Skip to content

Update pip to 26.2.1 - #801

Open
pyup-bot wants to merge 1 commit into
masterfrom
pyup-update-pip-10.0.0-to-26.2.1
Open

Update pip to 26.2.1#801
pyup-bot wants to merge 1 commit into
masterfrom
pyup-update-pip-10.0.0-to-26.2.1

Conversation

@pyup-bot

@pyup-bot pyup-bot commented Aug 5, 2026

Copy link
Copy Markdown
Collaborator

This PR updates pip from 10.0.0 to 26.2.1.

Changelog

26.2.1

===================

Bug Fixes
---------

- Reallow keyring installed in a (non-activated) virtual environment to be be used
via the ``import`` provider method while installing build dependencies. (`14227 <https://github.com/pypa/pip/issues/14227>`_)

26.2

=================

Deprecations and Removals
-------------------------

- Newly published packages will no longer be immediately visible to pip
if the index uses caching. To install a newly published package, use
``--refresh-package``. (`13680 <https://github.com/pypa/pip/issues/13680>`_)
- Drop support for detecting legacy, non-:pep:`405`, ``virtualenv`` (< 20)
environments. (`14062 <https://github.com/pypa/pip/issues/14062>`_)
- Constraints files, including ``PIP_CONSTRAINT``, no longer affect isolated
build environments. Use ``--build-constraint`` or the ``PIP_BUILD_CONSTRAINT``
environment variable to constrain build dependencies instead.

The ``--use-feature=build-constraint`` flag is now always enabled and has no
effect. (`14094 <https://github.com/pypa/pip/issues/14094>`_)

Features
--------

- Declare support for Python 3.15 (`14208 <https://github.com/pypa/pip/issues/14208>`_)
- Support self-referential extras officially. pip has supported this by accident since version 21.2. (`11296 <https://github.com/pypa/pip/issues/11296>`_)
- Add ``--only-deps`` flag to instruct pip to select only the dependencies
of supplied packages. It cannot be used with ``--no-deps``, ``-r``, ``--group``,
or ``--requirements-from-script``. (`11440 <https://github.com/pypa/pip/issues/11440>`_)
- Cache simple responses in accordance to their ``Cache-Control`` header
instead of always revalidating on every request. To refresh cached package index responses
and ensure newly published packages are found, use ``--refresh-package <package>``. (`13680 <https://github.com/pypa/pip/issues/13680>`_)
- Add ``--no-require-hashes`` to disable automatic enablement of
``--require-hashes`` when encountering a requirement with hashes. (`14169 <https://github.com/pypa/pip/issues/14169>`_)
- Honor ``--only-final`` when sourcing requirements with ``-r pylock.toml``. (`13950 <https://github.com/pypa/pip/issues/13950>`_)
- Add support for ``pylock.toml`` ``upload-time`` field, so ``--uploaded-prior-to`` works with ``-r pylock.toml``. (`14168 <https://github.com/pypa/pip/issues/14168>`_)
- Better error messages in case of conflicts with requirements from ``-r pylock.toml``. (`13963 <https://github.com/pypa/pip/issues/13963>`_)
- Add experimental support for isolating build subprocesses by creating standard
virtual environments. This will fix most (if not all) subtle isolation issues
that can lead to broken builds exclusive to pip. The feature can be enabled
via ``--use-feature=venv-isolation`` and will be enabled by default in a future
release.

Note that the feature has limited compatibility with ``--use-feature=inprocess-build-deps``.
While most builds should work with both features enabled, there are known edge cases.
``inprocess-build-deps`` will not be enabled by default until they are fixed. (`14070 <https://github.com/pypa/pip/issues/14070>`_)
- Present more informative diagnostic errors on uncaught network errors. (`14115 <https://github.com/pypa/pip/issues/14115>`_)
- Allow opting out of Git partial clones with ``PIP_NO_PARTIAL_CLONE_FOR_BROKEN_GIT_SERVER``. (`11043 <https://github.com/pypa/pip/issues/11043>`_)
- Add a ``--no-proxy-env`` (or ``--proxy ""``) option to ignore proxies
configured via non-pip environment variables or configuration files.
A proxy set with ``--proxy`` is still used. (`5378 <https://github.com/pypa/pip/issues/5378>`_)
- Add support for pulling username from keyring subprocess provider (`12543 <https://github.com/pypa/pip/issues/12543>`_)
- Speedup tab autocompletion by lazy-importing certain modules. (`4768 <https://github.com/pypa/pip/issues/4768>`_)
- Improve cached wheel lookup performance when many cached wheels are checked
for compatibility. (`14122 <https://github.com/pypa/pip/issues/14122>`_)
- Speed up path compaction when displaying uninstall changes. (`14107 <https://github.com/pypa/pip/issues/14107>`_)

Bug Fixes
---------

- Only emit the invalid-metadata warning once per location per run, instead of repeating it during the same command. (`11436 <https://github.com/pypa/pip/issues/11436>`_)
- Handle ``BrokenPipeError`` when pip output is piped to a command that closes early. (`11608 <https://github.com/pypa/pip/issues/11608>`_)
- Follow symlinks while checking if installed scripts are on PATH. (`11953 <https://github.com/pypa/pip/issues/11953>`_)
- Stop dropping extras from messages about candidates with inconsistent metadata. (`12023 <https://github.com/pypa/pip/issues/12023>`_)
- Stop animating progress bars and status spinners when running on CI, even
if ``FORCE_COLOR`` is set. (`13354 <https://github.com/pypa/pip/issues/13354>`_)
- Ensure truststore feature remains active while initially connecting to
a HTTPS proxy. (`13465 <https://github.com/pypa/pip/issues/13465>`_)
- Address encoding warnings emitted when Python's UTF-8 Mode is enabled by
continuing to use the configured locale. (`13922 <https://github.com/pypa/pip/issues/13922>`_)
- Raise an error when the :pep:`658` ``.metadata`` file used during dependency
resolution disagrees with the downloaded wheel's ``METADATA`` on ``Name``,
``Version``, ``Requires-Dist``, ``Requires-Python`` or ``Provides-Extra``. (`13983 <https://github.com/pypa/pip/issues/13983>`_)
- Prevent system packages from leaking into isolated build environments on Python 3.15 (`14033 <https://github.com/pypa/pip/issues/14033>`_)
- Never use persistent wheel cache for local directory requirements even if there
is a matching entry. (`14044 <https://github.com/pypa/pip/issues/14044>`_)
- Avoid re-fetching a pinned Git commit that is already present locally. (`14055 <https://github.com/pypa/pip/issues/14055>`_)
- Report the correct configuration level for ``cert`` in ``pip debug`` output. (`14056 <https://github.com/pypa/pip/issues/14056>`_)
- Fix ``pip show`` crash when a distribution has no ``Metadata-Version``. (`14057 <https://github.com/pypa/pip/issues/14057>`_)
- Remove empty ``http-v2`` cache directories when running ``pip cache purge``. (`14058 <https://github.com/pypa/pip/issues/14058>`_)
- Report a copy failure in ``pip wheel`` instead of a misleading build failure. (`14059 <https://github.com/pypa/pip/issues/14059>`_)
- Make ``pip install`` conflict checks independent of installed distribution iteration order. (`14074 <https://github.com/pypa/pip/issues/14074>`_)
- Fix ``ProtocolError`` exceptions raised after an incomplete download from bypassing
download resume logic and leading to a crash. (`14079 <https://github.com/pypa/pip/issues/14079>`_)
- Fix caching bug where local directory requirements would be cached if the
directory name contains a dash. (`14080 <https://github.com/pypa/pip/issues/14080>`_)
- Avoid reparsing distribution metadata when formatting the default ``pip list``
columns output with the importlib backend. (`14089 <https://github.com/pypa/pip/issues/14089>`_)
- Fix decoding the URL path twice while determining a link filename (CVE-2026-13346). (`14110 <https://github.com/pypa/pip/issues/14110>`_)
- Avoid reading installed file lists in ``pip show`` unless ``--files`` is used. (`14117 <https://github.com/pypa/pip/issues/14117>`_)
- Additional rejection of tar archives that write outside the target
directory through symlink traversal when extracting on Python
versions pre-PEP 706. (`14127 <https://github.com/pypa/pip/issues/14127>`_)
- Fix ``pip list --not-required`` listing dependencies of packages excluded with ``--exclude``. (`14129 <https://github.com/pypa/pip/issues/14129>`_)
- Fail an interrupted download instead of corrupting the saved file when the
server resumes a range request from a different offset than was requested. (`14131 <https://github.com/pypa/pip/issues/14131>`_)
- Fix option errors printing the usage message with raw Rich markup. (`14136 <https://github.com/pypa/pip/issues/14136>`_)
- platformdirs 4.6.0+ adds support for ``XDG_*`` environment variables on macOS, so
some directory locations may change if any of these are set:

- ``XDG_CACHE_HOME``: The `pip cache directory <https://pip.pypa.io/en/stable/cli/pip_cache/>`_
 will be at ``$XDG_CACHE_HOME/pip``.
- ``XDG_DATA_DIRS``: The `global configuration file <https://pip.pypa.io/en/stable/topics/configuration/#config-file>`_
 will be inside ``$XDG_DATA_DIRS/pip``
- ``XDG_DATA_HOME``: The `user configuration file <https://pip.pypa.io/en/stable/topics/configuration/#config-file>`_
 will be inside ``$XDG_DATA_HOME/pip``, if the directory exists (`14142 <https://github.com/pypa/pip/issues/14142>`_)
- Recover credentials embedded in a redirect ``Location`` URL when handling a
``401`` response, even under ``--no-input``. Previously this extraction was
gated behind keyring being enabled, so ``--no-input`` (with the default keyring
provider) caused downloads that rely on a cross-origin redirect with embedded
credentials to fail with ``401``. (`14182 <https://github.com/pypa/pip/issues/14182>`_)
- Reject a package ``path`` in a ``pylock.toml`` fetched from a URL when it
resolves outside the lock file's own location, so a remote lock file can no
longer point at the local filesystem or another host. (`14159 <https://github.com/pypa/pip/issues/14159>`_)
- Respect ``--uploaded-prior-to``, ``--no-binary``, ``--only-binary``,
and ``--prefer-binary`` in ``pip list --outdated`` and
``pip list --uptodate`` when determining the latest available version. (`14190 <https://github.com/pypa/pip/issues/14190>`_)
- Show a clear error instead of a traceback for an invalid requirement marker. (`6385 <https://github.com/pypa/pip/issues/6385>`_)

Vendored Libraries
------------------

- Upgrade certifi to 2026.6.17
- Upgrade distlib to 0.4.2
- Upgrade idna to 3.18
- Upgrade platformdirs to 4.10.0
- Upgrade pygments to 2.20.0
- Upgrade requests to 2.34.2
- Upgrade tomli to 2.4.1
- Upgrade urllib3 to 2.7.0

Process
-------

- Include a CycloneDX SBOM (Software Bill of Materials) file alongside vendored libraries.

26.1.2

===================

Bug Fixes
---------

- Reject ``console_scripts`` and ``gui_scripts`` entry points whose name would
install a script outside the scripts directory. (`14000 <https://github.com/pypa/pip/issues/14000>`_)
- Fix installation incorrectly failing when the target path contains a doubled
slash, such as with ``pip install --root //...``. (`14001 <https://github.com/pypa/pip/issues/14001>`_)
- Send a consistent ``Accept-Encoding`` header to avoid a spurious ``Cache entry
deserialization failed`` warning. (`14012 <https://github.com/pypa/pip/issues/14012>`_)

26.1.1

===================

Bug Fixes
---------

- Fix issue where uninstallation left behind empty directories. Revert the
removal of the adjacent ``__pycache__`` directory when a .py file is removed. (`13973 <https://github.com/pypa/pip/issues/13973>`_)

26.1

=================

Deprecations and Removals
-------------------------

- Drop support for Python 3.9. (`13795 <https://github.com/pypa/pip/issues/13795>`_)

Features
--------

- Add experimental support to read requirements from standardized pylock.toml files (``-r pylock.toml``). (`13876 <https://github.com/pypa/pip/issues/13876>`_)
- Allow ``--uploaded-prior-to`` to accept a duration in days (e.g., ``P3D`` for 3 days ago). (`13674 <https://github.com/pypa/pip/issues/13674>`_)

Enhancements
------------

- Speed up dependency resolution when there are complex conflicts. (`13859 <https://github.com/pypa/pip/issues/13859>`_)
- Reduce memory usage when resolving large dependency trees. (`13843 <https://github.com/pypa/pip/issues/13843>`_)
- Emit a deprecation warning when pip imports an unexpected module after
installation of a distribution has started. (`13912 <https://github.com/pypa/pip/issues/13912>`_)
- Allow URL constraints to apply to requirements with extras. (`12018 <https://github.com/pypa/pip/issues/12018>`_)
- Allow unpinned requirements to use hashes from constraints. Constraints
like ``{name}=={version} --hash=...`` feeds into hash verification for
a corresponding requirement. (`9243 <https://github.com/pypa/pip/issues/9243>`_)
- Improve conflict reports that involve direct URLs. (`13932 <https://github.com/pypa/pip/issues/13932>`_)
- Show all errors instead of first error for faulty ``dependency_groups`` definitions. (`13917 <https://github.com/pypa/pip/issues/13917>`_)

Bug Fixes
---------

- Fix recovery hint for missing RECORD file to use ``--ignore-installed``
instead of ``--force-reinstall``. (`12645 <https://github.com/pypa/pip/issues/12645>`_)
- Fix misleading error message when a constraint file cannot be opened. (`13226 <https://github.com/pypa/pip/issues/13226>`_)
- Show the filename rather than the full URL when downloading files from non-PyPI indexes in non-verbose mode. (`13494 <https://github.com/pypa/pip/issues/13494>`_)
- Remove the adjacent ``__pycache__`` directory when a .py file is removed. (`13725 <https://github.com/pypa/pip/issues/13725>`_)
- Force UTF-8 encoding for :pep:`723` metadata. (`13861 <https://github.com/pypa/pip/issues/13861>`_)
- Minor performance improvement when filtering candidates during resolution. (`13916 <https://github.com/pypa/pip/issues/13916>`_)
- Fix a hang on Windows when stdout is closed during verbose output. (`13927 <https://github.com/pypa/pip/issues/13927>`_)
- Common path prefixes are determined by path segment, not character by character. (`13847 <https://github.com/pypa/pip/issues/13847>`_)
- Fix installing ``.tar.gz`` source distributions that look like a zip file. (`13867 <https://github.com/pypa/pip/issues/13867>`_)

Vendored Libraries
------------------

- Upgrade certifi to 2026.2.25
- Upgrade packaging to 26.2
- Upgrade requests to 2.33.1
- Upgrade tomli to 2.3.1
- Upgrade urllib3 to 2.6.3
- Use ``packaging`` 26.1's new ``dependency_groups`` module, removing ``dependency-groups`` vendor.
- Use ``packaging.direct_url`` to manipulate ``direct_url.json``. Besides difference
in validation error messages, there should be no user-visible change.

Process
-------

- Add an explicit AI policy.

26.0.1

===================

Bug Fixes
---------

- Fix ``--pre`` not being respected from the command line when a requirement file
includes an option e.g. ``-extra-index-url``. (`13788 <https://github.com/pypa/pip/issues/13788>`_)

26.0

=================

Deprecations and Removals
-------------------------

- Remove support for non-bare project names in egg fragments. Affected users should use
the `Direct URL requirement syntax <https://packaging.python.org/en/latest/specifications/version-specifiers/#direct-references>`_. (`13157 <https://github.com/pypa/pip/issues/13157>`_)

Features
--------

- Display pip's command-line help in colour, if possible. (`12134 <https://github.com/pypa/pip/issues/12134>`_)
- Support installing dependencies declared with inline script metadata
(:pep:`723`) with ``--requirements-from-script``. (`12891 <https://github.com/pypa/pip/issues/12891>`_)
- Add ``--all-releases`` and ``--only-final`` options to control pre-release
and final release selection during package installation. (`13221 <https://github.com/pypa/pip/issues/13221>`_)
- Add ``--uploaded-prior-to`` option to only consider packages uploaded prior to
a given datetime when the ``upload-time`` field is available from a remote index. (`13625 <https://github.com/pypa/pip/issues/13625>`_)
- Add ``--use-feature inprocess-build-deps`` to request that build dependencies are installed
within the same pip install process. This new mechanism is faster, supports ``--no-clean``
and ``--no-cache-dir`` reliably, and supports prompting for authentication.

Enabling this feature will also enable ``--use-feature build-constraints``. This feature will
become the default in a future pip version. (`9081 <https://github.com/pypa/pip/issues/9081>`_)
- ``pip cache purge`` and ``pip cache remove`` now clean up empty directories
and legacy files left by older pip versions. (`9058 <https://github.com/pypa/pip/issues/9058>`_)

Bug Fixes
---------

- Fix selecting pre-release versions when only pre-releases match.
For example, ``package>1.0`` with versions ``1.0, 2.0rc1`` now installs
``2.0rc1`` instead of failing. (`13746 <https://github.com/pypa/pip/issues/13746>`_)
- Revisions in version control URLs now must be percent-encoded.
For example, use ``git+https://example.com/repo.gitissue%231`` to specify the branch ``issue#1``.
If you previously used a branch name containing a ``%`` character in a version control URL, you now need to replace it with ``%25`` to ensure correct percent-encoding. (`13407 <https://github.com/pypa/pip/issues/13407>`_)
- Preserve original casing when a path is displayed. (`6823 <https://github.com/pypa/pip/issues/6823>`_)
- Fix bash completion when the ``$IFS`` variable has been modified from its default. (`13555 <https://github.com/pypa/pip/issues/13555>`_)
- Precompute Python requirements on each candidate, reducing time of long resolutions. (`13656 <https://github.com/pypa/pip/issues/13656>`_)
- Skip redundant work converting version objects to strings when using the
``importlib.metadata`` backend. (`13660 <https://github.com/pypa/pip/issues/13660>`_)
- Fix ``pip index versions`` to honor only-binary/no-binary options. (`13682 <https://github.com/pypa/pip/issues/13682>`_)
- Fix fallthrough logic for options, allowing overriding global options with
defaults from user config. (`13703 <https://github.com/pypa/pip/issues/13703>`_)
- Use a path-segment prefix comparison, not char-by-char. (`13777 <https://github.com/pypa/pip/issues/13777>`_)

Vendored Libraries
------------------

- Upgrade CacheControl to 0.14.4
- Upgrade certifi to 2026.1.4
- Upgrade idna to 3.11
- Upgrade packaging to 26.0
- Upgrade platformdirs to 4.5.1

25.3

=================

Deprecations and Removals
-------------------------

- Remove support for the legacy ``setup.py develop`` editable method in setuptools
editable installs; setuptools >= 64 is now required. (`11457 <https://github.com/pypa/pip/issues/11457>`_)
- Remove the deprecated ``--global-option`` and ``--build-option``.
``--config-setting`` is now the only way to pass options to the build backend. (`11859 <https://github.com/pypa/pip/issues/11859>`_)
- Deprecate the ``PIP_CONSTRAINT`` environment variable for specifying build
constraints.

Use the ``--build-constraint`` option or the ``PIP_BUILD_CONSTRAINT`` environment variable
instead. When build constraints are used, ``PIP_CONSTRAINT`` no longer affects isolated build
environments. To enable this behavior without specifying any build constraints, use
``--use-feature=build-constraint``. (`13534 <https://github.com/pypa/pip/issues/13534>`_)
- Remove support for non-standard legacy wheel filenames. (`13581 <https://github.com/pypa/pip/issues/13581>`_)
- Remove support for the deprecated ``setup.py bdist_wheel`` mechanism. Consequently,
``--use-pep517`` is now always on, and ``--no-use-pep517`` has been removed. (`6334 <https://github.com/pypa/pip/issues/6334>`_)

Features
--------

- When :pep:`658` metadata is available, full distribution files are no longer downloaded when using ``pip lock`` or ``pip install --dry-run``. (`12603 <https://github.com/pypa/pip/issues/12603>`_)
- Add support for installing an editable requirement written as a Direct URL (``PackageName  URL``). (`13495 <https://github.com/pypa/pip/issues/13495>`_)
- Add support for build constraints via the ``--build-constraint`` option. This
allows constraining the versions of packages used during the build process
(e.g., setuptools) without affecting the final installation. (`13534 <https://github.com/pypa/pip/issues/13534>`_)
- On ``ResolutionImpossible`` errors, include a note about causes with no candidates. (`13588 <https://github.com/pypa/pip/issues/13588>`_)
- Building pip itself from source now uses flit-core instead of setuptools.
This does not affect how pip installs or builds packages you use. (`13473 <https://github.com/pypa/pip/issues/13473>`_)

Bug Fixes
---------

- Handle malformed ``Version`` metadata entries and
show a sensible error message instead of crashing. (`13443 <https://github.com/pypa/pip/issues/13443>`_)
- Permit spaces between a filepath and extras in an install requirement. (`13523 <https://github.com/pypa/pip/issues/13523>`_)
- Ensure the self-check files in the cache have the same permissions as the rest of the cache. (`13528 <https://github.com/pypa/pip/issues/13528>`_)
- Avoid concurrency issues and improve performance when caching locally built wheels,
especially when the temporary build directory is on a different filesystem than the cache.
The wheel directory passed to the build backend is now a temporary subdirectory inside
the cache directory. (`13540 <https://github.com/pypa/pip/issues/13540>`_)
- Include relevant user-supplied constraints in logs when reporting dependency conflicts. (`13545 <https://github.com/pypa/pip/issues/13545>`_)
- Fix a regression in configuration parsing that was turning a single value
into a list and thus leading to a validation error. (`13548 <https://github.com/pypa/pip/issues/13548>`_)
- For Python versions that do not support :pep:`706`, pip will now raise an installation error for a
source distribution when it includes a symlink that points outside the source distribution archive. (`13550 <https://github.com/pypa/pip/issues/13550>`_)
- Prevent ``--user`` installs if ``site.ENABLE_USER_SITE`` is set to ``False``. (`8794 <https://github.com/pypa/pip/issues/8794>`_)


Vendored Libraries
------------------

- Upgrade certifi to 2025.10.5
- Upgrade msgpack to 1.1.2
- Upgrade platformdirs to 4.5.0
- Upgrade requests to 2.32.5
- Upgrade resolvelib to 1.2.1
- Upgrade rich to 14.2.0
- Upgrade tomli to 2.3.0
- Upgrade truststore to 0.10.4

25.2

=================

Features
--------

- Declare support for Python 3.14 (`13506 <https://github.com/pypa/pip/issues/13506>`_)
- Automatic download resumption and retrying is enabled by default. (`13464 <https://github.com/pypa/pip/issues/13464>`_)
- Requires-Python error message displays version clauses in numerical order. (`13367 <https://github.com/pypa/pip/issues/13367>`_)
- Minor performance improvement getting the order to install a very large number of interdependent packages. (`13424 <https://github.com/pypa/pip/issues/13424>`_)
- Show time taken instead of ``eta 0:00:00`` at download completion. (`13483 <https://github.com/pypa/pip/issues/13483>`_)
- Speed up small CLI tools by removing ``import re`` from the console
script executable template. (`13165 <https://github.com/pypa/pip/issues/13165>`_)
- Remove warning when cloning from a Git reference that does not look like a commit hash. (`12283 <https://github.com/pypa/pip/issues/12283>`_)

Bug Fixes
---------

- ``pip config debug`` now correctly separates options as set by the different files
at the same level. (`12099 <https://github.com/pypa/pip/issues/12099>`_)
- Ensure truststore feature remains active even when a proxy is also in use. (`13343 <https://github.com/pypa/pip/issues/13343>`_)
- Include sub-commands in tab completion. (`13140 <https://github.com/pypa/pip/issues/13140>`_)
- ``pip list`` with the ``json`` or ``freeze`` format enabled will no longer
crash when encountering a package with an invalid version. (`13345 <https://github.com/pypa/pip/issues/13345>`_)
- Provide a hint if a system error is raised involving long filenames or path segments on Windows. (`13346 <https://github.com/pypa/pip/issues/13346>`_)
- Resumed downloads are saved to the HTTP cache like any other normal download. (`13441 <https://github.com/pypa/pip/issues/13441>`_)
- Configured verbosity is consistently forwarded while calling Git during
VCS operations. (`13329 <https://github.com/pypa/pip/issues/13329>`_)
- Suppress the progress bar, when running with ``--log`` and ``--quiet``.

Consequently, a new ``auto`` mode for ``--progress-bar`` has been added.
``auto`` will enable progress bars unless suppressed by ``--quiet``,
while ``on`` will always enable progress bars. (`10915 <https://github.com/pypa/pip/issues/10915>`_)
- Fix normalization of local URLs with non-``file`` schemes. (`13509 <https://github.com/pypa/pip/issues/13509>`_)
- Fix normalization of local file URLs on Windows in newer Python versions. (`13510 <https://github.com/pypa/pip/issues/13510>`_)
- Fix remaining test failures in Python 3.14 by adjusting ``path_to_url`` and similar functions. (`13423 <https://github.com/pypa/pip/issues/13423>`_)
- Fix missing ``network`` test markings, making the suite pass in offline
environments again. (`13378 <https://github.com/pypa/pip/issues/13378>`_)

Vendored Libraries
------------------

- Upgrade CacheControl to 0.14.3
- Upgrade certifi to 2025.7.14
- Upgrade distlib to 0.4.0
- Upgrade msgpack to 1.1.1
- Upgrade platformdirs to 4.3.8
- Upgrade pygments to 2.19.2
- Upgrade requests to 2.32.4
- Upgrade resolvelib to 1.2.0
- Upgrade rich to 14.1.0
- Remove vendored typing-extensions.

Process
-------

- pip's own licensing metadata now follows :pep:`639`.
In addition, the licenses of pip's vendored dependencies are now included
in the ``License-File`` metadata field and in the wheel.

25.1.1

===================

Bug Fixes
---------

- Fix ``req.source_dir`` AssertionError when using the legacy resolver. (`13353 <https://github.com/pypa/pip/issues/13353>`_)
- Fix crash on Python 3.9.6 and lower when pip failed to compile a Python module
during installation. (`13364 <https://github.com/pypa/pip/issues/13364>`_)
- Names in dependency group includes are now normalized before lookup, which
fixes incorrect ``Dependency group '...' not found`` errors. (`13372 <https://github.com/pypa/pip/issues/13372>`_)

Vendored Libraries
------------------

- Fix issues with using tomllib from the stdlib if available, rather than tomli
- Upgrade dependency-groups to 1.3.1

25.1

=================

Deprecations and Removals
-------------------------

- Drop support for Python 3.8. (`12989 <https://github.com/pypa/pip/issues/12989>`_)
- On python 3.14+, the ``pkg_resources`` metadata backend cannot be used anymore. (`13010 <https://github.com/pypa/pip/issues/13010>`_)
- Hide ``--no-python-version-warning`` from CLI help and documentation
as it's useless since Python 2 support was removed. Despite being
formerly slated for removal, the flag will remain as a no-op to
avoid breakage. (`13303 <https://github.com/pypa/pip/issues/13303>`_)
- A warning is emitted when the deprecated ``pkg_resources`` library is used to
inspect and discover installed packages. This warning should only be visible to
users who set an undocumented environment variable to disable the default
``importlib.metadata`` backend. (`13318 <https://github.com/pypa/pip/issues/13318>`_)
- Deprecate the legacy ``setup.py bdist_wheel`` mechanism. To silence the warning,
and future-proof their setup, users should enable ``--use-pep517`` or add a
``pyproject.toml`` file to the projects they control. (`13319 <https://github.com/pypa/pip/issues/13319>`_)

Features
--------

- Suggest checking "pip config debug" in case of an InvalidProxyURL error. (`12649 <https://github.com/pypa/pip/issues/12649>`_)
- Using ``--debug`` also enables verbose logging. (`12710 <https://github.com/pypa/pip/issues/12710>`_)
- Display a transient progress bar during package installation. (`12712 <https://github.com/pypa/pip/issues/12712>`_)
- Minor performance improvement when installing packages with a large number
of dependencies by increasing the requirement string cache size. (`12873 <https://github.com/pypa/pip/issues/12873>`_)
- Add a ``--group`` option which allows installation from :pep:`735` Dependency
Groups. ``--group`` accepts arguments of the form ``group`` or
``path:group``, where the default path is ``pyproject.toml``, and installs
the named Dependency Group from the provided ``pyproject.toml`` file. (`12963 <https://github.com/pypa/pip/issues/12963>`_)
- Add support to enable resuming incomplete downloads.

Control the number of retry attempts using the ``--resume-retries`` flag. (`12991 <https://github.com/pypa/pip/issues/12991>`_)
- Use :pep:`753` "Well-known Project URLs in Metadata" normalization rules when
identifying an equivalent project URL to replace a missing ``Home-Page`` field
in ``pip show``. (`13135 <https://github.com/pypa/pip/issues/13135>`_)
- Remove ``experimental`` warning from ``pip index versions`` command. (`13188 <https://github.com/pypa/pip/issues/13188>`_)
- Add a structured ``--json`` output to ``pip index versions`` (`13194 <https://github.com/pypa/pip/issues/13194>`_)
- Add a new, *experimental*, ``pip lock`` command, implementing :pep:`751`. (`13213 <https://github.com/pypa/pip/issues/13213>`_)
- Speed up resolution by first only considering the preference of
candidates that must be required to complete the resolution. (`13253 <https://github.com/pypa/pip/issues/13253>`_)
- Improved heuristics for determining the order of dependency resolution. (`13273 <https://github.com/pypa/pip/issues/13273>`_)
- Provide hint, documentation, and link to the documentation when
resolution too deep error occurs. (`13282 <https://github.com/pypa/pip/issues/13282>`_)
- Include traceback on failure to import ``setuptools`` when ``setup.py`` is being invoked directly. (`13290 <https://github.com/pypa/pip/issues/13290>`_)
- Support for :pep:`738` Android wheels. (`13299 <https://github.com/pypa/pip/issues/13299>`_)
- Display wheel build tag in ``pip list`` columns output if set. (`5210 <https://github.com/pypa/pip/issues/5210>`_)
- Build environment dependencies are no longer compiled to bytecode during
installation for a minor performance improvement. (`7294 <https://github.com/pypa/pip/issues/7294>`_)

Bug Fixes
---------

- When using the ``importlib.metadata`` backend (the default on Python 3.11+),
``pip list`` does not show installed egg distributions more than once anymore.
Additionally, egg distributions whose parent directory was in ``sys.path`` but
the egg themselves were not in ``sys.path`` are not detected anymore. (`12308 <https://github.com/pypa/pip/issues/12308>`_)
- Disable Git and SSH prompts when ``--no-input`` is passed. (`12718 <https://github.com/pypa/pip/issues/12718>`_)
- Gracefully handle Windows registry access errors while guessing the MIME type of a file. (`12769 <https://github.com/pypa/pip/issues/12769>`_)
- Support multiple global configuration paths returned by ``platformdirs`` on MacOS. (`12903 <https://github.com/pypa/pip/issues/12903>`_)
- Resolvelib 1.1.0 fixes a known issue where pip would report a
ResolutionImpossible error even though there is a valid solution.
However, some very complex dependency resolutions that previously
resolved may resolve slower or fail with an ResolutionTooDeep error. (`13001 <https://github.com/pypa/pip/issues/13001>`_)
- Show the correct path to the interpreter also when it's a symlink in a venv in the pip upgrade prompt. (`13156 <https://github.com/pypa/pip/issues/13156>`_)
- Parse wheel filenames according to `binary distribution format specification
<https://packaging.python.org/en/latest/specifications/binary-distribution-format/#file-format>`_.
When a filename doesn't match the spec a deprecation warning is emitted and the
filename is parsed using the old method. (`13229 <https://github.com/pypa/pip/issues/13229>`_)
- While resolving dependencies prefer if any of the known requirements are
"direct", e.g. points to an explicit URL. (`13244 <https://github.com/pypa/pip/issues/13244>`_)
- When choosing a preferred requirement for resolving dependencies
do not consider a specifier with a * in it, e.g. "==1.*", to be a
pinned specifier. (`13252 <https://github.com/pypa/pip/issues/13252>`_)
- Fix a regression that causes dependencies to be checked *before* ``Requires-Python``
project metadata is checked, leading to wasted cycles when the Python version is
unsupported. (`13270 <https://github.com/pypa/pip/issues/13270>`_)
- Don't require the ``wheel`` library to be installed to use ``--no-use-pep517``, any more. (`13330 <https://github.com/pypa/pip/issues/13330>`_)
- Fix regression that suppressed errors indicating which packages were ignored
due to incompatible ``requires-python`` metadata. (`13333 <https://github.com/pypa/pip/issues/13333>`_)
- Fix fish shell completion when commandline contains multiple commands. (`9727 <https://github.com/pypa/pip/issues/9727>`_)

Vendored Libraries
------------------

- Upgrade CacheControl to 0.14.2
- Upgrade certifi to 2025.1.31
- Upgrade packaging to 25.0
- Upgrade platformdirs to 4.3.7
- Upgrade pygments to 2.19.1
- Upgrade resolvelib to 1.1.0.
- Upgrade rich to 14.0.0
- Vendor tomli-w 1.2.0
- Upgrade truststore to 0.10.1
- Upgrade typing_extensions to 4.13.2

Improved Documentation
----------------------

- Added support for building only the man pages with minimal dependencies using
the sphinx-build ``--tag man`` option. This enables distributors to generate man
pages without requiring HTML documentation dependencies. (`13168 <https://github.com/pypa/pip/issues/13168>`_)

25.0.1

===================

Bug Fixes
---------

- Fix an unsupported type annotation on Python 3.10 and earlier. (`13181 <https://github.com/pypa/pip/issues/13181>`_)
- Fix a regression where truststore would never be used while installing build dependencies. (`13186 <https://github.com/pypa/pip/issues/13186>`_)

25.0

=================

Deprecations and Removals
-------------------------

- Deprecate the ``no-python-version-warning`` flag as it has long done nothing
since Python 2 support was removed in pip 21.0. (`13154 <https://github.com/pypa/pip/issues/13154>`_)

Features
--------

- Prefer to display :pep:`639` ``License-Expression`` in ``pip show`` if metadata version is at least 2.4. (`13112 <https://github.com/pypa/pip/issues/13112>`_)
- Support :pep:`639` ``License-Expression`` and ``License-File`` metadata fields in JSON
output. ``pip inspect`` and ``pip install --report`` now emit
``license_expression`` and ``license_file`` fields in the ``metadata`` object,
if the corresponding fields are present in the installed ``METADATA`` file. (`13134 <https://github.com/pypa/pip/issues/13134>`_)
- Files in the network cache will inherit the read/write permissions of pip's cache
directory (in addition to the current user retaining read/write access). This
enables a single cache to be shared among multiple users. (`11012 <https://github.com/pypa/pip/issues/11012>`_)
- Return the size, along with the number, of files cleared on ``pip cache purge`` and ``pip cache remove`` (`12176 <https://github.com/pypa/pip/issues/12176>`_)
- Cache ``python-requires`` checks while filtering potential installation candidates. (`13128 <https://github.com/pypa/pip/issues/13128>`_)
- Optimize package collection by avoiding unnecessary URL parsing and other processing. (`13132 <https://github.com/pypa/pip/issues/13132>`_)

Bug Fixes
---------

- Reorder the encoding detection when decoding a requirements file, relying on
UTF-8 over the locale encoding by default, matching the documented behaviour.
(`12771 <https://github.com/pypa/pip/issues/12771>`_)
- The pip version self check is disabled on ``EXTERNALLY-MANAGED`` environments. (`11820 <https://github.com/pypa/pip/issues/11820>`_)
- Fix a security bug allowing a specially crafted wheel to execute code during
installation. (`13079 <https://github.com/pypa/pip/issues/13079>`_)
- The inclusion of ``packaging`` 24.2 changes how pre-release specifiers with ``<`` and ``>``
behave. Including a pre-release version with these specifiers now implies
accepting pre-releases (e.g., ``<2.0dev`` can include ``1.0rc1``). To avoid
implying pre-releases, avoid specifying them (e.g., use ``<2.0``).
The exception is ``!=``, which never implies pre-releases. (`13163 <https://github.com/pypa/pip/issues/13163>`_)
- The ``--cert`` and ``--client-cert`` command-line options are now respected while
installing build dependencies. Consequently, the private ``_PIP_STANDALONE_CERT``
environment variable is no longer used. (`5502 <https://github.com/pypa/pip/issues/5502>`_)
- The ``--proxy`` command-line option is now respected while installing build dependencies. (`6018 <https://github.com/pypa/pip/issues/6018>`_)

Vendored Libraries
------------------

- Upgrade CacheControl to 0.14.1
- Upgrade idna to 3.10
- Upgrade msgpack to 1.1.0
- Upgrade packaging to 24.2
- Upgrade platformdirs to 4.3.6
- Upgrade pyproject-hooks to 1.2.0
- Upgrade rich to 13.9.4
- Upgrade tomli to 2.2.1

Improved Documentation
----------------------

- Removed section about non-existing ``--force-keyring`` flag. (`12455 <https://github.com/pypa/pip/issues/12455>`_)

Process
-------

- Started releasing to PyPI from a GitHub Actions CI/CD workflow that implements trusted publishing and bundles :pep:`740` digital attestations.

24.3.1

===================

Bug Fixes
---------

- Allow multiple nested inclusions of the same requirements file again. (`13046 <https://github.com/pypa/pip/issues/13046>`_)

24.3

=================

Deprecations and Removals
-------------------------

- Deprecate wheel filenames that are not compliant with :pep:`440`. (`12918 <https://github.com/pypa/pip/issues/12918>`_)

Features
--------

- Detect recursively referencing requirements files and help users identify
the source. (`12653 <https://github.com/pypa/pip/issues/12653>`_)
- Support for :pep:`730` iOS wheels. (`12961 <https://github.com/pypa/pip/issues/12961>`_)

Bug Fixes
---------

- Display a better error message when an already installed package has an invalid requirement. (`12953 <https://github.com/pypa/pip/issues/12953>`_)
- Ignore ``PIP_TARGET`` and ``pip.conf`` ``global.target`` when preparing a build environment. (`8438 <https://github.com/pypa/pip/issues/8438>`_)
- Restore support for macOS 10.12 and older (via truststore). (`12901 <https://github.com/pypa/pip/issues/12901>`_)
- Allow installing pip in editable mode in a virtual environment on Windows. (`12666 <https://github.com/pypa/pip/issues/12666>`_)

Vendored Libraries
------------------

- Upgrade certifi to 2024.8.30
- Upgrade distlib to 0.3.9
- Upgrade truststore to 0.10.0
- Upgrade urllib3 to 1.26.20

24.2

=================

Deprecations and Removals
-------------------------

- Deprecate ``pip install --editable`` falling back to ``setup.py develop``
when using a setuptools version that does not support :pep:`660`
(setuptools v63 and older). (`11457 <https://github.com/pypa/pip/issues/11457>`_)

Features
--------

- Check unsupported packages for the current platform. (`11054 <https://github.com/pypa/pip/issues/11054>`_)
- Use system certificates *and* certifi certificates to verify HTTPS connections on Python 3.10+.
Python 3.9 and earlier only use certifi.

To revert to previous behaviour, pass the flag ``--use-deprecated=legacy-certs``. (`11647 <https://github.com/pypa/pip/issues/11647>`_)
- Improve discovery performance of installed packages when the ``importlib.metadata``
backend is used to load distribution metadata (used by default under Python 3.11+). (`12656 <https://github.com/pypa/pip/issues/12656>`_)
- Improve performance when the same requirement string appears many times during
resolution, by consistently caching the parsed requirement string. (`12663 <https://github.com/pypa/pip/issues/12663>`_)
- Minor performance improvement of finding applicable package candidates by not
repeatedly calculating their versions (`12664 <https://github.com/pypa/pip/issues/12664>`_)
- Disable pip's self version check when invoking a pip subprocess to install
PEP 517 build requirements. (`12683 <https://github.com/pypa/pip/issues/12683>`_)
- Improve dependency resolution performance by caching platform compatibility
tags during wheel cache lookup. (`12712 <https://github.com/pypa/pip/issues/12712>`_)
- ``wheel`` is no longer explicitly listed as a build dependency of ``pip``.
``setuptools`` injects this dependency in the ``get_requires_for_build_wheel()``
hook and no longer needs it on newer versions. (`12728 <https://github.com/pypa/pip/issues/12728>`_)
- Ignore ``--require-virtualenv`` for ``pip check`` and ``pip freeze`` (`12842 <https://github.com/pypa/pip/issues/12842>`_)
- Improve package download and install performance.

Increase chunk sizes when downloading (256 kB, up from 10 kB) and reading files (1 MB, up from 8 kB).
This reduces the frequency of updates to pip's progress bar. (`12810 <https://github.com/pypa/pip/issues/12810>`_)
- Improve pip install performance.

Files are now extracted in 1MB blocks, or in one block matching the file size for
smaller files. A decompressor is no longer instantiated when extracting 0 bytes files,
it is not necessary because there is no data to decompress. (`12803 <https://github.com/pypa/pip/issues/12803>`_)

Bug Fixes
---------

- Set ``no_color`` to global ``rich.Console`` instance. (`11045 <https://github.com/pypa/pip/issues/11045>`_)
- Fix resolution to respect ``--python-version`` when checking ``Requires-Python``. (`12216 <https://github.com/pypa/pip/issues/12216>`_)
- Perform hash comparisons in a case-insensitive manner. (`12680 <https://github.com/pypa/pip/issues/12680>`_)
- Avoid ``dlopen`` failure for glibc detection in musl builds (`12716 <https://github.com/pypa/pip/issues/12716>`_)
- Avoid keyring logging crashes when pip is run in verbose mode. (`12751 <https://github.com/pypa/pip/issues/12751>`_)
- Fix finding hardlink targets in tar files with an ignored top-level directory. (`12781 <https://github.com/pypa/pip/issues/12781>`_)
- Improve pip install performance by only creating required parent
directories once, instead of before extracting every file in the wheel. (`12782 <https://github.com/pypa/pip/issues/12782>`_)
- Improve pip install performance by calculating installed packages printout
in linear time instead of quadratic time. (`12791 <https://github.com/pypa/pip/issues/12791>`_)

Vendored Libraries
------------------

- Remove vendored tenacity.
- Update the preload list for the ``DEBUNDLED`` case, to replace ``pep517`` that has been renamed to ``pyproject_hooks``.
- Use tomllib from the stdlib if available, rather than tomli
- Upgrade certifi to 2024.7.4
- Upgrade platformdirs to 4.2.2
- Upgrade pygments to 2.18.0
- Upgrade setuptools to 70.3.0
- Upgrade typing_extensions to 4.12.2

Improved Documentation
----------------------

- Correct ``—-ignore-conflicts`` (including an em dash) to ``--ignore-conflicts``. (`12851 <https://github.com/pypa/pip/issues/12851>`_)

24.1.2

===================

Bug Fixes
---------

- Fix finding hardlink targets in tar files with an ignored top-level directory. (`12781 <https://github.com/pypa/pip/issues/12781>`_)

24.1.1

===================

Bug Fixes
---------

- Actually use system trust stores when the truststore feature is enabled.

Vendored Libraries
------------------

- Upgrade requests to 2.32.3

24.1

=================

Vendored Libraries
------------------

- Upgrade truststore to 0.9.1.

24.1b2

===================

Features
--------

- Report informative messages about invalid requirements. (`12713 <https://github.com/pypa/pip/issues/12713>`_)

Bug Fixes
---------

- Eagerly import the self version check logic to avoid crashes while upgrading or downgrading pip at the same time. (`12675 <https://github.com/pypa/pip/issues/12675>`_)
- Accommodate for mismatches between different sources of truth for extra names, for packages generated by ``setuptools``. (`12688 <https://github.com/pypa/pip/issues/12688>`_)
- Accommodate for development versions of CPython ending in ``+`` in the version string. (`12691 <https://github.com/pypa/pip/issues/12691>`_)

Vendored Libraries
------------------

- Upgrade packaging to 24.1
- Upgrade requests to 2.32.0
- Remove vendored colorama
- Remove vendored six
- Remove vendored webencodings
- Remove vendored charset_normalizer

``requests`` provides optional character detection support on some APIs when processing ambiguous bytes. This isn't relevant for pip to function and we're able to remove it due to recent upstream changes.

24.1b1

===================

Deprecations and Removals
-------------------------

- Drop support for EOL Python 3.7. (`11934 <https://github.com/pypa/pip/issues/11934>`_)
- Remove support for legacy versions and dependency specifiers.

Packages with non standard-compliant versions or dependency specifiers are now ignored by the resolver.
Already installed packages with non standard-compliant versions or dependency specifiers
must be uninstalled before upgrading them. (`12063 <https://github.com/pypa/pip/issues/12063>`_)

Features
--------

- Improve performance of resolution of large dependency trees, with more caching. (`12453 <https://github.com/pypa/pip/issues/12453>`_)
- Further improve resolution performance of large dependency trees, by caching hash calculations. (`12657 <https://github.com/pypa/pip/issues/12657>`_)
- Reduce startup time of commands (e.g. show, freeze) that do not access the network by 15-30%. (`4768 <https://github.com/pypa/pip/issues/4768>`_)
- Reword and improve presentation of uninstallation errors. (`10421 <https://github.com/pypa/pip/issues/10421>`_)
- Add a 'raw' progress_bar type for simple and parsable download progress reports (`11508 <https://github.com/pypa/pip/issues/11508>`_)
- ``pip list`` no longer performs the pip version check unless ``--outdated`` or ``--uptodate`` is given. (`11677 <https://github.com/pypa/pip/issues/11677>`_)
- Use the ``data_filter`` when extracting tarballs, if it's available. (`12111 <https://github.com/pypa/pip/issues/12111>`_)
- Display the Project-URL value under key "Home-page" in ``pip show`` when the Home-Page metadata field is not set.

The Project-URL key detection is case-insensitive, and ignores any dashes and underscores. (`11221 <https://github.com/pypa/pip/issues/11221>`_)

Bug Fixes
---------

- Ensure ``-vv`` gets passed to any ``pip install`` build environment subprocesses. (`12577 <https://github.com/pypa/pip/issues/12577>`_)
- Deduplicate entries in the ``Requires`` field of ``pip show``. (`12165 <https://github.com/pypa/pip/issues/12165>`_)
- Fix error on checkout for subversion and bazaar with verbose mode on. (`11050 <https://github.com/pypa/pip/issues/11050>`_)
- Fix exception with completions when COMP_CWORD is not set (`12401 <https://github.com/pypa/pip/issues/12401>`_)
- Fix intermittent "cannot locate t64.exe" errors when upgrading pip. (`12666 <https://github.com/pypa/pip/issues/12666>`_)
- Remove duplication in invalid wheel error message (`12579 <https://github.com/pypa/pip/issues/12579>`_)
- Remove the incorrect pip3.x console entrypoint from the pip wheel. This console
script continues to be generated by pip when it installs itself. (`12536 <https://github.com/pypa/pip/issues/12536>`_)
- Gracefully skip VCS detection in pip freeze when PATH points to a non-directory path. (`12567 <https://github.com/pypa/pip/issues/12567>`_)
- Make the ``--proxy`` parameter take precedence over environment variables. (`10685 <https://github.com/pypa/pip/issues/10685>`_)

Vendored Libraries
------------------

- Add charset-normalizer 3.3.2
- Remove chardet
- Remove pyparsing
- Upgrade CacheControl to 0.14.0
- Upgrade certifi to 2024.2.2
- Upgrade distro to 1.9.0
- Upgrade idna to 3.7
- Upgrade msgpack to 1.0.8
- Upgrade packaging to 24.0
- Upgrade platformdirs to 4.2.1
- Upgrade pygments to 2.17.2
- Upgrade rich to 13.7.1
- Upgrade setuptools to 69.5.1
- Upgrade tenacity to 8.2.3
- Upgrade typing_extensions to 4.11.0
- Upgrade urllib3 to 1.26.18

Improved Documentation
----------------------

- Document UX research done on pip. (`10745 <https://github.com/pypa/pip/issues/10745>`_)
- Fix the direct usage of zipapp showing up as ``python -m pip.pyz`` rather than ``./pip.pyz`` / ``.\pip.pyz`` (`12043 <https://github.com/pypa/pip/issues/12043>`_)
- Add a warning explaining that the snippet in "Fallback behavior" is not a valid
``pyproject.toml`` snippet for projects, and link to setuptools documentation
instead. (`12122 <https://github.com/pypa/pip/issues/12122>`_)
- The Python Support Policy has been updated. (`12529 <https://github.com/pypa/pip/issues/12529>`_)
- Document the environment variables that correspond with CLI options. (`12576 <https://github.com/pypa/pip/issues/12576>`_)
- Update architecture documentation for command line interface. (`6831 <https://github.com/pypa/pip/issues/6831>`_)

Process
-------

- Remove ``setup.py`` since all the pip project metadata is now declared in
``pyproject.toml``.
- Move remaining pip development tools configurations to ``pyproject.toml``.

24.0

=================

Features
--------

- Retry on HTTP status code 502 (`11843 <https://github.com/pypa/pip/issues/11843>`_)
- Automatically use the setuptools PEP 517 build backend when ``--config-settings`` is
used for projects without ``pyproject.toml``. (`11915 <https://github.com/pypa/pip/issues/11915>`_)
- Make pip freeze and pip uninstall of legacy editable installs of packages whose name
contains ``_`` compatible with ``setuptools>=69.0.3``. (`12477 <https://github.com/pypa/pip/issues/12477>`_)
- Support per requirement ``--config-settings`` for editable installs. (`12480 <https://github.com/pypa/pip/issues/12480>`_)

Bug Fixes
---------

- Optimized usage of ``--find-links=<path-to-dir>``, by only scanning the relevant directory once, only considering file names that are valid wheel or sdist names, and only considering files in the directory that are related to the install. (`12327 <https://github.com/pypa/pip/issues/12327>`_)
- Removed ``wheel`` from the ``[build-system].requires`` list fallback
that is used when ``pyproject.toml`` is absent. (`12449 <https://github.com/pypa/pip/issues/12449>`_)

Vendored Libraries
------------------

- Upgrade distlib to 0.3.8

Improved Documentation
----------------------

- Fix explanation of how PIP_CONFIG_FILE works (`11815 <https://github.com/pypa/pip/issues/11815>`_)
- Fix outdated pip install argument description in documentation. (`12417 <https://github.com/pypa/pip/issues/12417>`_)
- Replace some links to PEPs with links to the canonical specifications on the :doc:`pypug:index` (`12434 <https://github.com/pypa/pip/issues/12434>`_)
- Updated the ``pyproject.toml`` document to stop suggesting
to depend on ``wheel`` as a build dependency directly. (`12449 <https://github.com/pypa/pip/issues/12449>`_)
- Update supported interpreters in development docs (`12475 <https://github.com/pypa/pip/issues/12475>`_)

Process
-------

- Most project metadata is now defined statically via pip's ``pyproject.toml`` file.

23.3.2

===================

Bug Fixes
---------

- Fix a bug in extras handling for link requirements (`12372 <https://github.com/pypa/pip/issues/12372>`_)
- Fix mercurial revision "parse error": use ``--rev={ref}`` instead of ``-r={ref}`` (`12373 <https://github.com/pypa/pip/issues/12373>`_)

23.3.1

===================

Bug Fixes
---------

- Handle a timezone indicator of Z when parsing dates in the self check. (`12338 <https://github.com/pypa/pip/issues/12338>`_)
- Fix bug where installing the same package at the same time with multiple pip processes could fail. (`12361 <https://github.com/pypa/pip/issues/12361>`_)

23.3

=================

Process
-------

- Added reference to `vulnerability reporting guidelines <https://www.python.org/dev/security/>`_ to pip's security policy.

Deprecations and Removals
-------------------------

- Drop a fallback to using SecureTransport on macOS. It was useful when pip detected OpenSSL older than 1.0.1, but the current pip does not support any Python version supporting such old OpenSSL versions. (`12175 <https://github.com/pypa/pip/issues/12175>`_)

Features
--------

- Improve extras resolution for multiple constraints on same base package. (`11924 <https://github.com/pypa/pip/issues/11924>`_)
- Improve use of datastructures to make candidate selection 1.6x faster. (`12204 <https://github.com/pypa/pip/issues/12204>`_)
- Allow ``pip install --dry-run`` to use platform and ABI overriding options. (`12215 <https://github.com/pypa/pip/issues/12215>`_)
- Add ``is_yanked`` boolean entry to the installation report (``--report``) to indicate whether the requirement was yanked from the index, but was still selected by pip conform to :pep:`592`. (`12224 <https://github.com/pypa/pip/issues/12224>`_)

Bug Fixes
---------

- Ignore errors in temporary directory cleanup (show a warning instead). (`11394 <https://github.com/pypa/pip/issues/11394>`_)
- Normalize extras according to :pep:`685` from package metadata in the resolver
for comparison. This ensures extras are correctly compared and merged as long
as the package providing the extra(s) is built with values normalized according
to the standard. Note, however, that this *does not* solve cases where the
package itself contains unnormalized extra values in the metadata. (`11649 <https://github.com/pypa/pip/issues/11649>`_)
- Prevent downloading sdists twice when :pep:`658` metadata is present. (`11847 <https://github.com/pypa/pip/issues/11847>`_)
- Include all requested extras in the install report (``--report``). (`11924 <https://github.com/pypa/pip/issues/11924>`_)
- Removed uses of ``datetime.datetime.utcnow`` from non-vendored code. (`12005 <https://github.com/pypa/pip/issues/12005>`_)
- Consistently report whether a dependency comes from an extra. (`12095 <https://github.com/pypa/pip/issues/12095>`_)
- Fix completion script for zsh (`12166 <https://github.com/pypa/pip/issues/12166>`_)
- Fix improper handling of the new onexc argument of ``shutil.rmtree()`` in Python 3.12. (`12187 <https://github.com/pypa/pip/issues/12187>`_)
- Filter out yanked links from the available versions error message: "(from versions: 1.0, 2.0, 3.0)" will not contain yanked versions conform PEP 592. The yanked versions (if any) will be mentioned in a separate error message. (`12225 <https://github.com/pypa/pip/issues/12225>`_)
- Fix crash when the git version number contains something else than digits and dots. (`12280 <https://github.com/pypa/pip/issues/12280>`_)
- Use ``-r=...`` instead of ``-r ...`` to specify references with Mercurial. (`12306 <https://github.com/pypa/pip/issues/12306>`_)
- Redact password from URLs in some additional places. (`12350 <https://github.com/pypa/pip/issues/12350>`_)
- pip uses less memory when caching large packages. As a result, there is a new on-disk cache format stored in a new directory ($PIP_CACHE_DIR/http-v2). (`2984 <https://github.com/pypa/pip/issues/2984>`_)

Vendored Libraries
------------------

- Upgrade certifi to 2023.7.22
- Add truststore 0.8.0
- Upgrade urllib3 to 1.26.17

Improved Documentation
----------------------

- Document that ``pip search`` support has been removed from PyPI (`12059 <https://github.com/pypa/pip/issues/12059>`_)
- Clarify --prefer-binary in CLI and docs (`12122 <https://github.com/pypa/pip/issues/12122>`_)
- Document that using OS-provided Python can cause pip's test suite to report false failures. (`12334 <https://github.com/pypa/pip/issues/12334>`_)

23.2.1

===================

Bug Fixes
---------

- Disable :pep:`658` metadata fetching with the legacy resolver. (`12156 <https://github.com/pypa/pip/issues/12156>`_)

23.2

=================

Process
-------

- Deprecate support for eggs for Python 3.11 or later, when the new ``importlib.metadata`` backend is used to load distribution metadata. This only affects the egg *distribution format* (with the ``.egg`` extension); distributions using the ``.egg-info`` *metadata format* (but are not actually eggs) are not affected. For more information about eggs, see `relevant section in the setuptools documentation <https://setuptools.pypa.io/en/stable/deprecated/python_eggs.html>`__.

Deprecations and Removals
-------------------------

- Deprecate legacy version and version specifiers that don't conform to the
:ref:`specification <pypug:version-specifiers>`.
(`12063 <https://github.com/pypa/pip/issues/12063>`_)
- ``freeze`` no longer excludes the ``setuptools``, ``distribute``, and ``wheel``
from the output when running on Python 3.12 or later, where they are not
included in a virtual environment by default. Use ``--exclude`` if you wish to
exclude any of these packages. (`4256 <https://github.com/pypa/pip/issues/4256>`_)

Features
--------

- make rejection messages slightly different between 1 and 8, so the user can make the difference. (`12040 <https://github.com/pypa/pip/issues/12040>`_)

Bug Fixes
---------

- Fix ``pip completion --zsh``. (`11417 <https://github.com/pypa/pip/issues/11417>`_)
- Prevent downloading files twice when :pep:`658` metadata is present (`11847 <https://github.com/pypa/pip/issues/11847>`_)
- Add permission check before configuration (`11920 <https://github.com/pypa/pip/issues/11920>`_)
- Fix deprecation warnings in Python 3.12 for usage of shutil.rmtree (`11957 <https://github.com/pypa/pip/issues/11957>`_)
- Ignore invalid or unreadable ``origin.json`` files in the cache of locally built wheels. (`11985 <https://github.com/pypa/pip/issues/11985>`_)
- Fix installation of packages with :pep:`658` metadata using non-canonicalized names (`12038 <https://github.com/pypa/pip/issues/12038>`_)
- Correctly parse ``dist-info-metadata`` values from JSON-format index data. (`12042 <https://github.com/pypa/pip/issues/12042>`_)
- Fail with an error if the ``--python`` option is specified after the subcommand name. (`12067 <https://github.com/pypa/pip/issues/12067>`_)
- Fix slowness when using ``importlib.metadata`` (the default way for pip to read metadata in Python 3.11+) and there is a large overlap between already installed and to-be-installed packages. (`12079 <https://github.com/pypa/pip/issues/12079>`_)
- Pass the ``-r`` flag to mercurial to be explicit that a revision is passed and protect
against ``hg`` options injection as part of VCS URLs. Users that do not have control on
VCS URLs passed to pip are advised to upgrade. (`12119 <https://github.com/pypa/pip/issues/12119>`_)

Vendored Libraries
------------------

- Upgrade certifi to 2023.5.7
- Upgrade platformdirs to 3.8.1
- Upgrade pygments to 2.15.1
- Upgrade pyparsing to 3.1.0
- Upgrade Requests to 2.31.0
- Upgrade rich to 13.4.2
- Upgrade setuptools to 68.0.0
- Updated typing_extensions to 4.6.0
- Upgrade typing_extensions to 4.7.1
- Upgrade urllib3 to 1.26.16

23.1.2

===================

Vendored Libraries
------------------

- Upgrade setuptools to 67.7.2

23.1.1

===================

Bug Fixes
---------

- Revert `11487 <https://github.com/pypa/pip/pull/11487>`_, as it causes issues with virtualenvs created by the Windows Store distribution of Python. (`#11987 <https://github.com/pypa/pip/issues/11987>`_)

Vendored Libraries
------------------

- Revert pkg_resources (via setuptools) back to 65.6.3

Improved Documentation
----------------------

- Update documentation to reflect the new behavior of using the cache of locally
built wheels in hash-checking mode. (`11967 <https://github.com/pypa/pip/issues/11967>`_)

23.1

=================

Deprecations and Removals
-------------------------

- Remove support for the deprecated ``--install-options``. (`11358 <https://github.com/pypa/pip/issues/11358>`_)
- ``--no-binary`` does not imply ``setup.py install`` anymore. Instead a wheel will be
built locally and installed. (`11451 <https://github.com/pypa/pip/issues/11451>`_)
- ``--no-binary`` does not disable the cache of locally built wheels anymore. It only
means "don't download wheels". (`11453 <https://github.com/pypa/pip/issues/11453>`_)
- Deprecate ``--build-option`` and ``--global-option``. Users are invited to switch to
``--config-settings``. (`11859 <https://github.com/pypa/pip/issues/11859>`_)
- Using ``--config-settings`` with projects that don't have a ``pyproject.toml`` now prints
a deprecation warning. In the future the presence of config settings will automatically
enable the default build backend for legacy projects and pass the settings to it. (`11915 <https://github.com/pypa/pip/issues/11915>`_)
- Remove ``setup.py install`` fallback when building a wheel failed for projects without
``pyproject.toml``. (`8368 <https://github.com/pypa/pip/issues/8368>`_)
- When the ``wheel`` package is not installed, pip now uses the default build backend
instead of ``setup.py install`` and ``setup.py develop`` for project without
``pyproject.toml``. (`8559 <https://github.com/pypa/pip/issues/8559>`_)

Features
--------

- Specify egg-link location in assertion message when it does not match installed location to provide better error message for debugging. (`10476 <https://github.com/pypa/pip/issues/10476>`_)
- Present conflict information during installation after each choice that is rejected (pass ``-vv`` to ``pip install`` to show it) (`10937 <https://github.com/pypa/pip/issues/10937>`_)
- Display dependency chain on each Collecting/Processing log line. (`11169 <https://github.com/pypa/pip/issues/11169>`_)
- Support a per-requirement ``--config-settings`` option in requirements files. (`11325 <https://github.com/pypa/pip/issues/11325>`_)
- The ``--config-settings``/``-C`` option now supports using the same key multiple
times. When the same key is specified multiple times, all values are passed to
the build backend as a list, as opposed to the previous behavior, where pip would
only pass the last value if the same key was used multiple times. (`11681 <https://github.com/pypa/pip/issues/11681>`_)
- Add ``-C`` as a short version of the ``--config-settings`` option. (`11786 <https://github.com/pypa/pip/issues/11786>`_)
- Reduce the number of resolver rounds, since backjumping makes the resolver more efficient in finding solutions. This also

@pyup-bot pyup-bot mentioned this pull request Aug 5, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@pyup-bot