pip 26.1 Ships Lockfile Support and Dependency Cooldowns

Richard Si·medium signalXBlueskyLinkedInCopy link

pip 26.1 (released April 26) adds experimental pylock.toml support — the first pip version implementing PEP 751 lockfiles, one year after the PEP was accepted. The '--uploaded-prior-to' flag enables dependency cooldowns, preventing pip from pulling packages uploaded in the last N hours (defense against supply chain attacks). Also drops Python 3.9 support and includes resolver improvements toward removing the legacy resolver. For AI agent builders running Python pipelines, this closes a major reproducibility gap that previously required Poetry or PDM.