- update to 25.2
# 25.1
* Drop support for Python 3.8.
* On python 3.14+, the pkg_resources metadata backend cannot be used
anymore.
* Hide --no-python-version-warning from CLI help and documentation
as it's useless since Python 2 support was removed.
* A warning is emitted when the deprecated pkg_resources library is
used to inspect and discover installed packages.
* Deprecate the legacy setup.py bdist_wheel mechanism. To silence
the warning, and future-proof their setup, users should enable
--use-pep517 or add a pyproject.toml file to the projects they
control.
* Using --debug also enables verbose logging.
* Display a transient progress bar during package installation.
* Add a --group option which allows installation from PEP 735
Dependency Groups.
* Use PEP 753 "Well-known Project URLs in Metadata" normalization
rules when identifying an equivalent project URL to replace
a missing Home-Page field in pip show.
* Add a new, experimental, pip lock command, implementing PEP 751.
* Resolvelib 1.1.0 fixes a known issue where pip would report a
ResolutionImpossible error even though there is a valid solution.
However, some very complex dependency resolutions that previously
resolved may resolve slower or fail with an ResolutionTooDeep error.
# 25.2
* Declare support for Python 3.14
* Automatic download resumption and retrying is enabled by default.
* Requires-Python error message displays version clauses in numerical
order.
OBS-URL: https://build.opensuse.org/request/show/1299243
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-pip?expand=0&rev=142
- update to 25.0.1
* Fix an unsupported type annotation on Python 3.10 and earlier.
(#13181)
* Fix a regression where truststore would never be used while
installing build dependencies. (#13186)
* Deprecate the no-python-version-warning flag as it has long done
nothing since Python 2 support was removed in pip 21.0. (#13154)
* Prefer to display PEP 639 License-Expression in pip show if
metadata version is at least 2.4. (#13112)
* Support PEP 639 License-Expression and License-File metadata
fields in JSON output. pip inspect and pip install --report now
emit license_expression and license_file fields in the metadata
object, if the corresponding fields are present in the installed
METADATA file. (#13134)
* Files in the network cache will inherit the read/write permissions
of pip’s cache directory (in addition to the current user retaining
read/write access). This enables a single cache to be shared among
multiple users. (#11012)
* Return the size, along with the number, of files cleared on pip
cache purge and pip cache remove (#12176)
* Cache python-requires checks while filtering potential installation
candidates. (#13128)
* Optimize package collection by avoiding unnecessary URL parsing and
other processing. (#13132)
* Reorder the encoding detection when decoding a requirements file,
relying on UTF-8 over the locale encoding by default, matching the
documented behaviour. (#12771)
* The pip version self check is disabled on EXTERNALLY-MANAGED
environments. (#11820)
* Fix a security bug allowing a specially crafted wheel to execute
OBS-URL: https://build.opensuse.org/request/show/1270557
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-pip?expand=0&rev=140
* Allow multiple nested inclusions of the same requirements
file again.
* Deprecate wheel filenames that are not compliant with PEP
440.
* Detect recursively referencing requirements files and help
users identify the source.
* Support for PEP 730 iOS wheels.
* Display a better error message when an already installed
package has an invalid requirement.
* Ignore PIP_TARGET and pip.conf global.target when preparing a
build environment.
* Restore support for macOS 10.12 and older (via truststore).
* Allow installing pip in editable mode in a virtual
environment on Windows.
* Upgrade certifi to 2024.8.30
* Upgrade distlib to 0.3.9
* Upgrade truststore to 0.10.0
* Upgrade urllib3 to 1.26.20
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-pip?expand=0&rev=137
* Deprecate pip install --editable falling back to setup.py
develop when using a setuptools version that does not support
PEP 660 (setuptools v63 and older).
* Check unsupported packages for the current platform. (#11054)
* Check unsupported packages for the current platform.
* Use system certificates and certifi certificates to verify
HTTPS connections on Python 3.10+. Python 3.9 and earlier
only use certifi. To revert to previous behaviour, pass the
flag --use-deprecated=legacy-certs. (#11647)
* Use system certificates and certifi certificates to verify
HTTPS connections on Python 3.10+. Python 3.9 and earlier
only use certifi.
* To revert to previous behaviour, pass the flag --use-
deprecated=legacy-certs.
* Improve discovery performance of installed packages when the
importlib.metadata backend is used to load distribution
metadata (used by default under Python 3.11+). (#12656)
* Improve discovery performance of installed packages when the
importlib.metadata backend is used to load distribution
metadata (used by default under Python 3.11+).
* Improve performance when the same requirement string appears
many times during resolution, by consistently caching the
parsed requirement string. (#12663)
* Improve performance when the same requirement string appears
many times during resolution, by consistently caching the
parsed requirement string.
* Minor performance improvement of finding applicable package
candidates by not repeatedly calculating their versions
(#12664)
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-pip?expand=0&rev=124
* Actually use system trust stores when the truststore feature
is enabled.
* Report informative messages about invalid requirements.
* Eagerly import the self version check logic to avoid crashes
while upgrading or downgrading pip at the same time.
* Accommodate for mismatches between different sources of truth
for extra names, for packages generated by setuptools.
* Accommodate for development versions of CPython ending in +
in the version string.
* requests provides optional character detection support on
some APIs when processing ambiguous bytes. This isn't
relevant for pip to function and we're able to remove it due
to recent upstream changes.
* Drop support for EOL Python 3.7.
* Remove support for legacy versions and dependency specifiers.
* Packages with non standard-compliant versions or dependency
specifiers are now ignored by the resolver. Already installed
packages with non standard-compliant versions or dependency
specifiers must be uninstalled before upgrading them.
* Improve performance of resolution of large dependency trees,
with more caching.
* Further improve resolution performance of large dependency
trees, by caching hash calculations.
* Reduce startup time of commands (e.g. show, freeze) that do
not access the network by 15-30%.
* Reword and improve presentation of uninstallation errors.
* Add a 'raw' progress_bar type for simple and parsable
download progress reports
* pip list no longer performs the pip version check unless
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-pip?expand=0&rev=122
* Retry on HTTP status code 502
* Automatically use the setuptools PEP 517 build backend when
--config-settings is used for projects without
pyproject.toml.
* Make pip freeze and pip uninstall of legacy editable installs
of packages whose name contains _ compatible with
setuptools>=69.0.3.
* Support per requirement --config-settings for editable
installs.
* Optimized usage of --find-links=<path-to-dir>, by only
scanning the relevant directory once, only considering file
names that are valid wheel or sdist names, and only
considering files in the directory that are related to the
install.
* Removed wheel from the [build-system].requires list fallback
that is used when pyproject.toml is absent.
* Upgrade distlib to 0.3.8
* Fix explanation of how PIP_CONFIG_FILE works
* Fix outdated pip install argument description in
documentation.
* Replace some links to PEPs with links to the canonical
specifications on the :doc:`pypug:index`
* Updated the pyproject.toml document to stop suggesting to
depend on wheel as a build dependency directly.
* Update supported interpreters in development docs
* Most project metadata is now defined statically via pip's
pyproject.toml file.
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-pip?expand=0&rev=120
* Fix a bug in extras handling for link requirements (`#12372
* Fix mercurial revision "parse error": use ``--rev={ref}``
instead of ``-r={ref}`` (`#12373
- Finally drop csv23, it has been removed upstream since 2021.
``setup.py``.
- Use libalternatives instead of update-alternatives.
* Document that certain removals can be fast tracked.
* use %python_clone and %python_install_alternative for sip and
* Make the setup.py install deprecation warning less
noisy. We warn only when setup.py install succeeded and
setup.py bdist_wheel failed, as situations where both
fails are most probably irrelevant to this deprecation.
- 20.2.2
* Only attempt to use the keyring once and if it fails, don’t try
again. This prevents spamming users with several keyring unlock
* Fix regression that distributions in system site-packages are
not correctly found when a virtual environment is configured
* Disable caching for range requests, which causes corrupted
wheels when pip tries to obtain metadata using the feature
* Always use UTF-8 to read pyvenv.cfg to match the built-in venv.
* 2020 Resolver: Correctly handle marker evaluation in
constraints and exclude them if their markers do not match the
* Correctly find already-installed distributions with dot (.) in
* Trace a better error message on installation failure due to
* Fix SVN version detection for alternative SVN distributions.
* New resolver: Correctly include the base package when specified
* Use UTF-8 to handle ZIP archive entries on Python 2 according
to PEP 427, so non-ASCII paths can be resolved as expected.
* Add deprecation warning for invalid requirements format
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-pip?expand=0&rev=113
- Bug Fixes
- Handle a timezone indicator of Z when parsing dates in the
self check. (#12338)
- Fix bug where installing the same package at the same time
with multiple pip processes could fail. (#12361)
- Update to 23.3:
- Process
- Added reference to vulnerability reporting guidelines to
pip's security policy.
- Features
- Improve extras resolution for multiple constraints on same
base package. (#11924)
- Improve use of datastructures to make candidate selection
1.6x faster. (#12204)
- Allow pip install --dry-run to use platform and ABI
overriding options. (#12215)
- Add is_yanked boolean entry to the installation report
(--report) to indicate whether the requirement was yanked
from the index, but was still selected by pip conform to
PEP 592. (#12224)
- Bug Fixes
- Ignore errors in temporary directory cleanup (show a
warning instead). (#11394)
- Normalize extras according to PEP 685 from package metadata
in the resolver for comparison. This ensures extras are
correctly compared and merged as long as the package
providing the extra(s) is built with values normalized
according to the standard. Note, however, that this
does not solve cases where the package itself contains
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-pip?expand=0&rev=111
- Bug Fixes
- Handle a timezone indicator of Z when parsing dates in the
self check. (#12338)
- Fix bug where installing the same package at the same time
with multiple pip processes could fail. (#12361)
- Update to 23.3:
- Process
- Added reference to vulnerability reporting guidelines to
pip's security policy.
- Features
- Improve extras resolution for multiple constraints on same
base package. (#11924)
- Improve use of datastructures to make candidate selection
1.6x faster. (#12204)
- Allow pip install --dry-run to use platform and ABI
overriding options. (#12215)
- Add is_yanked boolean entry to the installation report
(--report) to indicate whether the requirement was yanked
from the index, but was still selected by pip conform to
PEP 592. (#12224)
- Bug Fixes
- Ignore errors in temporary directory cleanup (show a
warning instead). (#11394)
- Normalize extras according to PEP 685 from package metadata
in the resolver for comparison. This ensures extras are
correctly compared and merged as long as the package
providing the extra(s) is built with values normalized
according to the standard. Note, however, that this
does not solve cases where the package itself contains
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-pip?expand=0&rev=109
- Update to 23.1.2
- Upgrade setuptools to 67.7.2
- 23.1.1:
- Revert #11487, as it causes issues with virtualenvs created by the
Windows Store distribution of Python. (#11987)
- Revert pkg_resources (via setuptools) back to 65.6.3
- Update documentation to reflect the new behavior of using the
cache of locally built wheels in hash-checking mode. (#11967)
- 23.1:
- Remove support for the deprecated --install-options. (#11358)
- --no-binary does not imply setup.py install anymore. Instead a
wheel will be built locally and installed. (#11451)
- --no-binary does not disable the cache of locally built wheels
anymore. It only means "don't download wheels". (#11453)
- Deprecate --build-option and --global-option. Users are invited to
switch to --config-settings. (#11859)
- Using --config-settings with projects that don't have a
pyproject.toml now prints a deprecation warning. In the future the
presence of config settings will automatically enable the default
build backend for legacy projects and pass the setttings to it.
(#11915)
- Remove setup.py install fallback when building a wheel failed for
projects without pyproject.toml. (#8368)
- When the wheel package is not installed, pip now uses the default
build backend instead of setup.py install and setup.py develop for
project without pyproject.toml. (#8559)
- Specify egg-link location in assertion message when it does not
match installed location to provide better error message for
debugging. (#10476)
- Present conflict information during installation after each choice
that is rejected (pass -vv to pip install to show it) (#10937)
- Display dependency chain on each Collecting/Processing log line.
(#11169)
- Support a per-requirement --config-settings option in requirements
files. (#11325)
- The --config-settings/-C option now supports using the same key
multiple times. When the same key is specified multiple times, all
values are passed to the build backend as a list, as opposed to
the previous behavior, where pip would only pass the last value if
the same key was used multiple times. (#11681)
- Add -C as a short version of the --config-settings option.
(#11786)
- Reduce the number of resolver rounds, since backjumping makes the
resolver more efficient in finding solutions. This also makes
pathological cases fail quicker. (#11908)
- Warn if --hash is used on a line without requirement in a
requirements file. (#11935)
- Stop propagating CLI --config-settings to the build dependencies.
They already did not propagate to requirements provided in
requirement files. To pass the same config settings to several
requirements, users should provide the requirements as CLI
arguments. (#11941)
- Support wheel cache when using --require-hashes. (#5037)
- Add --keyring-provider flag. See the Authentication page in the
documentation for more info. (#8719)
- In the case of virtual environments, configuration files are now
also included from the base installation. (#9752)
- Fix grammar by changing "A new release of pip available:" to "A
new release of pip is available:" in the notice used for
indicating that. (#11529)
- Normalize paths before checking if installed scripts are on PATH.
(#11719)
- Correct the way to decide if keyring is available. (#11774)
- More consistent resolution backtracking by removing legacy hack
related to setuptools resolution (#11837)
- Include AUTHORS.txt in pip's wheels. (#11882)
- The uninstall and install --force-reinstall commands no longer
call normalize_path() repeatedly on the same paths. Instead, these
results are cached for the duration of an uninstall operation,
resulting in improved performance, particularly on Windows.
(#11889)
- Fix and improve the parsing of hashes embedded in URL fragments.
(#11936)
- When package A depends on package B provided as a direct URL
dependency including a hash embedded in the link, the
--require-hashes option did not warn when user supplied hashes
were missing for package B. (#11938)
- Correctly report requested_extras in the installation report when
extras are specified for a local directory installation. (#11946)
- When installing an archive from a direct URL or local file,
populate download_info.info.hashes in the installation report, in
addition to the legacy download_info.info.hash key. (#11948)
- 23.0.1:
- Change the hashes in the installation report to be a mapping. Emit
the archive_info.hashes dictionary in direct_url.json. (#11312)
- Implement logic to read the EXTERNALLY-MANAGED file as specified
in PEP 668. This allows a downstream Python distributor to prevent
users from using pip to modify the externally managed environment.
(#11381)
- Enable the use of keyring found on PATH. This allows keyring
installed using pipx to be used by pip. (#11589)
- The inspect and installation report formats are now declared
stable, and their version has been bumped from 0 to 1. (#11757)
- Wheel cache behavior is restored to match previous versions,
allowing the cache to find existing entries. (#11527)
- Use the "venv" scheme if available to obtain prefixed lib paths.
(#11598)
- Deprecated a historical ambiguity in how egg fragments in
URL-style requirements are formatted and handled. egg fragments
that do not look like PEP 508 names now produce a deprecation
warning. (#11617)
- Fix scripts path in isolated build environment on Debian. (#11623)
- Make pip show show the editable location if package is editable
(#11638)
- Stop checking that wheel is present when build-system.requires is
provided without build-system.build-backend as setuptools (which
we still check for) will inject it anyway. (#11673)
- Fix an issue when an already existing in-memory distribution would
cause exceptions in pip install (#11704)
OBS-URL: https://build.opensuse.org/request/show/1084785
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-pip?expand=0&rev=103
* Deprecations and Removals
+ Deprecate installation with setup.py install when no-binary is enabled
for source distributions without pyproject.toml. (#11452)
+ Deprecate installation with setup.py install when the wheel package is
absent for source distributions without pyproject.toml. (#8559)
+ Drop --use-deprecated=out-of-tree-build. (#11001)
* Features
+ Use the data-dist-info-metadata attribute from PEP 658 to resolve
distribution metadata without downloading the dist yet. (#11111)
+ Add --dry-run option to pip install, to let it print what it would
install but not actually make changes in the target environment. (#11096)
+ Add pip inspect command to obtain the list of installed distributions
and other information about the Python environment, in JSON. (#11245)
+ Add option to install and uninstall commands to opt-out from
running-as-root warning. (#10556)
+ Add a user interface for supplying config settings to build backends.
(#11059)
+ Explains why specified version cannot be retrieved when Requires-Python
is not satisfied. (#9615)
+ Validate build dependencies when using --no-build-isolation. (#9794)
* Bug Fixes
+ Fix entry point generation of pip.X, pipX.Y, and easy_install-X.Y to
correctly account for multi-digit Python version segments. (#11547)
+ Fix --no-index when --index-url or --extra-index-url is specified
inside a requirements file. (#11276)
+ Ignore distributions with invalid Name in metadata instead of crashing,
when using the importlib.metadata backend. (#11352)
+ Raise RequirementsFileParseError when parsing malformed requirements
options that can’t be sucessfully parsed by shlex. (#11491)
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-pip?expand=0&rev=101
- Drop the doctype check, that presented a warning for index
pages that use non-compliant HTML 5.
- Update to 22.0.3:
- Print the exception via rich.traceback, when running with
--debug.
- Only calculate topological installation order, for packages
that are going to be installed/upgraded.
- This fixes an AssertionError that occured when determining
installation order, for a very specific combination of
upgrading-already-installed-package + change of dependencies
+ fetching some packages from a package index. This
combination was especially common in Read the Docs'
builds.
- Use html.parser by default, instead of falling back
to html5lib when --use-deprecated=html5lib is not
passed.
- Clarify that using per-requirement overrides disables the
usage of wheels.
- Update to 22.0.2:
- Instead of failing on index pages that use non-compliant
HTML 5, print a deprecation warning and fall back to
html5lib-based parsing for now. This simplifies the migration
for non-compliant index pages, by letting such indexes
function with a warning.
- Update to 22.0.1:
- Accept lowercase <!doctype html> on index pages.
- Properly handle links parsed by html5lib, when using
--use-deprecated=html5lib.
- Update to 22.0:
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-pip?expand=0&rev=96
* Always refuse installing or building projects that have no ``pyproject.toml`` nor
``setup.py``.
* Tweak running-as-root detection, to check ``os.getuid`` if it exists, on
Unix-y and non-Linux/non-MacOS machines.
* When installing projects with a ``pyproject.toml`` in editable mode, and the build
backend does not support :pep:`660`, prepare metadata using
``prepare_metadata_for_build_wheel`` instead of ``setup.py egg_info``. Also, refuse
installing projects that only have a ``setup.cfg`` and no ``setup.py`` nor
``pyproject.toml``. These restore the pre-21.3 behaviour.
* Restore compatibility of where configuration files are loaded from on MacOS
* Upgrade pep517 to 0.12.0
* Improve deprecation warning regarding the copying of source trees when
installing from a local directory.
* Suppress location mismatch warnings when pip is invoked from a Python source
tree, so ``ensurepip`` does not emit warnings on CPython ``make install``.
* On Python 3.10 or later, the installation scheme backend has been changed to use
``sysconfig``. This is to anticipate the deprecation of ``distutils`` in Python
3.10, and its scheduled removal in 3.12. For compatibility considerations, pip
installations running on Python 3.9 or lower will continue to use ``distutils``.
* Remove the ``--build-dir`` option and aliases, one last time.
* In-tree builds are now the default. ``--use-feature=in-tree-build`` is now
ignored. ``--use-deprecated=out-of-tree-build`` may be used temporarily to ease
the transition.
* Un-deprecate source distribution re-installation behaviour.
* Replace vendored appdirs with platformdirs.
* Support `PEP 610 <https://www.python.org/dev/peps/pep-0610/>`_ to detect
editable installs in ``pip freeze`` and ``pip list``. The ``pip list`` column output
has a new ``Editable project location`` column, and the JSON output has a new
``editable_project_location`` field.
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-pip?expand=0&rev=92
- Update to 20.2.4:
Deprecations and Removals
* Document that certain removals can be fast tracked.
* Document that Python versions are generally supported until
PyPI usage falls below 5%
Features
* New resolver: Avoid accessing indexes when the installed
candidate is preferred and considered good enough
* Improve error message friendliness when an environment
has packages with corrupted metadata
* Cache package listings on index packages so they are guarenteed
to stay stable during a pip command session. This also improves
performance when a index page is accessed multiple times during
the command session
* New resolver: Tweak resolution logic to improve user experience
when user-supplied requirements conflict
Bug Fixes
* New resolver: Correctly respect ``Requires-Python`` metadata
to reject incompatible packages in ``--no-deps`` mode
* New resolver: Pick up hash declarations in constraints files
and use them to filter available distributions
* New resolver: If a package appears multiple times in user
specification with different ``--hash`` options, only hashes
that present in all specifications should be allowed
OBS-URL: https://build.opensuse.org/request/show/860101
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-pip?expand=0&rev=90
