How to Automate Dependency Monitoring with n8n

By The LightCube Labs team

What You Will Need

• A self-hosted n8n instance (Community Edition is free) or an n8n Cloud trial
• A GitHub repository with a package.json file (and a read-only token if it is private)
• A Slack app with the chat:write scope, invited to #engineering
• SMTP credentials for the Send Email node
• Estimated setup time: 45 minutes

How the n8n Workflow Fits Together

This n8n workflow turns a package.json file into a ranked upgrade list. It has nine nodes: a Schedule Trigger, two HTTP Request nodes, two Code nodes, a Split Out node, an IF node, a Slack node, and a Send Email node. The first half gathers data and the second half makes decisions, which is a common pattern for n8n monitoring jobs.

The unusual part is that all version logic runs inside n8n itself. There is no external dependency scanner involved, so the n8n workflow can run on a small server, and you can change the priority rules by editing a few lines of JavaScript.

Step-by-Step Workflow Setup

Node: Schedule Trigger
Trigger Interval: Weeks
Weeks Between Triggers: 1
Trigger on Weekdays: Monday
Trigger at Hour: 8
Trigger at Minute: 0

Expression: {{ $now.toFormat("yyyy-MM-dd") }}

{
  "timestamp": "2026-11-09T08:00:00.000-08:00",
  "Day of week": "Monday"
}

Node: HTTP Request
Method: GET
URL: https://raw.githubusercontent.com/YOUR-ORG/YOUR-REPO/main/package.json
Authentication: Generic Credential Type > Header Auth (private repos only)
  Name: Authorization
  Value: Bearer ghp_yourFineGrainedToken
Options > Response > Response Format: JSON

Expression: https://raw.githubusercontent.com/{{ $json.repo }}/main/package.json

{
  "name": "acme-dashboard",
  "version": "2.4.1",
  "dependencies": {
    "express": "^4.17.1",
    "@sentry/node": "^6.19.7",
    "request": "^2.88.2",
    "lodash": "~4.17.15"
  },
  "devDependencies": {
    "jest": "^26.6.3"
  }
}

Node 1: Code (Run Once for All Items)
const pkg = $input.first().json;
const all = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
const list = Object.entries(all)
  .map(([name, range]) => ({ name, range, current: String(range).replace(/^[\^~>=<\s]+/, '') }))
  .filter(d => /^\d+\.\d+\.\d+/.test(d.current));
return [{ json: { packages: list } }];

Node 2: Split Out
Fields To Split Out: packages
Include: No Other Fields

Expression: {{ $json.name }} @ {{ $json.current }}

{
  "name": "@sentry/node",
  "range": "^6.19.7",
  "current": "6.19.7"
}

Node: HTTP Request
Method: GET
URL: https://registry.npmjs.org/{{ $json.name.replace("/", "%2F") }}/latest
Authentication: None
Options > Batching:
  Items per Batch: 10
  Batch Interval (ms): 500
Options > Response > Never Error: On

Expression: {{ $json.name.replace("/", "%2F") }}

{
  "name": "request",
  "version": "2.88.2",
  "deprecated": "request has been deprecated, see https://github.com/request/request/issues/3142"
}

Node: Code (Run Once for All Items)
const parse = v => String(v).split('-')[0].split('.').map(n => parseInt(n, 10) || 0);
const rows = [];
$input.all().forEach((item, i) => {
  const base = $('Split Out').itemMatching(i).json;
  const cur = parse(base.current), lat = parse(item.json.version);
  let gap = 'current';
  if (lat[0] > cur[0]) gap = 'major';
  else if (lat[1] > cur[1]) gap = 'minor';
  else if (lat[2] > cur[2]) gap = 'patch';
  const deprecated = Boolean(item.json.deprecated);
  const priority = deprecated ? 'P0' : gap === 'major' ? 'P1' : gap === 'minor' ? 'P2' : gap === 'patch' ? 'P3' : 'OK';
  rows.push({ name: base.name, current: base.current, latest: item.json.version,
    gap, deprecated, priority, note: item.json.deprecated || '' });
});
const order = { P0: 0, P1: 1, P2: 2, P3: 3, OK: 4 };
rows.sort((a, b) => order[a.priority] - order[b.priority]);
const critical = rows.filter(r => r.priority === 'P0' || r.priority === 'P1');
return [{ json: { rows: rows.filter(r => order[r.priority] < 4), criticalCount: critical.length, total: rows.length } }];

Expression: {{ $json.criticalCount }} critical of {{ $json.total }} packages

{
  "rows": [
    { "name": "request", "current": "2.88.2", "latest": "2.88.2", "gap": "current", "deprecated": true, "priority": "P0" },
    { "name": "@sentry/node", "current": "6.19.7", "latest": "8.34.0", "gap": "major", "deprecated": false, "priority": "P1" },
    { "name": "lodash", "current": "4.17.15", "latest": "4.17.21", "gap": "patch", "deprecated": false, "priority": "P3" }
  ],
  "criticalCount": 2,
  "total": 5
}

Node 1: IF
Conditions: Number
  Value 1: {{ $json.criticalCount }}
  Operation: is greater than
  Value 2: 0

Node 2: Slack (true branch)
Resource: Message
Operation: Send
Channel: #engineering
Text:
*{{ $json.criticalCount }} critical dependency updates this week*
{{ $json.rows.filter(r => r.priority === "P0" || r.priority === "P1").map(r => r.priority + " " + r.name + " " + r.current + " to " + r.latest).join("\n") }}

Expression: {{ $json.rows.filter(r => r.priority === "P0").length }} deprecated

{
  "ok": true,
  "channel": "C03ENGINEER",
  "message": {
    "text": "*2 critical dependency updates this week*\nP0 request 2.88.2 to 2.88.2\nP1 @sentry/node 6.19.7 to 8.34.0"
  }
}

Node: Send Email
Credential: SMTP (host, port 587, user, app password)
From Email: deps@yourcompany.com
To Email: engineering@yourcompany.com
Subject: Weekly dependency report: {{ $json.criticalCount }} critical, {{ $json.rows.length }} outdated
Email Format: HTML
HTML:
<table><tr><th>Priority</th><th>Package</th><th>Current</th><th>Latest</th></tr>
{{ $json.rows.map(r => "<tr><td>" + r.priority + "</td><td>" + r.name + "</td><td>" + r.current + "</td><td>" + r.latest + "</td></tr>").join("") }}
</table>

Expression: {{ $json.rows.length }} outdated packages

{
  "accepted": ["engineering@yourcompany.com"],
  "rejected": [],
  "response": "250 2.0.0 OK queued"
}

Extending This n8n Workflow

After a few runs, consider these upgrades to the n8n workflow. Store each week's rows in Google Sheets or a database so you can chart how long a package stays outdated. Add a second n8n branch that opens a GitHub issue for every P0 package through the HTTP Request node and the issues API, so deprecations get an owner. Finally, read package-lock.json instead of package.json for exact installed versions, as noted below in troubleshooting.

Because the report is built from structured rows, the same data can feed a dashboard or a pull request bot later without changing the n8n nodes that collect it.

Frequently Asked Questions

Does this detect security vulnerabilities?

Not directly. It flags deprecation and version distance. For known CVEs, add one more HTTP Request node that posts the dependency list to the GitHub advisory or OSV API and merge the findings into the priority logic.

Can it monitor a monorepo with several package.json files?

Yes. Put the file paths in a Set node before the fetch step, loop over them with a Split Out node, and include the path in each row so the Slack and email output groups by workspace.

Why compare versions in a Code node rather than use the semver package?

Self-hosted n8n blocks external modules in the Code node unless you allow them with an environment variable. The number comparison here covers major, minor and patch with no installation, which keeps the workflow portable to n8n Cloud.

Will this hit npm rate limits?

The public registry tolerates normal read traffic. The batching option of ten items every 500 ms keeps even large dependency trees well within polite use.