deps-bump

name	deps-bump
description	Safely update Txtify dependencies or resolve Dependabot alerts. Use when asked to bump packages, fix security alerts, or when a Dependabot PR appears.

Dependency updates for Txtify

Ground rules

1. torch and torchaudio move together, same version. A mismatch doesn't fail the build — it crashes the worker at import, and jobs just hang at 10%. This is the #1 trap.
2. stable-ts ≥ 2.19.1 so pip resolves an openai-whisper that builds under modern setuptools (older ones import pkg_resources in setup.py and break the Docker build). Check stable-ts's openai-whisper constraint before bumping torch far ahead.
3. Before adding any package, and before "fixing" an alert on one: check it's actually imported — grep -rn '<pkg>' src/. Unused packages get deleted, not bumped (transformers/accelerate/srt/webvtt-py died this way).
4. yt-dlp rots fastest and breaks YouTube downloads silently. After bumping, verify with a real download (host venv is fine):

   import yt_dlp
   opts = {"format": "bestaudio/best", "postprocessors": [{"key": "FFmpegExtractAudio", "preferredcodec": "mp3", "preferredquality": "192"}], "outtmpl": "yt_test.%(ext)s", "quiet": True}
   yt_dlp.YoutubeDL(opts).download(["https://www.youtube.com/watch?v=jNQXAC9IVRw"])  # 19s clip
   

5. Runtime deps go in requirements.txt; test-only deps (pytest, httpx, pypdf) in requirements-dev.txt. Don't ship test tooling in the image.

Checking alerts

gh api repos/lkmeta/txtify/dependabot/alerts --paginate \
  --jq '.[] | select(.state=="open") | [.security_advisory.severity, .dependency.package.name, .security_vulnerability.vulnerable_version_range, (.security_vulnerability.first_patched_version.identifier // "none")] | @tsv'

Pick the newest version that is explicitly patched in the alert set rather than blindly taking latest — conservative for the ML stack, current for everything else. Alerts auto-resolve after GitHub rescans the updated manifest (minutes to hours); don't chase the counter.

Verification (non-negotiable)

Any requirements.txt change requires the full Docker E2E — the unit tests stub the ML stack and will pass even when the worker can't import: run the verify skill, Tier 2 (./scripts/docker_e2e.sh → PASS: docker E2E complete).