Remote

Richard Si 🌺

@ichard26@fosstodon.org

mastodon 4.7.3

A hobby Python developer who writes command line tooling. Maintainer of pip. Triager of mypyc. Former maintainer of black and bandersnatch. Moderator of Python Discord.

Header photo by Evie S. on Unsplash (https://unsplash.com/photos/pink-petaled-flower-digital-wallpaper-MicqqGyDQ6w)

79 Followers

34 Following

11 Posts

Joined September 01, 2024

Pronouns:

he/him

GitHub:

https://github.com/ichard26

Blog:

https://ichard26.github.io/

Richard Si 🌺 @ichard26@fosstodon.org

· 5mo ago

I know that @yossarian@infosec.exchange has argued that "no, you don't need analytics for your blog" but taking a look at my blog analytics, it is nice to have an estimate (however inaccurate) at how many people I've reached.

The whole point of my pip release posts to help disseminate awareness. In particular, I like that I can see my secondary goal of providing an "Googleable" and historical user-friendly changelog is also proving viable.

15,000 eyeballs on "boring" packaging infrastructure is not nothing!

infosec.exchange

yossarian (@yossarian@infosec.exchange) - Infosec Exchange

Richard Si 🌺 @ichard26@fosstodon.org

· 17mo ago

pip 25.1 has been released earlier today! It is our second feature release of the year. It's a large release, with several new features, including support for Dependency Groups (PEP 735), resumable downloads, and experimental lockfile (PEP 751) generation support. 🎉

This time around, I did the responsible thing and wrote my accompanying post *ahead of time*, so if you want to read it on release day, you can right now!

https://ichard26.github.io/blog/2025/04/whats-new-in-pip-25.1/

#python #packaging

ichard26.github.io

Richard Si 🌺 @ichard26@fosstodon.org

· 5mo ago

Replying to

@pradyunsg @davidism Recently we even got one that was like "hey, if the package index was compromised in this *obscure* way, because pip doesn't validate metadata consistency in this one specific area, pip now has a critical security vulnerability 💥" like... c'mon, we'd have much BIGGER problems beyond pip if PyPI was compromised/insecure

Richard Si 🌺 @ichard26@fosstodon.org

· 23mo ago

pip 24.3 has been released (*checks watch*) almost three weeks ago, but do you know what changed in this release?

If not, I have a release write-up for pip 24.3 that can fix that!

https://ichard26.github.io/blog/2024/11/whats-new-in-pip-24.3/?utm_source=Mastodon&utm_medium=socialfeed

TL;DR: pip 24.3 is a small release with a truststore bugfix, error QoL improvements, and one minor deprecation of noncompliant wheel filenames (which won't affect you).

#python #pypa

ichard26.github.io

Richard Si 🌺 @ichard26@fosstodon.org

· 20mo ago

pip 25.0 has been out for a week! 🎉 with a new release, that means a new blog post on the changes. Please enjoy!

https://ichard26.github.io/blog/2025/01/whats-new-in-pip-25.0/?utm_source=Mastodon&utm_medium=socialfeed

This time around, I chose to include a list of deprecations pending for removal in pip 25.1. In practice, I expect some of these removals to be pushed back, but a public list can't hurt.

#python #pip

ichard26.github.io

Richard Si 🌺 @ichard26@fosstodon.org

· 21mo ago

Replying to

Upcoming changes wise, there isn't that much. IMO, the highlights are that package collection was further optimized, and TLS/proxy flags are respected while installing build dependencies. There were several removals scheduled for pip 25.0, but there wasn't enough time to finish them and ensure the migration would be smooth. Assuming everything's goes to plan (!) expect several removals in 25.1. This includes the removal of legacy setup.py based editable installs: https://github.com/pypa/pip/issues/11457

GitHub

Deprecate legacy `setup.py develop` mechanism for `pip install --editable` · Issue #11457 · pypa/pip

Last updated on January 12, 2025. TL;DR: The -e / --editable pip install option is NOT deprecated. What is changing is the underlying method to achive it. The execution of setup.py develop when pip...

Richard Si 🌺 @ichard26@fosstodon.org

· 23mo ago

Replying to

@sethmlarson@fosstodon.org Thank you! My main goal with these write-ups is to bring attention to the various changes made in pip releases. pip is an important piece of foundational tooling, and I strongly believe it deserves a better communication story. pip has been going through a period of evolution. Sure, it's slower as of lately, but it's still evolving—and importantly—deprecating legacy features. This transition can be made easier if users have a readable resource to read *what* changed and *why*.

Richard Si 🌺 @ichard26@fosstodon.org

· 23mo ago

Replying to

@sethmlarson@fosstodon.org In these write-ups, I try to strike a balance between informing users strictly on the changes in a pip release... and the larger story behind them. Is that the best approach? I'm not sure, but I find it more fun to write. I get to play detective while discussing the history or the reasoning behind a certain change. I find it makes me better at understanding our users' perspectives. If I find it hard to explain a change, then it must be even more bewildering for our users.

Richard Si 🌺 @ichard26@fosstodon.org

· 17mo ago

@pythonbytes@fosstodon.org thank you for covering the pip 25.1 release! I'm glad y'all liked it. I never thought I'd see my own little blog on a major podcast. My goal has always been to inform the broader ecosystem about what the pip project is doing, esp. as historically we've been quiet and only get attention when we break something.

pip 25.1 was an exceptional release with several major features. pip 25.2 is likely going to be smaller, not least because we're all a bit tired. 😅

https://www.youtube.com/watch?v=BGhDge-iUTw&t=100s

Or you go to jail - Python Bytes Podcast Ep. 430

Richard Si 🌺 @ichard26@fosstodon.org

· 19mo ago

I wrote a thing: https://ichard26.github.io/blog/2025/03/faster-pip-ci-on-windows-d-drive/

If you have a Windows GHA job that is file I/O heavy, it's worth checking whether that I/O is being performed on the system C: drive or the (faster) D: working space drive. The D: drive is the default, but the system temporary directory is on C:

Setting TEMP to D:\Temp improved pip's Windows CI times by up to 30% 🎉

ichard26.github.io