Simon Willison's Weblog

What's new in pip 26.1 - lockfiles and dependency cooldowns!

9.0内容质量

TL;DR · AI 摘要

pip 26.1 引入了 lockfiles 和依赖冷却功能，改进 Python 包管理的稳定性和安全性。

核心要点

  • 新增 lockfiles 功能，生成精确依赖锁定文件 pylock.toml。
  • 支持依赖冷却选项 --uploaded-prior-to，避免安装过于新版本。
  • 停止支持 Python 3.9，建议升级到更高版本。
#pip#Python#包管理#安全
打开原文

What's new in pip 26.1 - lockfiles and dependency cooldowns!

[Simon Willison’s Weblog](http://simonwillison.net/)

Subscribe

Sponsored by: Sonar — Now with SAST + SCA for secure, dependency-aware Agentic Engineering. SonarQube Advanced Security

28th April 2026 - Link Blog

[What's new in pip 26.1 - lockfiles and dependency cooldowns!](https://ichard26.github.io/blog/2026/04/whats-new-in-pip-26.1/) ([via](https://lobste.rs/s/w2oiaq/what_s_new_pip_26_1_lockfiles_dependency "Lobste.rs")) Richard Si describes an excellent set of upgrades to Python's default pip tool for installing dependencies.

This version drops support for Python 3.9 - fair enough, since it's been EOL since October. macOS still ships with python3 as a default Python 3.9, so I tried out the new Python version against Python 3.14 like this:

code
uv python install 3.14
mkdir /tmp/experiment
cd /tmp/experiment
python3.14 -m venv venv
source venv/bin/activate
pip install -U pip
pip --version

This confirmed I had pip 26.1 - then I tried out the new lock files:

code
pip lock datasette llm

This installs Datasette and LLM and all of their dependencies and writes the whole lot to a 519 line pylock.toml file - here's the result.

The new release also supports dependency cooldowns, discussed here previously, via the new --uploaded-prior-to PXD option where X is a number of days. The format is P-number-of-days-D, following ISO duration format but only supporting days.

I shipped a new release of LLM, version 0.31, three days ago. Here's how to use the new --uploaded-prior-to P4D option to ask for a version that is at least 4 days old.

code
pip install llm --uploaded-prior-to P4D
venv/bin/llm --version

This gave me version 0.30.

Posted 28th April 2026 at 5:23 am

Recent articles

This is a link post by Simon Willison, posted on 28th April 2026.

packaging 48pip 17python 1247security 599supply-chain 18

Monthly briefing

Sponsor me for $10/month and get a curated email digest of the month's most important LLM developments.

Pay me to send you less!

Sponsor & subscribe