Our review

Manages Python dependencies in a uv-based project, including auditing, updating, and compatibility checks.

Strengths

Automates updates with test verification
Detects outdated packages and security vulnerabilities
Respects version constraints (torch, sentence-transformers, neo4j)
Handles both main and dev dependencies

Limitations

Requires uv installed and a project configured with pyproject.toml
Only works for Python >=3.13
Security audit depends on the pip-audit tool (not directly integrated)

When to use it

For maintaining a Python project cleanly, checking versions, and applying updates without breaking compatibility.

When not to use it

For projects not using uv, older Python environments, or dependencies not managed via pyproject.toml.

name: deps description: Check, audit, and update Python dependencies invocation: user

Dependency Manager

Check, audit, and update Python dependencies.

Project Setup

Package manager: uv
Config: pyproject.toml
Lock file: uv.lock
Build system: hatchling
Python: >=3.13

Commands Reference

# Check installed versions
uv pip list

# Check outdated packages
uv pip list --outdated

# Sync dependencies
uv sync
uv sync --extra dev

# Add dependency
uv add <package>
uv add --dev <package>
uv add "<package>>=1.0,<2.0"

# Remove dependency
uv remove <package>

# Update lock file
uv lock

# Update specific package
uv lock --upgrade-package <package> && uv sync

# Update all
uv lock --upgrade && uv sync

Instructions

"check" or "status" (default)

Run uv pip list to show installed packages
Run uv pip list --outdated to show outdated packages
Present a summary table of current vs latest versions
Highlight packages with major version updates (potential breaking changes)

"update" or "upgrade"

Show what would be updated (uv pip list --outdated)
Ask user to confirm before proceeding
For specific package: uv lock --upgrade-package <name> && uv sync
For all: uv lock --upgrade && uv sync
After updating, run uv run pytest to verify nothing broke
If tests fail, identify which update caused failure and suggest reverting

"add <package>"

Determine if main or dev dependency
Run uv add <package> or uv add --dev <package>
Verify in pyproject.toml
Run uv run pytest to verify compatibility

"remove <package>"

Search for imports of the package in the codebase
Warn if the package is imported anywhere
Run uv remove <package>
Run uv run pytest to verify

"audit" or "security"

Run uv pip list to get all packages
Check for known vulnerabilities (suggest pip-audit if available)
Report findings with severity and recommended actions

Key Considerations

torch is very large (~2GB). Updates should be deliberate.
litellm updates frequently and may introduce breaking changes.
sentence-transformers must remain compatible with the project's embedding model.
neo4j driver version must match the server version (currently 5-community).
Always run tests after any dependency change.
uv.lock should be committed after dependency changes.

Rules

NEVER remove a dependency without checking for usage first
NEVER update torch or sentence-transformers without explicit user consent
Always run tests after dependency changes
If uv sync fails, check Python version compatibility (requires >=3.13)

Python Dependency Manager

Recommended for