uv-deps

UV Deps

Arguments

Specific package names (e.g. fastapi asyncpg), . for all packages, or glob patterns (e.g. django-*).

The text following the skill invocation is available as $ARGUMENTS (e.g. in Claude Code, /uv-deps fastapi asyncpg sets $ARGUMENTS to fastapi asyncpg; other assistants pass arguments similarly). If invoked with no arguments, $ARGUMENTS is empty.

If $ARGUMENTS is help, --help, -h, or ?, skip the workflow and read references/interactive-help.md.

Workflow Selection

Based on user request:

• Security audit (audit, CVE, vulnerabilities, security): Read references/audit-workflow.md
• Dependency updates (update, upgrade, latest, modernize): Read references/update-workflow.md
• Ambiguous (no clear intent, or invoked with no args): Read references/interactive-help.md

Shared Process

1. Create Worktree

Create an isolated git worktree so the main working directory is never modified:

TIMESTAMP=$(date +%Y%m%d-%H%M%S)
BRANCH_NAME="py-uv-deps-$TIMESTAMP"
WORKTREE_PATH="${TMPDIR:-/private/tmp}/$BRANCH_NAME"
git worktree add "$WORKTREE_PATH" -b "$BRANCH_NAME"

If git worktree add fails due to a sandbox permission error:

git worktree requires write access to the parent temp directory — the per-run $WORKTREE_PATH is nested under it. Grant that access in your assistant's settings (in Claude Code: add the resolved path — the value of $TMPDIR, or /private/tmp if $TMPDIR is unset or empty — to the sandbox allowlist in settings.json) and retry.

All subsequent steps operate within $WORKTREE_PATH. Discovery, syncs, edits, and commits all happen there. Code blocks in reference files that show cd "$WORKTREE_PATH/<directory>" must run that cd explicitly — the working directory does not carry over between blocks.

2. Verify Tool Access

Verify that uv and uvx are available and can reach PyPI. See references/uv-commands.md for verification commands and troubleshooting.