| name | deps-bump |
| description | Safely update Txtify dependencies or resolve Dependabot alerts. Use when asked to bump packages, fix security alerts, or when a Dependabot PR appears. |
Dependency updates for Txtify
Ground rules
torch and torchaudio move together, same version. A mismatch doesn't fail the build — it crashes the worker at import, and jobs just hang at 10%. This is the #1 trap.stable-ts ≥ 2.19.1 so pip resolves an openai-whisper that builds under modern setuptools (older ones import pkg_resources in setup.py and break the Docker build). Check stable-ts's openai-whisper constraint before bumping torch far ahead.- Before adding any package, and before "fixing" an alert on one: check it's actually imported —
grep -rn '<pkg>' src/. Unused packages get deleted, not bumped (transformers/accelerate/srt/webvtt-py died this way).
yt-dlp rots fastest and breaks YouTube downloads silently. After bumping, verify with a real download (host venv is fine):
import yt_dlp
opts = {"format": "bestaudio/best", "postprocessors": [{"key": "FFmpegExtractAudio", "preferredcodec": "mp3", "preferredquality": "192"}], "outtmpl": "yt_test.%(ext)s", "quiet": True}
yt_dlp.YoutubeDL(opts).download(["https://www.youtube.com/watch?v=jNQXAC9IVRw"])
- Runtime deps go in
requirements.txt; test-only deps (pytest, httpx, pypdf) in requirements-dev.txt. Don't ship test tooling in the image.
Checking alerts
gh api repos/lkmeta/txtify/dependabot/alerts --paginate \
--jq '.[] | select(.state=="open") | [.security_advisory.severity, .dependency.package.name, .security_vulnerability.vulnerable_version_range, (.security_vulnerability.first_patched_version.identifier // "none")] | @tsv'
Pick the newest version that is explicitly patched in the alert set rather than blindly taking latest — conservative for the ML stack, current for everything else. Alerts auto-resolve after GitHub rescans the updated manifest (minutes to hours); don't chase the counter.
Verification (non-negotiable)
Any requirements.txt change requires the full Docker E2E — the unit tests stub the ML stack and will pass even when the worker can't import: run the verify skill, Tier 2 (./scripts/docker_e2e.sh → PASS: docker E2E complete).
