Build an AI Dependency Updater with Python

import asyncio, re, json
import httpx

async def check_pypi(client, name, current):
    """Check a single package against PyPI."""
    try:
        resp = await client.get(
            f"https://pypi.org/pypi/{name}/json",
            timeout=10
        )
        data = resp.json()
        latest = data["info"]["version"]
        if latest != current:
            return {
                "name": name,
                "current": current,
                "latest": latest,
                "summary": data["info"].get("summary", ""),
            }
    except Exception:
        pass
    return None

def parse_requirements(path):
    """Parse requirements.txt into (name, version) tuples."""
    deps = []
    with open(path) as f:
        for line in f:
            line = line.strip()
            if not line or line.startswith("#"):
                continue
            m = re.match(r"([a-zA-Z0-9_-]+)==([^\s]+)", line)
            if m:
                deps.append((m.group(1), m.group(2)))
    return deps

async def find_outdated(deps):
    """Check all deps concurrently, return outdated ones."""
    async with httpx.AsyncClient() as client:
        tasks = [
            check_pypi(client, name, ver)
            for name, ver in deps
        ]
        results = await asyncio.gather(*tasks)
    return [r for r in results if r]

import anthropic

client = anthropic.Anthropic(
    api_key="sk-your-ezai-key",
    base_url="https://ezaiapi.com",
)

def analyze_updates(outdated):
    """Ask Claude to classify each update by risk."""
    pkg_list = "\n".join(
        f"- {p['name']}: {p['current']} → {p['latest']} ({p['summary']})"
        for p in outdated
    )

    response = client.messages.create(
        model="claude-sonnet-4-5",
        max_tokens=2048,
        messages=[{
            "role": "user",
            "content": f"""Analyze these Python dependency updates.
For each package, classify the risk and explain why.

Outdated packages:
{pkg_list}

Return valid JSON with this structure:
{{
  "updates": [
    {{
      "name": "package-name",
      "current": "1.0.0",
      "latest": "2.0.0",
      "risk": "low|medium|high",
      "reason": "why this risk level",
      "breaking_changes": ["list of known breaking changes"],
      "update_order": 1
    }}
  ],
  "summary": "overall recommendation"
}}

Rules:
- Patch versions (1.0.0 → 1.0.1) are almost always LOW risk
- Minor versions (1.0 → 1.1) are LOW-MEDIUM depending on the package
- Major versions (1.x → 2.x) are MEDIUM-HIGH
- Security-related packages should be prioritized regardless of risk
- Order updates so dependencies are updated before dependents"""
        }],
    )

    return json.loads(
        response.content[0].text
    )

import sys

RISK_COLORS = {
    "low": "\033[92m",      # green
    "medium": "\033[93m",   # yellow
    "high": "\033[91m",     # red
}
RESET = "\033[0m"

async def main():
    path = sys.argv[1] if len(sys.argv) > 1 else "requirements.txt"
    print(f"🔍 Scanning {path}...")

    deps = parse_requirements(path)
    print(f"   Found {len(deps)} pinned dependencies")

    outdated = await find_outdated(deps)
    if not outdated:
        print("✅ All dependencies are up to date!")
        return

    print(f"   {len(outdated)} packages are outdated\n")
    print("🤖 Analyzing breaking changes with Claude...")

    plan = analyze_updates(outdated)

    # Sort by update_order
    updates = sorted(
        plan["updates"],
        key=lambda x: x.get("update_order", 99)
    )

    print("\n📋 UPDATE PLAN\n" + "=" * 50)
    for u in updates:
        color = RISK_COLORS.get(u["risk"], "")
        print(f"\n{color}[{u['risk'].upper()}]{RESET} {u['name']}")
        print(f"  {u['current']} → {u['latest']}")
        print(f"  {u['reason']}")
        if u.get("breaking_changes"):
            for bc in u["breaking_changes"]:
                print(f"  ⚠️  {bc}")

    print(f"\n{'='*50}\n📝 {plan['summary']}")

asyncio.run(main())

python3 dep_updater.py requirements.txt

# Output:
# 🔍 Scanning requirements.txt...
#    Found 23 pinned dependencies
#    8 packages are outdated
#
# 🤖 Analyzing breaking changes with Claude...
#
# 📋 UPDATE PLAN
# ==================================================
#
# [LOW] certifi
#   2024.2.2 → 2026.1.31
#   Certificate bundle update. No API changes.
#
# [HIGH] pydantic
#   1.10.14 → 2.6.1
#   Major rewrite of validation layer
#   ⚠️  BaseModel.dict() renamed to model_dump()
#   ⚠️  validator decorator replaced by field_validator

def parse_package_json(path):
    """Parse package.json dependencies."""
    with open(path) as f:
        pkg = json.load(f)

    deps = []
    for section in ("dependencies", "devDependencies"):
        for name, ver in pkg.get(section, {}).items():
            # Strip ^, ~, >= prefixes to get pinned version
            clean = re.sub(r"^[\^~>=<]+", "", ver)
            deps.append((name, clean))
    return deps

async def check_npm(client, name, current):
    """Check a package against the npm registry."""
    try:
        resp = await client.get(
            f"https://registry.npmjs.org/{name}/latest",
            timeout=10
        )
        data = resp.json()
        latest = data["version"]
        if latest != current:
            return {
                "name": name,
                "current": current,
                "latest": latest,
                "summary": data.get("description", ""),
            }
    except Exception:
        pass
    return None

# .github/workflows/dep-check.yml
name: AI Dependency Check
on:
  schedule:
    - cron: "0 9 * * 1"  # Every Monday at 9 AM
  workflow_dispatch:

jobs:
  check-deps:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pip install httpx anthropic
      - run: python dep_updater.py requirements.txt > plan.md
        env:
          ANTHROPIC_API_KEY: ${{ secrets.EZAI_API_KEY }}
          ANTHROPIC_BASE_URL: "https://ezaiapi.com"