How to get an email when a GitHub repo publishes a release

Open the repository on GitHub, click Watch, choose Custom, tick Releases, and make sure email delivery is switched on in your notification settings — that is the whole answer for a repository you already know you care about, and it is free. The four other options below exist because that one has real limits: it needs a GitHub account, it covers only repositories you thought to subscribe, and it says nothing about the hundreds of packages underneath the handful you watch. Every fact on this page was checked against a primary source on 1 August 2026, and each source is linked at the bottom.

1. GitHub’s custom watch — the direct answer

GitHub’s own watch settings send a release email without any third-party tool. On a repository page, the Watch button opens a menu, and GitHub Docs describes the granular option in its own words: “If you want to further customize notifications, click Custom, then select specific events that you want to be notified of, such as Issues or Pull Requests, in addition to participating and @mentions.” Releases are among the event types selectable there, alongside issues, pull requests, security alerts and discussions, so a repository can be subscribed to releases and nothing else — which is what stops a busy repository from filling an inbox with issue traffic.

One precondition catches most people who set this up and then hear nothing. GitHub Docs states it plainly: “You’ll only receive notification emails if you’ve chosen to receive email notifications in your notification settings.” Watching a repository for releases sets what GitHub notifies about; the account-level notification settings decide whether any of it reaches email at all. Both have to be right. Use custom watch for the handful of repositories a project genuinely depends on.

2. The repository’s releases.atom feed — no account, no permission

Every public GitHub repository publishes an Atom feed of its releases at https://github.com/OWNER/REPO/releases.atom, and reading it requires no account, no token and no relationship with the repository. Fetched unauthenticated on 1 August 2026, https://github.com/prisma/prisma/releases.atom returned HTTP 200 with content type application/atom+xml and 10 entries; the same request against astral-sh/ruff returned 10 entries and the tags 0.16.1 and 0.16.0. Point any feed reader that emails — or a scheduled script — at that URL and the release stream arrives without touching notification settings.

Two limits are worth knowing before relying on an Atom feed. The feed carries the 10 most recent releases only, so a reader that polls less often than a repository ships can miss entries in between. And the feed does not filter prereleases: the Prisma feed read on 1 August 2026 led with 7.10.0-dev.49 and 7.10.0-dev.48, which are development tags rather than shipped versions. A feed reader pointed at a repository that tags nightlies will email a nightly. Filtering on the tag name is the fix, and it has to be done on the reader’s side.

3. Dependabot alerts — a different question, often confused with this one

Dependabot alerts answer “is something I depend on vulnerable”, not “has something I depend on shipped”. GitHub Docs defines the trigger precisely: an alert fires when “a new vulnerability is added to the GitHub Advisory Database” or when “your dependency graph changes”, and only advisories reviewed by GitHub trigger alerts at all. A release with no security implication produces no Dependabot alert, which makes Dependabot a poor substitute for release notifications and an excellent complement to them.

The delivery rule is the part that surprises people, and GitHub Docs states it as two conditions that must both hold: GitHub emails new alerts to people who “have write, maintain, or admin permissions to a repository” and “are watching the repository and have enabled notifications for security alerts”. Write access is the gate. Dependabot will not tell anyone about a vulnerability in a repository they merely use, only in repositories they can commit to — so for a dependency owned by someone else, Dependabot is silent by design.

4. NewReleases.io — one list across GitHub and the package registries

NewReleases.io watches release streams and emails them, and its reach is wider than GitHub alone. Its pricing page, read on 1 August 2026, advertises a plan with “No credit card required!” and lists GitHub, GitLab, Codeberg, Gitea, Bitbucket and GNU Savannah alongside package registries including npm, PyPI, Maven Central, Cargo, RubyGems, Packagist, NuGet, Hex and Docker Hub. The same page describes importing a watch list straight from a dependency manifest — package.json, requirements.txt, go.mod, Cargo.toml, pom.xml, Gemfile or composer.json — and delivering to email, Slack, Discord, Telegram, Microsoft Teams, Matrix or a webhook.

The pricing page read on 1 August 2026 did not state a per-account limit on how many projects the free plan tracks, and carried no paid-tier names or prices in the content served, so no figure is quoted here. Anyone deciding on that basis should check the current page rather than trust a number repeated second-hand. The reason to reach for a service like this over custom watch is the manifest import: a watch list built by hand covers what someone remembered, and a watch list built from a lockfile covers what a project actually uses.

5. The Standup — the surface area around the repos you already watch

The Standup does not answer the literal question on this page, and saying so is the point of putting it last. The Standup is one wire with one daily email: tagged releases from the repos it tracks, vendor changelogs, reviewed high and critical CVEs, and live platform outages, in the same order for every reader. There is no per-reader watch list, no way to add a repository to a personal feed, and no alert the minute a named repository cuts a tag. Anyone who needs that should use custom watch, which does it properly and costs nothing.

What a daily wire covers is the gap the other four options leave. Custom watch reports the repositories someone already thought of. Dependabot reports vulnerabilities in repositories someone can commit to. Neither reports the outage at the platform a service deploys to, the changelog entry from a vendor nobody set up a watch for, or the advisory in a transitive dependency three levels down. The Standup is free to read in full, the archive is open, and the daily email is double opt-in with one-click unsubscribe.

The five options compared

Each row states what the tool emails, whether a per-repository list is possible, what account it needs, and what it costs, as verified on 1 August 2026.

Which one to pick

For fewer than about twenty repositories that a team genuinely depends on, GitHub’s custom watch is the right tool and nothing else is needed: it is free, it is first-party, and releases can be selected without subscribing to issue traffic. For a watch list that should mirror a lockfile rather than someone’s memory, a service that imports dependency manifests — NewReleases.io is the one checked here — removes the step where a dependency gets added to a project and never added to the watch list. For a pipeline or a script, the releases.atom feed needs no account and no token, at the cost of handling prereleases and the 10-entry window.

Security advisories deserve their own answer, because release notifications do not cover them and Dependabot only covers repositories with write access. Reading a reviewed-CVE feed is the gap-filler there. Most working setups end up as two things rather than one: a per-repository watch for the short list that matters most, and a digest for everything moving around it.

Common questions

Can I watch a repository for releases only, without issues and pull requests?

Yes. The Custom option in a repository’s Watch menu selects specific event types, and releases is one of them, so a subscription can cover releases while leaving issues and pull requests unsubscribed. GitHub Docs describes Custom as the way to “select specific events that you want to be notified of”. Selecting releases alone is the standard way to follow an active repository without its issue tracker.

I am watching a repository for releases but no email arrives. Why?

The most common cause is that email delivery is off at the account level, which silences the subscription without changing it. GitHub Docs is explicit: “You’ll only receive notification emails if you’ve chosen to receive email notifications in your notification settings.” Check the account’s notification settings for email delivery first, then confirm the repository’s watch state is Custom with releases ticked rather than the default. A repository that has not tagged a release since the subscription was created is the other explanation — releases fire on tagged releases, not on commits or merges.

Does the releases.atom feed include prereleases?

Yes, and that catches people using Atom feeds to drive alerts. The feed at https://github.com/prisma/prisma/releases.atom, fetched on 1 August 2026, led with 7.10.0-dev.49 and 7.10.0-dev.48 — development tags, not shipped releases. GitHub serves the release stream as tagged, so filtering prereleases out is the reader’s job, usually by matching on the tag name. A repository that tags nightlies will produce a nightly notification through an unfiltered feed reader.

Is there a way to follow releases without a GitHub account?

The releases.atom feed is public and needs no account: fetched with no credentials on 1 August 2026, both github.com/prisma/prisma/releases.atom and github.com/astral-sh/ruff/releases.atom returned HTTP 200 with content type application/atom+xml. Any feed reader can consume that URL, and readers that send email turn it into release notifications without a GitHub login. A daily digest is the other account-free route — The Standup’s needs only an email address.

Will Dependabot tell me when a dependency publishes a new version?

No. Dependabot alerts fire on vulnerabilities, not versions: GitHub Docs ties an alert to a new vulnerability being “added to the GitHub Advisory Database” or to a change in the dependency graph, and only GitHub-reviewed advisories trigger one. A routine release with no security content produces no alert. Dependabot version updates are a separate feature that opens pull requests rather than sending release email.

Sources

Every claim above traces to one of these, each fetched on 1 August 2026. Prices and product behaviour change without notice — check the source rather than this page if a decision rests on it.

GitHub Docs — Configuring notifications — The custom watch option and the email-delivery precondition. Fetched 1 August 2026.

GitHub Docs — About Dependabot alerts — What triggers an alert, who is emailed, and which advisories qualify. Fetched 1 August 2026.

github.com/prisma/prisma/releases.atom — Fetched unauthenticated 1 August 2026: HTTP 200, application/atom+xml, 10 entries.

NewReleases.io pricing — The free plan and the sources it watches. Fetched 1 August 2026.

Where to go next

What the wire covers is the full list of the nine kinds on the feed and how the daily email works. Releases and changelogs is the archive filtered to what vendors shipped. Advisories and outages is the reviewed-CVE and live-incident view. The wire is the current feed, newest first.