Dependency Audit Sweep

Outdated dependencies are the quiet tax on every Python project: they carry unfixed bugs, deprecated APIs, and license surprises that surface only when you ship. This skill runs a disciplined dependency audit — inventory, PyPI freshness check, staleness classification, license review, and a risk-tiered upgrade plan — and reports, never auto-upgrades.

Give a project owner a clear, honest picture of how stale their Python dependencies are, which upgrades carry real breaking-change risk, and what licenses they are shipping — so the upgrade plan is deliberate, not a hopeful pip install --upgrade.

• Before a release, refactor, or migration: know what is stale first.

• When inheriting a codebase: the audit is the fastest health check.

• Periodically (monthly/quarterly) as maintenance hygiene.

• Before licensing review or compliance conversations.

• Do not use as a vulnerability scanner. This skill flags outdated packages and license metadata only. It does NOT check CVEs. For CVE coverage, pair it with pip-audit or the OSV API.

• Do not use for non-Python ecosystems (npm, cargo, Go modules) — the script is Python/PyPI only.

• Do not use where network access to pypi.org is blocked (the freshness check needs the public PyPI JSON API).