# Updating Deps

> Update Python dependencies using UV. Scan for outdated packages, identify unused dependencies, and safely update pyproject.toml while respecting version constraints (e.g., Django LTS). Use when this capability is needed.

- Skill: `tomevault-io/updating-deps` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/updating-deps`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/updating-deps/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/updating-deps

---


# Dependency Update Workflow

A structured approach for updating Python dependencies in this UV-managed project.

## Prerequisites

- This project uses **UV** for dependency management (never pip directly)
- Dependencies are in `pyproject.toml` under `[project] dependencies` and `[dependency-groups] dev`
- Django is pinned to 5.2.x LTS (`>=5.2.x,<6.0`)

## Step 1: Check Outdated Dependencies

```bash
uv pip list --outdated
```

This shows all outdated packages. Focus on **top-level dependencies** listed in `pyproject.toml`.

## Step 2: Identify Unused Dependencies

For each suspicious dependency, search for actual usage:

```bash
# Check for imports
grep -r "from <package>|import <package>" src/

# Check if it's a transitive dependency
uv pip show <package> | grep -i "required-by"
```

### Known Transitive Dependencies (safe to remove from explicit deps)

These are pulled in automatically by other packages:
- `multidict` - transitive from aiohttp/aiogram
- `pygments` - transitive from mkdocs-material, pytest

### Type Stubs Belong in Dev

Move `types-*` packages to `[dependency-groups] dev`, not production dependencies.

## Step 3: Categorize Updates

### Safe Updates (patch/minor, no breaking changes)
- Patch versions: `1.2.3` → `1.2.4`
- Minor versions with good release notes: `1.2.x` → `1.3.x`

### Needs Review (major versions)
- Major bumps: `1.x` → `2.x`
- Check release notes/changelog before updating

### Version-Pinned Dependencies
- **Django**: Keep at latest 5.2.x LTS (`>=5.2.x,<6.0`)
- Check classifier in pyproject.toml: `"Framework :: Django :: 5.2"`

## Step 4: Apply Updates

Edit `pyproject.toml` directly, then sync:

```bash
uv sync --dev
```

## Step 5: Verify

Run all checks to ensure nothing broke:

```bash
make check
```

This runs: format, lint, mypy, i18n-check

## Common Patterns

### Remove Unused Dependency
1. Search for usage: `grep -r "import <pkg>" src/`
2. Check reverse deps: `uv pip show <pkg> | grep Required-by`
3. Remove from pyproject.toml
4. Run `uv sync --dev`

### Move to Dev Dependencies
1. Remove from `[project] dependencies`
2. Add to `[dependency-groups] dev`
3. Run `uv sync --dev`

### Pin to Major Version
```toml
# Allow patches within LTS
"django>=5.2.11,<6.0"
```

## Dependencies Removed (2026-02-04)

For reference, these were removed as unused/transitive:
- `django-extension` - typo (django-extensions already present)
- `django-money` - unused
- `freezegun` in prod - duplicate (already in dev)
- `multidict` - transitive from aiohttp
- `ninja-schema` - unused
- `pyopenssl` - unused
- `pygments` - transitive from dev deps
- `types-tqdm` - moved to dev
- `piexif` - moved to dev (only used in tests)

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/letsrevel) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-11 -->