Practical UV
Practical UV for VS Code
A Convert to uv button on every requirements.txt, then outdated and vulnerable dependencies flagged in the file you have open, a dependency dashboard, version pickers and uv commands in the palette.
VS Code 1.125 or newer, VSCodium or Cursor.
Practical UV CLI
The same move from pip to uv, in any terminal, script or pipeline. It lists the commands, asks once, then runs them. Nothing to install first: npx fetches it.
Node.js 18 or newer, and uv. macOS, Linux and Windows.
Migrate from pip to uv in one click
1Open your requirements.txt
The one your project installs from. As soon as it is the active editor, a Convert to uv button appears in the status bar.
# requirements.txtrequests==2.32.3pydantic>=2.10fastapiLn 3, Col 8UTF-8 Convert to uv2Click Convert to uv, then confirm
Practical UV lists the commands it will run, and where, then waits for you. They run in VS Code's own terminal: uv init --bare if the workspace has no pyproject.toml yet, which writes that file and nothing else, then uv add -r to import every requirement.
Converting requirements-dev.txt offers uv's dev group instead. Also in the command palette, as UV: Convert requirements.txt to uv project.
Convert my-app to a uv project?
Runs in the terminal, in my-app:
uv init --bareuv add -r requirements.txt"uv init --bare" creates pyproject.toml and nothing else. requirements.txt is read, not changed.
CancelConvertTerminal$ uv init --bareInitialized project `my-app`$ uv add -r requirements.txtCreating virtual environment at: .venvResolved 15 packages in 402msInstalled 14 packages in 38ms3You're on uv
Your dependencies now live in pyproject.toml, uv.lock pins every version, and .venv is installed. requirements.txt is left exactly as it was, so you can compare before you delete it.
From here, uv sync installs and uv run runs — and Practical UV keeps flagging whatever falls behind.
# pyproject.toml[project]name = "my-app"version = "0.1.0"requires-python = ">=3.13"dependencies = ["fastapi>=0.115.0", was unpinned"pydantic>=2.10","requests==2.32.3",]uv.lock every version pinned .venv installed
Or convert from any terminal
The button's conversion is also a command-line tool. Run it in the project folder: it lists the same commands, asks once, then runs them. Development requirements go into uv's dev group, and a development file that includes requirements.txt is split the same way.
Needs Node.js and uv. --dry-run only prints the commands, and --yes skips the question, for scripts. On npm.
# In the project folder npx @wizhut_tech/practical-uv convert # Development requirements npx @wizhut_tech/practical-uv convert \ requirements-dev.txt
Or migrate by hand
Want to type each step yourself? These are the commands the button runs: the first two for requirements.txt, the third for a development requirements file. One that starts with -r requirements.txt takes one more step, and the questions below cover it.
# Create pyproject.toml, nothing else uv init --bare # Import every requirement and install uv add -r requirements.txt # Development-only: into the dev group uv add --dev -r requirements-dev.txt
Your pip habits, in uv
Much of the change is what you stop doing: uv creates the virtual environment and keeps the lockfile current on its own.
| pip | uv |
|---|---|
| python -m venv .venv | Not needed — uv creates .venv itself |
| source .venv/bin/activate | Not needed — uv run uses .venv directly |
| pip install -r requirements.txt | uv sync |
| pip install requests | uv add requests |
| pip uninstall requests | uv remove requests |
| pip install --upgrade requests | uv lock --upgrade-package requests |
| pip freeze > requirements.txt | Not needed — uv keeps uv.lock current |
| pip list --outdated | uv tree --outdated or see it flagged in the file |
| python app.py | uv run app.py |
uv inside the editor, flagging what's vulnerable and not just what's old
Known Vulnerabilities, in the File You Declared Them
Your declared dependencies are checked against the OSV advisory database — the PyPA Advisory Database and GitHub Security Advisories. Each finding names the CVE, its severity, and the version that fixes it, with a quick fix that makes the bump for you.
uv.lock (or an == pin) resolves each range to the version you actually install, so a finding means you are affected rather than your constraint permits it. Only top-level dependencies are reported — nothing you can't fix where you're standing.
Off by default. Turning it on is what sends package names and versions to api.osv.dev; a per-package check is always available from the quick-fix menu.
Outdated Detection — Everywhere
PyPI polled in the background, in pyproject.toml or requirements.txt. Every stale dep gets a one-click upgrade.
The Upgrade, One Menu Away
The extension in VS Code: a stale pin underlined in pyproject.toml, with the upgrade and a version picker on the quick-fix menu.
Not Migrating Yet? Still Covered
Outdated pins, hover, the dashboard and the vulnerability check all work on requirements.txt too — comments, pip options and environment markers included.
Dependency Dashboard
An interactive webview — every dep, current vs. latest, a Security column linking each advisory, and an Upgrade button on every outdated row.
Pick Any Version
The full PyPI history of a package, in a quick-pick menu.
Command Palette
uv sync, add, and run — without dropping to a terminal. Plus a "Run uv sync" prompt on save when versions change.
pyproject.toml-Native
Reads and writes the file your team already commits. Bump project version, switch requires-python — all from quick-fixes.
Version Bumps Without Typing
The extension in VS Code: the project version bumped by build, minor or major from the same menu.
uv's speed, editor-native ergonomics
Known-Vulnerability Detection
Declared dependencies are checked against the OSV advisory database — the PyPA Advisory Database and GitHub Security Advisories. Every finding names the CVE, its severity, and the version that fixes it, and arrives as a diagnostic, a hover entry, and an "Upgrade … (fixes CVE-…)" quick fix.
uv.lock-Accurate, Top-Level Only
A uv.lock entry — or an == pin — resolves each declared range to the exact version you actually install, so a finding means you are affected rather than your constraint permits it. Only top-level dependencies are reported, so every finding is fixable in the file in front of you.
Check One Package On Demand
Background checking is off by default — enabling it is what sends your package names to api.osv.dev. Until then, ⌘. on any dependency offers "Check <package> for security advisories", and a one-off UV: Check Dependencies command scans the whole file without changing the setting.
Outdated Dependency Detection
Practical UV polls PyPI in the background and flags every dependency in pyproject.toml or requirements.txt that has a newer release available — with a one-click upgrade affordance per row.
Pip / requirements.txt Support
Same outdated detection, hover info, code actions, and dashboard for requirements.txt, requirements-*.txt, and any *.txt under requirements/. Comments, pip directives, direct URL specs, and PEP 508 markers all parsed correctly.
Migrate from pip to uv
Open a requirements.txt and a "Convert to uv" button appears in the status bar. Confirm once, and uv init --bare (if needed) and uv add -r run in the integrated terminal — you end up with a pyproject.toml, a uv.lock and an installed .venv, and nothing else. Development requirements go into uv's dev group. Outside VS Code, npx @wizhut_tech/practical-uv does the same.
Dependency Dashboard
UV: Show Dependencies opens an interactive webview that lists every dependency with its current and latest PyPI versions, a Security column linking each advisory it found, and an Upgrade button on every outdated row.
Version Picker
Pick any version from the full PyPI history of a package — pre-releases, yanked releases, or anything in between — straight from a quick-pick menu.
Python Version Picker
Place the cursor on requires-python and quick-fix to any Python release — latest patch versions sourced live from endoflife.date, or browse the full history from 3.1 onwards.
Project Version Bumping
Cursor on the [project] version line — bump major, minor, or build with a quick-fix. 0.1.0 → 0.1.1, 0.2.0, or 1.0.0 in a single keystroke.
Hover Info
Hover any package name to see its latest PyPI version with a link straight to the project page. No tab-switching to look up what you already have open.
Command Palette Integration
Run uv sync, uv add, and uv run from VS Code's command palette without dropping to a terminal. Output streams into the integrated panel — and a "Run uv sync" prompt fires automatically when you save a pyproject.toml with changed versions.
Questions people ask before moving from pip to uv
- Do I need VS Code to migrate from pip to uv?
- No. Run
npx @wizhut_tech/practical-uv convertin the project folder and it does what the button does: it lists the commands, asks once, then runs them. Underneath it is two uv commands —uv init --bare, thenuv add -r requirements.txt— which you can also type yourself. In VS Code, Practical UV then keeps watching the pyproject.toml they produce: outdated versions are flagged where you declared them, and known vulnerabilities too once you turn that check on. - What happens to my requirements.txt?
- Nothing. The migration reads it and leaves it exactly as it was, so you can compare before you delete it — from then on, uv works from pyproject.toml and uv.lock. If a tool still insists on a requirements.txt,
uv export --format requirements.txt --output-file requirements.txtwrites one from the lockfile. - My requirements.txt came from pip freeze. Does that matter?
- It works, but a frozen file lists everything that was installed — including packages you never asked for — and each of them becomes a direct dependency of your project. If you keep your top-level requirements in a separate file (pip-tools calls it requirements.in), import that one and pass the frozen file as a constraint:
uv add -r requirements.in -c requirements.txt. uv keeps the versions you had and lists only what you actually depend on. - What about requirements-dev.txt?
- The button offers uv's dev group for it, with your main dependencies as the other choice, and imports it with
uv add --dev -r requirements-dev.txt. Most development files start with-r requirements.txt, and uv follows that line, so on its own that import would copy every runtime package into the dev group too. The button imports requirements.txt into your main dependencies first, then takes its packages back out of the dev group; by hand, that last step isuv remove --devfollowed by those package names. The dev group is whatuv syncinstalls by default anduv sync --no-devleaves out. - Can I use uv without converting the project?
- Yes — uv also works as a faster pip. Run
uv venv, thenuv pip install -r requirements.txt, and requirements.txt stays the file you edit. Practical UV works there too: outdated pins are flagged in requirements.txt just as in pyproject.toml, and the Convert to uv button is waiting for when you are ready. - Does Practical UV install uv?
- No. The extension runs the uv already on your machine, in VS Code's integrated terminal, and so does the npx command, which also needs Node.js. Install uv first — Astral's standalone installer, Homebrew, pipx and pip all work — then open your requirements.txt.
Two tools, both free.