DepExit 自動找出高風險依賴並驗證替換方案

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady

What I Built

Auditing a neglected Python codebase is a dull job. You read changelogs, check which packages are abandoned, guess at replacements, and hope the migration doesn't break anything. That's a day or two of work nobody wants to do.

DepExit does it while you're away. Point it at a repo and it finds the risky dependencies and asks Gemma 4 for a replacement plan for each one. It then refuses to trust the plan until it has applied it to an isolated copy, reinstalled everything, and run the tests. Each dependency ends up with a Dependency Exit Capsule: a JSON record, a readable Markdown page, and a patch. Every fact in the capsule is tagged OBSERVED, MEASURED, AI-SUGGESTED, or AI · VERIFIED, so you can see what came from files, what came from running code, and what is only the model's suggestion.

The lazy part is that you don't have to babysit the AI's answer. A wrong migration in a healthy project is worse than none, so nothing is claimed as fixed until it has actually been run. You come back to a report and a patch to review.

Demo

A complete run on the organizer's LinkWatch repo is committed in examples/linkwatch-run/. Open report.html after cloning, or read SUMMARY.md on GitHub. It was produced on 15 October 2026 with gemma-4-31b-it through the Gemini API and took 13 minutes, which is about as long as it takes to make tea.

| Measure | Result |
|---|---|
| Dependencies analysed | 16 |
| At risk | 10 |
| Gemma 4 plans verified by execution | 10 of 10 |
| Tests before | 9 of 10 passing, 1 warning |
| All verified plans applied together | 23 of 23 passing (10 original + 13 written by Gemma), 0 warnings |

Code

sabeenaviklar / H26_404_TeamNotFound_DepExit

DepExit uses only the Python standard library, so there is nothing to install for the tool itself:

bash export GEMINI_API_KEY="your-key" python -m depexit doctor python -m depexit analyze https://github.com/rishrek/LinkWatch

How I Built It

The rule behind the design is that Gemma proposes and execution decides.

Deterministic code does the seeing. It parses requirements*.txt and pyproject.toml, walks every file with ast to find imports, private-API use and monkeypatches, installs the project in a clean virtual environment, imports each package on its own, runs pytest, and pulls release history from PyPI and GitHub.
Gemma 4 does the thinking. It gets only the evidence DepExit collected and the exact files involved, and returns a replacement decision, code edits, requirement changes, and small tests that capture the behaviour the repo relies on. I used gemma-4-31b-it through the Gemini API, with automatic fallback to gemma-4-26b-a4b-it. Local inference through Ollama is supported too.
Deterministic code judges. It applies the plan to a fresh copy and runs the original tests plus Gemma's own tests against both the old dependency and the replacement. A plan counts as verified only if every risk indicator is gone, nothing regressed, and the old package is no longer referenced. If it fails, the concrete failure output goes back to Gemma for one corrected attempt.

Gemma never decides risk, never grades its own work, and is never the source of an OBSERVED or MEASURED field. Packages it proposes are checked against PyPI, and every prompt and raw response is saved next to the capsule.

An earlier run marked requests as verified even though Gemma's reply had been truncated and nothing was changed. I found it by reading our own capsule, then fixed the parser and added plan validation and per-indicator re-checks. The committed run is the fixed one. I also ran DepExit with no AI on an unrelated project, jazzband/prettytable (337 tests), which exposed four layout bugs that I fixed the same day.

Why Open Innovation Matters

Automation you leave running unattended has to be something you can check afterwards. Open models make that possible.

Auditable. Gemma 4's weights are Apache 2.0, and DepExit saves every prompt and raw response. A capsule is a replayable record, not a black-box answer, and depexit replay re-verifies a saved plan later without calling any model.
Set it up once, no bill. There are no paid services and no dependencies to install. Switching the model is a flag (--ai google or --ai ollama), not a rewrite.
Private when it needs to be. Freelancers and small teams often can't send a client's code to a closed API. With a local Gemma 4 through Ollama, the code stays on the machine. (Keep this only if you complete the Ollama run. Otherwise write "can run locally" and name the tradeoff.)

My First User

My first user tried DepExit on a Python project with outdated dependencies and found it useful for spotting at-risk packages and understanding possible replacements. They liked that DepExit didn't just suggest migrations with AI but actually tested them and showed evidence of whether they worked.

Their feedback was that the detailed reports made the issues easy to understand, but a simpler summary of the recommended changes would be more convenient. They also suggested clearer migration priorities so developers know what to fix first. Both are on my list.

Prize Categories

Gemma, Blackboard.io, Best Use of GitHub Copilot