GitHub Release Monitor: Know the Day a Dependency Ships

Watch any list of GitHub repositories and get every new release as it happens — the version, the changelog, the author and the assets. Stars, forks, open issues and days since the last push come alongside, so you can see a dependency stalling or a competitor accelerating.

Built for engineering teams tracking what they depend on, and for anyone who currently finds out about a breaking release from a failing build.

How it works

flowchart LR
    A["owner/repo list"] --> B["GitHub REST API"]
    B --> C["Releases + repo stats"]
    C --> D{"Seen last run?"}
    D -->|no| E["new"]
    D -->|yes| F["seen"]
    E --> G[("Release feed")]
    C --> H["stars, forks, issues,<br/>days since last push"]

No scraping: this reads GitHub's documented public API, so it does not break when GitHub restyles a page and it needs no proxy or browser.

Built for

• Engineering teams tracking the libraries they depend on
• Security and platform teams who need to see a patch release the day it lands
• Developer-tool companies watching competitors and the wider ecosystem
• Technical investors reading release cadence and issue counts as health signals

Input

{
  "repositories": [
    "apify/crawlee",
    "facebook/react",
    "https://github.com/vercel/next.js"
  ],
  "onlyNew": true
}

Setting	What it does
repositories	owner/name or any GitHub URL, mixed freely
githubToken	Optional. Raises the rate limit from 60/hour to 5,000
onlyNew	Return only releases not seen last run
includePrereleases	Include RCs, betas and alphas. Off by default
tagContains / tagExcludes	Narrow to a major line, or drop nightlies
includeRepoStats	Also fetch stars, forks, issues and last-push age

About the rate limit

GitHub allows 60 requests an hour from an unauthenticated client, which is roughly 30 repositories per run with stats on. A free personal access token with no scopes at all raises that to 5,000.

If the limit is hit, the run stops cleanly and says so in the summary rather than grinding through a wall of 403s and reporting an empty result as though nothing had shipped.

Output

{
  "repo": "apify/crawlee",
  "tag": "v3.18.1",
  "name": "v3.18.1",
  "version": { "major": 3, "minor": 18, "patch": 1, "prerelease": null },
  "bumpType": "patch",
  "isPrerelease": false,
  "publishedAt": "2026-09-09T11:02:31Z",
  "author": "B4nan",
  "assetCount": 0,
  "body": "### Bug Fixes\n* handle session rotation on 403 ...",
  "url": "https://github.com/apify/crawlee/releases/tag/v3.18.1",
  "changeType": "new",
  "checkedAt": "2026-09-17T18:21:09.884Z"
}

bumpType is computed against the release below it, so you can filter for major and get only the releases that are likely to break something.

The changelog is kept in body rather than reduced to a link, because the changelog is the reason anyone watches releases in the first place.

Turn it into a release alert

{
  "repositories": ["apify/crawlee", "apify/apify-sdk-js"],
  "onlyNew": true
}

Schedule it hourly. The first run records the release history without alerting; every run after returns only what actually shipped.

Run it as an API

curl -X POST "https://api.apify.com/v2/acts/arched_friend~github-release-monitor/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "repositories": ["facebook/react"],
    "onlyNew": true
  }'

Pricing

You pay $0.005 for each repository checked, however many releases it has.

Watching 40 repos hourly	Monthly cost
Reading release feeds by hand	not realistically possible
Dependency monitoring suites	$50 to $300 per month
This Actor	around $144 per month, or $6 per month once a day

Common questions

Why did the first run return everything without alerting? Because a first run has no baseline, and firing an alert for a decade of release history would be useless. Those rows are labelled first-run; the run after that is when new starts meaning something.

Can it watch private repositories? Yes, with a token that can read them. Without one they come back as not-found, which is what GitHub reports for anything the caller cannot see.

Does it track commits or tags? No. It watches published releases, which is where maintainers put the changelog. A repo that never cuts releases returns nothing.

Is my token stored? It is passed per run as a secret input and used only for the Authorization header on GitHub calls.

Related products

• Tech Stack Checker to find which libraries a site is running before you watch them
• Website Change Monitor to watch a changelog page for projects that do not use releases
• Broken Link Checker and SEO Meta & Content Auditor for the docs sites around those projects
• Hacker News Brand Monitor to catch the discussion when a release lands