Rank and triage dependency risk with GitHub, OSV, Slack, npm, PyPI and OpenAI
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This AI workflow has 33 nodes and runs on a schedule (every week at 08:00). Along the way it connects GitHub, OpenAI Chat Model and Slack. It also calls api.osv.dev over HTTP.
How it runs
Trigger: On a schedule (every week at 08:00).
- Settings (Edit Fields (Set)): sets 9 fields: repos, python_manifest, issue_owner…
- List Your Repos (Code): runs custom JavaScript code
- Read package.json (GitHub): get (file)
- Read The Python Manifest (GitHub): get (file)
- Open package.json (Extract from File): extracts data from a file (text)
- Open The Python Manifest (Extract from File): extracts data from a file (text)
- Both Manifests (Merge): merges the data from its input branches
- List The Dependencies (Code): runs custom JavaScript code
- One Batch Of Packages (Loop Over Items (Split in Batches)): loops over the items in batches
- Build The Shortlist (Code): runs custom JavaScript code
…plus 20 more steps. See the full node list below.
Services it uses
HTTP calls to: api.osv.dev
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (15)
- Schedule Trigger
n8n-nodes-base.scheduleTrigger - Edit Fields (Set)
n8n-nodes-base.set - Code
n8n-nodes-base.code - GitHub
n8n-nodes-base.github - Extract from File
n8n-nodes-base.extractFromFile - Merge
n8n-nodes-base.merge - Loop Over Items (Split in Batches)
n8n-nodes-base.splitInBatches - Filter
n8n-nodes-base.filter - HTTP Request
n8n-nodes-base.httpRequest - If
n8n-nodes-base.if - No Operation, do nothing
n8n-nodes-base.noOp - Basic LLM Chain
@n8n/n8n-nodes-langchain.chainLlm - OpenAI Chat Model
@n8n/n8n-nodes-langchain.lmChatOpenAi - Data table
n8n-nodes-base.dataTable - Slack
n8n-nodes-base.slack
From the author
Quick overview This workflow runs weekly to scan GitHub repositories for JavaScript and Python dependencies, checks their release health via npm/PyPI and known vulnerabilities via OSV, then ranks the highest-risk packages and posts a single Slack digest and…