Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A tool to upgrade dependencies to the latest versions, inspired by npm-check-updates
From PyPi
pip install pip-check-updates
From GitHub
pip install git+https://github.com/zehengl/pip-check-updates.git
Depends on where you install
pip-check-updates
, if Python's scripts folder is not inpath
, thepcu
entry point would not be available. However you can replacepcu
withpython -m pip-check-updates
.
Show any new dependencies for the project in the current directory:
Changes are color coded
- Red = major upgrade
- Cyan = minor upgrade
- Green = patch upgrade
pcu
Checking dependencies
100%|████████████████████| 6/6 [00:01<00:00, 5.75it/s]
In requirements.txt
Django 3.1.13 → 3.2.6
pandas 0.25.3 → 1.3.2
tqdm 4.62.0 → 4.62.1
Run pcu requirements.txt -u to upgrade versions in 1 file
Upgrade a project's requirements file:
pcu -u
Upgrading dependencies
100%|████████████████████| 6/6 [00:01<00:00, 5.84it/s]
In requirements.txt
Django 3.1.13 → 3.2.6
pandas 0.25.3 → 1.3.2
tqdm 4.62.0 → 4.62.1
Run pip install -r requirements.txt to install new versions
Specify requirements file if needed, -r
option will be recognized as well:
pcu requirements-dev.txt
Checking dependencies
100%|████████████████████| 10/10 [00:01<00:00, 6.05it/s]
In requirements.txt
Django 3.1.13 → 3.2.6
pandas 0.25.3 → 1.3.2
tqdm 4.62.0 → 4.62.1
In requirements-dev.txt
black 21.6b0 → 21.7b0
pylint 2.9.3 → 2.9.6
pytest 5.4.3 → 6.2.4
Run pcu requirements-dev.txt -u to upgrade versions in 2 files
Target version:
pcu requirements-dev.txt -t patch
Checking dependencies
100%|████████████████████| 10/10 [00:02<00:00, 4.73it/s]
In requirements.txt
tqdm 4.62.0 → 4.62.1
In requirements-dev.txt
pylint 2.9.3 → 2.9.6
Run pcu requirements-dev.txt -u to upgrade versions in 2 files
Filter by a pattern:
pcu requirements-dev.txt -f "py*"
Checking dependencies
100%|████████████████████| 10/10 [00:01<00:00, 6.01it/s]
In requirements-dev.txt
pylint 2.9.3 → 2.9.6
pytest 5.4.3 → 6.2.4
Run pcu requirements-dev.txt -u to upgrade versions in 1 file
Work with conda-forge (WIP):
pcu environment.yml -u
Work with Pipenv (WIP):
pcu Pipfile
Include unstable versions:
pcu --pre
Checking dependencies
100%|████████████████████| 6/6 [00:01<00:00, 5.75it/s]
In requirements.txt
Django 3.1.13 → 3.2.6.dev
pandas 0.25.3 → 1.3.2.32.dev
tqdm 4.62.0 → 4.62.1.2.dev
Run pcu requirements.txt -u to upgrade versions in 1 file
Show the helper text:
pcu -h
usage: pcu [-h] [-u] [-f FILTER [FILTER ...]] [-t {latest,newest,greatest,major,minor,patch}] [-x] [-i] [--no_ssl_verify] [--no_recursive] [--ignore_warning] [--show_full_path]
[--no_color] [--ignore_additional_labels] [--init] [--extra EXTRA] [--pre] [--fail_on_update] [--loggable]
[path]
pip-check-updates: A tool to upgrade dependencies to the latest versions, inspired by npm-check-updates.
positional arguments:
path specify path to a requirements file
optional arguments:
-h, --help show this help message and exit
-u, --upgrade overwrite package file with upgraded versions instead of just outputting to console.
-f FILTER [FILTER ...], --filter FILTER [FILTER ...]
include only package names matching the given strings.
-t {latest,newest,greatest,major,minor,patch}, --target {latest,newest,greatest,major,minor,patch}
target version to upgrade to: latest, newest, greatest, major, minor, patch.
-x, --txt output new requirements file instead of human-readable message.
-i, --interactive enable interactive prompts for each dependency.
--no_ssl_verify disable SSL verification.
--no_recursive disable recursive checking.
--ignore_warning ignore warning.
--show_full_path show full path.
--no_color disable color.
--ignore_additional_labels
ignore additional labels.
--init initialize pcufile.toml.
--extra EXTRA extras to consider when parsing TOML files. Not used with Pipfile.
--pre include unstable versions when checking for updates.
--fail_on_update exit with code 1 if updates are available.
--loggable to be logging friendly.
Thanks goes to these wonderful people (emoji key):
Pedro Américo 🐛 💻 | Anders Hovmöller 🐛 | Jani Tiainen 🐛 | Daniel A.A. Pelsmaeker 🐛 | Nikolai Røed Kristiansen 🤔 💻 | Giovanni Santini 🤔 💻 | Pelayo García 💻 🤔 |
Radu Suciu 🐛 💻 | atchisson 🤔 💻 | purificant 💻 |
This project follows the all-contributors specification. Contributions of any kind welcome!
FAQs
A tool to upgrade dependencies to the latest versions
We found that pip-check-updates demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.