Dependency Checker v0.4.0

Dependency Checker 0.4.0 adds the check-dependencies Agent Skill, with an MCP server and CLI for repository dependency audits. It collects declarations, locked versions, and source usage so an agent can explain a dependency, inspect its impact, and review a proposed update.

Added

• Static dependency evidence for Python/PyPI, JavaScript and TypeScript/npm, Go modules, Java and Kotlin/Maven or Gradle, and C/C++/Conan or vcpkg.
• Seven MCP tools for repository context, indexing, offline hygiene scans, paginated inventory, dependency explanations, impact analysis, and update previews. The skill can fall back to an installed CLI when MCP is unavailable.
• A SQLite evidence index with freshness checks and qualified package identities. Queries, explanations, and impact results include evidence and usage completeness.
• JSON, SARIF, and CycloneDX reports; optional OSV checks for PyPI, npm, Go, and Maven; and scoped dependency policies and tool-usage declarations.
• Read-only update previews for requirements text files and static PEP 621 groups. Previews preserve the supported formatting and leave manifests and locks unchanged.

Fixed

• Installed Python package directories no longer pollute repository scans. Sibling modules in if __package__ script fallbacks retain their local ownership.
• Compiled requirements locks now retain exact versions and markers from entries with multiline hash options. Docker pip hints stop at shell separators.
• Frontend test files and common test/build configurations retain their dependency scope. Astro, Vue, and Svelte components report unsupported usage coverage.
• Maven dependencies retain their literal declarations when a local parent does not match. Unknown inherited versions remain unresolved, and independent Python component declarations no longer produce cross-component duplicate findings.
• Cache freshness now covers compiled requirements locks and frontend component files. Analysis changes trigger Python source re-parsing.
• Git and GitNexus metadata subprocesses use an empty input stream, fixing Windows MCP requests that stalled while inheriting the protocol input pipe.

Upgrade notes

Use the new CLI subcommands in scripts. For an offline JSON scan:

depcheck scan . --offline --format json

The v0.2 CLI flags and legacy Python module paths have changed. The bundled MCP launcher requires Python 3.11 or newer and uv 0.12.4. Rebuild an incompatible derived index with depcheck index ..

Scans parse repository files as data. Indexing writes the local .depcheck cache. Package-manager commands and target project code are not executed. Enabling security or Python compatibility checks allows network requests. Offline scans report those checks as skipped.

Cargo/Rust, stylesheet and command-only usage, and parts of framework or namespace resolution remain outside scanner coverage. OSV checks for Conan and vcpkg report unsupported security coverage. Empty usage results need review against the project's build, plugin, and deployment configuration.

Validation

301 tests passed on Python 3.11 and 3.12. CI passed all six jobs, including MCP and installed-wheel checks on Ubuntu, macOS, and Windows, plus lint, formatting, types, lockfile checks, and the offline MCP contract suite.

The release ZIP includes the skill, MCP descriptors, and scanner source. SHA256SUMS records its checksum.

Full changelog · CI run