uv pip autoupdate?

[gtkacz]

Question

Is there a way to run a command through uv to "autoupdate" (bump to the latest version conforming to the constraints, like what dependabot does) in a pip environment?

Platform

Linux 5.15.167.4-microsoft-standard-WSL2 x86_64 GNU/Linux

Version

uv 0.6.8 (c1ef482 2025-03-18)

[FishAlchemist]

I believe this request is associated with this issue

• Add option to upgrade all packages in the environment, e.g., upgrade --all #1419

[notatallshaw]

FWIW, if your using a pip workflow, this is the purpose of the uv pip compile:

1. Define your unpinned requirements in a requirements.in
2. Compile them to a requirements.txt, e.g. uv pip compile --upgrade requirements.in -o requirements.txt
3. Sync your environment with the upgraded requirements uv pip sync requirements.txt

You can write a small script to turn this into a single command, with various options you may prefer. I beleive uv pip compile also supports implicitly extracting the requirements out of a pyproject.toml.

[gtkacz]

@notatallshaw thing is, I need some of the dependencies pinned due to vulnerabilities detected by Snyk

[notatallshaw]

@notatallshaw thing is, I need some of the dependencies pinned due to vulnerabilities detected by Snyk

In the workflow I describe above all dependencies and transitive dependencies are pinned in the requirements.txt, if you need to constrain what versions a particular package can be pinned to then you define those constraints in the requirements.in.

[konstin]

@notatallshaw thing is, I need some of the dependencies pinned due to vulnerabilities detected by Snyk

How do you currently define what you install in the venv, and how does snyk interact with that?

[gtkacz]

@konstin Snyk itself will create PRs pinning versions to avoid vulnerabilites, e.g.: https://github.com/gtkacz/temporal_adjusters_py/pull/34/files

[konstin]

You can use uv pip install --upgrade requirements_dev.txt, this will update all direct dependencies listed and their transitive dependencies, too.

[gtkacz]

@konstin that will do it only on the env, no? I was looking for a command that would update the requirements file itself