Monitor Node.js dependencies

This recipe shows how to track Node.js package versions deployed in your applications. You will scrape version information from package.json and compare it against upstream GitHub releases.

Prerequisites

• A running Planekeeper instance with at least one active agent
• A Git repository containing a package.json file

Step 1: Create a gather job for the upstream package

Most popular npm packages host their releases on GitHub. Create a gather job pointing to the package’s GitHub repository.

1. Navigate to Gather Jobs in the sidebar
2. Click Create Gather Job
3. Fill in the fields:

4. Click Create

The tag filter ^\d+\.\d+\.\d+$ ensures only clean semver tags are included, filtering out any non-release tags.

Step 2: Scrape your deployed version from package.json

Option A: Track the application version

If your package.json contains your application’s own version:

{
  "name": "my-api",
  "version": "2.1.0"
}

1. Navigate to Scrape Jobs in the sidebar
2. Click Create Scrape Job
3. Fill in the fields:

4. Click Create

Option B: Track a specific dependency version

If you want to monitor a specific dependency:

{
  "dependencies": {
    "express": "^4.18.2",
    "lodash": "^4.17.21"
  }
}

1. Create a scrape job with:

2. Click Create

Option C: Use Regex for cleaner extraction

For dependency versions with range prefixes, the Regex parser gives more control:

This strips any ^, ~, >= prefix and extracts only the version number.

Step 3: Create a rule

1. Navigate to Rules in the sidebar
2. Click Create Rule
3. Fill in the fields:

4. Click Create

Step 4: Create an alert config

1. Navigate to Alert Configs in the sidebar
2. Click Create Alert Config
3. Fill in the fields:

4. Click Create

Monitoring multiple dependencies

To monitor several dependencies from the same repository, create separate scrape jobs for each one – each with a different parse expression targeting the specific dependency.

Each scrape job pairs with its own gather job (pointing to the dependency’s GitHub repo) and shares the same rule through separate alert configs.