depsmith

Prepare, review and apply dependency updates for a repository, from a Rust CLI or a typed Python API. Each target is resolved by its own package manager in a disposable copy of the repository. You review the exact file and dependency changes, and the reviewed files are then written without resolving again.

• Supported: Pixi (pixi.toml, Pixi-managed pyproject.toml), GitHub Actions workflow references, Cargo (Cargo.lock owners), conda (environment.yml locked with conda-lock), uv (pyproject.toml with uv.lock) and npm (package.json with package-lock.json).
• Safe by default: updates keep your constraints. Proposals go stale if the repository changes, and interrupted writes can be recovered.
• Evidence-backed suggestions for pins that block newer releases, which you can accept in the same declaration style.
• Optional vulnerability scanning compares before and after with one database snapshot. Packages it cannot assess are reported, never treated as clean.

📖 Documentation: the wiki

Install

pip install --pre depsmith         # Python 3.10+: CLI and Python API
cargo install depsmith             # build the CLI from crates.io (Rust 1.89+)
cargo binstall depsmith            # the release executable, via cargo-binstall
curl -fsSL https://github.com/ArjunRachithcf/depsmith/releases/latest/download/install.sh | sh

On Windows, irm https://github.com/ArjunRachithcf/depsmith/releases/latest/download/install.ps1 | iex. The install scripts download the release executable for your platform, verify it against the release's SHA256SUMS before installing anything, and install it to ~/.local/bin (%LOCALAPPDATA%\depsmith\bin on Windows); they never edit your shell startup files. While only release candidates are published, ask for one explicitly:

curl -fsSL https://github.com/ArjunRachithcf/depsmith/releases/download/v0.1.0-rc.2/install.sh | sh -s -- --version v0.1.0-rc.2

$env:DEPSMITH_VERSION = "v0.1.0-rc.2"
irm https://github.com/ArjunRachithcf/depsmith/releases/download/v0.1.0-rc.2/install.ps1 | iex

Other options: --pre (newest release including pre-releases), --prefix DIR ($env:DEPSMITH_PREFIX), and --help.

Then depsmith init checks the native tools your targets use and offers to install the missing ones. See Getting started.

Quick start

depsmith discover --root path/to/project
depsmith check    --root path/to/project --target pixi:pixi.toml
depsmith update   --root path/to/project --target pixi:pixi.toml

check writes nothing and exits 1 when updates are pending. update shows the changes and asks before applying. In CI, add --apply --yes --non-interactive --json (CI integration).

from depsmith import UpdateOptions, prepare

proposal = prepare(
    "path/to/project", targets=["pixi:pixi.toml"], options=UpdateOptions()
)
for change in proposal.changes:
    print(change.diff)
if not proposal.failures:
    proposal.apply()

Learn more

The wiki is generated from docs/wiki/, and its terms follow the glossary in CONTEXT.md.

Status

Alpha. The first release will be published to PyPI and as GitHub release binaries, with conda-forge after that (Releasing). Post-install project checks and interactive suggestion prompts are planned. New package managers plug in through one adapter module and a shared conformance suite (Architecture).

Contributing

See Development and testing and Architecture. Install the hooks with prek install --hook-type pre-commit --hook-type pre-push. Changes land through pull requests with signed commits.

License

MIT