Hey all,

I'm one of the maintainers of pip. Earlier yesterday, we released pip 26.1.

The main new feature is experimental support for pylock.toml files ( PEP 751 ) as a requirements source. pylock.toml files or URLs can be provided with the -r / --requirements options to the commands supporting it.

pip install -r pylock.toml pip wheel -r pylock.toml pip download -r pylock.toml

Note : As conveyed by the experimental warning, keep in mind this feature may evolve significantly or even be removed in favor of another option or command in future pip releases.

Other notable improvements include:

Allow --uploaded-prior-to to accept a duration in days (e.g., P7D for 7 days ago) to support "Dependency cooldowns", a strategy of intentionally delaying package updates to give security researchers and package authors time to recover from (ever-increasing) supply chain attacks.…