Seems like https://greenkeeper.io/ is a similar idea with more polish (and with paid options). No affiliation, I've just seen GreenKeeper in action on the Kube Dashboard repo.
+1 for this. We've been using Greenkeeper on a number of projects and it's amazing!
Yes, this. Greenkeeper is excellent and produced by a great team.
I run 'npm-check -u' [1] every morning on my develop branch and then I run my tests. I never thought about automating that part of my workflow. Sadly I don't host on GitHub.
And the duct-taping of the NPM ecosystem goes on and on and on...
How do you mean? There's some simple native support for checking if packages are outdated (npm outdated), and there's additional tooling that ties into various exposed APIs. If this is a comment on npm not just doing everything for everyone as part of the native package then... https://en.wikipedia.org/wiki/Unix_philosophy
One of my frustrations is updating submodule deps. The above link seems interesting, but most projects I work on are small enough that hovering over the dep in pckg.json file in vscode lets me know what is the latest. At the top level, I don't have much trouble managing updatea, however what about deps of deps and so on? It is hard to update these, and sometimes it breaks/is manual. Then it is overwritten when a new npm install ia run.
How often does it send an email, and where is the changelog pulled from?
So if 10 things update tomorrow will it get 10 emails? Can it be setup to run weekly or longer?
A good thought. It sends an email on each upgrade, however in my experience it doesn't happen SO often, tops two-three times a day, depends of course on the volume of packages you use. But it's a good idea to have a daily digest, thanks for that.
My only request is that the email "digest" be configurable. Being able to set this up to notify me once per week, or even once per month would be awesome. I could spend that one time to upgrade my deps, then lock them back down again until the next one.
the changelog is a link to the changelog or history.md in the github repo
Yes it does. This is btw why we ask for the "repo" permission and not only for "public-repo" permission.
Love this idea, but can't connect a private repo to grant access to all our code. Any plans to allow uploading a package.json to achieve the same thing (understanding that it's my responsibility to keep it up to date)?
no plans for that yet but now that you raised the point...
Obligatory: dependencyci.com, which does the a very similar thing.
is it only when a package is have wild cards like *, ^ in versions or all the time?
All the time. Even if you use a specific version, wouldn't you like to be in the know about the latest version, so you may consider upgrading?