Announcement: pip 26.2

Packaging Announcements
,
1

On behalf of the PyPA, I am pleased to announce that the pip team has just released pip 26.2.

This is the third feature release of pip for the year 2026. You can read more about our versioning, deprecation policy, and release process here.

Highlights

  • Declare support for Python 3.15
  • Newly published packages will no longer be immediately visible to pip if the index uses caching (e.g., PyPI instructs clients to cache simple responses for 10 minutes). To install a newly published package, use --refresh-package <pkg>
  • Constraints files, including PIP_CONSTRAINT, no longer affect isolated build environments. Use --build-constraint or the PIP_BUILD_CONSTRAINT environment variable to constrain build dependencies instead.
  • Add --only-deps flag to instruct pip to select only the dependencies of supplied packages. It cannot be used with --no-deps, -r, --group, or --requirements-from-script
  • Add --no-require-hashes to disable automatic enablement of --require-hashes when encountering a requirement with hashes.
  • Present more informative diagnostic errors on uncaught network errors
  • Add experimental support for isolating build subprocesses by creating standard virtual environments (via --use-feature=venv-isolation)
  • Add a --no-proxy-env (or --proxy "") option to ignore proxies configured via non-pip environment variables or configuration files. A proxy set with --proxy is still used.
  • Respect --uploaded-prior-to, --no-binary, --only-binary, and --prefer-binary in pip list --outdated and pip list --uptodate when determining the latest available version.
  • Honor --only-final and --uploaded-prior-to when sourcing requirements with -r pylock.toml
  • Fix decoding the URL path twice while determining a link filename (CVE-2026-13346)

Beyond this list, 26.2 contains additional bug-fixes and smaller QoL improvements. Please consult our changelog for more information.

Alternatively, you may consult my unofficial pip 26.2 release blog post that explores the major changes in pip 26.2:

Release process

This release was built and published to PyPI using a GitHub workflow and a PyPI Trusted Publisher.

Thanks

As with all pip releases, a significant amount of the work was contributed by pip’s user community. Many thanks to all who have contributed, whether through code, documentation, issue reports and/or discussion. Your help keeps pip improving, and is hugely appreciated.

In addition, I’d like to thank the Python Software Foundation’s Packaging-WG specifically for providing funding for pip development for the past few months.

Cheers,

Richard (who is cutting their second pip YY.2 release and 2nd release ever)

20 Likes
2

I’d like to give @ichard26 a big thanks, for persisting with getting the grant and now being able to work part time on pip for a few months and giving us regular updates: Updates for part-time 2026 development · Issue #14025 · pypa/pip · GitHub

I can say with very high confidence that he has made progress on issues for pip, such as providing real venv build isolation, that are tricky, and beyond either the time available or review capacity of all other active maintainers.

12 Likes
3

I’ve cut pip 26.2.1 to fix a regression where keyring installed in a (non-activated) virtual environment couldn’t be used via the import provider method while installing build dependencies. See 26.2 behavior change: building a wheel with `PIP_EXTRA_INDEX_URL` fails due to lack of keyring · Issue #14227 · pypa/pip · GitHub for more details.

6 Likes