Skip to content

Upgrading pip 25 to 26

Breaking25.3 → 26.2.2Breaking5Security8Platform2Deprecated1New16Changed40Fixed43Other2

Full comparisonBack to pip
BreakingUpgrade verdict

5 breaking changes and 2 platform requirement changes and 7 security fixes.

In plain terms
  • If a package index caches responses, pip may not see a package right after it is published. Use the refresh option to fetch it.
  • pip no longer recognizes very old virtualenv environments (version 20 and older).
  • Constraints no longer apply to build dependencies. Use the build constraint option or environment variable to constrain them.
  • Old-style egg fragment names no longer work; switch to the direct URL requirement format.
Must act Top 5 of 15 that need code or config changes

Python requirement changed in 26.1: >=3.9 → >=3.10.

What you must change

Breaking5
Newly published packages are no longer immediately visible to pip when the index uses caching; use --refresh-package to install them.
--refresh-package
26.2NEWS.rstSummarizedView source
Drops support for detecting legacy, non-PEP 405 virtualenv (< 20) environments.
virtualenv
26.2NEWS.rstSummarizedView source
Constraints files, including PIP_CONSTRAINT, no longer affect isolated build environments; use --build-constraint or PIP_BUILD_CONSTRAINT instead.
PIP_CONSTRAINT--build-constraintPIP_BUILD_CONSTRAINT--use-feature=build-constraint
26.2NEWS.rstSummarizedView source
Removes support for non-bare project names in egg fragments; use Direct URL requirement syntax instead.
26.0NEWS.rstSummarizedView source
Revisions in version control URLs must now be percent-encoded, e.g. issue%231 for branch issue#1.
26.0NEWS.rstSummarizedView source
Security7
Fixes decoding the URL path twice while determining a link filename (CVE-2026-13346).
Medium · CVSS 6.5
26.2NEWS.rstSummarizedView source
Rejects tar archives that write outside the target directory through symlink traversal when extracting on Python versions pre-PEP 706.
26.2NEWS.rstSummarizedView source
Rejects a package path in a pylock.toml fetched from a URL when it resolves outside the lock file's own location.
pylock.toml
26.2NEWS.rstSummarizedView source
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
console_scriptsgui_scriptsMedium · CVSS 5.5
26.1.2GitHub AdvisoryOriginalView source
pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
26.1GitHub AdvisoryOriginalView source
pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files
26.1GitHub AdvisoryOriginalView source
pip Path Traversal vulnerability
26.0GitHub AdvisoryOriginalView source
Platform2
Declares support for Python 3.15.
26.2NEWS.rstSummarizedView source
Drops support for Python 3.9.
26.1NEWS.rstSummarizedView source

Deprecations to plan for

Deprecated1
Emits a deprecation warning when pip imports an unexpected module after installation of a distribution has started.
26.1NEWS.rstSummarizedView source