Activity

Activity is the organization's history, newest first. Every member can read it. Filter it by kind — Dependencies, Notes, Allowlist, Policy, Repositories, MCP keys — or search by package.

Dependency changes

From a repository's second scan on, each scan compares the packages it found with the scan before. A package added to or removed from the default branch is recorded with:

• the repository and the manifests it is declared in;
• the newest commit that changed the manifest, with its message and author;
• the pull request that commit was merged in, if any;
• the person: the one who merged the pull request, else the one who pushed, else the commit's author.

A row reads like octocat added npm chart.js to acme/web, with links to the person, the pull request and the commit on GitHub.

The first scan of a repository records nothing: it is the starting point. A scan that skipped files is not compared, so a skipped file never shows up as a removed package.

Governance changes

Changes made in Depos are recorded as they happen:

• notes added, edited or deleted;
• allowlist entries added, edited or deleted, and baselines;
• policy mode changes;
• changes to the pull request check scope;
• repositories added to or removed from Depos;
• MCP keys added or deleted (see AI agents).

Where else it shows

• A package's page has a History card with its own changes.
• A repository's page has a History card with the packages added to or removed from it.
• Home shows the latest changes.

Deleted notes and entries, removed repositories, and repositories no longer in the GitHub App installation keep their history.