Skip to content

Upgrading pip 18 to 19

Breaking18.1 → 19.3.1Breaking6Security8Platform1Deprecated2New18Changed55Fixed71Other15

Full comparisonBack to pip
BreakingUpgrade verdict

6 breaking changes and a platform requirement change and 7 security fixes.

In plain terms
  • The --venv flag on the pip config command is gone. Use the standard virtual environment handling instead.
  • The old --process-dependency-links flag no longer exists.
  • pip freeze no longer detects SVN editable installs via dependency links.
  • If you install from a Subversion repository URL without the svn+ prefix, that no longer works. Add svn+ to the URL to keep the old behavior.
Must act Top 5 of 16 that need code or config changes

Python requirement changed in 19.2: >=2.7,!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.* → >=2.7,!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*.

What you must change

Breaking6
Removes the deprecated --venv option from pip config.
pip config--venv
19.3NEWS.rstSummarizedView source
Removes the deprecated --process-dependency-links option.
--process-dependency-links
19.0NEWS.rstSummarizedView source
Removes the deprecated SVN editable detection based on dependency links during freeze.
freeze
19.0NEWS.rstSummarizedView source
Removes undocumented support for un-prefixed URL requirements pointing to SVN repositories.
svn+
19.3NEWS.rstSummarizedView source
Using --build-options in a PEP 517 build now fails with an error instead of silently ignoring the option.
--build-options
19.1NEWS.rstSummarizedView source
Errors out with an informative message when installing a PEP 517 pyproject.toml source tree using --editable mode.
--editablepyproject.toml
19.1NEWS.rstSummarizedView source
Security7
Redacts single-part login credentials from URLs in log messages.
19.3NEWS.rstSummarizedView source
Aborts installation if any archive contains a file which would be placed outside the extraction location.
19.3NEWS.rstSummarizedView source
Hides security-sensitive strings like passwords in log messages related to version control system command invocations.
19.3NEWS.rstSummarizedView source
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
pip installContent-Disposition
19.2GitHub AdvisoryOriginalView source
Hides passwords in output when using --find-links.
--find-links
19.2NEWS.rstSummarizedView source
Redacts the password from the extra index URL when using pip -v.
pip -v
19.1NEWS.rstSummarizedView source
Redacts the password from the URL in various log messages.
19.0NEWS.rstSummarizedView source
Platform1
Drops support for EOL Python 3.4.
19.2NEWS.rstSummarizedView source

Deprecations to plan for

Deprecated2
Deprecates support for Python 3.4.
19.0NEWS.rstSummarizedView source
Prints a warning for Python 2.7 about impending End-of-life and prompts migration to Python 3.
19.0NEWS.rstSummarizedView source