v7.3.0

Note

7.3.0 is available on 🐍 PyPI and 🐙 GitHub.

• Breaking: [mpm] Move the declarative-manager schema, validation and class factory into the new meta_package_manager.definitions module, out of meta_package_manager.config (which keeps the loading policy: trust gate, override application, registration passes) and meta_package_manager.manager (which keeps the base class only).
• Breaking: [mpm] Move the cross-manager fan-out machinery (collect_from_managers, collect_per_package, OperationTrail, the shared-lock families and the jobs policy) into the new meta_package_manager.dispatch module, out of meta_package_manager.execution (which keeps the single-subprocess engine).
• Breaking: [mpm] Move the per-command column registries and the table-projection and serialization helpers into the new meta_package_manager.tables module, which also absorbs the meta_package_manager.sorting module and its SortableField vocabulary.
• Breaking: [mpm] meta_package_manager.sbom no longer re-exports the SBOM writers: import them from meta_package_manager.sbom.base, meta_package_manager.sbom.spdx and meta_package_manager.sbom.cyclonedx.
• [mpm] Manager definitions gain three schema features: per-refinement search argument templates (exact_args, extended_args and id_name_only_args, spliced at their {marker} position when the matching mpm search flag is active, and advertising native support), a [N] list-index suffix on JSON field selectors, and sudo = true on query operations for tools that gate even their read-only listings behind root.
• [mpm] Malformed JSON output from a manager's query now logs a warning tagged with the manager ID and yields no packages, instead of crashing the command; built-in managers and config-defined operations share the same parse_json implementation.
• [choco] Convert from a Python class to a bundled configuration definition, the native exact and ID-restricted search switches declared through the new refinement templates.
• [macports] Convert from a Python class to a bundled configuration definition, the native exact/extended search switches declared through the new refinement templates. The optional description column of its search results is no longer populated.
• [stew] Convert from a Python class to a bundled configuration definition, its two installed-listing regexes merged into one alternation, with no functional change.
• [zerobrew] Convert from a Python class to a bundled configuration definition, its installed-versions array read through the new [N] field selector, with no functional change.
• [mpm] The --query, --exact and --overwrite options of dump and sbom now share a single definition and help text.
• [mpm] Fix the bar-plugin labeller file rule, whose glob targeted a directory and could never match the plugin's module files.
• [bar-plugin] The <xbar.version> header tracks the package version again: it fell out of the version-bump configuration during the bump-my-version migration and was stuck at 7.0.0.dev0.
• [mpm] Sudo priming now probes the credential cache before any prompt: found warm (a prior sudo --validate, a NOPASSWD rule), it is silently kept alive for the whole run. The password notice names the escalating managers and the subcommand (apt needs administrator rights to upgrade: enter your password.), the sudo prompt is branded ([mpm] password for apt:), and the no-terminal warning names the managers left to fail fast. A host whose sudo is missing or cannot be run logs a warning instead of crashing.
• [mpm] Add an internal_sudo marker for managers whose CLI runs sudo itself mid-run and is never wrapped by mpm: cask and fink adopt it, and manager definitions may set it as a config field. A warm credential cache found at priming time is now kept alive for internal escalators too.
• [mpm] A mutating call of an internal escalator that goes silent for 30 seconds on a terminal, with no warm credential cache, now logs a warning that it may be waiting on a hidden password prompt, quoting its last output line. Addresses #1938.
• [mpm] --verbosity INFO now discloses every package manager CLI invocation as a reproducible $-prompt line, forced environment variables included. Version-detection probes stay at DEBUG.
• [mpm] The output of package manager CLIs now streams to DEBUG logs live, line by line and tagged with the manager ID, instead of being dumped once the call completes. Closes #528.
• [mpm] Streamed CLI output and manager-scoped log lines glue the manager ID into their level prefix (debug:mas: ..., warning:gem: Could not list installed packages.), making logs grep-able by manager. Closes #530.
• [mpm] Disclosed CLI invocations are themed by token family: dim prompt sigil, environment name/value assignment pairs, highlighted binary name (directory plain, in the $-prompt and spawn-trace lines), option-styled flags.
• [mpm] --no-color now also strips the color of log lines emitted from background threads (streamed subprocess output, concurrent fan-outs).
• [mpm] The capability probe logs one answered DEBUG line per manager (brew implements installed.) instead of an unanswered question exposing the raw class repr.
• [mpm] Add -0/--zero-exit: action commands then report per-package failures without gating automation on a non-zero exit code. Usage and configuration errors keep exiting 2.
• [mpm] Add a --columns option to the table-rendering subcommands (managers, installed, outdated, search, which): a comma-separated list of column IDs restricts and reorders the table, SQL-SELECT-style, validated against each command's column registry. mpm search's description column joins the registry: --description is now a shorthand for selecting it, and an explicit --columns selection wins. Serialized formats keep the full structured payload.
• [mpm] The mpm managers table's binary-path highlighting is delegated to click-extra's highlight_bin_name, the same renderer as the $-prompt and spawn-trace log lines.
• [mpm] Log lines emitted while a progress spinner animates now print on their own line above it, instead of garbling the in-progress frame.
• [mpm] Delegate subprocess spawning, output streaming, timeout enforcement and Ctrl+C child termination to click-extra, raising its floor from 8.3.0 to 8.4.0.
• [mpm] Authenticate the GitHub API release lookups in the Guix, Nix and yay cooldown workflow jobs, which flaked on the anonymous rate limit.
• [mpm] The per-manager table of the augmentations page now renders live at Sphinx build time, derived from the capability declarations in the manager implementations. Drops steamcmd's stale full-upgrade --all row.
• [mpm] The PyPI keywords and the labeller file/content rules in pyproject.toml are now generated from the manager pool by docs/docs_update.py. Every bundled manager gains labeller coverage, definition-file globs are anchored on their full stem, and the chocotaley keyword typo is fixed.
• [mpm] Bundled manager definitions now embed their version-probe and parser output samples in a [samples] table of their own TOML file; the test suite derives its checks from the shipped files instead of hardcoded per-manager fixtures.
• [bar-plugin] Version differences are now highlighted in the outdated-package menu lines, with the same coloring as mpm outdated: common prefix gray, installed suffix red, latest suffix green. Package lines carry ansi=true so both SwiftBar and Xbar render the colors.
• [mpm] Delegate --cooldown duration parsing and the cross-command --sort-by machinery to click-extra, keeping the same per-table sorting semantics. -s/--sort-by now renders at the end of its option group in help screens.
• [mpm] mpm which joins the sortable-table commands instead of ignoring --sort-by, its manager column leading the default sort.
• [mpm] docs/docs_update.py now renders the pyproject.toml label arrays in pyproject-fmt's canonical style, ending the pull-request ping-pong between the update-docs and format-pyproject autofix jobs. A new test asserts the rewritten sections stay a pyproject-fmt fixpoint.
• [mpm] The dump and Brewfile provenance headers and the bar-plugin upgrade notice now write the bare package version, dropping their v prefix.
• [cask] upgrade --all now passes --greedy to brew upgrade when auto-updating packages are included, matching the outdated behavior. Auto-updating casks reported as outdated were never upgraded. Closes #1940.
• [pipx] outdated now relies on pipx's native pipx list --outdated query on pipx 1.16.0 and newer: all venvs are checked in a single call, each by its own backend (pip or uv). Older pipx keeps the previous per-venv pip probes.

Full changelog: v7.2.0...v7.3.0