depsmith

Prepare, review and apply dependency updates for a repository, from a Rust CLI or a typed Python API. Each target is resolved by its own package manager in a disposable copy of the repository. You review the exact file and dependency changes, and the reviewed files are then written without resolving again.

• Supported: Pixi (pixi.toml, Pixi-managed pyproject.toml), GitHub Actions workflow references, Cargo (Cargo.lock owners), conda (environment.yml locked with conda-lock) and uv (pyproject.toml with uv.lock).
• Safe by default: updates keep your constraints. Proposals go stale if the repository changes, and interrupted writes can be recovered.
• Evidence-backed suggestions for pins that block newer releases, which you can accept in the same declaration style.
• Optional vulnerability scanning compares before and after with one database snapshot. Packages it cannot assess are reported, never treated as clean.

📖 Documentation: the wiki

Install

python -m pip install .   # from a checkout; Python 3.10+
depsmith init             # checks the native tools your targets use; offers to install missing ones

A standalone executable builds with cargo build --release --locked -p depsmith-cli (Rust 1.89+). See Getting started.

Quick start

depsmith discover --root path/to/project
depsmith check    --root path/to/project --target pixi:pixi.toml
depsmith update   --root path/to/project --target pixi:pixi.toml

check writes nothing and exits 1 when updates are pending. update shows the changes and asks before applying. In CI, add --apply --yes --non-interactive --json (CI integration).

from depsmith import UpdateOptions, prepare

proposal = prepare(
    "path/to/project", targets=["pixi:pixi.toml"], options=UpdateOptions()
)
for change in proposal.changes:
    print(change.diff)
if not proposal.failures:
    proposal.apply()

Learn more

The wiki is generated from docs/wiki/, and its terms follow the glossary in CONTEXT.md.

Status

Alpha. The first release will be published to PyPI and as GitHub release binaries, with conda-forge after that (Releasing). Post-install project checks and interactive suggestion prompts are planned. New package managers plug in through one adapter module and a shared conformance suite (Architecture).

Contributing

See Development and testing and Architecture. Install the hooks with prek install --hook-type pre-commit --hook-type pre-push. Changes land through pull requests with signed commits.

License

MIT