Pip 26.3 Adds Pylock Support and Build Backend Warnings

pip 26.3 adds support for installing extras and non-default dependency groups directly from a pylock.toml file, covering the installation half of a workflow where one lock file serves multiple environments. You can run pip install -r "pylock.toml[extra1,extra2]" to pull in extras or pip install --group pylock.toml:dev for a non-default group, and these options can be combined as pip install --group 'pylock.toml[sa14]:dev'. In an example from release manager Damien Hillard using the nab universal lock file generator, a project declares mutually exclusive extras sa14 and sa20 pinned to SQLAlchemy 1.4 and 2.0 alongside a dev group containing pytest. This functionality works with any tool producing standard pylock.toml files.

Local builds now display build backend warnings from tools like setuptools, hatchling, flit-core, uv-build, or poetry-core for the first time. Local builds such as pip install . or pip install -e . log these backend warnings by default, while non-local builds show them in -vv output. For example, a setuptools project referencing a missing README.md now produces a BuildBackendWarning.

Additionally, the release notes include a caution that installing untrusted wheels can still execute third-party code because wheels are zip archives unpacked into importable Python installation locations and Python's import system is dynamic. While pip 26.3 adds hardening against untrusted wheels, the release manager cannot guarantee that installing a malicious wheel avoids executing third-party code, noting that this limit likely applies to other Python installers as well. Future plans include further pip hardening, proposing fixes in Python itself, and a potential future built around lock files only where installers refuse by default to install anything or execute third-party code.