# Dependency management · Tech watch

[Canonical source](<https://sebastien.rigaux.be/en/tech-watch/tags/dependency-management>)

Tracking, updating and controlling libraries and tools used by a project.

## [NewReleases centralizes version tracking and alerts](<https://sebastien.rigaux.be/en/tech-watch/links/newreleases-centralizes-version-tracking-and-alerts>)

NewReleases tracks new project and package versions across platforms such as GitHub, npm, NuGet, and Docker Hub, then sends alerts by email, instant messaging, or webhook. It removes the need to check each dependency or tool manually.

Notifications can be instant or scheduled, and tracking can be configured from dependency files such as `package.json`, `requirements.txt`, or `go.mod`. Regular-expression and prerelease-status filters help narrow down which versions trigger alerts.

2026-11-05 · [Markdown](<https://sebastien.rigaux.be/en/tech-watch/links/newreleases-centralizes-version-tracking-and-alerts.md>) · [Original resource](<https://newreleases.io/>)

## [DeadTag turns abandoned website tags into iPhone attack paths](<https://sebastien.rigaux.be/en/tech-watch/links/deadtag-turns-abandoned-website-tags-into-iphone-attack-paths>)

Expired domains behind old analytics and advertising tags have been bought and repurposed to redirect visitors to malicious content, including the Coruna and DarkSword iOS exploit kits. Report URI and iVerify describe a chain that filters visitors and tailors its payload to the device; security scanners may receive only an empty response.

The case shows how a forgotten third-party script remains an active dependency: its domain can change hands without any site change. The article recommends auditing tags, monitoring loaded scripts, and restricting their domains with a Content Security Policy.

2026-10-29 · [Markdown](<https://sebastien.rigaux.be/en/tech-watch/links/deadtag-turns-abandoned-website-tags-into-iphone-attack-paths.md>) · [Original resource](<https://blog.report-uri.com/deadtag-how-forgotten-website-tags-became-a-delivery-network-for-iphone-spyware/>)

## [React project structure: from single file to modular monorepo](<https://sebastien.rigaux.be/en/tech-watch/links/react-project-structure-from-single-file-to-modular-monorepo>)

This comprehensive overview walks through organizing a React project, from a single file to a modular monorepo structure. The author details how to split code (files, technical folders, feature folders, domains, packages) and the impact of each approach on maintainability, dependency isolation, and scalability. Concrete examples illustrate how to evolve the architecture as the project grows, with clear rules to prevent cross-feature dependencies and encourage reuse.

2026-10-19 · [Markdown](<https://sebastien.rigaux.be/en/tech-watch/links/react-project-structure-from-single-file-to-modular-monorepo.md>) · [Original resource](<https://www.robinwieruch.de/react-folder-structure/>)

## [Npm-check-updates: identify newer dependency versions](<https://sebastien.rigaux.be/en/tech-watch/links/npm-check-updates-identify-newer-dependency-versions>)

Npm-check-updates compares package.json dependencies with available versions and can update their constraints. Installation remains a separate step, allowing review of the proposed changes.

2025-10-05 · [Markdown](<https://sebastien.rigaux.be/en/tech-watch/links/npm-check-updates-identify-newer-dependency-versions.md>) · [Original resource](<https://github.com/raineorshine/npm-check-updates>)

## [Knip: find unused dependencies, exports and files](<https://sebastien.rigaux.be/en/tech-watch/links/knip-find-unused-dependencies-exports-and-files>)

Knip analyzes project entry points and tooling to detect unused code. Framework-aware plugins make dependency, export and file cleanup more targeted.

2025-10-05 · [Markdown](<https://sebastien.rigaux.be/en/tech-watch/links/knip-find-unused-dependencies-exports-and-files.md>) · [Original resource](<https://knip.dev/>)