Skip to content

Upgrading pip 20 to 21

Breaking20.3.4 → 21.3.1Breaking7Security3Deprecated2New15Changed54Fixed47Other10

Full comparisonBack to pip
BreakingUpgrade verdict

7 breaking changes and 2 security fixes.

In plain terms
  • The --build-dir command line option no longer exists.
  • Scripts that pass --find-links to pip freeze will stop working.
  • pip 21.0 no longer runs on Python 2; you must use Python 3.
  • Old cached wheel files from pip versions before 20.0 are no longer usable and will be ignored.
Must act Top 5 of 11 that need code or config changes

Python requirement changed in 21.0: >=2.7,!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.* → >=3.6.

What you must change

Breaking7
Removes the --build-dir option and its aliases.
--build-dir
21.3NEWS.rstSummarizedView source
Removes the deprecated --find-links option from pip freeze.
pip freeze--find-links
21.2NEWS.rstSummarizedView source
Drops support for Python 2.
21.0NEWS.rstSummarizedView source
Removes support for legacy wheel cache entries created by pip versions older than 20.0.
21.0NEWS.rstSummarizedView source
Removes support for VCS pseudo URLs in editable requirements, deprecated since 20.0.
21.0NEWS.rstSummarizedView source
Drops support for Python 3.5.
21.0NEWS.rstSummarizedView source
Removes the VCS export feature used only with editable VCS requirements, which had correctness issues.
21.0NEWS.rstSummarizedView source
Security2
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.
21.1GitHub AdvisoryOriginalView source
Updates vendored urllib3 to 1.26.4 to fix CVE-2021-28363.
urllib3
21.1NEWS.rstSummarizedView source

Deprecations to plan for

Deprecated2
Improves the deprecation warning about copying source trees when installing from a local directory.
21.3NEWS.rstSummarizedView source
Delays removal of the source distribution re-installation feature to 21.3.
21.2.1NEWS.rstSummarizedView source

API changes

Generated by DepDelta from published Python source. Not mixed with prose notes.

  • removed: export MYPY_CHECK_RUNNING
  • changed: function main(args=…) → function main(args: Optional[List[str]]=…) -> int