Mailman 3 April 2026 - PyPA-Committers

Request to enable GitHub Security Advisories (GHSA) for relevant repositories
by Seth Larson April 17, 2026

April 17, 2026

Hey folks, Can I ask everyone who is hosting their project on GitHub and is an admin of a PyPA project to enable the "Private Vulnerability Reporting <https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabili…>" feature if they don't already have a security reporting process? (Settings > Advanced Security > Private Vulnerability Reporting) This feature is a ticketing system, so you can take your time with reports without them falling through the cracks and collaborate with others more easily. I am happy to be added to GHSAs as a collaborator (@sethmlarson) if you need a second opinion or are unsure how the feature works. Also happy to answer questions about the feature. Thank you, Seth Larson

2 1

VOTE: PEP 772 - Packaging Council governance process
by Pradyun Gedam April 14, 2026

April 14, 2026

Hi all! I'm very excited to open the vote for endorsing the acceptance of PEP 772 - Packaging Council governance process <https://peps.python.org/pep-0772/>. This proposal was seconded by @dstufft here <https://discuss.python.org/t/pep-772-packaging-council-governance-process-r…> . This idea has been discussed over the last few years, and the PEP itself has been in discussion for over a year. It has also been approved by the PSF board (as outlined in the appendix, with the corresponding text changes in place as well). Best, Pradyun

33 32

VOTE: Moving pip-tools to PyPA
by Sviatoslav Sydorenko April 5, 2026

April 5, 2026

Hi PyPA committers, I'd like to open a vote on transferring pip-tools to the PyPA GitHub org: https://github.com/jazzband/pip-tools This is a project that provides a way to generate constraint files and manage virtualenv pins. Sometimes, I call it "an early DIY lock files" implementation. It's used by Dependabot to upgrade requirement/constraint files and is a prior art for what's reimplemented in uv. It's spent most of its life in the Jazzband collaborative maintenance organisation that is getting shut down this year[1]. And so, naturally we're looking for a new home[2]. Since both Stephen and I (webknjaz and sirosen — the current project leads) are already a part of PyPA and it is a tool of the packaging realm, we feel it's a good idea to keep maintaining the project under the familiar umbrella. -- Warm regards, Sviatoslav Sydorenko [1]: https://github.com/jazzband/pip-tools/discussions/2353 [2]: https://jazzband.co/news/2026/03/14/sunsetting-jazzband

19 25

VOTE: adding pypi-publish to PyPA on GitLab
by William Woodruff April 2, 2026

April 2, 2026

Hi PyPA committers, I'd like to open a vote on transferring pypi-publish to the PyPA GitLab org (*not* GitHub): https://gitlab.com/trailofbits/pypi-publish For a bit of context: pypi-publish is a GitLab "component", which is roughly analogous to a GitHub Action. Trail of Bits has created this component as a way to streamline GitLab usage of Trusted Publishing and attestations, similar to how pypa/gh-action-pypi-publish has streamlined usage of both on GitHub. If accepted, I would be a primary maintainer on pypi-publish, along with my co-maintainer and colleague Facundo Tuesca (@facutuesca on both GitHub and GitLab). Separately, the astute observer will note that PyPA doesn't have an official GitLab org yet. Ee is currently working on having gitlab.com/pypa released to the PyPA, but in the meantime there's a "holding pattern" organization with a subgroup for PyPA here: https://gitlab.com/python-software-foundation https://gitlab.com/python-software-foundation/pypa Best, William Woodruff

13 19