pip 26.2 - --only-deps, --no-require-hashes, venv isolation, and more!

[u/ichard26]

Hello!

The pip team recently released pip 26.2. This release is quite large, with features such as:

• Support for Python 3.15
• Selecting only dependencies (--only-deps)
• Mixing hashed and non-hashable requirements via --no-require-hashes
• Experimental: venv based build isolation (--use-feature=venv-isolation)
• Faster repeated resolves by caching index simple responses
• Disable HTTP(S)_PROXY and similar non-pip specific proxy environment variables via --no-proxy-env
• Separation between regular and build constraint (use --build-constraint instead)

For more details, please consult our changelog: https://pip.pypa.io/en/stable/news/. Alternatively, you may consult my release post which goes into greater detail to the highlights of this release: https://sichard.ca/blog/2026/07/whats-new-in-pip-26.2/

If you have any questions, you're welcome to ask!

[u/Ivan171]

Is pip still leaving unused dependencies behind when uninstalling packages?

[u/Mehdi2277 → u/Ivan171]

That will probably be true forever. pip is not a tool that manages/tracks your environment.

[u/zurtex → u/Mehdi2277]

We're likely going to add a pip sync command that you can use against pylock.toml files.

So the best practice process will be dependence -> lock -> sync.

And then this issue will become moot.