Detecting Outdated PyPI Packages in Production via CI/CD Pipeline

Hey there, Darian Vance here. As a Senior DevOps Engineer at TechResolve, I’m constantly looking for ways to automate the boring stuff so my team can focus on building features. One of the biggest time sinks used to be manually auditing our production dependencies. I’d check logs, run commands locally, and cross-reference versions. It was a tedious process, easily eating up a couple of hours a week. That is, until I realized we could automate the entire check and get a Slack alert whenever a dependency falls behind. This simple addition to our CI/CD pipeline has been a game-changer for our security posture and maintenance workflow. Let me walk you through how I set it up.

Prerequisites

Before we start, make sure you have the following ready:

• A Python project with a requirements.txt file.
• Access to your project’s CI/CD platform (e.g., GitLab CI, GitHub Actions, Jenkins).
• A notification service you can post to, like a Slack Webhook URL.
• Basic familiarity with Python and YAML.

The Guide: Step-by-Step

Step 1: The Heart of the Operation – The Python Script

First, we need a script that can programmatically check for outdated packages. The best way to do this is to use pip’s own functionality. I’ll skip the standard virtualenv setup since you likely have your own workflow for that. Let’s jump straight to the Python logic. We’ll create a new file named check_dependencies.py in your project’s root directory.

The logic is simple: we’ll execute the `pip list –outdated` command, but we’ll ask it for JSON output. Parsing JSON is far more reliable than trying to read plain text. If the JSON output contains any packages, we know we have work to do.

Here’s the script:

import json
import os
import subprocess
import requests

# --- Configuration ---
# In a real CI/CD environment, this should be an environment variable.
SLACK_WEBHOOK_URL = os.environ.get("SLACK_WEBHOOK_URL")

def get_outdated_packages():
    """Checks for outdated pip packages and returns them as a list of dicts."""
    # We run the pip command as a subprocess. Using '--format json' is key.
    # Using 'python3 -m pip' ensures we use the pip from the correct environment.
    command = ["python3", "-m", "pip", "list", "--outdated", "--format", "json"]
    
    try:
        # We capture the output of the command.
        result = subprocess.check_output(command)
        outdated_packages = json.loads(result)
        return outdated_packages
    except subprocess.CalledProcessError as e:
        # This might happen if pip itself has an error, not if packages are just outdated.
        print(f"Error running pip command: {e}")
        return None
    except json.JSONDecodeError:
        print("Error decoding JSON from pip command. Is pip working correctly?")
        return None

def format_alert_message(packages):
    """Formats a list of outdated packages for a Slack message."""
    if not packages:
        return ""
    
    header = "*:warning: Outdated Python Packages Detected in Production! :warning:*\n"
    message_lines = [header, "The following packages are outdated:"]
    
    for pkg in packages:
        line = f"- `{pkg['name']}` (Current: {pkg['version']}, Latest: {pkg['latest_version']})"
        message_lines.append(line)
        
    message_lines.append("\nPlease review and update the `requirements.txt` file.")
    return "\n".join(message_lines)

def send_slack_alert(message):
    """Sends a message to a predefined Slack webhook."""
    if not SLACK_WEBHOOK_URL:
        print("SLACK_WEBHOOK_URL not set. Skipping notification.")
        return

    payload = {"text": message}
    try:
        response = requests.post(SLACK_WEBHOOK_URL, json=payload)
        response.raise_for_status() # Raises an exception for 4xx/5xx errors
        print("Slack notification sent successfully.")
    except requests.exceptions.RequestException as e:
        print(f"Failed to send Slack alert: {e}")

if __name__ == "__main__":
    print("Checking for outdated PyPI packages...")
    outdated = get_outdated_packages()

    if outdated is None:
        # An error occurred in get_outdated_packages, details already printed.
        raise RuntimeError("Failed to check for outdated packages.")

    if outdated:
        print(f"Found {len(outdated)} outdated packages.")
        alert_message = format_alert_message(outdated)
        print(alert_message)
        send_slack_alert(alert_message)
        # IMPORTANT: This raises an exception, which will cause a non-zero exit code.
        # This is how we signal to the CI/CD runner that the job should fail.
        raise Exception("Outdated packages were found.")
    else:
        print("All packages are up to date. Great job!")

Pro Tip: Pin your dependencies! In my production setups, I always use a `requirements.txt` file generated from a tool like `pip-tools`. This pins every direct and transitive dependency to a specific version (e.g., `requests==2.28.1`). This avoids “it works on my machine” issues and makes your builds reproducible. This script then becomes your safety net, telling you when a *new* version of a pinned dependency is available.

Step 2: Integrate into Your CI/CD Pipeline

Now, we need to run this script as part of our automated pipeline. The goal is to have a dedicated job that fails if the script finds any outdated packages. A failing pipeline is a loud, clear signal that someone needs to take action.

Here’s a conceptual example of what a job might look like in a generic YAML-based CI/CD system. You’ll need to adapt it to your specific platform’s syntax.

dependency_check:
  stage: quality_gate
  image: python:3.10-slim
  variables:
    SLACK_WEBHOOK_URL: $CI_SLACK_WEBHOOK_URL # Use your CI/CD platform's secret management
  script:
    - echo "Installing dependencies..."
    - python3 -m pip install --upgrade pip
    - python3 -m pip install -r requirements.txt
    - python3 -m pip install requests # Need this for the script's notifications
    - echo "Running dependency scan..."
    - python3 check_dependencies.py

The key part here is the last line: `python3 check_dependencies.py`. If our script finds outdated packages, it raises an exception, which results in a non-zero exit code. Your CI/CD runner will see that non-zero exit code and automatically fail the job. Perfect!

Pro Tip: Don’t run this on every single commit. That can get noisy. In my experience, the best approach is to run this as a scheduled job that triggers once a week. This gives you a regular, predictable cadence for reviewing dependencies. A good cron-like schedule for this would be something like `0 2 * * 1` to run every Monday at 2 AM.

Common Pitfalls

Here are a few places where I’ve stumbled in the past, so you can avoid them:

• Forgetting to install the dependencies first. The CI job runs in a clean environment. You must always run `pip install -r requirements.txt` *before* executing the check script, otherwise pip has nothing to check against.
• Private package indexes. If you use a private repository like Artifactory or Gemfury, `pip` won’t know about it by default. You’ll need to configure pip within your CI job to use your private index, usually via an environment variable or by passing an `–extra-index-url` flag during the install step.
• Alert Fatigue. Getting a Slack notification every hour because a minor version of a dependency was released is a great way to get everyone to ignore the alerts. As mentioned in the pro-tip, scheduling this to run weekly is the sweet spot between staying informed and being overwhelmed.

Conclusion

And that’s it. With one Python script and a few lines of YAML, you’ve created an automated dependency monitoring system. This isn’t just about saving time; it’s about shifting your team’s mindset from being reactive to proactive. You’ll catch potential security vulnerabilities and compatibility issues long before they become production fires. It’s a small investment of time that pays huge dividends in stability and peace of mind.

Stay sharp,
Darian Vance

Darian Vance

Lead Cloud Architect & DevOps Strategist

With over 12 years in system architecture and automation, Darian specializes in simplifying complex cloud infrastructures. An advocate for open-source solutions, he founded TechResolve to provide engineers with actionable, battle-tested troubleshooting guides and robust software alternatives.

🤖 Frequently Asked Questions