Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
pip
requirements.txt
file (Also pins up-to-date versions if mentioned).requirements.txt
detector.pipupgrade
in your CI workflow.$ pip install pipupgrade
Check out installation for more details.
Upgrades all the packages across all detected pip environments.
Upgrades pipupgrade
.
pipupgrade --format {table,tree,json,yaml}
Display packages in the format (defaults to table
)
pipupgrade --pip-path PIP_PATH
Upgrades all the packages within the defined pip environment.
Checks and pretty prints outdated packages (Does not perform upgrades).
pipupgrade --upgrade-type {major,minor,patch}
Upgrades packages only of the upgrade type (defaults to minor and patch).
WARNING: Upgrades all packages (including the ones that break change).
List all packages.
Prompts confirmation dialog for each package to be upgraded.
pipupgrade --requirements REQUIREMENTS
Upgrades the requirements file (if required).
Upgrades the Pipfile and Pipfile.lock file (if required).
Upgrades all the requirements file and/or Pipfile/Pipfile.lock within a project directory.
That's basically it! Run the help for more details...
$ pipupgrade --help
usage: pipupgrade [--pip-path PIP_PATH] [-y] [-c]
[--upgrade-type {major,minor,patch} [{major,minor,patch} ...]]
[-l] [-f {table,tree,json,yaml}] [-a] [--pip] [-s]
[-r REQUIREMENTS] [--pipfile PIPFILE] [-i] [-p PROJECT]
[--git-username GIT_USERNAME] [--git-email GIT_EMAIL]
[--pull-request] [--github-access-token GITHUB_ACCESS_TOKEN]
[--github-reponame GITHUB_REPONAME]
[--github-username GITHUB_USERNAME]
[--target-branch TARGET_BRANCH] [-j JOBS] [-u]
[--no-included-requirements] [--no-cache] [-o OUTPUT]
[--ignore-error] [--force] [--no-color] [-V] [-v] [-h]
[packages [packages ...]]
pipupgrade (v VERSION)
UPGRADE ALL THE PIP PACKAGES!
positional arguments:
packages Packages to Upgrade. (default: None)
optional arguments:
--ignore IGNORE Ignore packages to upgrade. (default: None)
--pip-path PIP_PATH Path to pip executable to be used. (default: None)
-y, --yes Confirm for all dialogs. (default: 0)
-c, --check Perform a dry-run, avoid updating packages. (default:
0)
--upgrade-type {major,minor,patch} [{major,minor,patch} ...]
Upgrade Type (default: ['minor', 'patch'])
-l, --latest Update all packages to latest. (default: 0)
-f {table,tree,json,yaml}, --format {table,tree,json,yaml}
Display packages format. (default: table)
-a, --all List all packages. (default: 0)
--pip Update pip. (default: 0)
-s, --self Update pipupgrade. (default: False)
-r REQUIREMENTS, --requirements REQUIREMENTS
Path(s) to requirements.txt file. (default: None)
--pipfile PIPFILE Path(s) to Pipfile (default: None)
-i, --interactive Interactive Mode. (default: 0)
-p PROJECT, --project PROJECT
Path(s) to Project (default: None)
--git-username GIT_USERNAME
Git Username (default: None)
--git-email GIT_EMAIL
Git Email (default: None)
--pull-request Perform a Pull Request. (default: False)
--github-access-token GITHUB_ACCESS_TOKEN
GitHub Access Token (default: None)
--github-reponame GITHUB_REPONAME
Target GitHub Repository Name (default: None)
--github-username GITHUB_USERNAME
Target GitHub Username (default: None)
--target-branch TARGET_BRANCH
Target Branch (default: master)
-j JOBS, --jobs JOBS Number of Jobs to be used. (default: 4)
-u, --user Install to the Python user install directory for
environment variables and user configuration.
(default: 0)
--no-included-requirements
Avoid updating included requirements. (default: 0)
--no-cache Avoid fetching latest updates from PyPI server.
(default: 0)
-o OUTPUT, --output OUTPUT
Print Output to File. (default: None)
--ignore-error Ignore Error in case of upgrade failure. (default: 0)
--force Force search for files within a project. (default: 0)
--no-color Avoid colored output. (default: 0)
-V, --verbose Display verbose output. (default: False)
-v, --version Show pipupgrade's version number and exit.
-h, --help Show this help message and exit.
Using pipupgrade
's Docker Image to generate a Pull Request can be done as follows:
$ docker run \
-e "PIPUPGRADE_GIT_USERNAME=<YOUR_GIT_USERNAME>" \
-e "PIPUPGRADE_GIT_EMAIL=<YOUR_GIT_EMAIL>" \
-e "PIPUPGRADE_GITHUB_REPONAME=<YOUR_GIT_REPONAME>" \
-e "PIPUPGRADE_GITHUB_USERNAME=<YOUR_GIT_USERNAME>" \
--rm \
-it \
-v $(pwd):/path/to/project \
achillesrasquinha/pipupgrade \
--project /path/to/project \
--pull-request \
--force \
--yes \
--verbose
pipupgrade
attempts to provide an all-in-one solution as compared to the following packages:
This repository has been released under the MIT License.
FAQs
UPGRADE ALL THE PIP PACKAGES!
We found that pipupgrade demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.