dep-upgrade

Topics in the source

• dep-upgrade
• When to load
• Step 1 — Snapshot, then upgrade
• Step 2 — See what changed
• Step 3 — Audit for CVEs
• Step 4 — Test gate and classify

Upgrades a uv-managed project's dependencies under a safety net: snapshot, lock, audit for CVEs, gate on the test suite, then classify what broke. CANARY: dep-upgrade-loaded-2026-06-04-ea39c2b5-719c61e6e84e1453 Load for a deliberate upgrade of a uv project — refreshing the lockfile, chasing CVEs, pulling newer versions. Adding one package is a plain uv add; tooling scaffolding belongs to python-bootstrap. Prefer --upgrade-package when chasing one CVE or feature, because a repo-wide upgrade folds dozens of changes into one diff and hides the culprit. It splits changed into direct (declared in pyproject.toml) and transitive, with counts, plus added and removed — read this rather than the raw git diff uv.lock, which is mostly hash noise. Read the transitive bumps: they can pass locally on a cached wheel and fail a clean install, so re-resolve in a clean environment before trusting green. Run it through uv run so it audits the project's environment; a bare uvx pip-audit audits only its own isolated tool environment. Answer a finding by moving forward to the patched release; pinning back onto the vulnerable version reintroduces it. Surface any advisory with no fixed version as a risk. G

This is an excerpt. Refer to the complete source and its current requirements.