pip-review
Looking for a new maintainer! See https://github.com/jgonggrijp/pip-review/issues/76.
pip-review is a convenience wrapper around pip. It can list available updates by deferring to pip list --outdated. It can also automatically or interactively install available updates for you by deferring to pip install.
Example, report-only:
$ pip-review
requests==0.13.4 is available (you have 0.13.2)
redis==2.4.13 is available (you have 2.4.9)
rq==0.3.2 is available (you have 0.3.0)
Example, actually install everything:
$ pip-review --auto
... <pip install output>
Example, run interactively, ask to upgrade for each package:
$ pip-review --interactive
requests==0.14.0 is available (you have 0.13.2)
Upgrade now? [Y]es, [N]o, [A]ll, [Q]uit y
...
redis==2.6.2 is available (you have 2.4.9)
Upgrade now? [Y]es, [N]o, [A]ll, [Q]uit n
rq==0.3.2 is available (you have 0.3.0)
Upgrade now? [Y]es, [N]o, [A]ll, [Q]uit y
...
Run pip-review -h for a complete overview of the options.
Note: If you want to pin specific packages to prevent them from automatically being upgraded, you can use a constraint file (similar to requirements.txt):
$ export PIP_CONSTRAINT="${HOME}/constraints.txt
$ cat $PIP_CONSTRAINT
pyarrow==0.14.1
pandas<0.24.0
$ pip-review --auto
...
Set this variable in .bashrc or .zshenv to make it persistent. Alternatively, this option can be specified in pip.conf, e.g.:
Linux:
$ cat ~/.config/pip/pip.conf
[global]
constraint = /home/username/constraints.txt
Windows:
$ cat $HOME\AppData\Roaming\pip\pip.ini
[global]
constraint = '$HOME\Roaming\pip\constraints.txt'
The conf file are dependent of the user, so If you use multiple users you must define config file for each of them. https://pip.pypa.io/en/stable/user_guide/#constraints-files
Since version 0.5, you can also invoke pip-review as python -m pip_review. This can be useful if you are using multiple versions of Python next to each other.
Before version 1.0, pip-review had its own logic for finding package updates instead of relying on pip list --outdated.
Like pip, pip-review updates all packages, including pip and pip-review.
Installation
To install, simply use pip:
$ pip install pip-review
Decide for yourself whether you want to install the tool system-wide, or inside a virtual env. Both are supported.
Testing
To test with your active Python version:
$ ./run-tests.sh
To test under all (supported) Python versions:
$ tox
The tests run quite slow, since they actually interact with PyPI, which involves downloading packages, etc. So please be patient.
Origins
pip-review was originally part of pip-tools but has been discontinued as such. See Pin Your Packages by Vincent Driessen for the original introduction. Since there are still use cases, the tool now lives on as a separate package.
Metadata
Release files for pip-review 1.3.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| pip-review-1.3.0.tar.gz | 6.6 kB | Without provenance | Details for pip-review-1.3.0.tar.gz |
Release files / pip-review-1.3.0.tar.gz
| Download URL | pip-review-1.3.0.tar.gz |
|---|---|
| Size | 6.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
886fc48503a6ec99851036f30a6be07ce7e4610d1491786affecb7a364eddeda
|
|
BLAKE2b-256 checksum How to use checksums |
f7e8bcb143f21668de2c285ce3d73041ba035b2340fb44bdd95ee04b3e313d09
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/3.1.1 pkginfo/1.5.0.1 requests/2.23.0 setuptools/46.1.1 requests-toolbelt/0.9.1 tqdm/4.43.0 CPython/3.8.14
|
Security for pip-review 1.3.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.