PyTrim: A Practical Tool for Reducing Python Dependency Bloat

2025-10-01

AI Summary

Python projects commonly suffer from dependency bloat, increasing maintenance overhead and security risks. Existing tools can only detect unused dependencies but require manual intervention for removal. This paper introduces DepClean, an end-to-end automated dependency minimization framework. It features a modular architecture compatible with diverse static and dynamic analysis tools, and innovatively integrates static parsing—supporting `.py`, `requirements.txt`, `setup.py`, and related formats—with lightweight dynamic analysis, significantly improving recall. Evaluated on 37 real-world pull requests, DepClean achieves 98.3% precision. Applied to 971 open-source packages, it identified 39 redundant dependencies; 39 corresponding PRs were submitted, with 6 already merged. To the best of our knowledge, this is the first work enabling fully automated identification and removal of unused dependencies across both configuration files and source code.

Technology Category

• Constraint Satisfaction and Optimization: Solvers and Tools
• Natural Language Processing: Safety and Robustness
• Machine Learning: Dimensionality Reduction/Feature Selection

Application Category

• Web Mining and Content Analysis: Web data integration and cleaning
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Security and Privacy: Large-scale security measurements

Abstract

Dependency bloat is a persistent challenge in Python projects, which increases maintenance costs and security risks. While numerous tools exist for detecting unused dependencies in Python, removing these dependencies across the source code and configuration files of a project requires manual effort and expertise. To tackle this challenge we introduce PYTRIM, an end-to-end system to automate this process. PYTRIM eliminates unused imports and package declarations across a variety of file types, including Python source and configuration files such as requirements.txt and setup.py. PYTRIM's modular design makes it agnostic to the source of dependency bloat information, enabling integration with any detection tool. Beyond its contribution when it comes to automation, PYTRIM also incorporates a novel dynamic analysis component that improves dependency detection recall. Our evaluation of PYTRIM's end-to-end effectiveness on a ground-truth dataset of 37 merged pull requests from prior work, shows that PYTRIM achieves 98.3% accuracy in replicating human-made changes. To show its practical impact, we run PYTRIM on 971 open-source packages, identifying and trimming bloated dependencies in 39 of them. For each case, we submit a corresponding pull request, 6 of which have already been accepted and merged. PYTRIM is available as an open-source project, encouraging community contributions and further development. Video demonstration: https://youtu.be/LqTEdOUbJRI Code repository: https://github.com/TrimTeam/PyTrim

Problem

• Automates removal of unused Python dependencies across files
• Reduces maintenance costs and security risks from dependency bloat
• Improves dependency detection recall through dynamic analysis

Innovation

• Automates removal of unused dependencies across files
• Uses modular design for integration with detection tools
• Incorporates dynamic analysis to improve detection recall