Skip to main content
Glama

wheelripe

Before you move to a new Python, find every dependency that has no wheel for it yet — and the version bump that fixes each one.

Python 3.15 shipped on 2026-10-09. Moving a project means finding out, package by package, whether each locked dependency has a cp315 (or abi3, or free-threaded cp315t/abi3t) wheel for your platforms. Today that means upgrading, watching pip/uv fall back to an sdist and fail on a missing compiler or header, fixing one, and repeating — or hand-checking the PyPI JSON API like harlequin#1119 and dynamic-des#40 do. pip install --only-binary=:all: --python-version 3.15 stops at the first failure and never tells you which newer release would work.

wheelripe reads your lockfile, asks the index for every release's file list, and applies the same tag rules pip does (PEP 425/600/656/803 — CI cross-checks every verdict against pip on the real PyPI) for every target platform at once.

wheelripe checking a requirements file for CPython 3.15

Install

uvx --from git+https://github.com/Blackman99/wheelripe wheelripe          # one-off
pipx install git+https://github.com/Blackman99/wheelripe                   # or keep it

Not on PyPI yet; the release has a wheel you can pip install directly.

Related MCP server: mcp-toolkit

Use

wheelripe                               # auto-detects uv.lock / pylock.toml / poetry.lock / requirements.txt / pyproject.toml
wheelripe uv.lock --python 3.15t        # free-threaded
wheelripe requirements.txt --platform linux-aarch64,musllinux-x86_64 --glibc 2.28
BLOCKED  confluent-kafka 2.16.0          no cp315 wheel for any target platform (ships cp38–cp314)
BUMP     numpy 1.26.4 → 2.5.2            no cp315 wheel in 1.26.4 (ships cp39–cp312); 2.5.2 is the first release with one
BUMP     pydantic_core 2.41.5 → 2.48.0   no cp315 wheel in 2.41.5 (ships cp39–cp314); 2.48.0 is the first release with one
READY    1 package (0 with binary wheels · 1 pure Python)

NOT RIPE for CPython 3.15: 1 blocked upstream · 2 need a version bump

Exit code is 1 when anything needs a bump or is blocked (--fail-on blocked|build|never to change). Also: -f json|markdown|github, a GitHub Action (uses: Blackman99/wheelripe@v0.1.0), and an MCP server (wheelripe mcp) so coding agents check before they bump.

Docs: https://blackman99.github.io/wheelripe/docs/ · GOAL.md · ROADMAP.md · MIT

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    9 MCP servers for React + TypeScript development automation — component scaffolding, dependency auditing, WCAG accessibility checking, test generation, TypeScript enforcement, and monorepo management. 134 tests, CI on Node 20+22.
    7
    137 npm
    3
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    An MCP server that scans your lockfiles (npm, PyPI, Go, Rust, Ruby, PHP) for known vulnerabilities, enriches with EPSS exploit probability scores, and recommends fix versions. $14/mo — not per-seat.
    9
    60 PyPI
    1
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    deptrust is a CLI that checks package versions for known vulnerabilities across npm, PyPI, crates.io, Go modules, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, GitHub Actions, and more. It runs locally as a CLI and as an MCP server. It calls public package registry and OSV APIs directly; there is no hosted deptrust service to trust or configure.
    106 npm
    61
    MIT