Python pip¶

The pip package installer for Python, driven as a module (python -m pip) rather than through the pip executable.

Calling the module through the interpreter lets pip upgrade itself, an advantage on Windows in particular (https://snarky.ca/why-you-should-use-python-m-pip/).

Installed and outdated packages are read from pip’s list --format=json output. The outdated query adds --not-required to report only top-level packages, since upgrading a transitive dependency can break its parent’s version constraints (#1214). There is no search: PyPI disabled its server-side search API in 2020 under unmanageable load, so pip search no longer works (see pip issue 5216).

Note

All operations target the default pip scope (system site-packages, or the active virtualenv). Per-scope targeting (system vs user vs venv) and multi-binary discovery (multiple pythons via pyenv) are tracked in #1725.

Note

Interpreter discovery probes the running Python first, so an mpm installed inside a virtualenv manages that virtualenv, then the Python(s) on PATH. Two kinds are skipped so the manager only targets a scope the user can install into: mpm’s own distributor-managed bundle (Homebrew stages it under a Cellar prefix) and any externally-managed, non-virtualenv interpreter that PEP 668 forbids pip install into. When every candidate is skipped, the manager reports as unavailable.

Note

Installs, upgrades and removals are marked privileged, so a global install can escalate with --sudo, but escalation is off by default. The supply-chain cooldown needs pip 26.1, the first release to honor --uploaded-prior-to; older pip silently ignores the release-age gate.

Home page: https://pip.pypa.io
Source: meta_package_manager/managers/pip.py
Version requirement: >=26.1.0

Platforms¶

🅱️ BSD
🐧 Linux
🍎 macOS
⨂ Unix
🪟 Windows

Operations¶

Operation	Supported	Notes
`installed`	✓
`outdated`	✓
`search`
`install`	✓
`upgrade`	✓
`upgrade_all`	✓	backfilled by `mpm`
`remove`	✓
`sync`
`cleanup`	✓

Ecosystem¶

Accepted purl types: pkg:pip, pkg:pypi

Usage¶

$ mpm --pip installed
$ mpm --pip upgrade --all
$ mpm install pkg:pip/hello
$ mpm --dry-run --pip upgrade --all

Every example above accepts --dry-run, which simulates the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Deselect the manager for a single run with --no-pip, disable it from your configuration, or tune its invocation attributes with per-manager overrides.

Command line¶

CLI names, in lookup order: python3, python
Arguments forced before each call: -m pip --no-color

The version is probed by running:

$ python3 -m pip --no-color --version
pip 2.0.2 from /usr/local/lib/python/site-packages/pip (python 3.7)

and extracted with:

r"pip\s+(?P<version>\S+)"

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown¶

mpm natively enforces its release-age cooldown on Python pip, injecting the PIP_UPLOADED_PRIOR_TO environment variable on every call.

Status: ✅ Enforced (pip ≥ 26.1)
Mechanism: --uploaded-prior-to env PIP_UPLOADED_PRIOR_TO
Reference: pypa/pip#13674

Reference traces¶

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Python pip well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ python -m pip --no-color list --format=json --verbose --quiet
[
 {
    "version": "1.3",
    "name": "backports.functools-lru-cache",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
  },
  {
    "version": "0.9999999",
    "name": "html5lib",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
  },
  {
    "name": "setuptools",
    "version": "46.0.0",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": ""
  },
  {
    "version": "2.8",
    "name": "Jinja2",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": ""
  }
]

$ python -m pip --no-color list --format=json --outdated             > --not-required --verbose --quiet
[
  {
    "latest_filetype": "wheel",
    "version": "0.7.9",
    "name": "alabaster",
    "latest_version": "0.7.10",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
  },
  {
    "latest_filetype": "wheel",
    "version": "0.9999999",
    "name": "html5lib",
    "latest_version": "0.999999999",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
   },
  {
    "latest_filetype": "wheel",
    "version": "2.8",
    "name": "Jinja2",
    "latest_version": "2.9.5",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
   },
  {
    "latest_filetype": "wheel",
    "version": "0.5.3",
    "name": "mccabe",
    "latest_version": "0.6.1",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
   },
  {
    "latest_filetype": "wheel",
    "version": "2.2.0",
    "name": "pycodestyle",
    "latest_version": "2.3.1",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
   },
  {
    "latest_filetype": "wheel",
    "version": "2.1.3",
    "name": "Pygments",
    "latest_version": "2.2.0",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": ""
   }
]