uv for VS Code — what's outdated and what's vulnerable, in the file you already have open
Requires VS Code 1.125 or newer.
New in 0.2.0
Your declared dependencies are checked against the OSV advisory database — the PyPA Advisory Database and GitHub Security Advisories. Each finding names the CVE, its severity, and the version that fixes it, with a quick fix that makes the bump for you.
uv.lock (or an == pin) resolves each range to the version you actually install, so a finding means you are affected rather than your constraint permits it. Only top-level dependencies are reported — nothing you can't fix where you're standing.
Off by default. Turning it on is what sends package names and versions to api.osv.dev; a per-package check is always available from the quick-fix menu.
PyPI polled in the background, in pyproject.toml or requirements.txt. Every stale dep gets a one-click upgrade.
A status-bar action on every requirements.txt. One click, and your project is on uv.
An interactive webview — every dep, current vs. latest, a Security column linking each advisory, and an Upgrade button on every outdated row.
The full PyPI history of a package, in a quick-pick menu.
uv sync, add, and run — without dropping to a terminal. Plus a "Run uv sync" prompt on save when versions change.
Reads and writes the file your team already commits. Bump project version, switch requires-python — all from quick-fixes.
Built for Python developers who use uv
A focused VS Code extension that turns uv's speed into editor-native ergonomics — and, since 0.2.0, watches the dependencies you declared for published advisories.
Declared dependencies are checked against the OSV advisory database — the PyPA Advisory Database and GitHub Security Advisories. Every finding names the CVE, its severity, and the version that fixes it, and arrives as a diagnostic, a hover entry, and an "Upgrade … (fixes CVE-…)" quick fix.
A uv.lock entry — or an == pin — resolves each declared range to the exact version you actually install, so a finding means you are affected rather than your constraint permits it. Only top-level dependencies are reported, so every finding is fixable in the file in front of you.
Background checking is off by default — enabling it is what sends your package names to api.osv.dev. Until then, ⌘. on any dependency offers "Check <package> for security advisories", and a one-off UV: Check Dependencies command scans the whole file without changing the setting.
Practical UV polls PyPI in the background and flags every dependency in pyproject.toml or requirements.txt that has a newer release available — with a one-click upgrade affordance per row.
Same outdated detection, hover info, code actions, and dashboard for requirements.txt, requirements-*.txt, and any *.txt under requirements/. Comments, pip directives, direct URL specs, and PEP 508 markers all parsed correctly.
Open a requirements.txt and a "Convert to uv" action appears in the status bar. One click runs uv init (if needed) and uv add -r in the integrated terminal — your project is on uv.
UV: Show Dependencies opens an interactive webview that lists every dependency with its current and latest PyPI versions, a Security column linking each advisory it found, and an Upgrade button on every outdated row.
Pick any version from the full PyPI history of a package — pre-releases, yanked releases, or anything in between — straight from a quick-pick menu.
Place the cursor on requires-python and quick-fix to any Python release — latest patch versions sourced live from endoflife.date, or browse the full history from 3.1 onwards.
Cursor on the [project] version line — bump major, minor, or build with a quick-fix. 0.1.0 → 0.1.1, 0.2.0, or 1.0.0 in a single keystroke.
Hover any package name to see its latest PyPI version with a link straight to the project page. No tab-switching to look up what you already have open.
Run uv sync, uv add, and uv run from VS Code's command palette without dropping to a terminal. Output streams into the integrated panel — and a "Run uv sync" prompt fires automatically when you save a pyproject.toml with changed versions.
Free, open source, and ready to drop into your editor — VS Code, VSCodium, or Cursor. v0.2.0 adds CVE checking against the OSV advisory database, off by default until you ask for it.