Practical UV
uv for VS Code — migrate from pip in one click, then see what's outdated and what's vulnerable in the file you have open
Requires VS Code 1.125 or newer.
pip → uv
Migrate from pip to uv in one click
Your requirements.txt already lists everything uv needs. Open it, click Convert to uv, and Practical UV does the rest in VS Code's terminal: a pyproject.toml, every requirement imported, a lockfile written and the environment installed. Nothing runs until you confirm.
- 1
Open your requirements.txt
The one your project installs from. As soon as it is the active editor, a Convert to uv button appears in the status bar.
# requirements.txtrequests==2.32.3pydantic>=2.10fastapiLn 3, Col 8UTF-8 Convert to uv - 2
Click Convert to uv, then confirm
Practical UV lists the commands it will run, and where, then waits for you. They run in VS Code's own terminal: uv init --bare if the workspace has no pyproject.toml yet, which writes that file and nothing else, then uv add -r to import every requirement.
Converting requirements-dev.txt offers uv's dev group instead. Also in the command palette, as UV: Convert requirements.txt to uv project.
Convert my-app to a uv project?
Runs in the terminal, in my-app:
uv init --bareuv add -r requirements.txt"uv init --bare" creates pyproject.toml and nothing else. requirements.txt is read, not changed.
CancelConvertTerminal · uv$ uv init --bareInitialized project `my-app`$ uv add -r requirements.txtCreating virtual environment at: .venvResolved 15 packages in 402msInstalled 14 packages in 38ms - 3
You're on uv
Your dependencies now live in pyproject.toml, uv.lock pins every version, and .venv is installed. requirements.txt is left exactly as it was, so you can compare before you delete it.
From here, uv sync installs and uv run runs — and Practical UV keeps flagging whatever falls behind.
# pyproject.toml[project]name = "my-app"version = "0.1.0"requires-python = ">=3.13"dependencies = ["fastapi>=0.115.0", was unpinned"pydantic>=2.10","requests==2.32.3",]uv.lock every version pinned .venv installed
Without the button
Or migrate by hand
Not in VS Code, or want to watch each step? These are the commands the button runs: the first two for requirements.txt, the third for a development requirements file. One that starts with -r requirements.txt takes one more step, and the questions below cover it.
# Create pyproject.toml, nothing else uv init --bare # Import every requirement and install uv add -r requirements.txt # Development-only: into the dev group uv add --dev -r requirements-dev.txt
After the move
Your pip habits, in uv
Much of the change is what you stop doing: uv creates the virtual environment and keeps the lockfile current on its own.
| pip | uv |
|---|---|
| python -m venv .venv | Not needed — uv creates .venv itself |
| source .venv/bin/activate | Not needed — uv run uses .venv directly |
| pip install -r requirements.txt | uv sync |
| pip install requests | uv add requests |
| pip uninstall requests | uv remove requests |
| pip install --upgrade requests | uv lock --upgrade-package requests |
| pip freeze > requirements.txt | Not needed — uv keeps uv.lock current |
| pip list --outdated | uv tree --outdated or see it flagged in the file |
| python app.py | uv run app.py |
uv inside the editor — now flagging what's vulnerable, not just what's old.
New in 0.2.0
Known Vulnerabilities, in the File You Declared Them
Your declared dependencies are checked against the OSV advisory database — the PyPA Advisory Database and GitHub Security Advisories. Each finding names the CVE, its severity, and the version that fixes it, with a quick fix that makes the bump for you.
uv.lock (or an == pin) resolves each range to the version you actually install, so a finding means you are affected rather than your constraint permits it. Only top-level dependencies are reported — nothing you can't fix where you're standing.
Off by default. Turning it on is what sends package names and versions to api.osv.dev; a per-package check is always available from the quick-fix menu.
Outdated Detection — Everywhere
PyPI polled in the background, in pyproject.toml or requirements.txt. Every stale dep gets a one-click upgrade.
The Upgrade, One Menu Away
The extension in VS Code: a stale pin underlined in pyproject.toml, with the upgrade and a version picker on the quick-fix menu.
Not Migrating Yet? Still Covered
Outdated pins, hover, the dashboard and the vulnerability check all work on requirements.txt too — comments, pip options and environment markers included.
Dependency Dashboard
An interactive webview — every dep, current vs. latest, a Security column linking each advisory, and an Upgrade button on every outdated row.
Pick Any Version
The full PyPI history of a package, in a quick-pick menu.
Command Palette
uv sync, add, and run — without dropping to a terminal. Plus a "Run uv sync" prompt on save when versions change.
pyproject.toml-Native
Reads and writes the file your team already commits. Bump project version, switch requires-python — all from quick-fixes.
Version Bumps Without Typing
The extension in VS Code: the project version bumped by build, minor or major from the same menu.
Built for Python developers who use uv
uv's speed, editor-native ergonomics
A focused VS Code extension that turns uv's speed into editor-native ergonomics — and, since 0.2.0, watches the dependencies you declared for published advisories.
Known-Vulnerability Detection
Declared dependencies are checked against the OSV advisory database — the PyPA Advisory Database and GitHub Security Advisories. Every finding names the CVE, its severity, and the version that fixes it, and arrives as a diagnostic, a hover entry, and an "Upgrade … (fixes CVE-…)" quick fix.
uv.lock-Accurate, Top-Level Only
A uv.lock entry — or an == pin — resolves each declared range to the exact version you actually install, so a finding means you are affected rather than your constraint permits it. Only top-level dependencies are reported, so every finding is fixable in the file in front of you.
Check One Package On Demand
Background checking is off by default — enabling it is what sends your package names to api.osv.dev. Until then, ⌘. on any dependency offers "Check <package> for security advisories", and a one-off UV: Check Dependencies command scans the whole file without changing the setting.
Outdated Dependency Detection
Practical UV polls PyPI in the background and flags every dependency in pyproject.toml or requirements.txt that has a newer release available — with a one-click upgrade affordance per row.
Pip / requirements.txt Support
Same outdated detection, hover info, code actions, and dashboard for requirements.txt, requirements-*.txt, and any *.txt under requirements/. Comments, pip directives, direct URL specs, and PEP 508 markers all parsed correctly.
Migrate from pip to uv
Open a requirements.txt and a "Convert to uv" button appears in the status bar. Confirm once, and uv init --bare (if needed) and uv add -r run in the integrated terminal — you end up with a pyproject.toml, a uv.lock and an installed .venv, and nothing else. Development requirements go into uv's dev group.
Dependency Dashboard
UV: Show Dependencies opens an interactive webview that lists every dependency with its current and latest PyPI versions, a Security column linking each advisory it found, and an Upgrade button on every outdated row.
Version Picker
Pick any version from the full PyPI history of a package — pre-releases, yanked releases, or anything in between — straight from a quick-pick menu.
Python Version Picker
Place the cursor on requires-python and quick-fix to any Python release — latest patch versions sourced live from endoflife.date, or browse the full history from 3.1 onwards.
Project Version Bumping
Cursor on the [project] version line — bump major, minor, or build with a quick-fix. 0.1.0 → 0.1.1, 0.2.0, or 1.0.0 in a single keystroke.
Hover Info
Hover any package name to see its latest PyPI version with a link straight to the project page. No tab-switching to look up what you already have open.
Command Palette Integration
Run uv sync, uv add, and uv run from VS Code's command palette without dropping to a terminal. Output streams into the integrated panel — and a "Run uv sync" prompt fires automatically when you save a pyproject.toml with changed versions.
FAQ · Migrating from pip
Questions people ask before moving from pip to uv
Do I need VS Code to migrate from pip to uv?
No. The migration is two uv commands — uv init --bare, then uv add -r requirements.txt — and they work in any terminal. Practical UV runs them for you once you confirm, then keeps watching the pyproject.toml they produce: outdated versions are flagged where you declared them, and known vulnerabilities too once you turn that check on.
What happens to my requirements.txt?
Nothing. The migration reads it and leaves it exactly as it was, so you can compare before you delete it — from then on, uv works from pyproject.toml and uv.lock. If a tool still insists on a requirements.txt, uv export --format requirements.txt --output-file requirements.txt writes one from the lockfile.
My requirements.txt came from pip freeze. Does that matter?
It works, but a frozen file lists everything that was installed — including packages you never asked for — and each of them becomes a direct dependency of your project. If you keep your top-level requirements in a separate file (pip-tools calls it requirements.in), import that one and pass the frozen file as a constraint: uv add -r requirements.in -c requirements.txt. uv keeps the versions you had and lists only what you actually depend on.
What about requirements-dev.txt?
The button offers uv's dev group for it, with your main dependencies as the other choice, and imports it with uv add --dev -r requirements-dev.txt. Most development files start with -r requirements.txt, and uv follows that line, so on its own that import would copy every runtime package into the dev group too. The button imports requirements.txt into your main dependencies first, then takes its packages back out of the dev group; by hand, that last step is uv remove --dev followed by those package names. The dev group is what uv sync installs by default and uv sync --no-dev leaves out.
Can I use uv without converting the project?
Yes — uv also works as a faster pip. Run uv venv, then uv pip install -r requirements.txt, and requirements.txt stays the file you edit. Practical UV works there too: outdated pins are flagged in requirements.txt just as in pyproject.toml, and the Convert to uv button is waiting for when you are ready.
Does Practical UV install uv?
No. It runs the uv already on your machine, in VS Code's integrated terminal. Install uv first — Astral's standalone installer, Homebrew, pipx and pip all work — then open your requirements.txt.
Install in one click
Free, open source, and ready to drop into your editor — VS Code, VSCodium, or Cursor. Open a requirements.txt and your project is one click from uv. Since v0.2.1 that move adds nothing you did not ask for, and development requirements get uv's dev group.