub releases and pull requests are noisy. Pulse filters the feed — surfacing breaking changes, deprecations, and security events from the repos you care about, with priority scores that tell you what to act on first.

What it does

Know when something you depend on breaks. changes deps OWNER/REPO fetches your project's SBOM and cross-references it against your watchlist. You see only the releases and merged pull requests that intersect your actual dependency graph — not everything that moved upstream.

Catch security events as they're announced. The priority engine scans release notes for CVEs, RCEs, and auth-bypass terms and surfaces matching entries as Urgent above all other output. This is distinct from Dependabot: it fires on watched repos you evaluate or track, not just packages already in your lockfile.

Track the ecosystem beyond your lockfile. changes watch add OWNER/REPO lets you follow repos you're evaluating, frameworks not yet on PyPI, or upstream tools that don't version-bump via Dependabot. The changes pulse command buckets everything into Urgent / Act / Review so the signal is never buried in volume.

Prerequisites

• Python 3.11+
• (Optional) gh CLI — required only for changes deps. Install from cli.github.com and run gh auth login.
• (Optional) GITHUB_TOKEN — unauthenticated requests are rate-limited to 60 req/hr; a personal access token (no scopes needed for public repos) raises this to 5,000 req/hr. Set via export GITHUB_TOKEN=ghp_... (macOS/Linux) or $env:GITHUB_TOKEN="ghp_..." (PowerShell). An expired or invalid token causes changes sync to exit with an authentication error.

Quick Start

pip install -r requirements-dev.txt
pip install -e .

# Optional — first-run wizard: configure token, LLM model, and run initial sync
# Skip this step if you prefer to run `changes sync` directly; the default
# watchlist is loaded automatically on first run.
changes setup

# Minimal path (no wizard): sync repos then view the feed
changes sync
changes pulse

# List watched repos
changes watch list

# Validate watchlist against the GitHub API (no store writes)
changes watch validate

Sample Output

── Urgent ──
[BREAKING_CHANGE] semantic-kernel v1.21.0: Remove legacy kernel.run() API
  https://github.com/microsoft/semantic-kernel/releases/tag/python-1.21.0
  ↳ kernel.run() and all synchronous wrappers removed; migrate to kernel.invoke()
[BREAKING_CHANGE] langgraph v0.3.0: StateGraph checkpoint API redesigned
  https://github.com/langchain-ai/langgraph/releases/tag/0.3.0
── Act ──
[DEPRECATION] copilot-sdk v2.14.0: Deprecate CopilotClient.complete() sync wrapper
  https://github.com/github/copilot-sdk/releases/tag/v2.14.0
[DEPRECATION] semantic-kernel v1.20.0: OpenAITextCompletion class deprecated
  https://github.com/microsoft/semantic-kernel/releases/tag/python-1.20.0
── Review ──
[FEATURE] awesome-copilot v3.7.1: Add Rust and Swift prompt library entries
  https://github.com/github/awesome-copilot/releases/tag/v3.7.1
[FEATURE] promptflow v1.16.0: Introduce async batch run support
  https://github.com/microsoft/promptflow/releases/tag/v1.16.0
  ↳ New AsyncBatchRun class lets you fan out evaluations without blocking the main thread
[BUGFIX] gemini-cli v0.1.9: Fix token count overflow on large context windows
  https://github.com/google-gemini/gemini-cli/releases/tag/v0.1.9
[BUGFIX] agent-framework v0.8.3: Fix memory leak in tool-call loop
  https://github.com/microsoft/agent-framework/releases/tag/v0.8.3
  (and 4 more in Review)
─────────────────────────────────────────────
14 changes across 10 repos  •  last synced 3m ago

Commands

Command	Description
changes setup	First-run wizard: configure GitHub token, LLM model, and run initial sync
changes sync	Sync all watchlisted repos
changes watch add OWNER/REPO	Add a repo to the watchlist
changes watch rm OWNER/REPO	Remove a repo from the watchlist
changes watch list	List all watched repos; highlights repos whose last sync failed with a red indicator and error message; shows 0 (no releases) for repos that synced but returned no entries, vs 0 for repos that have never synced
changes watch validate	Check each watched repo against the GitHub API; reports dead/renamed repos
changes status	Show total entries, watchlist size, configured model, store path, and GitHub API rate-limit; lists watched repos with sync-error indicators and prints a count of repos that failed their last sync
changes pulse	Display a priority-bucketed change feed (Urgent / Act / Review); prints a changes sync hint when the store is empty or the filtered query returns no results
changes open ENTRY_ID	Open the change entry URL in the default browser
changes resources ENTRY_ID	Show discovered docs and migration guides for a change entry
changes issue ENTRY_ID	Draft and create a tracking GitHub issue for a change entry (requires gh CLI)
changes check ENTRY_ID	Search the local project for imports of the changed package
changes security ENTRY_ID	Query GitHub security advisories for the changed package (requires gh CLI)
changes deps OWNER/REPO	Cross-reference a repo's SBOM against your watchlist (requires gh CLI)

Run changes --help or changes <command> --help for the full flag reference.

Further Reading

• ARCHITECTURE.md — component diagram, module responsibilities, and data-flow walkthroughs
• RUNBOOK.md — diagnosis and resolution for common operational issues
• AGENTS.md — Copilot agent roster, skills, hooks, guardrails, and reference cards
• CONTRIBUTING.md — branch workflow, issue conventions, and testing patterns