Pip 26.1 Ships Dependency Cooldowns and Experimental Lockfile Support to Combat Supply Chain Attacks

Pip 26.1 introduces two major features: dependency cooldowns via the --uploaded-prior-to flag, which prevents installation of packages published within a configurable time window (e.g., 7 days), and experimental pylock.toml lockfile support from PEP 751. Research shows a 7-day cooldown would have blocked 8 out of 10 analyzed supply chain attacks. The lockfile support means pip install -r pylock.toml now works natively, giving pylock.toml a path to widespread adoption since pip ships with every Python installation. The release also patches two CVEs (including an arbitrary code execution hole) and upgrades vendored urllib3 to 2.6.3. Community discussion centers on whether pip's lockfile support matters given uv's rapid adoption, with some raising governance concerns about OpenAI's acquisition of Astral.