Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
A simple, correct Python build frontend.
See the documentation for more information.
build
can be installed via pip
or an equivalent via:
$ pip install build
$ python -m build
This will build the package in an isolated environment, generating a
source-distribution and wheel in the directory dist/
.
See the documentation for full information.
--sdist
(-s
): Produce just an SDist--wheel
(-w
): Produce just a wheel-C<option>=<value>
: A Config-setting, the PEP 517 way of passing options to a backend. Can be passed multiple times. Matching options will make a list. Note that setuptools has very limited support.--installer
: Pick an installer for the isolated build (pip
or uv
).--no-isolation
(-n
): Disable build isolation.--skip-dependency-check
(-x
): Disable dependency checking when not isolated; this should be done if some requirements or version ranges are not required for non-isolated builds.--outdir
(-o
): The output directory (defaults to dist
)Some common combinations of arguments:
--sdist --wheel
(-sw
): Produce and SDist and a wheel, both from the source distribution. The default (if no flag is passed) is to build an SDist and then build a wheel from the SDist.-nx
: Disable build isolation and dependency checking. Identical to pip and uv's --no-build-isolation
flag.If you use pipx, such as in GitHub Actions, the following command will download and run build in one step:
$ pipx run build
If you want to use uv to speed up the virtual environment creation, you can use
--installer=uv
. You can get a Python wheel for uv
with the [uv]
extra.
Combining both suggestions yields the following:
$ pipx run build[uv] --installer=uv
If you are using cibuildwheel, build is integrated and can be use with either (in your pyproject.toml
):
[tool.cibuildwheel]
build-frontend = "build"
or
[tool.cibuildwheel]
build-frontend = "build[uv]"
(Be sure to pre-install uv before running cibuildwheel for this one!)
On conda-forge, this package is called python-build.
Everyone interacting in the build's codebase, issue trackers, chat rooms, and mailing lists is expected to follow the PSF Code of Conduct.
FAQs
A simple, correct Python build frontend
We found that build demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.