# Announcement: pip 26.3 release!

**URL:** <https://discuss.python.org/t/announcement-pip-26-3-release/109822>\
**Category:** Announcements\
**Created:** [November 2, 2026, 10:06pm UTC](https://discuss.python.org/t/announcement-pip-26-3-release/109822 "2026-11-02T22:06:53Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![notatallshaw](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/notatallshaw/32/10861_2.png) [@notatallshaw](https://discuss.python.org/u/notatallshaw)\
**Post date:** [November 2, 2026, 10:06pm UTC](https://discuss.python.org/t/announcement-pip-26-3-release/109822/1 "2026-11-02T22:06:53Z")

</div>

I’m pleased to announce pip 26.3 on behalf of the PyPA.

[pip 26.3 on PyPI](https://pypi.org/project/pip/26.3/)

This is the final quarterly feature release of 2026. You can read about pip’s [versioning, deprecation policy, and release process](https://pip.pypa.io/en/stable/development/release-process/) in the documentation.

# Highlights

## Wheel installation hardening

We have clarified in our [security policy](https://github.com/pypa/pip/blob/main/SECURITY.md#wheel-installation) that you should only install wheels from sources you trust: Python’s dynamic import system means pip cannot guarantee that installing a wheel will not execute third-party code.

pip 26.3 blocks unexpected imports during wheel installation, following warnings introduced in pip 26.1, and improves recovery from interrupted installations. If this breaks a legitimate installation, please [open an issue](https://github.com/pypa/pip/issues/new/choose).

## More ways to install from [`pylock.toml`](https://packaging.python.org/en/latest/specifications/pylock-toml/) files

You can now select extras defined by a lock file:

```shell
python -m pip install -r "pylock.toml[extra1,extra2]"

```

You can also select non-default dependency groups from a local lock file:

```shell
python -m pip install --group pylock.toml:dev --group pylock.toml:docs

```

`-r pylock.toml` installs the lock file’s default groups when they are defined.

Also, `--no-binary` now correctly selects a source distribution recorded in the lock file.

Installing from these files remains experimental.

## Build backend warnings for local builds

pip now forwards your build backend’s `UserWarning`s as `BuildBackendWarning` at normal verbosity when installing local projects, including editable installs.

For example, if a Setuptools project’s `setup.cfg` sets `long_description = file: README.md` but the file is missing, the warning is now visible:

```console
$ python -m pip install .
...
  .../setuptools/config/expand.py:128: BuildBackendWarning: File '.../README.md' cannot be found
...
Successfully installed warning-example-0.1

```

For builds from source archives or remote sources, these warnings are logged as debug and you will need to use very verbose mode to see them (`-vv`).

## Everything else

There are also fixes for configuration handling, build constraints, and wheel cache warnings exposing URL credentials, along with vendored dependency updates. See the [full changelog](https://pip.pypa.io/en/stable/news/) for the complete list.

# Release process

This release was built and published to PyPI through a [GitHub workflow](https://github.com/pypa/pip/blob/main/.github/workflows/release.yml) using [PyPI Trusted Publishing](https://docs.pypi.org/trusted-publishers/).

# Thanks

Thank you to everyone who contributed code, reviews, documentation, testing, and bug reports. Your contributions keep pip improving for the many people and projects that depend on it.

Regards,  
Damian