Getting started
Sign up, add your first lockfile, and tune your digest in about ten minutes.
DevUpdate.io watches release notes and the underlying git diffs for the libraries you depend on, so you can find out what actually changed before you update. This page walks you through the first three things to do once your account exists.
1. Add your first lockfile #
Start here. A lockfile is your whole project in one file, so a single upload turns everything on at once: every pinned version is matched against OSV/GHSA advisories, each package is looked up against its registry and the resolved repo added as a tracked source, and you get available upgrades with their risk plus the ones a parent constraint blocks.
Open the Lockfiles tab. Two ways in:
- Connect a GitHub repo (public or private) so we fetch the lockfile on a schedule and recompute as you commit. See Live lockfile connection.
- Upload a file once, in any of the supported formats:
package-lock.json,yarn.lock,pnpm-lock.yaml,go.sum,Cargo.lock,poetry.lock,uv.lock,Pipfile.lock,requirements.txt, orcomposer.lock.
You'll get a checklist of discovered packages; pick which ones to start tracking for release notes. The security audit doesn't wait for that choice, or need it: an advisory match needs only the ecosystem, name, and version, so it covers every pinned dependency from the moment the file lands.
Only the lockfile is read. Your source code never leaves your machine, and we never ask for it.
On the Hobbyist (free) tier you can track up to 1,000 sources across 2 lockfiles, enough to fully cover a full repo: a frontend and a backend lockfile. Need more lockfiles? See Billing → Plans.
2. Add individual sources (optional) #
A source is anything that publishes releases, typically a GitHub repository, but also static release-notes pages from vendors like Google. Your lockfile already added one per package it resolved, so this step is for the things a lockfile can't name: a project you follow but don't depend on, or a vendor API changelog that isn't a package at all.
From the dashboard, open the Sources tab and click Add source. Paste
the GitHub URL (https://github.com/<owner>/<repo>) and submit.
We immediately fetch the latest tagged releases via the GitHub API, queue diff analysis against the previous tag, and start polling for new releases. Active sources are checked about hourly; quiet ones are polled less often (at least daily) and snap back to hourly the moment they ship. The first summary usually appears within a minute.
3. Tune your digest #
Once releases are flowing, you probably don't want a notification for every patch. From Settings → Digests you can pick a daily or weekly schedule, choose your timezone, and decide what threshold counts as "worth emailing about."
What's next #
- Understand what shows up on the dashboard: Pulse feed.
- Learn how the risk number is computed: Risk scoring.
- Hook DevUpdate up to Claude or Cursor: MCP server.