n8n Dependency Risk Triage: GitHub + OSV to Slack Digest

n8n Dependency Risk Triage: GitHub + OSV to Slack Digest

Stay ahead of vulnerable and stale dependencies. This n8n workflow scans your listed GitHub repositories every Monday, cross-checks JavaScript and Python dependency health with npm/PyPI and vulnerability data from OSV, ranks the highest-risk packages, and delivers a single Slack digest—automatically creating a GitHub issue when replacements are needed.

What this workflow does

• Weekly GitHub dependency inventory: Runs every Monday morning, reads package.json and a configured Python manifest (e.g., pyproject.toml or requirements.txt) from each listed GitHub repository, and extracts dependency names and versions (normalizing version ranges to bare numbers).
• Release and maintenance signals: Looks up each dependency in npm or PyPI to capture the latest version, last release date, deprecation/yank status, and basic maintenance indicators.
• Vulnerability verification with OSV: Queries OSV for advisories affecting the specific dependency version, filters out findings that are already fixed, and flags advisories with no fix available.
• Risk scoring and verdict: Calculates a risk score and a clear verdict (replace/upgrade/watch/fine) based on staleness, deprecation, severity, and fix availability, then builds a ranked shortlist.
• Actionable Slack output + GitHub follow-up: Uses an OpenAI-compatible chat model to generate one actionable sentence per shortlisted package, upserts results into an n8n Data Table, posts a single Slack summary, and creates one GitHub issue when any packages are marked for replacement.

Use cases

• Weekly security hygiene for SaaS teams maintaining both Node.js and Python services.
• Dependency risk visibility for automation engineers who want fewer alerts and more prioritized actions.
• Hands-off triage: digest to Slack, then GitHub issue creation only when replacements are required.

Technical details

• Integrations: GitHub (read repositories + open issues), Slack (single digest message).
• Workflow nodes: if, set, code, no op, merge, slack.
• External checks: npm/PyPI lookup for release health and OSV for vulnerability advisories.
• AI assistance: OpenAI-compatible chat model for one actionable sentence per risky package.

Setup (high level)

• Add a GitHub credential with access to the repositories you want to scan and the repository where issues should be created.
• Add a Slack credential (cr) and configure the destination for the weekly digest.