DepExit: the lazy way to find out which dependencies are about to die
This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady What I Built Auditing a neglected Python codebase is a dull job. You read changelogs, check which packages are abandoned, guess at replacements, and hope the migration doesn't break anything. That's a day or two of…
DepExit is a tool designed to simplify the process of identifying and addressing risky dependencies in neglected Python codebases. Users simply point it at a repository, and it performs several tasks autonomously. First, DepExit analyzes the project's dependencies, identifying which ones are at risk of being abandoned or outdated.
Next, it employs the Gemma 4 language model to suggest replacement packages for those at-risk dependencies. However, before accepting any suggested replacement, DepExit puts it to the test by applying the plan to an isolated copy of the project, re-installing all dependencies, and running the tests. This ensures that the proposed changes do not break anything and that the migration is safe.
DepExit records the results of each step in a Dependency Exit Capsule, which includes a JSON record, a readable Markdown page, and a patch. These capsules contain information tagged as OBSERVED, MEASURED, AI-SUGGESTED, or AI-VERIFIED, allowing users to see which information came from files, which was obtained through running code, and which is only the model's suggestion.
The tool uses only the Python standard library, making it easy to install and run without any additional dependencies. The tool's design is based on the principle that Gemma proposes changes, and execution decides whether they are safe. Deterministic code parses the project's dependencies, walks through the codebase to find imports and monkey patches, installs the project in a clean virtual environment, and runs tests to verify the changes.
DepExit's results include the number of dependencies analyzed, the number at risk, the number of Gemma 4 plans verified by execution, and the number of tests before and after verification. In a demonstration, DepExit analyzed the LinkWatch repository, finding 16 dependencies, of which 10 were at risk. Out of these, Gemma 4 generated plans for 10 replacements, all of which were verified by execution.
The tests showed that 9 out of 10 original tests passed, and all verified plans were applied successfully, resulting in 23 out of 23 tests passing. The full report, along with the generated patches, can be found in the examples/linkwatch-run directory of the DepExit repository. The tool was built with the rule that Gemma proposes changes, and execution decides whether they are safe, ensuring that any migration is verified and tested before being accepted.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
