Python dependency freshness audit — 2026-05-30¶

Scope: every fork-local pyproject.toml and requirements*.txt checked against PyPI's current info.version. Master tip 387839eacf at audit time.

Method:

# Enumerate
find . -type f \( -name 'pyproject.toml' -o -name 'requirements*.txt' \
  -o -name 'Pipfile' -o -name 'poetry.lock' \) \
  -not -path './build*' -not -path './core/build*'

# For each pinned package
curl -s "https://pypi.org/pypi/<pkg>/json" \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['info']['version'])"

Files audited (12 total):

• pyproject.toml (root — empty)
• python/pyproject.toml (harness shim — empty)
• dev-llm/pyproject.toml
• tools/vmaf-tune/pyproject.toml
• tools/vmaf-roi-score/pyproject.toml
• tools/ensemble-training-kit/pyproject.toml
• ai/pyproject.toml
• mcp-server/vmaf-mcp/pyproject.toml
• python/requirements.txt
• python/test/requirements.txt
• docs/requirements.txt
• tools/ensemble-training-kit/requirements-frozen.txt

Findings¶

At-latest (no action)¶

Bumped (this PR)¶

The optuna bump is the one with material substance: tools/vmaf-tune's fast extra already required optuna>=4.8.0, so the dev extra's optuna>=3.6 floor was internally inconsistent — pip would happily install 3.x for pip install -e .[dev] while the runtime code path under fast needs 4.x. Realigning to 4.8.0 prevents that mismatch.

Hash pinning (deferred)¶

None of the four requirements*.txt files use --hash=sha256: pinning. The two install-facing ones (python/requirements.txt, docs/requirements.txt) and the kit's requirements-frozen.txt are the candidates for pip-compile --generate-hashes. Deferred because:

1. Hash pinning needs a policy ADR: where lockfiles live, how often they refresh, which CI gate enforces them, what the upgrade flow is.
2. The freshness sweep is independent — adding hashes today against already-fresh floors is no harder tomorrow.
3. A 600-line lockfile PR would dwarf the 9-line bump PR; reviewability suffers.

Follow-up: file a separate planning entry once the lockfile-policy ADR is drafted.

Reproducer¶

# Re-run the audit
python3 -c "
import json, urllib.request
pkgs = ['typer','ruff','anthropic','openai','pytorch-lightning','mcp',
        'pytest-asyncio','pandas-stubs','optuna']
for p in pkgs:
    with urllib.request.urlopen(f'https://pypi.org/pypi/{p}/json') as r:
        print(p, '=', json.load(r)['info']['version'])
"

# Validate TOML after edits
python3 -c "
import tomllib
for f in ['ai/pyproject.toml','mcp-server/vmaf-mcp/pyproject.toml',
         'dev-llm/pyproject.toml','tools/vmaf-tune/pyproject.toml',
         'tools/vmaf-roi-score/pyproject.toml']:
    tomllib.load(open(f,'rb')); print('OK', f)
"