Skip to content

Remove unused deepdiff dependency - #2674

Open
tmilnthorp wants to merge 1 commit into
AppDaemon:devfrom
tmilnthorp:remove-unused-deepdiff
Open

tmilnthorp wants to merge 1 commit into
AppDaemon:devfrom
tmilnthorp:remove-unused-deepdiff

Conversation

@tmilnthorp

Copy link
Copy Markdown

Follow-up to #2673.

What

deepdiff is declared in [project].dependencies but is never imported anywhere in the AppDaemon codebase — I grepped the whole tree (including dynamic import_module/__import__/string references) and there are zero hits outside pyproject.toml, uv.lock, the Dockerfile comment, and old HISTORY.md changelog lines.

This removes it, along with its now-orphaned orderly-set transitive (nothing else depends on it), and adds a HISTORY.md entry.

Why

Beyond trimming an unused package: deepdiff periodically draws security advisories (e.g. the 8.6.1/8.6.2 DoS fixes), which forces downstream packagers to chase versions of a dependency AppDaemon doesn't actually use. Dropping it removes that noise entirely.

Notes for the reviewer

  • uv.lock was edited minimally on purpose. Running the pinned uv-lock pre-commit hook (uv 0.9.26) regenerates the whole file — it migrates the lock format (revision = 1 → 3, adds upload-time to every entry), which turns this into a ~3.7k-line diff unrelated to deepdiff. To keep the change reviewable I removed only the deepdiff/orderly-set entries and left the rest (and revision = 1) untouched. Happy to instead run the full regeneration if you'd prefer the format migration to ride along.
  • Dockerfile left alone (possible follow-up). The ARM build installs git rust cargo with the comment "build the orjson package (required by deepdiff)" — but deepdiff 9.x no longer pulls orjson (it's not in the lock at all), so that step already appears dead. I left it out of this PR since I can't test the multi-arch image build locally; flagging it in case you'd like it cleaned up too.

Testing

pyproject.toml and uv.lock both still parse; the end-of-file, trailing-whitespace, ruff-check, and codespell pre-commit hooks pass on the changed files. No code imports deepdiff, so nothing at runtime depends on it.

`deepdiff` is declared in the runtime dependencies but never imported anywhere
in the AppDaemon codebase. Dropping it (and its now-orphaned `orderly-set`
transitive) trims the install and removes a package that periodically triggers
security advisories despite being unused. See AppDaemon#2673.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant