D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
blackhat.pw
:
/
kunden
/
proc
/
self
/
root
/
usr
/
share
/
doc
/
python3-pip
/
html
/
development
/
Filename :
vendoring-policy.html
back
Copy
<!doctype html> <html class="no-js" lang="en" data-content_root="../"> <head><meta charset="utf-8"/> <meta name="viewport" content="width=device-width,initial-scale=1"/> <meta name="color-scheme" content="light dark"><meta name="viewport" content="width=device-width, initial-scale=1" /> <link rel="search" title="Search" href="../search.html" /><link rel="copyright" title="Copyright" href="../copyright.html" /><link rel="next" title="UX Research & Design" href="../ux-research-design/index.html" /><link rel="prev" title="Release process" href="release-process.html" /> <!-- Generated with Sphinx 8.1.3 and Furo 2024.08.06 --> <title>Vendoring Policy - pip documentation v25.1.1</title> <link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=a746c00c" /> <link rel="stylesheet" type="text/css" href="../_static/styles/furo.css?v=ad9e2e31" /> <link rel="stylesheet" type="text/css" href="../_static/copybutton.css?v=76b2166b" /> <link rel="stylesheet" type="text/css" href="../_static/tabs.css?v=4c969af8" /> <link rel="stylesheet" type="text/css" href="../_static/styles/furo-extensions.css?v=4aa03575" /> <style> body { --color-code-background: #f8f8f8; --color-code-foreground: black; } @media not print { body[data-theme="dark"] { --color-code-background: #202020; --color-code-foreground: #d0d0d0; } @media (prefers-color-scheme: dark) { body:not([data-theme="light"]) { --color-code-background: #202020; --color-code-foreground: #d0d0d0; } } } </style></head> <body> <script> document.body.dataset.theme = localStorage.getItem("theme") || "auto"; </script> <svg xmlns="http://www.w3.org/2000/svg" style="display: none;"> <symbol id="svg-toc" viewBox="0 0 24 24"> <title>Contents</title> <svg stroke="currentColor" fill="currentColor" stroke-width="0" viewBox="0 0 1024 1024"> <path d="M408 442h480c4.4 0 8-3.6 8-8v-56c0-4.4-3.6-8-8-8H408c-4.4 0-8 3.6-8 8v56c0 4.4 3.6 8 8 8zm-8 204c0 4.4 3.6 8 8 8h480c4.4 0 8-3.6 8-8v-56c0-4.4-3.6-8-8-8H408c-4.4 0-8 3.6-8 8v56zm504-486H120c-4.4 0-8 3.6-8 8v56c0 4.4 3.6 8 8 8h784c4.4 0 8-3.6 8-8v-56c0-4.4-3.6-8-8-8zm0 632H120c-4.4 0-8 3.6-8 8v56c0 4.4 3.6 8 8 8h784c4.4 0 8-3.6 8-8v-56c0-4.4-3.6-8-8-8zM115.4 518.9L271.7 642c5.8 4.6 14.4.5 14.4-6.9V388.9c0-7.4-8.5-11.5-14.4-6.9L115.4 505.1a8.74 8.74 0 0 0 0 13.8z"/> </svg> </symbol> <symbol id="svg-menu" viewBox="0 0 24 24"> <title>Menu</title> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather-menu"> <line x1="3" y1="12" x2="21" y2="12"></line> <line x1="3" y1="6" x2="21" y2="6"></line> <line x1="3" y1="18" x2="21" y2="18"></line> </svg> </symbol> <symbol id="svg-arrow-right" viewBox="0 0 24 24"> <title>Expand</title> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather-chevron-right"> <polyline points="9 18 15 12 9 6"></polyline> </svg> </symbol> <symbol id="svg-sun" viewBox="0 0 24 24"> <title>Light mode</title> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1" stroke-linecap="round" stroke-linejoin="round" class="feather-sun"> <circle cx="12" cy="12" r="5"></circle> <line x1="12" y1="1" x2="12" y2="3"></line> <line x1="12" y1="21" x2="12" y2="23"></line> <line x1="4.22" y1="4.22" x2="5.64" y2="5.64"></line> <line x1="18.36" y1="18.36" x2="19.78" y2="19.78"></line> <line x1="1" y1="12" x2="3" y2="12"></line> <line x1="21" y1="12" x2="23" y2="12"></line> <line x1="4.22" y1="19.78" x2="5.64" y2="18.36"></line> <line x1="18.36" y1="5.64" x2="19.78" y2="4.22"></line> </svg> </symbol> <symbol id="svg-moon" viewBox="0 0 24 24"> <title>Dark mode</title> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1" stroke-linecap="round" stroke-linejoin="round" class="icon-tabler-moon"> <path stroke="none" d="M0 0h24v24H0z" fill="none" /> <path d="M12 3c.132 0 .263 0 .393 0a7.5 7.5 0 0 0 7.92 12.446a9 9 0 1 1 -8.313 -12.454z" /> </svg> </symbol> <symbol id="svg-sun-with-moon" viewBox="0 0 24 24"> <title>Auto light/dark, in light mode</title> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1" stroke-linecap="round" stroke-linejoin="round" class="icon-custom-derived-from-feather-sun-and-tabler-moon"> <path style="opacity: 50%" d="M 5.411 14.504 C 5.471 14.504 5.532 14.504 5.591 14.504 C 3.639 16.319 4.383 19.569 6.931 20.352 C 7.693 20.586 8.512 20.551 9.25 20.252 C 8.023 23.207 4.056 23.725 2.11 21.184 C 0.166 18.642 1.702 14.949 4.874 14.536 C 5.051 14.512 5.231 14.5 5.411 14.5 L 5.411 14.504 Z"/> <line x1="14.5" y1="3.25" x2="14.5" y2="1.25"/> <line x1="14.5" y1="15.85" x2="14.5" y2="17.85"/> <line x1="10.044" y1="5.094" x2="8.63" y2="3.68"/> <line x1="19" y1="14.05" x2="20.414" y2="15.464"/> <line x1="8.2" y1="9.55" x2="6.2" y2="9.55"/> <line x1="20.8" y1="9.55" x2="22.8" y2="9.55"/> <line x1="10.044" y1="14.006" x2="8.63" y2="15.42"/> <line x1="19" y1="5.05" x2="20.414" y2="3.636"/> <circle cx="14.5" cy="9.55" r="3.6"/> </svg> </symbol> <symbol id="svg-moon-with-sun" viewBox="0 0 24 24"> <title>Auto light/dark, in dark mode</title> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1" stroke-linecap="round" stroke-linejoin="round" class="icon-custom-derived-from-feather-sun-and-tabler-moon"> <path d="M 8.282 7.007 C 8.385 7.007 8.494 7.007 8.595 7.007 C 5.18 10.184 6.481 15.869 10.942 17.24 C 12.275 17.648 13.706 17.589 15 17.066 C 12.851 22.236 5.91 23.143 2.505 18.696 C -0.897 14.249 1.791 7.786 7.342 7.063 C 7.652 7.021 7.965 7 8.282 7 L 8.282 7.007 Z"/> <line style="opacity: 50%" x1="18" y1="3.705" x2="18" y2="2.5"/> <line style="opacity: 50%" x1="18" y1="11.295" x2="18" y2="12.5"/> <line style="opacity: 50%" x1="15.316" y1="4.816" x2="14.464" y2="3.964"/> <line style="opacity: 50%" x1="20.711" y1="10.212" x2="21.563" y2="11.063"/> <line style="opacity: 50%" x1="14.205" y1="7.5" x2="13.001" y2="7.5"/> <line style="opacity: 50%" x1="21.795" y1="7.5" x2="23" y2="7.5"/> <line style="opacity: 50%" x1="15.316" y1="10.184" x2="14.464" y2="11.036"/> <line style="opacity: 50%" x1="20.711" y1="4.789" x2="21.563" y2="3.937"/> <circle style="opacity: 50%" cx="18" cy="7.5" r="2.169"/> </svg> </symbol> <symbol id="svg-pencil" viewBox="0 0 24 24"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1" stroke-linecap="round" stroke-linejoin="round" class="icon-tabler-pencil-code"> <path d="M4 20h4l10.5 -10.5a2.828 2.828 0 1 0 -4 -4l-10.5 10.5v4" /> <path d="M13.5 6.5l4 4" /> <path d="M20 21l2 -2l-2 -2" /> <path d="M17 17l-2 2l2 2" /> </svg> </symbol> <symbol id="svg-eye" viewBox="0 0 24 24"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1" stroke-linecap="round" stroke-linejoin="round" class="icon-tabler-eye-code"> <path stroke="none" d="M0 0h24v24H0z" fill="none" /> <path d="M10 12a2 2 0 1 0 4 0a2 2 0 0 0 -4 0" /> <path d="M11.11 17.958c-3.209 -.307 -5.91 -2.293 -8.11 -5.958c2.4 -4 5.4 -6 9 -6c3.6 0 6.6 2 9 6c-.21 .352 -.427 .688 -.647 1.008" /> <path d="M20 21l2 -2l-2 -2" /> <path d="M17 17l-2 2l2 2" /> </svg> </symbol> </svg> <input type="checkbox" class="sidebar-toggle" name="__navigation" id="__navigation"> <input type="checkbox" class="sidebar-toggle" name="__toc" id="__toc"> <label class="overlay sidebar-overlay" for="__navigation"> <div class="visually-hidden">Hide navigation sidebar</div> </label> <label class="overlay toc-overlay" for="__toc"> <div class="visually-hidden">Hide table of contents sidebar</div> </label> <a class="skip-to-content muted-link" href="#furo-main-content">Skip to content</a> <div class="page"> <header class="mobile-header"> <div class="header-left"> <label class="nav-overlay-icon" for="__navigation"> <div class="visually-hidden">Toggle site navigation sidebar</div> <i class="icon"><svg><use href="#svg-menu"></use></svg></i> </label> </div> <div class="header-center"> <a href="../index.html"><div class="brand">pip documentation v25.1.1</div></a> </div> <div class="header-right"> <div class="theme-toggle-container theme-toggle-header"> <button class="theme-toggle"> <div class="visually-hidden">Toggle Light / Dark / Auto color theme</div> <svg class="theme-icon-when-auto-light"><use href="#svg-sun-with-moon"></use></svg> <svg class="theme-icon-when-auto-dark"><use href="#svg-moon-with-sun"></use></svg> <svg class="theme-icon-when-dark"><use href="#svg-moon"></use></svg> <svg class="theme-icon-when-light"><use href="#svg-sun"></use></svg> </button> </div> <label class="toc-overlay-icon toc-header-icon" for="__toc"> <div class="visually-hidden">Toggle table of contents sidebar</div> <i class="icon"><svg><use href="#svg-toc"></use></svg></i> </label> </div> </header> <aside class="sidebar-drawer"> <div class="sidebar-container"> <div class="sidebar-sticky"><a class="sidebar-brand" href="../index.html"> <span class="sidebar-brand-text">pip documentation v25.1.1</span> </a><form class="sidebar-search-container" method="get" action="../search.html" role="search"> <input class="sidebar-search" placeholder="Search" name="q" aria-label="Search"> <input type="hidden" name="check_keywords" value="yes"> <input type="hidden" name="area" value="default"> </form> <div id="searchbox"></div><div class="sidebar-scroll"><div class="sidebar-tree"> <ul> <li class="toctree-l1"><a class="reference internal" href="../getting-started.html">Getting Started</a></li> <li class="toctree-l1"><a class="reference internal" href="../installation.html">Installation</a></li> <li class="toctree-l1"><a class="reference internal" href="../user_guide.html">User Guide</a></li> <li class="toctree-l1 has-children"><a class="reference internal" href="../topics/index.html">Topic Guides</a><input class="toctree-checkbox" id="toctree-checkbox-1" name="toctree-checkbox-1" role="switch" type="checkbox"/><label for="toctree-checkbox-1"><div class="visually-hidden">Toggle navigation of Topic Guides</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul> <li class="toctree-l2"><a class="reference internal" href="../topics/authentication.html">Authentication</a></li> <li class="toctree-l2"><a class="reference internal" href="../topics/caching.html">Caching</a></li> <li class="toctree-l2"><a class="reference internal" href="../topics/configuration.html">Configuration</a></li> <li class="toctree-l2"><a class="reference internal" href="../topics/dependency-resolution.html">Dependency Resolution</a></li> <li class="toctree-l2"><a class="reference internal" href="../topics/more-dependency-resolution.html">More on Dependency Resolution</a></li> <li class="toctree-l2"><a class="reference internal" href="../topics/https-certificates.html">HTTPS Certificates</a></li> <li class="toctree-l2"><a class="reference internal" href="../topics/local-project-installs.html">Local project installs</a></li> <li class="toctree-l2"><a class="reference internal" href="../topics/repeatable-installs.html">Repeatable Installs</a></li> <li class="toctree-l2"><a class="reference internal" href="../topics/secure-installs.html">Secure installs</a></li> <li class="toctree-l2"><a class="reference internal" href="../topics/vcs-support.html">VCS Support</a></li> <li class="toctree-l2"><a class="reference internal" href="../topics/python-option.html">Managing a different Python interpreter</a></li> <li class="toctree-l2"><a class="reference internal" href="../topics/workflow.html">Pip is not a workflow management tool</a></li> </ul> </li> <li class="toctree-l1 has-children"><a class="reference internal" href="../reference/index.html">Reference</a><input class="toctree-checkbox" id="toctree-checkbox-2" name="toctree-checkbox-2" role="switch" type="checkbox"/><label for="toctree-checkbox-2"><div class="visually-hidden">Toggle navigation of Reference</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul> <li class="toctree-l2 has-children"><a class="reference internal" href="../reference/build-system/index.html">Build System Interface</a><input class="toctree-checkbox" id="toctree-checkbox-3" name="toctree-checkbox-3" role="switch" type="checkbox"/><label for="toctree-checkbox-3"><div class="visually-hidden">Toggle navigation of Build System Interface</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul> <li class="toctree-l3"><a class="reference internal" href="../reference/build-system/pyproject-toml.html"><code class="docutils literal notranslate"><span class="pre">pyproject.toml</span></code></a></li> <li class="toctree-l3"><a class="reference internal" href="../reference/build-system/setup-py.html"><code class="docutils literal notranslate"><span class="pre">setup.py</span></code> (legacy)</a></li> </ul> </li> <li class="toctree-l2"><a class="reference internal" href="../reference/requirement-specifiers.html">Requirement Specifiers</a></li> <li class="toctree-l2"><a class="reference internal" href="../reference/requirements-file-format.html">Requirements File Format</a></li> <li class="toctree-l2"><a class="reference internal" href="../reference/installation-report.html">Installation Report</a></li> <li class="toctree-l2"><a class="reference internal" href="../reference/inspect-report.html"><code class="docutils literal notranslate"><span class="pre">pip</span> <span class="pre">inspect</span></code> JSON output specification</a></li> </ul> </li> <li class="toctree-l1 has-children"><a class="reference internal" href="../cli/index.html">Commands</a><input class="toctree-checkbox" id="toctree-checkbox-4" name="toctree-checkbox-4" role="switch" type="checkbox"/><label for="toctree-checkbox-4"><div class="visually-hidden">Toggle navigation of Commands</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul> <li class="toctree-l2"><a class="reference internal" href="../cli/pip.html">pip</a></li> <li class="toctree-l2"><a class="reference internal" href="../cli/pip_install.html">pip install</a></li> <li class="toctree-l2"><a class="reference internal" href="../cli/pip_uninstall.html">pip uninstall</a></li> <li class="toctree-l2"><a class="reference internal" href="../cli/pip_inspect.html">pip inspect</a></li> <li class="toctree-l2"><a class="reference internal" href="../cli/pip_list.html">pip list</a></li> <li class="toctree-l2"><a class="reference internal" href="../cli/pip_show.html">pip show</a></li> <li class="toctree-l2"><a class="reference internal" href="../cli/pip_freeze.html">pip freeze</a></li> <li class="toctree-l2"><a class="reference internal" href="../cli/pip_check.html">pip check</a></li> <li class="toctree-l2"><a class="reference internal" href="../cli/pip_lock.html">pip lock</a></li> <li class="toctree-l2"><a class="reference internal" href="../cli/pip_download.html">pip download</a></li> <li class="toctree-l2"><a class="reference internal" href="../cli/pip_wheel.html">pip wheel</a></li> <li class="toctree-l2"><a class="reference internal" href="../cli/pip_hash.html">pip hash</a></li> <li class="toctree-l2"><a class="reference internal" href="../cli/pip_search.html">pip search</a></li> <li class="toctree-l2"><a class="reference internal" href="../cli/pip_index.html">pip index</a></li> <li class="toctree-l2"><a class="reference internal" href="../cli/pip_cache.html">pip cache</a></li> <li class="toctree-l2"><a class="reference internal" href="../cli/pip_config.html">pip config</a></li> <li class="toctree-l2"><a class="reference internal" href="../cli/pip_debug.html">pip debug</a></li> </ul> </li> </ul> <p class="caption" role="heading"><span class="caption-text">Project</span></p> <ul class="current"> <li class="toctree-l1 current has-children"><a class="reference internal" href="index.html">Development</a><input checked="" class="toctree-checkbox" id="toctree-checkbox-5" name="toctree-checkbox-5" role="switch" type="checkbox"/><label for="toctree-checkbox-5"><div class="visually-hidden">Toggle navigation of Development</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul class="current"> <li class="toctree-l2"><a class="reference internal" href="getting-started.html">Getting Started</a></li> <li class="toctree-l2"><a class="reference internal" href="contributing.html">Contributing</a></li> <li class="toctree-l2"><a class="reference internal" href="ci.html">Continuous Integration</a></li> <li class="toctree-l2"><a class="reference internal" href="issue-triage.html">Issue Triage</a></li> <li class="toctree-l2 has-children"><a class="reference internal" href="architecture/index.html">Architecture of pip’s internals</a><input class="toctree-checkbox" id="toctree-checkbox-6" name="toctree-checkbox-6" role="switch" type="checkbox"/><label for="toctree-checkbox-6"><div class="visually-hidden">Toggle navigation of Architecture of pip’s internals</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul> <li class="toctree-l3"><a class="reference internal" href="architecture/overview.html">Broad functionality overview</a></li> <li class="toctree-l3"><a class="reference internal" href="architecture/anatomy.html">Repository anatomy & directory structure</a></li> <li class="toctree-l3"><a class="reference internal" href="architecture/configuration-files.html">Configuration File Handling</a></li> <li class="toctree-l3"><a class="reference internal" href="architecture/package-finding.html">Finding and choosing files (<code class="docutils literal notranslate"><span class="pre">index</span></code> and <code class="docutils literal notranslate"><span class="pre">PackageFinder</span></code>)</a></li> <li class="toctree-l3"><a class="reference internal" href="architecture/command-line-interface.html">Command Line Interface</a></li> <li class="toctree-l3"><a class="reference internal" href="architecture/upgrade-options.html">Options that control the installation process</a></li> </ul> </li> <li class="toctree-l2"><a class="reference internal" href="release-process.html">Release process</a></li> <li class="toctree-l2 current current-page"><a class="current reference internal" href="#">Vendoring Policy</a></li> </ul> </li> <li class="toctree-l1 has-children"><a class="reference internal" href="../ux-research-design/index.html">UX Research & Design</a><input class="toctree-checkbox" id="toctree-checkbox-7" name="toctree-checkbox-7" role="switch" type="checkbox"/><label for="toctree-checkbox-7"><div class="visually-hidden">Toggle navigation of UX Research & Design</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul> <li class="toctree-l2"><a class="reference internal" href="../ux-research-design/contribute.html">How to Contribute</a></li> <li class="toctree-l2"><a class="reference internal" href="../ux-research-design/guidance.html">UX Guidance</a></li> <li class="toctree-l2 has-children"><a class="reference internal" href="../ux-research-design/research-results/index.html">UX Research Results</a><input class="toctree-checkbox" id="toctree-checkbox-8" name="toctree-checkbox-8" role="switch" type="checkbox"/><label for="toctree-checkbox-8"><div class="visually-hidden">Toggle navigation of UX Research Results</div><i class="icon"><svg><use href="#svg-arrow-right"></use></svg></i></label><ul> <li class="toctree-l3"><a class="reference internal" href="../ux-research-design/research-results/about-our-users.html">About pip’s Users</a></li> <li class="toctree-l3"><a class="reference internal" href="../ux-research-design/research-results/mental-models.html">How Users Understand pip</a></li> <li class="toctree-l3"><a class="reference internal" href="../ux-research-design/research-results/users-and-security.html">How pip users think about security</a></li> <li class="toctree-l3"><a class="reference internal" href="../ux-research-design/research-results/ci-cd.html">How pip is used in interactive environments (i.e. CI, CD)</a></li> <li class="toctree-l3"><a class="reference internal" href="../ux-research-design/research-results/personas.html">pip Personas</a></li> <li class="toctree-l3"><a class="reference internal" href="../ux-research-design/research-results/prioritizing-features.html">Prioritizing pip Features</a></li> <li class="toctree-l3"><a class="reference internal" href="../ux-research-design/research-results/override-conflicting-dependencies.html">Providing an override to install packages with conflicting dependencies</a></li> <li class="toctree-l3"><a class="reference internal" href="../ux-research-design/research-results/pip-force-reinstall.html">pip --force-reinstall</a></li> <li class="toctree-l3"><a class="reference internal" href="../ux-research-design/research-results/pip-search.html">pip search</a></li> <li class="toctree-l3"><a class="reference internal" href="../ux-research-design/research-results/pip-upgrade-conflict.html">pip Upgrade Conflict</a></li> <li class="toctree-l3"><a class="reference internal" href="../ux-research-design/research-results/improving-pips-documentation.html">Improving pip’s Documentation</a></li> </ul> </li> </ul> </li> <li class="toctree-l1"><a class="reference internal" href="../news.html">Changelog</a></li> <li class="toctree-l1"><a class="reference external" href="https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md">Code of Conduct</a></li> <li class="toctree-l1"><a class="reference external" href="https://github.com/pypa/pip">GitHub</a></li> </ul> </div> </div> </div> </div> </aside> <div class="main"> <div class="content"> <div class="article-container"> <a href="#" class="back-to-top muted-link"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"> <path d="M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8v12z"></path> </svg> <span>Back to top</span> </a> <div class="content-icon-container"> <div class="view-this-page"> <a class="muted-link" href="../_sources/development/vendoring-policy.rst.txt" title="View this page"> <svg><use href="#svg-eye"></use></svg> <span class="visually-hidden">View this page</span> </a> </div> <div class="theme-toggle-container theme-toggle-content"> <button class="theme-toggle"> <div class="visually-hidden">Toggle Light / Dark / Auto color theme</div> <svg class="theme-icon-when-auto-light"><use href="#svg-sun-with-moon"></use></svg> <svg class="theme-icon-when-auto-dark"><use href="#svg-moon-with-sun"></use></svg> <svg class="theme-icon-when-dark"><use href="#svg-moon"></use></svg> <svg class="theme-icon-when-light"><use href="#svg-sun"></use></svg> </button> </div> <label class="toc-overlay-icon toc-content-icon" for="__toc"> <div class="visually-hidden">Toggle table of contents sidebar</div> <i class="icon"><svg><use href="#svg-toc"></use></svg></i> </label> </div> <article role="main" id="furo-main-content"> <section id="vendoring-policy"> <h1>Vendoring Policy<a class="headerlink" href="#vendoring-policy" title="Link to this heading">¶</a></h1> <ul class="simple"> <li><p>Vendored libraries <strong>MUST</strong> not be modified except as required to successfully vendor them.</p></li> <li><p>Vendored libraries <strong>MUST</strong> be released copies of libraries available on PyPI.</p></li> <li><p>Vendored libraries <strong>MUST</strong> be available under a license that allows them to be integrated into <code class="docutils literal notranslate"><span class="pre">pip</span></code>, which is released under the MIT license.</p></li> <li><p>Vendored libraries <strong>MUST</strong> be accompanied with LICENSE files.</p></li> <li><p>The versions of libraries vendored in pip <strong>MUST</strong> be reflected in <code class="docutils literal notranslate"><span class="pre">pip/_vendor/vendor.txt</span></code>.</p></li> <li><p>Vendored libraries <strong>MUST</strong> function without any build steps such as <code class="docutils literal notranslate"><span class="pre">2to3</span></code> or compilation of C code, practically this limits to single source 2.x/3.x and pure Python.</p></li> <li><p>Any modifications made to libraries <strong>MUST</strong> be noted in <code class="docutils literal notranslate"><span class="pre">pip/_vendor/README.rst</span></code> and their corresponding patches <strong>MUST</strong> be included <code class="docutils literal notranslate"><span class="pre">tools/vendoring/patches</span></code>.</p></li> <li><p>Vendored libraries should have corresponding <code class="docutils literal notranslate"><span class="pre">vendored()</span></code> entries in <code class="docutils literal notranslate"><span class="pre">pip/_vendor/__init__.py</span></code>.</p></li> </ul> <section id="rationale"> <h2>Rationale<a class="headerlink" href="#rationale" title="Link to this heading">¶</a></h2> <p>Historically pip has not had any dependencies except for <code class="docutils literal notranslate"><span class="pre">setuptools</span></code> itself, choosing instead to implement any functionality it needed to prevent needing a dependency. However, starting with pip 1.5, we began to replace code that was implemented inside of pip with reusable libraries from PyPI. This brought the typical benefits of reusing libraries instead of reinventing the wheel like higher quality and more battle tested code, centralization of bug fixes (particularly security sensitive ones), and better/more features for less work.</p> <p>However, there are several issues with having dependencies in the traditional way (via <code class="docutils literal notranslate"><span class="pre">install_requires</span></code>) for pip. These issues are:</p> <dl class="simple"> <dt><strong>Fragility</strong></dt><dd><p>When pip depends on another library to function then if for whatever reason that library either isn’t installed or an incompatible version is installed then pip ceases to function. This is of course true for all Python applications, however for every application <em>except</em> for pip the way you fix it is by re-running pip. Obviously, when pip can’t run, you can’t use pip to fix pip, so you’re left having to manually resolve dependencies and installing them by hand.</p> </dd> <dt><strong>Making other libraries uninstallable</strong></dt><dd><p>One of pip’s current dependencies is the <code class="docutils literal notranslate"><span class="pre">requests</span></code> library, for which pip requires a fairly recent version to run. If pip depended on <code class="docutils literal notranslate"><span class="pre">requests</span></code> in the traditional manner, then we’d either have to maintain compatibility with every <code class="docutils literal notranslate"><span class="pre">requests</span></code> version that has ever existed (and ever will), OR allow pip to render certain versions of <code class="docutils literal notranslate"><span class="pre">requests</span></code> uninstallable. (The second issue, although technically true for any Python application, is magnified by pip’s ubiquity; pip is installed by default in Python, in <code class="docutils literal notranslate"><span class="pre">pyvenv</span></code>, and in <code class="docutils literal notranslate"><span class="pre">virtualenv</span></code>.)</p> </dd> <dt><strong>Security</strong></dt><dd><p>This might seem puzzling at first glance, since vendoring has a tendency to complicate updating dependencies for security updates, and that holds true for pip. However, given the <em>other</em> reasons for avoiding dependencies, the alternative is for pip to reinvent the wheel itself. This is what pip did historically. It forced pip to re-implement its own HTTPS verification routines as a workaround for the Python standard library’s lack of SSL validation, which resulted in similar bugs in the validation routine in <code class="docutils literal notranslate"><span class="pre">requests</span></code> and <code class="docutils literal notranslate"><span class="pre">urllib3</span></code>, except that they had to be discovered and fixed independently. Even though we’re vendoring, reusing libraries keeps pip more secure by relying on the great work of our dependencies, <em>and</em> allowing for faster, easier security fixes by simply pulling in newer versions of dependencies.</p> </dd> <dt><strong>Bootstrapping</strong></dt><dd><p>Currently most popular methods of installing pip rely on pip’s self-contained nature to install pip itself. These tools work by bundling a copy of pip, adding it to <code class="docutils literal notranslate"><span class="pre">sys.path</span></code>, and then executing that copy of pip. This is done instead of implementing a “mini installer” (to reduce duplication); pip already knows how to install a Python package, and is far more battle-tested than any “mini installer” could ever possibly be.</p> </dd> </dl> <p>Many downstream redistributors have policies against this kind of bundling, and instead opt to patch the software they distribute to debundle it and make it rely on the global versions of the software that they already have packaged (which may have its own patches applied to it). We (the pip team) would prefer it if pip was <em>not</em> debundled in this manner due to the above reasons and instead we would prefer it if pip would be left intact as it is now.</p> <p>In the longer term, if someone has a <em>portable</em> solution to the above problems, other than the bundling method we currently use, that doesn’t add additional problems that are unreasonable then we would be happy to consider, and possibly switch to said method. This solution must function correctly across all of the situation that we expect pip to be used and not mandate some external mechanism such as OS packages.</p> </section> <section id="modifications"> <h2>Modifications<a class="headerlink" href="#modifications" title="Link to this heading">¶</a></h2> <ul class="simple"> <li><p><code class="docutils literal notranslate"><span class="pre">setuptools</span></code> is completely stripped to only keep <code class="docutils literal notranslate"><span class="pre">pkg_resources</span></code>.</p></li> <li><p><code class="docutils literal notranslate"><span class="pre">pkg_resources</span></code> has been modified to import its dependencies from <code class="docutils literal notranslate"><span class="pre">pip._vendor</span></code>, and to use the vendored copy of <code class="docutils literal notranslate"><span class="pre">platformdirs</span></code> rather than <code class="docutils literal notranslate"><span class="pre">appdirs</span></code>.</p></li> <li><p><code class="docutils literal notranslate"><span class="pre">packaging</span></code> has been modified to import its dependencies from <code class="docutils literal notranslate"><span class="pre">pip._vendor</span></code>.</p></li> <li><p><code class="docutils literal notranslate"><span class="pre">CacheControl</span></code> has been modified to import its dependencies from <code class="docutils literal notranslate"><span class="pre">pip._vendor</span></code>.</p></li> <li><p><code class="docutils literal notranslate"><span class="pre">requests</span></code> has been modified to import its other dependencies from <code class="docutils literal notranslate"><span class="pre">pip._vendor</span></code> and to <em>not</em> load <code class="docutils literal notranslate"><span class="pre">simplejson</span></code> (all platforms) and <code class="docutils literal notranslate"><span class="pre">pyopenssl</span></code> (Windows).</p></li> <li><p><code class="docutils literal notranslate"><span class="pre">platformdirs</span></code> has been modified to import its submodules from <code class="docutils literal notranslate"><span class="pre">pip._vendor.platformdirs</span></code>.</p></li> </ul> </section> <section id="automatic-vendoring"> <h2>Automatic Vendoring<a class="headerlink" href="#automatic-vendoring" title="Link to this heading">¶</a></h2> <p>Vendoring is automated via the <a class="reference external" href="https://pypi.org/project/vendoring/">vendoring</a> tool from the content of <code class="docutils literal notranslate"><span class="pre">pip/_vendor/vendor.txt</span></code> and the different patches in <code class="docutils literal notranslate"><span class="pre">tools/vendoring/patches</span></code>. Launch it via <code class="docutils literal notranslate"><span class="pre">vendoring</span> <span class="pre">sync</span> <span class="pre">.</span> <span class="pre">-v</span></code> (requires <code class="docutils literal notranslate"><span class="pre">vendoring>=0.2.2</span></code>). Tool configuration is done via <code class="docutils literal notranslate"><span class="pre">pyproject.toml</span></code>.</p> <p>To update the vendored library versions, we have a session defined in <code class="docutils literal notranslate"><span class="pre">nox</span></code>. The command to upgrade everything is:</p> <div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">nox</span> <span class="o">-</span><span class="n">s</span> <span class="n">vendoring</span> <span class="o">--</span> <span class="o">--</span><span class="n">upgrade</span><span class="o">-</span><span class="nb">all</span> <span class="o">--</span><span class="n">skip</span> <span class="n">urllib3</span> <span class="o">--</span><span class="n">skip</span> <span class="n">setuptools</span> </pre></div> </div> <p>At the time of writing (April 2025) we do not upgrade <code class="docutils literal notranslate"><span class="pre">urllib3</span></code> because the next version is a major upgrade and will be handled as an independent PR. We also do not upgrade <code class="docutils literal notranslate"><span class="pre">setuptools</span></code>, because we only rely on <code class="docutils literal notranslate"><span class="pre">pkg_resources</span></code>, and tracking every <code class="docutils literal notranslate"><span class="pre">setuptools</span></code> change is unnecessary for our needs.</p> </section> <section id="managing-local-patches"> <h2>Managing Local Patches<a class="headerlink" href="#managing-local-patches" title="Link to this heading">¶</a></h2> <p>The <code class="docutils literal notranslate"><span class="pre">vendoring</span></code> tool automatically applies our local patches, but updating, the patches sometimes no longer apply cleanly. In that case, the update will fail. To resolve this, take the following steps:</p> <ol class="arabic simple"> <li><p>Revert any incomplete changes in the revendoring branch, to ensure you have a clean starting point.</p></li> <li><p>Run the revendoring of the library with a problem again: <code class="docutils literal notranslate"><span class="pre">nox</span> <span class="pre">-s</span> <span class="pre">vendoring</span> <span class="pre">--</span> <span class="pre">--upgrade</span> <span class="pre"><library_name></span></code>.</p></li> <li><p>This will fail again, but you will have the original source in your working directory. Review the existing patch against the source, and modify the patch to reflect the new version of the source. If you <code class="docutils literal notranslate"><span class="pre">git</span> <span class="pre">add</span></code> the changes the vendoring made, you can modify the source to reflect the patch file and then generate a new patch with <code class="docutils literal notranslate"><span class="pre">git</span> <span class="pre">diff</span></code>.</p></li> <li><p>Now, revert everything <em>except</em> the patch file changes. Leave the modified patch file unstaged but saved in the working tree.</p></li> <li><p>Re-run the vendoring. This time, it should pick up the changed patch file and apply it cleanly. The patch file changes will be committed along with the revendoring, so the new commit should be ready to test and publish as a PR.</p></li> </ol> </section> <section id="debundling"> <h2>Debundling<a class="headerlink" href="#debundling" title="Link to this heading">¶</a></h2> <p>As mentioned in the rationale, we, the pip team, would prefer it if pip was not debundled (other than optionally <code class="docutils literal notranslate"><span class="pre">pip/_vendor/requests/cacert.pem</span></code>) and that pip was left intact. However, if you insist on doing so, we have a semi-supported method (that we don’t test in our CI) and requires a bit of extra work on your end in order to solve the problems described above.</p> <ol class="arabic simple"> <li><p>Delete everything in <code class="docutils literal notranslate"><span class="pre">pip/_vendor/</span></code> <strong>except</strong> for <code class="docutils literal notranslate"><span class="pre">pip/_vendor/__init__.py</span></code> and <code class="docutils literal notranslate"><span class="pre">pip/_vendor/vendor.txt</span></code>.</p></li> <li><p>Generate wheels for each of pip’s dependencies (and any of their dependencies) using your patched copies of these libraries. These must be placed somewhere on the filesystem that pip can access (<code class="docutils literal notranslate"><span class="pre">pip/_vendor</span></code> is the default assumption).</p></li> <li><p>Modify <code class="docutils literal notranslate"><span class="pre">pip/_vendor/__init__.py</span></code> so that the <code class="docutils literal notranslate"><span class="pre">DEBUNDLED</span></code> variable is <code class="docutils literal notranslate"><span class="pre">True</span></code>.</p></li> <li><p>Upon installation, the <code class="docutils literal notranslate"><span class="pre">INSTALLER</span></code> file in pip’s own <code class="docutils literal notranslate"><span class="pre">dist-info</span></code> directory should be set to something other than <code class="docutils literal notranslate"><span class="pre">pip</span></code>, so that pip can detect that it wasn’t installed using itself.</p></li> <li><p><em>(optional)</em> If you’ve placed the wheels in a location other than <code class="docutils literal notranslate"><span class="pre">pip/_vendor/</span></code>, then modify <code class="docutils literal notranslate"><span class="pre">pip/_vendor/__init__.py</span></code> so that the <code class="docutils literal notranslate"><span class="pre">WHEEL_DIR</span></code> variable points to the location you’ve placed them.</p></li> <li><p><em>(optional)</em> Update the <code class="docutils literal notranslate"><span class="pre">pip_self_version_check</span></code> logic to use the appropriate logic for determining the latest available version of pip and prompt the user with the correct upgrade message.</p></li> </ol> <p>Note that partial debundling is <strong>NOT</strong> supported. You need to prepare wheels for all dependencies for successful debundling.</p> </section> </section> </article> </div> <footer> <div class="related-pages"> <a class="next-page" href="../ux-research-design/index.html"> <div class="page-info"> <div class="context"> <span>Next</span> </div> <div class="title">UX Research & Design</div> </div> <svg class="furo-related-icon"><use href="#svg-arrow-right"></use></svg> </a> <a class="prev-page" href="release-process.html"> <svg class="furo-related-icon"><use href="#svg-arrow-right"></use></svg> <div class="page-info"> <div class="context"> <span>Previous</span> </div> <div class="title">Release process</div> </div> </a> </div> <div class="bottom-of-page"> <div class="left-details"> <div class="copyright"> <a href="../copyright.html">Copyright</a> © The pip developers </div> Made with <a href="https://www.sphinx-doc.org/">Sphinx</a> and <a class="muted-link" href="https://pradyunsg.me">@pradyunsg</a>'s <a href="https://github.com/pradyunsg/furo">Furo</a> </div> <div class="right-details"> </div> </div> </footer> </div> <aside class="toc-drawer"> <div class="toc-sticky toc-scroll"> <div class="toc-title-container"> <span class="toc-title"> On this page </span> </div> <div class="toc-tree-container"> <div class="toc-tree"> <ul> <li><a class="reference internal" href="#">Vendoring Policy</a><ul> <li><a class="reference internal" href="#rationale">Rationale</a></li> <li><a class="reference internal" href="#modifications">Modifications</a></li> <li><a class="reference internal" href="#automatic-vendoring">Automatic Vendoring</a></li> <li><a class="reference internal" href="#managing-local-patches">Managing Local Patches</a></li> <li><a class="reference internal" href="#debundling">Debundling</a></li> </ul> </li> </ul> </div> </div> </div> </aside> </div> </div><script src="../_static/documentation_options.js?v=22103397"></script> <script src="../_static/doctools.js?v=9bcbadda"></script> <script src="../_static/sphinx_highlight.js?v=dc90522c"></script> <script type="module" src="../_static/scripts/furo.js?v=d32f1409"></script> <script src="../_static/clipboard.min.js?v=66b4909c"></script> <script src="../_static/copybutton.js?v=80126f2a"></script> <script src="../_static/tabs.js?v=3ee01567"></script> </body> </html>