Check if requirements are up to date

Question

I'm using pip requirements files for keeping my dependency list.

I also try to follow best practices for managing dependencies and provide precise package versions inside the requirements file. For example:

Django==1.5.1
lxml==3.0

The question is: Is there a way to tell that there are any newer package versions available in the Python Package Index for packages listed inside requirements.txt?

For this particular example, currently latest available versions are 1.6.2 and 3.3.4 for Django and lxml respectively.

I've tried pip install --upgrade -r requirements.txt, but it says that all is up-to-date:

$ pip install --upgrade -r requirements.txt 
Requirement already up-to-date: Django==1.5.1 ...

Note that at this point I don't want to run an actual upgrade - I just want to see if there are any updates available.

Solution 1

Pip has this functionality built-in. Assuming that you're inside your virtualenv type:

$ pip list --outdated
psycopg2 (Current: 2.5.1 Latest: 2.5.2)
requests (Current: 2.2.0 Latest: 2.2.1)

$ pip install -U psycopg2 requests

After that new versions of psycopg2 and requests will be downloaded and installed. Then:

$ pip freeze > requirements.txt

And you are done. This is not one command but the advantage is that you don't need any external dependencies.

Solution 2

Just found a python package specifically for the task - piprot, with the following slogan:

How rotten are your requirements?

It's very straightforward to work with:

$ piprot requirements.txt 
Django (1.5.1) is 315 days out of date. Latest is 1.6.2
lxml (3.0) is 542 days out of date. Latest is 3.3.4
Your requirements are 857 days out of date

Also you can "pipe" pip freeze to piprot command, so it can actually inspect how rotten are the packages installed in your sandbox/virtual environment:

pip freeze | piprot

Hope that will help somebody in the future.

Solution 3

Since you mentioned you like to follow best practices, I am guessing you are using virtualenv too, correct? Assuming that is the case, and since you are already pinning your packages, there is a tool called pip-tools that you can run against your virtualenv to check for updates.

There is a down side, and why I mentioned the use of virtualenv though.

[the tool] checks PyPI and reports available updates. It uses the list of currently installed packages to check for updates, it does not use any requirements.txt

If you run it in your virtualenv, you can easily see which packages have updates available for your current active environment. If you aren't using virtualenv, though, it's probably not best to run it against the system as your other projects may depend on different versions (or may not work well with updated version even if they all currently work).

From the documentation provided, usage is simple. The pip-review shows you what updates are available, but does not install them.

$ pip-review
requests==0.13.4 available (you have 0.13.2)
redis==2.4.13 available (you have 2.4.9)
rq==0.3.2 available (you have 0.3.0)

If you want to automatically install as well, the tool can handle that too: $ pip-review --auto. There is also an --interactive switch that you can use to selectively update packages.

Once all of this is done, pip-tools provides a way to update your requirements.txt with the newest versions: pip-dump. Again, this runs against the currently active environment, so it is recommended for use within a virtualenv.

Installation of the project can be accomplished via pip install pip-tools.

Author's note: I've used this for small Django projects and been very pleased with it. One note, though, if you install pip-tools into your virtual environment, when you run pip-dump you'll find that it gets added to your requirements.txt file. Since my projects are small, I've always just manually removed that line. If you have a build script of some kind, you may want to automatically strip it out before you deploy.

Solution 4

You can just simply do something like this in your env (virtual or non virtual):

pip freeze | cut -d = -f 1 | xargs -n 1 pip search | grep -B2 'LATEST:'

View more solutions

Comments

[alecxe]

pip-tools is definitely the package I'm going to use, thank you for pointing it out. Also check the answer I've provided: as far as I understand, pip-tools works with your virtual environment, but piprot uses "requirements-only" approach, correct?

[Andy]

@alecxe That is how it looks. I hadn't seen piprot before. That looks very interesting too. Thanks for pointing it out.

[0atman]

This is the correct answer. The others are handy to know, but this uses no extra tools.

[tobych]

Gotta love how piprot adds up all the days at the end.

[alecxe]

@TobyChampion yeah, it's kind of depressing sometimes - especially if you know you cannot upgrade something that was released more than 1 year ago :)

[yucer]

pip freeze | piprot doesn't work for me: piprot (0.9.6) and pip (1.5.6) anyway piprot requirements.txt is works very good

[Vadim Kotov]

Just installed latest version of pip-tools, but I dont have pip-review file in my path. Something changed?

[kxr]

pip list --outdated runs slow for many packages installed. And pip search <package> is not very helpful - gives dev versions as latest and yields too much trash. Is there a command for checking precisely only one/few packages for updates (which actually would happen on pip install -U) thus a sort of simulation run?

[Max Tepkeev]

@kxr Just checked pip docs to be sure and as of today I don't think it is possible.

[thorwhalen]

Don't know if it's the same thing (I too have your problem @vadim, but found pip-review here: github.com/jgonggrijp/pip-review

[RoachLord]

pip-review was moved into another project as @thorwhalen has already mentioned and linked. Discussion as to why here

[Sohaib Farooqi]

No longer maintained :(