
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
deptime
Advanced tools
API time machine for Python libraries: tells coding agents what changed, in which release, and what to use instead. Local-first MCP server.
An API time machine for Python libraries, built for coding agents.
When an agent hits ImportError, AttributeError or "unexpected keyword argument" in a fast-moving library, one call to DepTime says what changed, in which release, and what to use instead. Answers are computed from static diffs of every indexed release, not from docs or model memory.
Free, open source (MIT), and local: your code and errors never leave your machine.
Every night, GitHub Actions reads each new release's public API with griffe, which parses the source without running it, diffs it against the previous release, and publishes the result as one file, index.sqlite.xz, on this repo's Releases. On your machine, deptime mcp checks that file's sha256 and schema before swapping it in, then answers every question locally in milliseconds. The full design is in docs/04-architecture.md, and the decisions are in docs/adr/.
TypeError: Client.__init__() got an unexpected keyword argument 'proxies'
{
"symbol": "httpx.Client.__init__(proxies)",
"issue": "param_removed",
"installed_version": "0.28.1",
"last_version_with": "0.27.2",
"first_version_without": "0.28.0",
"deprecated_in": "0.26.0",
"replacements": [
{"target": "proxy", "confidence": 0.8, "source": "deprecation_message"},
{"target": "mounts", "confidence": 0.79, "source": "deprecation_message"}
],
"pin_to_restore": "httpx<=0.27.2",
"confidence": "high"
}
That's the real explain_error answer from the published index, trimmed. The full answer also quotes the deprecation message DepTime found in httpx's own source, and adds a one-sentence explanation for your agent to pass on.
Status: alpha. The prebuilt index is rebuilt nightly. Known gaps are tracked in BACKLOG.md.
Requires uv.
# Claude Code. Cursor, Codex, VS Code and Claude Desktop take the same
# command (uvx deptime mcp) in their MCP config.
claude mcp add deptime -- uvx deptime mcp
On first launch DepTime downloads its prebuilt index (one file from this repo's GitHub Releases) in the background, then checks for a newer one at most once a day. Set DEPTIME_OFFLINE=1 to never touch the network.
Claude Code users can also install the plugin in integrations/claude-code with /plugin marketplace add cschmertz/deptime, then /plugin install deptime@deptime. It adds a skill and a local hook that suggests DepTime when a Python version-change error appears in a command's output.
First launch timing out? uvx installs DepTime the first time a client starts it. On macOS with an x86_64 uv (an Intel Mac, or Intel Homebrew on Apple silicon), one dependency, cryptography, has no prebuilt wheel and is compiled, which can take longer than a client waits for a server to start. Run uvx deptime --help once beforehand.
Checked 2026-11-05 with deptime 0.1.4 (details):
| Client | Result |
|---|---|
| Claude Code 2.1.318 | ✅ |
| Codex CLI 0.166.0 | ✅ |
MCP Python SDK clients 1.0–1.30 and TypeScript SDK clients 1.0–1.32 (protocols 2024-11-05 to 2025-11-25), over stdio and against deptime serve | ✅ |
| Cursor, VS Code, Claude Desktop | not checked yet; they take the same uvx deptime mcp command |
| Tool | Use it when |
|---|---|
explain_error(traceback, installed_versions?, pip_freeze?) | An import or call into a library just failed |
symbol_history(package, path) | Before trusting an API you remember |
check_symbols(package, version, symbols[{path, kwargs}]) | Pre-flight check of the symbols and kwargs you're about to use |
diff_versions(package, from_version | date, to_version?, used_symbols?) | Upgrading, or "what changed since my training cutoff?" |
coverage() | What's indexed (52 fast-moving packages: AI/agent stack + libraries with known breaking changes) |
Every answer carries evidence and a confidence level. If a package isn't covered, DepTime says so instead of guessing. The contracts are in docs/03-product-spec.md.
uvx deptime explain --installed httpx==0.28.1 < traceback.txt
uvx deptime history httpx Client.__init__
uvx deptime check httpx 0.28.1 'httpx.Client:proxies,proxy'
uvx deptime diff httpx 0.27.2 0.28.1
uvx deptime diff pydantic 2024-06-01 # everything since a date
uvx deptime index status | pull
Local mode covers coding agents. For web clients that only accept a URL, run deptime serve (MCP at /mcp, JSON at /v1/*) on any container host. The repo includes a Dockerfile and fly.toml, and the server applies anonymous rate limits. See docs/05-self-hosting.md.
The most useful contributions are wrong-answer reports, which become benchmark cases. See CONTRIBUTING.md. Development setup:
uv sync && uv run pytest
# build a small local index from real PyPI wheels
uv run deptime ingest httpx --versions 0.27.2 0.28.1
Product spec · Architecture · Self-hosting · Risks & spikes · Privacy & security
FAQs
API time machine for Python libraries: tells coding agents what changed, in which release, and what to use instead. Local-first MCP server.
The pypi package deptime receives a total of 436 weekly downloads. As such, deptime popularity was classified as not popular.
We found that deptime demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.