pip 25.3__tar.gz → 26.0__tar.gz

{pip-25.3 → pip-26.0}/AUTHORS.txt

@@ -1,6 +1,7 @@
 @Switch01
 A_Rog
 Aakanksha Agrawal
+Aarni Koskela
 Abhinav Sagar
 ABHYUDAY PRATAP SINGH
 abs51295
@@ -191,6 +192,7 @@ Dane Hillard
 daniel
 Daniel Collins
 Daniel Hahler
+Daniel Hollas
 Daniel Holth
 Daniel Jost
 Daniel Katz
@@ -318,6 +320,7 @@ gousaiyang
 gpiks
 Greg Roodt
 Greg Ward
+Guido Diepen
 Guilherme Espada
 Guillaume Seguin
 gutsytechster
@@ -327,8 +330,10 @@ gzpan123
 Hanjun Kim
 Hari Charan
 Harsh Vardhan
+Harsha Sai
 harupy
 Harutaka Kawamura
+Hasan-8326
 hauntsaninja
 Henrich Hartzer
 Henry Schreiner
@@ -369,6 +374,7 @@ Jakub Kuczys
 Jakub Stasiak
 Jakub Vysoky
 Jakub Wilk
+James
 James Cleveland
 James Curtin
 James Firth
@@ -425,12 +431,14 @@ Josh Hansen
 Josh Schneier
 Joshua
 JoshuaPerdue
+Jost Migenda
 Juan Luis Cano Rodríguez
 Juanjo Bazán
 Judah Rand
 Julian Berman
 Julian Gethmann
 Julien Demoor
+Julien Stephan
 July Tikhonov
 Jussi Kukkonen
 Justin van Heek
@@ -442,6 +450,7 @@ Kamal Bin Mustafa
 Karolina Surma
 kasium
 kaustav haldar
+Kaz Nishimura
 keanemind
 Keith Maxwell
 Kelsey Hightower
@@ -557,6 +566,7 @@ Monty Taylor
 morotti
 mrKazzila
 Muha Ajjan
+MUTHUSRIHEMADHARSHINI S A
 Nadav Wexler
 Nahuel Ambrosini
 Nate Coraor
@@ -581,6 +591,7 @@ Nitesh Sharma
 Niyas Sait
 Noah
 Noah Gorny
+Nothing-991
 Nowell Strite
 NtaleGrey
 nucccc
@@ -601,8 +612,10 @@ Omry Yadan
 onlinejudge95
 Oren Held
 Oscar Benjamin
+oxygen dioxide
 Oz N Tiram
 Pachwenko
+Paresh Joshi
 Patrick Dubroy
 Patrick Jenkins
 Patrick Lawson
@@ -737,6 +750,7 @@ Stavros Korokithakis
 Stefan Scherfke
 Stefano Rivera
 Stephan Erb
+Stephane Chazelas
 Stephen Payne
 Stephen Rosen
 stepshal
@@ -760,6 +774,7 @@ Sylvain
 Takayuki SHIMIZUKAWA
 Taneli Hukkinen
 tbeswick
+Terrance
 Thiago
 Thijs Triemstra
 Thomas Fenzl
@@ -808,6 +823,7 @@ Vitaly Babiy
 Vladimir Fokow
 Vladimir Rutsky
 W. Trevor King
+Weida Hong
 Wil Tan
 Wilfred Hughes
 William Edwards
@@ -825,6 +841,8 @@ Xianpeng Shen
 xoviat
 xtreak
 YAMAMOTO Takashi
+Yash
+Yashraj
 Yen Chi Hsuan
 Yeray Diaz Diaz
 Yoval P

{pip-25.3 → pip-26.0}/NEWS.rst

@@ -9,6 +9,62 @@
 
 .. towncrier release notes start
 
+26.0 (2026-01-30)
+=================
+
+Deprecations and Removals
+-------------------------
+
+- Remove support for non-bare project names in egg fragments. Affected users should use
+  the `Direct URL requirement syntax <https://packaging.python.org/en/latest/specifications/version-specifiers/#direct-references>`_. (`#13157 <https://github.com/pypa/pip/issues/13157>`_)
+
+Features
+--------
+
+- Display pip's command-line help in colour, if possible. (`#12134 <https://github.com/pypa/pip/issues/12134>`_)
+- Support installing dependencies declared with inline script metadata
+  (:pep:`723`) with ``--requirements-from-script``. (`#12891 <https://github.com/pypa/pip/issues/12891>`_)
+- Add ``--all-releases`` and ``--only-final`` options to control pre-release
+  and final release selection during package installation. (`#13221 <https://github.com/pypa/pip/issues/13221>`_)
+- Add ``--uploaded-prior-to`` option to only consider packages uploaded prior to
+  a given datetime when the ``upload-time`` field is available from a remote index. (`#13625 <https://github.com/pypa/pip/issues/13625>`_)
+- Add ``--use-feature inprocess-build-deps`` to request that build dependencies are installed
+  within the same pip install process. This new mechanism is faster, supports ``--no-clean``
+  and ``--no-cache-dir`` reliably, and supports prompting for authentication.
+
+  Enabling this feature will also enable ``--use-feature build-constraints``. This feature will
+  become the default in a future pip version. (`#9081 <https://github.com/pypa/pip/issues/9081>`_)
+- ``pip cache purge`` and ``pip cache remove`` now clean up empty directories
+  and legacy files left by older pip versions. (`#9058 <https://github.com/pypa/pip/issues/9058>`_)
+
+Bug Fixes
+---------
+
+- Fix selecting pre-release versions when only pre-releases match.
+  For example, ``package>1.0`` with versions ``1.0, 2.0rc1`` now installs
+  ``2.0rc1`` instead of failing. (`#13746 <https://github.com/pypa/pip/issues/13746>`_)
+- Revisions in version control URLs now must be percent-encoded.
+  For example, use ``git+https://example.com/repo.git@issue%231`` to specify the branch ``issue#1``.
+  If you previously used a branch name containing a ``%`` character in a version control URL, you now need to replace it with ``%25`` to ensure correct percent-encoding. (`#13407 <https://github.com/pypa/pip/issues/13407>`_)
+- Preserve original casing when a path is displayed. (`#6823 <https://github.com/pypa/pip/issues/6823>`_)
+- Fix bash completion when the ``$IFS`` variable has been modified from its default. (`#13555 <https://github.com/pypa/pip/issues/13555>`_)
+- Precompute Python requirements on each candidate, reducing time of long resolutions. (`#13656 <https://github.com/pypa/pip/issues/13656>`_)
+- Skip redundant work converting version objects to strings when using the
+  ``importlib.metadata`` backend. (`#13660 <https://github.com/pypa/pip/issues/13660>`_)
+- Fix ``pip index versions`` to honor only-binary/no-binary options. (`#13682 <https://github.com/pypa/pip/issues/13682>`_)
+- Fix fallthrough logic for options, allowing overriding global options with
+  defaults from user config. (`#13703 <https://github.com/pypa/pip/issues/13703>`_)
+- Use a path-segment prefix comparison, not char-by-char. (`#13777 <https://github.com/pypa/pip/issues/13777>`_)
+
+Vendored Libraries
+------------------
+
+- Upgrade CacheControl to 0.14.4
+- Upgrade certifi to 2026.1.4
+- Upgrade idna to 3.11
+- Upgrade packaging to 26.0
+- Upgrade platformdirs to 4.5.1
+
 25.3 (2025-10-24)
 =================
 
@@ -40,7 +96,7 @@ Features
   (e.g., setuptools) without affecting the final installation. (`#13534 <https://github.com/pypa/pip/issues/13534>`_)
 - On ``ResolutionImpossible`` errors, include a note about causes with no candidates. (`#13588 <https://github.com/pypa/pip/issues/13588>`_)
 - Building pip itself from source now uses flit-core instead of setuptools.
-  This does not affect how pip installs or builds packages you use. (`#13743 <https://github.com/pypa/pip/issues/13743>`_)
+  This does not affect how pip installs or builds packages you use. (`#13473 <https://github.com/pypa/pip/issues/13473>`_)
 
 Bug Fixes
 ---------

{pip-25.3 → pip-26.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pip
-Version: 25.3
+Version: 26.0
 Summary: The PyPA recommended tool for installing Python packages.
 Author-email: The pip developers <distutils-sig@python.org>
 Requires-Python: >=3.9
@@ -83,7 +83,7 @@ If you find bugs, need help, or want to talk to the developers, please use our m
 * `Discourse channel`_
 * `User IRC`_
 
-If you want to get involved head over to GitHub to get the source code, look at our development documentation and feel free to jump on the developer mailing lists and chat rooms:
+If you want to get involved, head over to GitHub to get the source code, look at our development documentation and feel free to jump on the developer mailing lists and chat rooms:
 
 * `GitHub page`_
 * `Development documentation`_

{pip-25.3 → pip-26.0}/README.rst

@@ -33,7 +33,7 @@ If you find bugs, need help, or want to talk to the developers, please use our m
 * `Discourse channel`_
 * `User IRC`_
 
-If you want to get involved head over to GitHub to get the source code, look at our development documentation and feel free to jump on the developer mailing lists and chat rooms:
+If you want to get involved, head over to GitHub to get the source code, look at our development documentation and feel free to jump on the developer mailing lists and chat rooms:
 
 * `GitHub page`_
 * `Development documentation`_

{pip-25.3 → pip-26.0}/build-project/build-requirements.txt

@@ -4,9 +4,9 @@
 #
 #    pip-compile --allow-unsafe --generate-hashes build-requirements.in
 #
-build==1.3.0 \
-    --hash=sha256:698edd0ea270bde950f53aed21f3a0135672206f3911e0176261a31e0e07b397 \
-    --hash=sha256:7145f0b5061ba90a1500d60bd1b13ca0a8a4cebdd0cc16ed8adf1c0e739f43b4
+build==1.4.0 \
+    --hash=sha256:6a07c1b8eb6f2b311b96fcbdbce5dab5fe637ffda0fd83c9cac622e927501596 \
+    --hash=sha256:f1b91b925aa322be454f8330c6fb48b465da993d1e7e7e6fa35027ec49f3c936
     # via -r build-requirements.in
 flit-core==3.12.0 \
     --hash=sha256:18f63100d6f94385c6ed57a72073443e1a71a4acb4339491615d0f16d6ff01b2 \

{pip-25.3 → pip-26.0}/docs/html/cli/pip_download.rst

@@ -61,6 +61,8 @@ Options
 
 .. pip-index-options:: download
 
+.. pip-package-selection-options:: download
+
 
 Examples
 ========

{pip-25.3 → pip-26.0}/docs/html/cli/pip_index.rst

@@ -30,6 +30,9 @@ Options
 
 .. pip-command-options:: index
 
+.. pip-index-options:: index
+
+.. pip-package-selection-options:: index
 
 
 Examples

{pip-25.3 → pip-26.0}/docs/html/cli/pip_install.rst

@@ -266,6 +266,7 @@ Options
 
 .. pip-index-options:: install
 
+.. pip-package-selection-options:: install
 
 .. _`pip install Examples`:
 

{pip-25.3 → pip-26.0}/docs/html/cli/pip_list.rst

@@ -31,6 +31,8 @@ Options
 
 .. pip-index-options:: list
 
+.. pip-package-selection-options:: list
+
 
 Examples
 ========

{pip-25.3 → pip-26.0}/docs/html/cli/pip_lock.rst

@@ -31,6 +31,8 @@ Options
 
 .. pip-index-options:: lock
 
+.. pip-package-selection-options:: lock
+
 
 Examples
 ========

{pip-25.3 → pip-26.0}/docs/html/cli/pip_wheel.rst

@@ -46,6 +46,8 @@ Options
 
 .. pip-index-options:: wheel
 
+.. pip-package-selection-options:: wheel
+
 
 Examples
 ========

{pip-25.3 → pip-26.0}/docs/html/development/architecture/overview.rst

@@ -101,7 +101,7 @@ IN OTHER WORDS
 While all dependencies have not been resolved, do the following:
 
 1.  Following the API defined in :pep:`503`, fetch the index page from
-    `http://{pypi_index}/simple/{package_name <http://pypi.org/simple/%7Bpackage_name>`__}
+    `https://{pypi_index}/simple/{package_name} <https://pypi.org/simple/{package_name}>`_
 2.  Parse all of the file links from the page.
 3.  Select a single file to download from the list of links.
 4.  Extract the metadata from the downloaded package.
@@ -139,4 +139,4 @@ files on PyPI. It’s for getting all files of Flask.)
 
 .. _`tracking issue`: https://github.com/pypa/pip/issues/6831
 .. _PyPI: https://pypi.org/
-.. _PyPI Simple API: https://warehouse.readthedocs.io/api-reference/legacy/#simple-project-api
+.. _PyPI Simple API: https://warehouse.readthedocs.io/api-reference/legacy/

{pip-25.3 → pip-26.0}/docs/html/development/contributing.rst

@@ -270,7 +270,7 @@ will initiate a vote among the existing maintainers.
     - CI Administration capabilities
     - ReadTheDocs Administration capabilities
 
-.. _`Studies have shown`: https://www.kessler.de/prd/smartbear/BestPracticesForPeerCodeReview.pdf
+.. _`Studies have shown`: https://smartbear.com/learn/code-review/best-practices-for-peer-code-review/
 .. _`resolve merge conflicts`: https://help.github.com/articles/resolving-a-merge-conflict-using-the-command-line
 .. _`GitHub Actions`: https://github.com/features/actions
 .. _`.github/workflows`: https://github.com/pypa/pip/blob/main/.github/workflows

{pip-25.3 → pip-26.0}/docs/html/development/getting-started.rst

@@ -206,11 +206,11 @@ in order to start contributing.
 
 .. _`open an issue`: https://github.com/pypa/pip/issues/new?title=Trouble+with+pip+development+environment
 .. _`install Python`: https://realpython.com/installing-python/
-.. _`rich CLI`: https://docs.pytest.org/en/latest/usage.html#specifying-tests-selecting-tests
+.. _`rich CLI`: https://docs.pytest.org/en/latest/how-to/usage.html#specifying-which-tests-to-run
 .. _`GitHub`: https://github.com/pypa/pip
 .. _`good first issues`: https://github.com/pypa/pip/labels/good%20first%20issue
 .. _`pip's architecture`: https://pip.pypa.io/en/latest/development/architecture/
 .. _`triaging issues`: https://pip.pypa.io/en/latest/development/issue-triage/
 .. _`Hello World for Git`: https://guides.github.com/activities/hello-world/
 .. _`Understanding the GitHub flow`: https://guides.github.com/introduction/flow/
-.. _`Start using Git on the command line`: https://docs.gitlab.com/ee/gitlab-basics/start-using-git.html
+.. _`Start using Git on the command line`: https://docs.gitlab.com/ee/topics/git/

{pip-25.3 → pip-26.0}/docs/html/index.md

@@ -50,3 +50,10 @@ lists or chat rooms:
 [irc-pypa-dev]: https://kiwiirc.com/nextclient/#ircs://irc.libera.chat:+6697/pypa-dev
 
 If you find any security issues, please report to [security@python.org](mailto:security@python.org)
+
+## Privacy Notice
+
+Pip does not collect any telemetry, however, it will send
+non-identifying environment information (Python version, OS, etc.) to any remote indices
+used, who may choose to retain such information. Please consult PyPI's privacy
+policy for their data collection and retention practices.

{pip-25.3 → pip-26.0}/docs/html/topics/https-certificates.md

@@ -17,6 +17,9 @@ allow users to specify a different certificate store/bundle for pip to use. It
 is also possible to use `REQUESTS_CA_BUNDLE` or `CURL_CA_BUNDLE` environment
 variables.
 
+If you need a specific certificate bundle, you can download the
+[Mozilla CA bundle provided by the curl project](https://curl.se/docs/caextract.html).
+
 ## Using system certificate stores
 
 ```{versionadded} 24.2

{pip-25.3 → pip-26.0}/docs/html/topics/vcs-support.md

@@ -163,7 +163,7 @@ pip also supports an `egg` fragment to specify the "project name". This is a leg
 feature and its use is discouraged in favour of the
 {ref}`Direct URL <pypug:dependency-specifiers>` form.
 
-The `egg` fragment **should** be a bare {ref}`project name <pypug:name-normalization>`.
+The `egg` fragment **MUST** be a bare {ref}`project name <pypug:name-normalization>`.
 Anything else is not guaranteed to work.
 ```
 

{pip-25.3 → pip-26.0}/docs/html/user_guide.rst

@@ -296,6 +296,120 @@ Example build constraints file (``build-constraints.txt``):
    # Pin Cython for packages that use it to build
    cython==0.29.24
 
+Controlling Pre-release Installation
+=====================================
+
+.. versionadded:: 26.0
+
+By default, pip installs stable versions of packages, unless their specifier includes
+a pre-release version (e.g., ``SomePackage>=1.0a1``) or if there are no stable versions
+available that satisfy the requirement. The ``--all-releases`` and ``--only-final``
+options provide per-package control over pre-release selection.
+
+Use ``--all-releases`` to allow pre-releases for specific packages:
+
+.. tab:: Unix/macOS
+
+   .. code-block:: shell
+
+      python -m pip install --all-releases=DependencyPackage SomePackage
+      python -m pip install --all-releases=:all: SomePackage
+
+.. tab:: Windows
+
+   .. code-block:: shell
+
+      py -m pip install --all-releases=DependencyPackage SomePackage
+      py -m pip install --all-releases=:all: SomePackage
+
+Use ``--only-final`` to explicitly disable pre-releases for specific packages:
+
+.. tab:: Unix/macOS
+
+   .. code-block:: shell
+
+      python -m pip install --only-final=DependencyPackage SomePackage
+      python -m pip install --only-final=:all: SomePackage
+
+.. tab:: Windows
+
+   .. code-block:: shell
+
+      py -m pip install --only-final=DependencyPackage SomePackage
+      py -m pip install --only-final=:all: SomePackage
+
+Both options accept ``:all:`` to apply to all packages, ``:none:`` to clear
+the setting, or comma-separated package names. Package-specific settings
+override ``:all:``. These options can also be used in requirements files.
+
+.. note::
+
+   The ``--pre`` flag is equivalent to ``--all-releases :all:`` but cannot
+   be combined with ``--all-releases`` or ``--only-final``.
+
+
+.. _`Filtering by Upload Time`:
+
+Filtering by Upload Time
+=========================
+
+.. versionadded:: 26.0
+
+The ``--uploaded-prior-to`` option allows you to filter packages by their upload time
+to an index, only considering packages that were uploaded before a specified datetime.
+This can be useful for creating reproducible builds by ensuring you only install
+packages that were available at a known point in time.
+
+.. tab:: Unix/macOS
+
+   .. code-block:: shell
+
+      python -m pip install --uploaded-prior-to=2025-03-16T00:00:00Z SomePackage
+
+.. tab:: Windows
+
+   .. code-block:: shell
+
+      py -m pip install --uploaded-prior-to=2025-03-16T00:00:00Z SomePackage
+
+The option accepts ISO 8601 datetime strings in several formats:
+
+* ``2025-03-16`` - Date in local timezone
+* ``2025-03-16T12:30:00`` - Datetime in local timezone
+* ``2025-03-16T12:30:00Z`` - Datetime in UTC
+* ``2025-03-16T12:30:00+05:00`` - Datetime in UTC offset
+
+For consistency across machines, use either UTC format (with 'Z' suffix) or UTC offset
+format (with timezone offset like '+05:00'). Local timezone formats may produce different
+results on different machines.
+
+.. note::
+
+    This option only applies to packages from remote indexes, not local files or VCS
+    requirements. Local package files are allowed regardless of the
+    ``--uploaded-prior-to`` setting, e.g. ``pip install /path/to/package.whl``,
+    packages from ``--find-links`` directories, or VCS requirements like
+    ``git+https://...``.
+
+    This option requires package indexes that provide upload-time metadata
+    (such as PyPI). If the index does not provide upload-time metadata for a
+    package file, pip will fail immediately with an error message indicating
+    that upload-time metadata is required when using ``--uploaded-prior-to``.
+
+You can combine this option with other filtering mechanisms like constraints files:
+
+.. tab:: Unix/macOS
+
+   .. code-block:: shell
+
+      python -m pip install -c constraints.txt --uploaded-prior-to=2025-03-16 SomePackage
+
+.. tab:: Windows
+
+   .. code-block:: shell
+
+      py -m pip install -c constraints.txt --uploaded-prior-to=2025-03-16 SomePackage
+
 
 .. _`Dependency Groups`:
 
@@ -303,6 +417,8 @@ Example build constraints file (``build-constraints.txt``):
 Dependency Groups
 =================
 
+.. versionadded:: 25.1
+
 "Dependency Groups" are lists of items to be installed stored in a
 ``pyproject.toml`` file.
 

{pip-25.3 → pip-26.0}/docs/pip_sphinxext.py

@@ -190,6 +190,17 @@ class PipIndexOptions(PipOptions):
         )
 
 
+class PipPackageSelectionOptions(PipOptions):
+    required_arguments = 1
+
+    def process_options(self) -> None:
+        cmd_name = self.arguments[0]
+        self._format_options(
+            [o() for o in cmdoptions.package_selection_group["options"]],
+            cmd_name=cmd_name,
+        )
+
+
 class PipCommandOptions(PipOptions):
     required_arguments = 1
 
@@ -316,6 +327,7 @@ def setup(app: Sphinx) -> dict[str, bool | str]:
     app.add_directive("pip-command-options", PipCommandOptions)
     app.add_directive("pip-general-options", PipGeneralOptions)
     app.add_directive("pip-index-options", PipIndexOptions)
+    app.add_directive("pip-package-selection-options", PipPackageSelectionOptions)
     app.add_directive(
         "pip-requirements-file-options-ref-list", PipReqFileOptionsReference
     )

{pip-25.3 → pip-26.0}/pyproject.toml

@@ -67,7 +67,6 @@ test = [
     "virtualenv < 20.0 ; python_version < '3.10' and (sys_platform != 'darwin' or platform_machine != 'arm64')",
     "virtualenv >= 20.0 ; python_version >= '3.10' or (sys_platform == 'darwin' and platform_machine == 'arm64')",
     "werkzeug",
-    "wheel",
     "tomli-w",
     "proxy.py",
 ]
@@ -76,11 +75,11 @@ test-common-wheels = [
     "flit-core >= 3.11, < 4",
     # We pin setuptools<80 because our test suite currently
     # depends on setup.py develop to generate egg-link files.
-    "setuptools >= 40.8.0, != 60.6.0, <80",
-    "wheel",
+    "setuptools >= 70.1.0, <80",
     # As required by pytest-cov.
     "coverage >= 4.4",
     "pytest-subket >= 0.8.1",
+    "keyring",
 ]
 
 docs = [
@@ -112,6 +111,7 @@ include = [
     "docs/**/*.rst",
 ]
 exclude = [
+    ".devcontainer/devcontainer.json",
     "src/pip/_vendor/**/*.pyi",
 ]
 
@@ -231,7 +231,6 @@ select = [
     "G",
     "I",
     "ISC",
-    "PERF",
     "PIE810",
     "PLE",
     "PLR0",
@@ -268,7 +267,7 @@ max-complexity = 33  # default is 10
 [tool.ruff.lint.pylint]
 max-args = 15  # default is 5
 max-branches = 28  # default is 12
-max-returns = 13  # default is 6
+max-returns = 15  # default is 6
 max-statements = 134  # default is 50
 
 [tool.ruff.per-file-target-version]

{pip-25.3 → pip-26.0}/src/pip/__init__.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-__version__ = "25.3"
+__version__ = "26.0"
 
 
 def main(args: list[str] | None = None) -> int: