A command line utility to check for unused, missing and transitive dependencies in a Python project.
deptry is a command line tool to check for issues with dependencies in a Python project, such as unused or missing dependencies. It supports projects using Poetry, pip, PDM, uv, and more generally any project supporting PEP 621 specification.
Dependency issues are detected by scanning for imported modules within all Python files in a directory and its subdirectories, and comparing those to the dependencies listed in the project's requirements.
To add deptry to your project, run one of the following commands:
# Install with poetry
poetry add --group dev deptry
# Install with pip
pip install deptry
Warning: When using pip to install deptry, make sure you install it within the virtual environment of your project. Installing deptry globally will not work, since it needs to have access to the metadata of the packages in the virtual environment.
deptry should be run within the root directory of the project to be scanned, and the project should be running in its own dedicated virtual environment.
To scan your project for dependency issues, run:
deptry .
Example output could look as follows:
Scanning 2 files...
foo/bar.py:1:0: DEP004 'numpy' imported but declared as a dev dependency
foo/bar.py:2:0: DEP001 'matplotlib' imported but missing from the dependency definitions
pyproject.toml: DEP002 'pandas' defined as a dependency but not used in the codebase
Found 3 dependency issues.
deptry can be configured by using additional command line arguments, or by adding a [tool.deptry] section in pyproject.toml. For more information, see the Usage and Configuration section of the documentation..
Repository initiated with fpgmaas/cookiecutter-poetry.
FAQs
A command line utility to check for unused, missing and transitive dependencies in a Python project.
We found that deptry demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PyPI confirms no security flaws were exploited in the Ultralytics supply chain attack and highlights improvements for safer package publishing.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.