pip 26.1 adds lockfiles and dependency cooldowns
pip 26.1 introduces two practical features for indie AI developers using Python: `pip lock` for reproducible environments and `--uploaded-prior-to` for avoiding packages uploaded too recently. This is not a model or API breakthrough, but it meaningfully improves deployment stability and supply-chain risk control for LLM apps, agents, and tools.
- `pip lock datasette llm` generates a `pylock.toml`, making Python environments easier to reproduce across local dev, servers, and collaborators.
- `--uploaded-prior-to P4D` lets developers avoid packages published within the last N days, which is useful for reducing supply-chain risk from rushed or compromised releases.
- pip 26.1 drops Python 3.9 support, so indie developers relying on older macOS defaults may need to upgrade their Python runtime before adopting it.