GitHub Dependency Release Monitor

Buyer: engineering, security, platform, and product teams that maintain a known public dependency allowlist.

Result: typed NEW_RELEASE rows for first-seen GitHub releases and SOURCE_CORRECTION rows when a previously tracked release changes materially. Each event includes the exact GitHub release page, tag, prerelease flag, notes, fingerprint, and replay-safe watchlist state.

Official source: GitHub's public releases API and the publisher-controlled html_url for each release.

First useful run: the Store prefill checks apify/apify-sdk-python, emits at most one event, evaluates at most 10 releases, and caps event charges at $0.04. An unchanged replay emits nothing and costs $0.00.

Source-backed example

Verified against GitHub on November 3, 2026: apify/apify-sdk-python release v4.2.0 was published October 30, 2026 and links to:

https://github.com/apify/apify-sdk-python/releases/tag/v4.2.0

The release notes include SDK changes such as support for task charge ceilings and child-run handling. The Actor preserves GitHub's release title, publication timestamp, notes, tag, prerelease flag, and exact release URL; it does not infer vulnerability, compatibility, or upgrade urgency.

60-second quick start

{
  "watchlistId": "apify-python-release-preview",
  "repositories": ["apify/apify-sdk-python"],
  "baselineMode": "emit_matches",
  "maxEvents": 1,
  "maxTotalChargeUsd": 0.04,
  "maxSourceRecords": 10,
  "stateStoreName": "apify-python-release-preview",
  "resetState": false,
  "qualityTestMode": false
}

For production, use baselineMode: "silent" once under a stable watchlist and state-store name, then schedule the identical repository allowlist. That baseline records current releases without charging; later new or corrected releases become events.

Events and pricing

• NEW_RELEASE / dependency-release-new — $0.04
• SOURCE_CORRECTION / github-release-dependency-watch-source-correction — $0.01

maxEvents and maxTotalChargeUsd bound each run. Candidates deferred by either cap remain pending instead of entering delivered state, so they can emit on a later run. Unchanged, empty, failed-source, and silent-baseline runs produce zero paid events.

Illustrative output shape

Illustrative — not a run receipt. The source-backed example above identifies a real release; this shape documents the event contract.

{
  "eventType": "NEW_RELEASE",
  "sourceId": "apify/apify-sdk-python:428974193",
  "title": "apify/apify-sdk-python 4.2.0",
  "publishedAt": "2026-10-30T11:52:50Z",
  "metadata": {
    "repository": "apify/apify-sdk-python",
    "tag": "v4.2.0",
    "prerelease": false
  },
  "sourceRecordUrl": "https://github.com/apify/apify-sdk-python/releases/tag/v4.2.0",
  "sourceFingerprint": "sha256:…"
}

Recommended workflow

1. use the bounded preview to inspect the event shape;
2. create a stable production watchlist for repositories you actually depend on;
3. run a silent baseline once;
4. schedule hourly, daily, or weekly according to upgrade urgency;
5. route events to dependency review, release-note triage, or ticket automation;
6. verify compatibility and security consequences against the project and your own dependency graph.

Limitations

• public repositories only; this Actor does not authenticate to private repositories.
• input is an explicit repository allowlist, not automatic dependency-file discovery.
• GitHub API availability and unauthenticated rate limits apply.
• maxSourceRecords is a global processing cap; the GitHub endpoint returns at most 100 releases per repository request.
• a release event is not a vulnerability alert, compatibility verdict, or recommendation to upgrade.
• release notes are publisher-controlled text and may be incomplete or corrected later.

Buyer bundle

Pair this Actor with a ticketing webhook or your software-composition-analysis process: this monitor supplies source-linked release deltas; your dependency inventory determines relevance; your security and engineering teams decide action.