pip-abandoned

License Python Compatibility Code style: black

Installation

I recommend installing pip-abandoned with pipx. This will give you a system-wide install of pip-abandoned with its dependencies isolated from any environments you intend to scan.

Alternatively pip-abandoned can be installed from PyPI with your package manager of choice: pip, poetry, pipenv, etc.

Introduction

Some package registries like NPM and Packagist allow a user to mark a package as abandoned or deprecated. This means it is relatively easy to tell if you are relying on a package abandoned by its author. It also allows package managers to consume this metadata to provide a warning at install time. PyPI does not have a mechanism to abandon or deprecate a package. There are some signals we can look at though.

Many packages are linked to a GitHub repository. If that GitHub repository is archived, this is a strong signal that the package itself is abandoned
Some packages may use the Development Status :: 7 - Inactive trove classifier to indicate the package is not actively maintained
Some packages may include a badge in the project README to indicate the package is not actively maintained

pip-abandoned uses these signals to identify potentially abandoned packages in your environment.

Authentication

pip-abandoned uses the GitHub GraphQL API to efficiently query many repos at once. The advantage of this is that it is fast. The tradeoff is that authentication is required. A PAT with read-only access to public repos will be sufficient for most cases. There are two ways we can provide an auth token:

Via an environment variable called GH_TOKEN e.g: GH_TOKEN=ghp_abc123
Run pip-abandoned set-token to store a token using the system keyring service with keyring

Usage

# Search a virtualenv path:
pip-abandoned search /home/alice/.virtualenvs/myproject/lib/python3.10/site-packages

# Search a requirements file:
pip-abandoned search -r /path/to/requirements.txt

When searching one or more requirements files, your packages will be installed into a temporary virtualenv. This means this search will include transitive dependencies.

Exit Codes

pip-abandoned search exits with

code 0 when no inactive, archived or unmaintained packages were found
code 1 when an error was encountered. For example:
- no packages were supplied in the path provided or
- no auth token was supplied
code 9 when one or more inactive, archived or unmaintained packages were found

Inspiration

pip-abandoned takes inspiration from pip-audit, another great project.

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

pip_abandoned-0.5.0.tar.gz (13.6 kB view details)

Uploaded Oct 25, 2025 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

pip_abandoned-0.5.0-py3-none-any.whl (8.3 kB view details)

Uploaded Oct 25, 2025 Python 3

File details

Details for the file pip_abandoned-0.5.0.tar.gz.

File metadata

Download URL: pip_abandoned-0.5.0.tar.gz
Upload date: Oct 25, 2025
Size: 13.6 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/6.1.0 CPython/3.13.7

File hashes

Hashes for pip_abandoned-0.5.0.tar.gz
Algorithm	Hash digest
SHA256	`989d100b383829f90138fab2f2ca6d58a0b439472ff4ec85ee5bc7062b575328`
MD5	`8a85e51617a64fad083178856c1174c0`
BLAKE2b-256	`55e2f6cf13ef1b83045b2b076249c63dd23ccbc0148264d8546946f46ac4bc79`

See more details on using hashes here.

Provenance

The following attestation bundles were made for pip_abandoned-0.5.0.tar.gz:

Publisher: publish.yml on chris48s/pip-abandoned

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: pip_abandoned-0.5.0.tar.gz
- Subject digest: 989d100b383829f90138fab2f2ca6d58a0b439472ff4ec85ee5bc7062b575328
- Sigstore transparency entry: 640150921
- Sigstore integration time: Oct 25, 2025
Source repository:
- Permalink: chris48s/pip-abandoned@7f1a8bd8da492189c65b2ae27a2d35e2a7342ea5
- Branch / Tag: refs/tags/0.5.0
- Owner: https://github.com/chris48s
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: publish.yml@7f1a8bd8da492189c65b2ae27a2d35e2a7342ea5
- Trigger Event: create