Announcement: pip 26.3 release!

notatallshaw · November 2, 2026, 10:06pm

I’m pleased to announce pip 26.3 on behalf of the PyPA.

This is the final quarterly feature release of 2026. You can read about pip’s versioning, deprecation policy, and release process in the documentation.

Highlights

Wheel installation hardening

We have clarified in our security policy that you should only install wheels from sources you trust: Python’s dynamic import system means pip cannot guarantee that installing a wheel will not execute third-party code.

pip 26.3 blocks unexpected imports during wheel installation, following warnings introduced in pip 26.1, and improves recovery from interrupted installations. If this breaks a legitimate installation, please open an issue.

More ways to install from `pylock.toml` files

You can now select extras defined by a lock file:

python -m pip install -r "pylock.toml[extra1,extra2]"

You can also select non-default dependency groups from a local lock file:

python -m pip install --group pylock.toml:dev --group pylock.toml:docs

-r pylock.toml installs the lock file’s default groups when they are defined.

Also, --no-binary now correctly selects a source distribution recorded in the lock file.

Installing from these files remains experimental.

Build backend warnings for local builds

pip now forwards your build backend’s UserWarnings as BuildBackendWarning at normal verbosity when installing local projects, including editable installs.

For example, if a Setuptools project’s setup.cfg sets long_description = file: README.md but the file is missing, the warning is now visible:

$ python -m pip install .
...
  .../setuptools/config/expand.py:128: BuildBackendWarning: File '.../README.md' cannot be found
...
Successfully installed warning-example-0.1

For builds from source archives or remote sources, these warnings are logged as debug and you will need to use very verbose mode to see them (-vv).

Everything else

There are also fixes for configuration handling, build constraints, and wheel cache warnings exposing URL credentials, along with vendored dependency updates. See the full changelog for the complete list.

Release process

This release was built and published to PyPI through a GitHub workflow using PyPI Trusted Publishing.

Thanks

Thank you to everyone who contributed code, reviews, documentation, testing, and bug reports. Your contributions keep pip improving for the many people and projects that depend on it.

Regards,
Damian