What’s New in pip 26.1 – Lockfiles and Dependency Cooldowns
Upgrade to pip 26.1, generate lockfiles with pip lock, and use --uploaded-prior-to to enforce dependency cooldowns.
Migrate your projects to pip 26.1, generate lockfiles, and apply dependency cooldowns where needed.
Summary
pip 26.1 introduces several major changes that affect Python dependency management. The release drops support for Python 3.9, which is now end‑of‑life, and introduces a new lockfile format that writes a 519‑line pylock.toml file containing all dependencies. A new --uploaded‑prior‑to option allows developers to enforce dependency cooldowns, using an ISO‑duration format (e.g. P4D for four days). This feature helps mitigate supply‑chain risk by ensuring that only packages older than a specified number of days are installed. The release also demonstrates the new lockfile by generating a pylock.toml for Datasette and LLM, and shows how to request a version of LLM that is at least four days old. These changes improve reproducibility and security for Python projects.
The removal of Python 3.9 support means projects still targeting that version must upgrade, and the new lockfile format requires updating build scripts to consume pylock.toml.
Key changes
- pip 26.1 drops Python 3.9 support
- Introduces pylock.toml lockfile with 519 lines
- Adds --uploaded-prior-to option for dependency cooldowns
- Option uses ISO duration format P<number>-D
- Supports specifying days for cooldown
- Example retrieves llm 0.30 with P4D
- Enhances supply‑chain security