Python pip¶

ID: pip
Links: Home page · Documentation · Repository · Wikipedia
Upstream stars: ⭐ 10,288
Last commit: 2026-09-23
Version requirement: >= 26.1
Cooldown: ✓
Platforms: 🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows
Operations: installed · outdated · install · upgrade · upgrade_all · remove · cleanup · doctor
purl types: pkg:pip/ · pkg:pypi/
CLI names (lookup order): python3 · python
Every call: python3 -m pip --no-color <command>
Issues and PRs: 📦 manager: pypi-based
Source: pip.py

The pip package installer for Python, driven as a module (python -m pip) rather than through the pip executable.

Calling the module through the interpreter lets pip upgrade itself, an advantage on Windows in particular: see why you should use python -m pip.

Installed and outdated packages are read from pip’s list --format=json output. The outdated query adds --not-required to report only top-level packages, since upgrading a transitive dependency can break its parent’s version constraints (#1214).

Note

All operations target the default pip scope (system site-packages, or the active virtualenv). Per-scope targeting (system vs user vs venv) and multi-binary discovery (multiple pythons via pyenv) are tracked in #1725.

Note

Interpreter discovery probes the running Python first, so an mpm installed inside a virtualenv manages that virtualenv, then the Python(s) on PATH. Three kinds are skipped so the manager only targets a scope the user can install into: mpm’s own distributor-managed bundle (Homebrew stages it under a Cellar prefix), any externally-managed, non-virtualenv interpreter that PEP 668 forbids pip install into, and any interpreter carrying no pip to drive. When every candidate is skipped, the manager reports as unavailable.

Note

Installs, upgrades and removals are marked privileged, so a global install can escalate with --sudo, but escalation is off by default. The supply-chain cooldown needs pip 26.1, the first release to honor --uploaded-prior-to; older pip silently ignores the release-age gate.

What `mpm` adds to `pip`¶

Through mpm, pip gains a one-command upgrade --all that refreshes every outdated package in a single run.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover pip alongside pipx, pipxu, uv, uvx and any other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `pip` commands, in `mpm`¶

You already know pip: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `pip`	With `mpm`
List what’s installed	`python list --format=json --verbose --quiet`	`mpm --pip installed`
List outdated packages	`python list --format=json --outdated > --not-required --verbose --quiet`	`mpm --pip outdated`
Install a package	`python install arrow`	`mpm install pkg:pip/arrow`
Upgrade one package	`python install --upgrade six`	`mpm --pip upgrade six`
Upgrade everything	—	`mpm --pip upgrade --all`
Remove a package	`python uninstall --yes arrow`	`mpm remove pkg:pip/arrow`
Clear caches	`python cache purge`	`mpm --pip cleanup --cache`
Run health checks	`python check`	`mpm --pip doctor`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✅
`outdated`	✅
`orphans`
`search`	❌	PyPI disabled its server-side search API in 2020 (pypa/pip#5216), so `pip search` no longer works.
`install`	✅
`upgrade`	✅
`upgrade_all`	✅	No native `upgrade --all`; backfilled by `mpm`.
`remove`	✅
`sync`
`cleanup`	✅
`doctor`	✅

Configuration¶

Ignore pip on the mpm CLI by passing the --no-pip option.
Ignore it for every run in your configuration:
```
[mpm]
pip = false
```
Raise the timeout of all pip calls:
```
[mpm.overrides.pip]
timeout = 900
```

Run mpm config-template pip to print all overridable settings for your configuration file:

[mpm.overrides.pip]
cli_names = [
    "python3",
    "python",
]
cli_search_path = []
dry_run = false
ignore_auto_updates = true
plan = false
post_args = []
pre_args = [
    "-m",
    "pip",
    "--no-color",
]
pre_cmds = []
requirement = ">=26.1.0"
stop_on_error = false
unmaintained = false
version_cli_options = [
    "-m",
    "pip",
    "--no-color",
    "--version",
]
version_regexes = [
    "pip\\s+(?P<version>\\S+)",
]

The arguments and environment variables listed in the box atop this page are forced on every pip call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Recipes¶

A few jobs you would otherwise script around pip, one mpm command each:

Snapshot and clone a machine: mpm --pip dump pip.toml, then mpm restore pip.toml on the next one.
Export a compliance SBOM: mpm --pip sbom (CycloneDX by default, --spdx for SPDX).
Gate CI on health: mpm --pip doctor relays Python pip’s own diagnosis and exits non-zero on trouble.

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

Its privileged operations are install, remove, upgrade.

See privilege escalation for the full policy.

Cooldown¶

mpm natively enforces its release-age cooldown on Python pip, injecting the PIP_UPLOADED_PRIOR_TO environment variable on every call. Point it at a window (mpm --cooldown 7 --pip upgrade --all) to skip anything published in the last 7 days: a guard against a compromised or yanked fresh release landing before anyone notices.

Status: ✅ Enforced (pip ≥ 26.1)
Mechanism: --uploaded-prior-to env PIP_UPLOADED_PRIOR_TO
Reference: pypa/pip#13674

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: PyPI (pkg:pypi)
Retraction: Yank (PEP 592): the file stays downloadable, but an installer “MUST ignore yanked releases, if the selection constraints can be satisfied with a non-yanked version”
Publish date: ✅ upload_time_iso_8601, plus a per-file yanked flag (JSON API)

Reference traces¶

A collection of raw native outputs captured from the manager’s own CLI and recorded in the manager source. If you know Python pip well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ python -m pip --no-color list --format=json --verbose --quiet
[
 {
    "version": "1.3",
    "name": "backports.functools-lru-cache",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
  },
  {
    "version": "0.9999999",
    "name": "html5lib",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
  },
  {
    "name": "setuptools",
    "version": "46.0.0",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": ""
  },
  {
    "version": "2.8",
    "name": "Jinja2",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": ""
  }
]

$ python -m pip --no-color list --format=json --outdated         > --not-required --verbose --quiet
[
  {
    "latest_filetype": "wheel",
    "version": "0.7.9",
    "name": "alabaster",
    "latest_version": "0.7.10",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
  },
  {
    "latest_filetype": "wheel",
    "version": "0.9999999",
    "name": "html5lib",
    "latest_version": "0.999999999",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
   },
  {
    "latest_filetype": "wheel",
    "version": "2.8",
    "name": "Jinja2",
    "latest_version": "2.9.5",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
   },
  {
    "latest_filetype": "wheel",
    "version": "0.5.3",
    "name": "mccabe",
    "latest_version": "0.6.1",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
   },
  {
    "latest_filetype": "wheel",
    "version": "2.2.0",
    "name": "pycodestyle",
    "latest_version": "2.3.1",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
   },
  {
    "latest_filetype": "wheel",
    "version": "2.1.3",
    "name": "Pygments",
    "latest_version": "2.2.0",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": ""
   }
]

Version check¶

The version is probed by running:

$ python3 -m pip --no-color --version
pip 26.2.1 from /tmp/mpm-pip/lib/python3.14/site-packages/pip (python 3.14)

and extracted with:

r"pip\s+(?P<version>\S+)"

Upstream project¶

Metrics	`pypa/pip`
Activity
Popularity
Metadata

Changelog¶

8.0.0 (2026-09-20)
- Report each manager’s install root and its owner in mpm doctor.
- Warn with the [mpm.overrides.<id>] sudo = true remedy when an operation carrying a dormant privileged marker fails on a permission error, like a global install into a root-owned prefix.
- Skip an interpreter carrying no pip, so an mpm installed by uv tool or pipx drives a real Python instead of its own virtualenv, and skip a Windows python3.exe app-execution alias with no Python behind it.
7.1.0 (2026-07-07)
- Only target a Python the user can actually install into: mpm’s own bundled virtualenv and externally-managed interpreters (PEP 668) are skipped, so distro-managed packages no longer surface as bogus outdated pip upgrades. Supersedes the dependency-tree filter from #1767.
- Probe the Python interpreter version under the short read-only timeout instead of the long state-changing default.
6.4.0 (2026-04-27)
- Add cleanup operation.
- Filter mpm’s own dependency tree from outdated results to fix false positives in Homebrew-installed environments. Closes #1767.
6.3.0 (2026-04-09)
- Only report top-level packages as outdated, skipping transitive dependencies. Closes #1214.
- Remove --user flag from upgrade command so upgrades target the same scope as list and outdated.
- Prepend the current Python executable to the list of candidates when searching for pip binaries, so the active environment is always checked first.
5.11.7 (2023-02-20)
- Print Python’s own version in debug logs before checking for Pip’s version.
5.4.0 (2022-06-29)
- Do not wait for user confirmation on remove operation.
5.2.0 (2022-06-16)
- Add remove operation.
4.1.0 (2021-05-01)
- Fix search of python3 binary on macOS. Closes #247.
3.6.0 (2021-01-03)
- pip search has been disabled by maintainers because of server-side high-load.
3.2.0 (2020-05-31)
- Remove pip2/pip3 distinctions, use system’s python and call pip module.
3.0.0 (2020-03-25)
- Collect installer metadata on listing.
- Bump minimal requirement of pip to 10.0.*.
2.9.0 (2020-03-18)
- Force Python pip upgrade to user-installed packages. Refs #58.
2.6.0 (2017-09-10)
- Use pip 9.0 JSON output. Closes #18.
- Bump minimal requirement of pip to 9.0.*.
2.2.0 (2016-12-25)
- Allow usage of pip2 and pip3 managers on Linux.
1.7.0 (2016-08-16)
- New workaround for full pip upgrade command.
1.6.0 (2016-08-10)
- Work around the lacks of full pip upgrade command.
1.2.0 (2016-07-08)
- Add support for both pip2 and pip3, Node’s npm, Atom’s apm, Ruby’s gem.
1.1.0 (2016-07-07)
- Add support for Python’s pip.

Python pip¶

What mpm adds to pip¶

Your pip commands, in mpm¶

Operations¶

Configuration¶

Recipes¶

Privilege escalation¶

Cooldown¶

Reference traces¶

Version check¶

Upstream project¶

Changelog¶

What `mpm` adds to `pip`¶

Your `pip` commands, in `mpm`¶