Dependency Management Python Packages

tach

A Python tool to visualize + enforce dependencies, using modular architecture 🌎 Open source 🐍 Installable via pip 🔧 Able to be adopted incrementally - ⚡ Implemented with no runtime impact ♾️ Interoperable with your existing systems 🦀 Written in rust

safety

Safety checks Python dependencies for known security vulnerabilities and suggests the proper remediations for vulnerabilities detected.

uv-iso-env

Isolated Environment re-written using uv

upd

Local-first dependency updates for polyglot repositories—Python, Node.js, Rust, Go, Ruby, .NET, Terraform, GitHub Actions, pre-commit, and Mise.

micropipenv

A lightweight wrapper for pip to support requirements.txt, Pipenv and Poetry lock files or converting them to pip-tools compatible output. Designed for containerized Python applications but not limited to them.

continuous-delivery-scripts

Git-based CI/CD tools for semantic releases, changelogs, SPDX SBOMs, third-party IP and licence reports

upd-cli

Local-first dependency updates for polyglot repositories—Python, Node.js, Rust, Go, Ruby, .NET, Terraform, GitHub Actions, pre-commit, and Mise.

django-upgrade-report

Which of your dependencies block a Django upgrade, and in which order to upgrade them.

fyn

Fyn is a fork of uv for fast Python package management, dependency resolution, virtual environments, and pyproject.toml workflows.

ghostpkg

Catch AI-hallucinated package names before you install them

ossiq

OSS IQ uses MSR-driven analysis tool to track versions lag and dependencies health at scale. Move from reactive CVE-chasing to a planned, predictable maintenance rhythm.

importspy

Policy-as-code admission for Python modules and dependencies. Inspect before execution, enforce runtime and supply-chain policies, and produce evidence-backed ADMIT/DENY decisions.

uv-align

Rust CLI tool to align 'pyproject.toml' version constraints with 'uv.lock'.

smelt-cli

Static architecture guardrails for Python codebases: a config-driven linter for layers, dependencies and structure, built for humans and coding agents.

cycl

CLI and Python SDK to help identify cross-stack import/export circular dependencies, for a given AWS account and region.

ud-resolver

Resolve, Lock and audit dependencies across 18+ ecosystems (PyPI, npm, Cargo, Conda, Go, Maven, NuGet..) In one pass. CUDA-aware resolution, CVE scanning, SBOM generation, and a single cross-ecosystem lock file - with CLI, REST API, desktop app, and VS Code extension.

uv-refresh

Rebuilds a uv project's pyproject.toml so every dependency is resolved fresh instead of dragging along stale version pins. Backs up first, builds in a temp directory, and swaps the result in atomically, so a failure or Ctrl+C never touches the real file.

update-gha

Keeps GitHub Actions version pins up to date, available as a GitHub Action or as the update-gha CLI via PyPI package.

koyote

truhowl keeps your codebase working when the outside world changes it detects SDK/API drift, repairs with verified patches, and opens merge-ready PRs

changelog-checker

A powerful tool for analyzing dependency updates and their changelogs

modguard

A Python tool to visualize + enforce dependencies, using modular architecture 🌎 Open source 🐍 Installable via pip 🔧 Able to be adopted incrementally - ⚡ Implemented with no runtime impact ♾️ Interoperable with your existing systems 🦀 Written in rust

poetry-plugin-check-yanked

A Poetry plugin to check for yanked packages in the poetry.lock file.

digdep

A lightweight Python dependency analyzer that scans Python projects and visualizes import relationships.

pydependencycheck

Production-grade dependency intelligence for Python. Why dependencies exist, who added them, if they're used, if they're safe, what changed. Supply chain integrity.