cleanup opportunities dependency freshness

Dependency freshness

Runtime dependencies are minimal, but development and security tooling need regular updates. Dependency policy is split across pyproject.toml, uv.lock, .github/dependabot.yml, and renovate.json.

Current dependency shape

Area	Source	Notes
Runtime	pyproject.toml	No required runtime dependencies.
Optional	pyproject.toml	kuzu>=0.11.0 for embedded graph projection.
Development	pyproject.toml	Ruff, mypy, coverage, Radon, Vulture, Deptry, Bandit, pip-audit, pre-commit.
Lock file	uv.lock	Largest tracked file and high churn from tool additions.
Automation	.github/dependabot.yml, renovate.json	Dependabot and Renovate update policy.

Checks

CI runs uv run deptry . and uv run pip-audit --desc off in .github/workflows/ci.yml. Renovate uses a minimum release age in renovate.json, which helps avoid adopting brand-new releases immediately.

Update path

Update dependencies through uv, inspect uv.lock, run the full validation list from AGENTS.md, and watch for changes in optional Kuzu behavior through tests and lode kuzu-sync.

Related pages

• Dependencies
• Quality automation
• Deployment