Upgrade risk

npm and PyPI upgrade alerts on packages you name

PyPI and npm dependency risk report with upgrade alerts. Paste a package list and start. Reads official npm registry, PyPI JSON, and OSV; GitHub is optional enrichment.

Not an OSV/GitHub security watch without a pinned package list (use OSS Vulnerability Monitor). Not an npm license-only check. Not a PyPI advisory-only scraper. You supply package names, ecosystems, and versions.

from $10.00 / 1,000 Package risk row ($0.01 per delivered package-risk-row); $0.25 per Package upgrade risk alert; $9.00 per Package portfolio risk report; $5.00 per Package risk export. No Actor Start.

Open PyPI & npm Dependency Risk Report on Apify

PyPI & npm Dependency Risk Report, not a neighboring Actor

Use this page for this Actor’s job. Use OSS Vulnerability Monitor for OSV & GitHub security advisories; Use npm License & Deprecation Checker for npm license/deprecation; Use PyPI Vulnerability Scraper for PyPI advisory watch.

Store ID: taroyamada/package-portfolio-upgrade-risk-report. Respect source terms, robots.txt, and rate limits.

Use cases

• One pinned npm package with initialRunMode baseline_only
• Leave githubToken empty unless you want repo enrichment
• Turn generateReport on after the baseline

How is PyPI & npm Dependency Risk Report different from OSS Vulnerability Monitor and npm License & Deprecation Checker?

PyPI & npm Dependency Risk Report (taroyamada/package-portfolio-upgrade-risk-report): PyPI and npm dependency risk report with upgrade alerts. Paste a package list and start. Reads official npm registry, PyPI JSON, and OSV; GitHub is optional enrichment. Not an OSV/GitHub security watch without a pinned package list (use OSS Vulnerability Monitor). Not an npm license-only check. Not a PyPI advisory-only scraper. You supply package names, ecosystems, and versions. OSS Vulnerability Monitor is for OSV & GitHub security advisories (input packages / repos; OSV / GitHub; Advisory rows). Not a pinned npm/PyPI upgrade-risk report. npm License & Deprecation Checker is for npm license/deprecation (input package names; npm registry; License rows). Not PyPI or OSV upgrade risk. PyPI Vulnerability Scraper is for PyPI advisory watch (input package names; PyPI; Advisory rows). Not npm registry upgrade risk.

What input is required?

Live required fields: none (see live fields). Published exampleRunInput is shown below.

Published Store example run input (omitted fields take schema defaults):

{
  "monitorKey": "starter-package-upgrade-risk",
  "initialRunMode": "baseline_only",
  "packages": [
    {
      "name": "lodash",
      "ecosystem": "npm",
      "version": "4.17.20"
    }
  ],
  "includeGitHub": false,
  "baselineOnly": false,
  "generateReport": false,
  "emitRawRows": false,
  "emitUnchanged": false
}

Run PyPI & npm Dependency Risk Report on Apify

How do dataset, webhook, and dry-run delivery work?

Dataset output is the billable surface when rows are written. See live PPE for which events bill. dryRun true validates or samples without the usual dataset/webhook side effects described on the Store schema. Unchanged runs that write zero default-dataset rows typically charge $0.00 on current PPE.

What does a result contain?

Published README Output Example / Sample Output JSON. Illustration: [ { "rowType": "package_portfolio_risk_report", "billingEventName": "package-portfolio-risk-report", "reportFirst": true, "changedPackageCount": 1, "advisoryCount": 1 }, { "rowType": "package_risk", "billingEventName": "package-risk-row", "packageName": "lodash", "ecosystem": "npm", "currentVersion": "4.17.20", "latestVersion": "4.17.21", "riskLevel": "high", "vulnerabilityCount": 1 }, { "rowType": "package_upgrade_risk_alert", "billingEventName": "package-upgrade-risk-alert", "alertReason": "known_vulnerability" } ] Treat README samples as illustrations, not a live coverage guarantee. There is no published output JSON schema on the Store page.

How is PyPI & npm Dependency Risk Report priced?

Billing is pay per event. The live Store card is from $10.00 / 1,000 Package risk row ($0.01 per delivered package-risk-row); $0.25 per Package upgrade risk alert; $9.00 per Package portfolio risk report; $5.00 per Package risk export. No Actor Start. Current PPE:

from $10.00 / 1,000 Package risk row ($0.01 per delivered package-risk-row); $0.25 per Package upgrade risk alert; $9.00 per Package portfolio risk report; $5.00 per Package risk export. No Actor Start.

See PyPI & npm Dependency Risk Report pricing on Apify

Limits to keep in mind

• No required array; supply packages
• Public registries only
• GitHub token optional
• Not a lockfile parser
• Respect source terms, robots.txt, and rate limits.

Open PyPI & npm Dependency Risk Report on Apify

Related pages

• OSS Vulnerability Monitor — Not a pinned npm/PyPI upgrade-risk report.
• npm License & Deprecation Checker — Not PyPI or OSV upgrade risk.
• PyPI Vulnerability Scraper — Not npm registry upgrade risk.
• Tools