HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
pypa
pip
Python2012–2026
pypa / pip

pip

The Python package installer

86Distinct people
105Mentions
0Explicit recommenders
10.3KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

The Python package installer

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year105 dated mentions

Observed mentions: 2012-06-22 17:44:37 UTC to 2026-10-22 01:47:33 UTC.

0510152012-01-01 00:00:00 UTC to 2013-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20122013-01-01 00:00:00 UTC to 2014-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2014-01-01 00:00:00 UTC to 2015-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 3 mentions; 1 submissions, 2 comments2016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 9 mentions; 1 submissions, 8 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 3 mentions; 2 submissions, 1 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 5 mentions; 1 submissions, 4 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 11 mentions; 0 submissions, 11 comments20192020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 17 mentions; 4 submissions, 13 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 14 mentions; 2 submissions, 12 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 5 mentions; 1 submissions, 4 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 9 mentions; 0 submissions, 9 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 14 mentions; 0 submissions, 14 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20122012-01-01 00:00:00 UTC2013-01-01 00:00:00 UTC101
20132013-01-01 00:00:00 UTC2014-01-01 00:00:00 UTC202
20142014-01-01 00:00:00 UTC2015-01-01 00:00:00 UTC303
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC312
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC918
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC321
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC514
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC11011
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC17413
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC14212
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC514
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC404
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC909
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC14014
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC505

From the project README

An excerpt from the repository, fetched Nov 13, 2026.

Read the project’s introduction
pip - The Python Package Installer Pip is the package installer for Python. You can use pip to install packages from the Python Package Index and other indexes. Please take a look at our documentation for how to install and use pip: Installation Usage We release updates regularly, with a new version every 3 months. Find more details in our documentation: Release notes Release process If you find bugs, need help, or want to talk to the developers, please use our mailing lists or chat rooms: Issue tracking Discourse channel User IRC If you want to get involved, head over to GitHub to get the source code, look at our development documentation and feel free to jump on the developer mailing lists and chat rooms: GitHub page Development documentation Development IRC Code of Conduct Everyone interacting in the pip project's codebases, issue trackers, chat rooms, and mailing lists is expected to follow the PSF Code of Conduct.
Read the full README on GitHub

What Hacker News says

105 sources
Seems like pip doesn't have a way to exclude packages although it was requested at least once: https://github.com/pypa/pip/issues/10797 Just checked if litellm crept in with any packages I installed recently. Fortunately it didn't, but I'm working on an OSS AI agent harness so its certainly a concern and I'd like just flatout block litellm so I don't have to worry about picking it up as transitive dependency. Guess I'll have to vibe a script and remember to run it. Sigh.
In Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor
> Their infrastructure (pip) getting worse and worse Hi, I'm a pip maintainer, can you please report any issue you think is happening in recent versions of pip: https://github.com/pypa/pip/ I particularly work on performance and stability and think we've been making big strides over the last two years > getting everyone to install private venv's for every app, leading to missing security updates, because updates just break everything. venv's stop your OS tooling from breaking, Linux distro maintainers pushed Python packaging to not allow installing into the system packages by default, and they weren't wrong. All these other problems are solved with proper use of a lock file (which are now standardized, and you can generate and install from them in the latest version of pip), and/or use a project tool (uv, poetry, etc.).
In Python 3.14 garbage collection rigamarole
The telemetry they removed here isn't unique to uv, and it's not being sent back to Astral. Here's the equivalent code in pip itself: https://github.com/pypa/pip/blob/59555f49a0916c6459755d7686a... It's providing platform information to PyPI to help track which operating systems and platforms are being used by different packages. The result is useful graphs like these: https://pypistats.org/packages/sqlite-utils and https://pepy.tech/projects/sqlite-utils?timeRange=threeMonth... The field that guesses if something is running in a CI environment is particularly useful, because it helps package authors tell if their package is genuinely popular or if it's just being installed in CI thousands of times a day by one heavy user who doesn't cache their requirements. Honestly, stripping this data and then implying that it was collected by Astral/
Read the rest
OpenAI in a creepy way is a bad look for this new fork. They should at least clarify in their documentation what the "telemetry" does so as not to make people think Astral were acting in a negative way. Personally I think stripping the telemetry damages the Python community's ability to understand the demographics of package consumption while not having any meaningful impact on end-user privacy at all. Here's the original issue against uv, where the feature was requested by a PyPI volunteer: https://github.com/astral-sh/uv/issues/1958 Update: I filed an issue against fyn suggesting they improve their documentation of this: https://github.com/duriantaco/fyn/issues/1
In Fyn: An uv fork with new features, bug fixes, stripped telemetry
> it's how much speed we "unlocked" just by finally treating Python packaging as a well-specified systems problem instead of a pile of historical accidents. A lot of that, in turn, boils down to realizing that it could be fast, and then expecting that and caring enough about it. > but with the same design decisions (PEP 517/518/621/658 focus, HTTP range tricks, aggressive wheel-first strategy, ignoring obviously defensive upper bounds, etc.), I strongly suspect we'd be debating a 1.3× vs 1.5× speedup instead of a 10× headline I'm doing a project of this sort (although I'm hoping not to reinvent the wheel (heh) for the actual resolution algorithm). I fully expect that some things will be barely improved or even slower, but many things will be nearly as fast as with uv. For example, installing from cache (the focus for the first round) main
Read the rest
ly relies on tools in the standard library that are written in C and have to make system calls and interact with the filesystem; Rust can't do a whole lot to improve on that. On the other hand, a new project can improve by storing unpacked files in the cache (like uv) instead of just the artifact (I'm storing both; pip stores the artifact, but with a msgpack header) and hard-linking them instead of copying them (so that the system calls do less I/O). It can also improve by actually making the cached data accessible without a network call (pip's cache is an HTTP cache; contacting PyPI tells it what the original download URL is for the file it downloaded, which is then hashed to determine its path). For another example, pre-compiling bytecode can be parallelized; there's even already code in the standard library for it. Pip hasn't been taking advantage of that all this time, but to my understanding it will soon feature its own logic (like uv does) to assign files to compile to worker processes. But Rust can't really help with the actual logic being parallelized, because that, too, is written purely in C (at least for CPython), within the interpreter. > why did it take a greenfield project to give Python the package manager behavior people clearly wanted for the last decade? (Zeroth, pip has been doing HTTP range tricks, or at least trying, for quite a while. And the exact point of PEP 658 is to obsolete them. It just doesn't really work for sdists with the current level of metadata expressive power, as in other PEPs like 440 and 508. Which is why we have more PEPs in the pipeline trying to fix that, like 725. And discussions and summaries like https://pypackaging-native.github.io/.) First, you have to write the standards. People in the community expect interoperability. PEP 518 exists specifically so that people could start working on alternatives to Setuptools as a build backend, and PEP 517 exists so that such alternatives could have the option of providing just the build backend functionality. (But the people making things like Poetry and Hatch had grander ideas anyway.) But also, consider the alternative: the only other viable way would have been for pip to totally rip apart established code paths and possibly break compatibility. And, well, if you used and talked about Python at any point between 2006 and 2020, you should have the first-hand experience required to complete that thought. Specifically regarding the "aggressive wheel-first strategy", I strongly encourage you to read the discussion on https://github.com/pypa/pip/issues/9140.
In How uv got so fast
> pip could implement parallel downloads, global caching, and metadata-only resolution tomorrow. It doesn’t, largely because backwards compatibility with fifteen years of edge cases takes precedence. pip is simply difficult to maintain. Backward compatibility concerns surely contribute to that but also there are other factors, like an older project having to satisfy the needs of modern times. For example, my employer (Datadog) allowed me and two other engineers to improve various aspects of Python packaging for nearly an entire quarter. One of the items was to satisfy a few long-standing pip feature requests. I discovered that the cross-platform resolution feature I considered most important is basically incompatible [1] with the current code base. Maintainers would have to decide which path they prefer. [1]: https://github.com/pypa/pip/i
Read the rest
In How uv got so fast
As of half a year ago with pip 25.1, it can install from "dependency groups" listed in pyproject.toml: https://ichard26.github.io/blog/2025/04/whats-new-in-pip-25.... Pip also generates PEP 751 lockfiles, and installing from those is on the roadmap still (https://github.com/pypa/pip/issues/13334). venv is lower-level tooling. Literally all it does is create a virtual environment — the same kind that uv creates and manages. There's nothing to "integrate".
In Uv is the best thing to happen to the Python ecosystem in a decade
Yes, if you control the index, you can lie to pip about what the package's hash should be. This is why you have to opt in to using a different index, and why the connection to PyPI has been properly secured since forever (https://github.com/pypa/pip/issues/425 ; note the date). Once pip supports installation from a PEP 751 lockfile (should be very soon, by my understanding), presumably this won't work, unless the lockfile is already compromised. The clearly AI-generated README is also confused about how this works. It claims: > Intercepts package index requests and rewrites URLs to point to the malicious mirror but it's actually implementing a malicious mirror by forwarding requests to PyPI and then serving a modified version of the PyPI result. "Preserves and updates SHA256 hashes for modified packages" is also an incoherent description;
Read the rest
preserving something and modifying it are mutually incompatible.
In PyPI mirror proxy that injects code and bypasses pip hash verification
I'm still "surprised" (though I've known for years) that GvR and Peters were in favour of the design and co-wrote the PEP (https://peps.python.org/pep-0572/), and that the other author is Chris Angelico who I (also) otherwise greatly respect. Where it's useful, it tends to just save a line of code or work around other defects (for example, the regex example near the start of the PEP points to either a missing null-coalescing operator — which has been repeatedly proposed and rejected, BTW — or the library's fault in not using the "null object" pattern). It's used twice for example as far as I can tell in all of pip and its vendored dependencies (>100 kloc), and it isn't really doing much in either case (https://github.com/pypa/pip/blob/main/src/pip/_internal/meta... and https://github.com/pypa/pip/blob/main/src/pip/_internal/meta... ; it w
Read the rest
as also used in `typing_extensions` but that's been dropped as a dependency; there are some false-positives related to code that parses source code and some data formats). But most importantly to me, it fundamentally violates the strong https://en.wikipedia.org/wiki/Command%E2%80%93query_separati... seen throughout the rest of the language. Meanwhile, changes that I think might actually be good are nowadays routinely rejected with the same kinds of arguments that PEP 572 faced and survived. It's unfortunate that Guido felt harassed and ended up leaving the project. It was overall better under his leadership. I wish I'd been paying attention at the time. I suspect that the people who created that feeling must have themselves felt betrayed.
In Python: The Documentary [video]
Oh really? - https://github.com/pypa/packaging/issues/774 - https://github.com/pypa/setuptools/issues/3548 - https://github.com/pypa/pip/issues/7953 I relied on those for a decade, maybe two. > something no one asked for Was being a facetious, sure someone asked for it, but it was pretty dumb. This has never "corrupted" anything, is rare (not happened to me in last 15 years), and simply fixed when knowledgeable. Not everyone can simply fix it, so a better solution would be to isolate the system python, allow more than one installed, etc. Distros already do this to some extent.
In PYX: The next step in Python packaging

Showing the 15 most recent of 105 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.