Mailman 3 - PyPA-Committers

VOTE: PEP 772 - Packaging Council governance process
by Pradyun Gedam April 14, 2026

April 14, 2026

Hi all! I'm very excited to open the vote for endorsing the acceptance of PEP 772 - Packaging Council governance process <https://peps.python.org/pep-0772/>. This proposal was seconded by @dstufft here <https://discuss.python.org/t/pep-772-packaging-council-governance-process-r…> . This idea has been discussed over the last few years, and the PEP itself has been in discussion for over a year. It has also been approved by the PSF board (as outlined in the appendix, with the corresponding text changes in place as well). Best, Pradyun

33 32

Request to enable GitHub Security Advisories (GHSA) for relevant repositories
by Seth Larson April 10, 2026

April 10, 2026

Hey folks, Can I ask everyone who is hosting their project on GitHub and is an admin of a PyPA project to enable the "Private Vulnerability Reporting <https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabili…>" feature if they don't already have a security reporting process? (Settings > Advanced Security > Private Vulnerability Reporting) This feature is a ticketing system, so you can take your time with reports without them falling through the cracks and collaborate with others more easily. I am happy to be added to GHSAs as a collaborator (@sethmlarson) if you need a second opinion or are unsure how the feature works. Also happy to answer questions about the feature. Thank you, Seth Larson

1 0

VOTE: Moving pip-tools to PyPA
by Sviatoslav Sydorenko April 6, 2026

April 6, 2026

Hi PyPA committers, I'd like to open a vote on transferring pip-tools to the PyPA GitHub org: https://github.com/jazzband/pip-tools This is a project that provides a way to generate constraint files and manage virtualenv pins. Sometimes, I call it "an early DIY lock files" implementation. It's used by Dependabot to upgrade requirement/constraint files and is a prior art for what's reimplemented in uv. It's spent most of its life in the Jazzband collaborative maintenance organisation that is getting shut down this year[1]. And so, naturally we're looking for a new home[2]. Since both Stephen and I (webknjaz and sirosen — the current project leads) are already a part of PyPA and it is a tool of the packaging realm, we feel it's a good idea to keep maintaining the project under the familiar umbrella. -- Warm regards, Sviatoslav Sydorenko [1]: https://github.com/jazzband/pip-tools/discussions/2353 [2]: https://jazzband.co/news/2026/03/14/sunsetting-jazzband

19 25

VOTE: adding pypi-publish to PyPA on GitLab
by William Woodruff April 2, 2026

April 2, 2026

Hi PyPA committers, I'd like to open a vote on transferring pypi-publish to the PyPA GitLab org (*not* GitHub): https://gitlab.com/trailofbits/pypi-publish For a bit of context: pypi-publish is a GitLab "component", which is roughly analogous to a GitHub Action. Trail of Bits has created this component as a way to streamline GitLab usage of Trusted Publishing and attestations, similar to how pypa/gh-action-pypi-publish has streamlined usage of both on GitHub. If accepted, I would be a primary maintainer on pypi-publish, along with my co-maintainer and colleague Facundo Tuesca (@facutuesca on both GitHub and GitLab). Separately, the astute observer will note that PyPA doesn't have an official GitLab org yet. Ee is currently working on having gitlab.com/pypa released to the PyPA, but in the meantime there's a "holding pattern" organization with a subgroup for PyPA here: https://gitlab.com/python-software-foundation https://gitlab.com/python-software-foundation/pypa Best, William Woodruff

13 19

Adding new maintainers without PyPA owners
by Bernat Gabor March 30, 2026

March 30, 2026

Hey per https://www.pypa.io/en/latest/members/#individual-membership project maintainers should be allowed to add additional maintainers without needing owner input. This seems impossible today for two reasons: - I can't add someone to this e-mail list, - I can only add users to the maintainers group who are already part of the PyPA. [image: image.png] What am I missing here? Is the pypa document written in a way that's not possible to operate? Is also unclear per that document what channel one should communicate with admins. Thanks!

11 22

RFC: amending PyPA governance to permit for use of PyPA funds
by Richard Si March 23, 2026

March 23, 2026

Hi all, If you don't know who I am. I've been a committer of the pip project since 2025 and a PyPA member for even longer through bandersnatch. As you likely know, PyPA is a fiscal sponsoree of the Python Software Foundation. This enables the PyPA to collect donations through the PSF. However, even with PEP 609 accepted, there is no established process to allow the PyPA to *use* any of its funds. Over the years, the PyPA has collected funds from GitHub Sponsors, Tidelift, and thanks.dev. Some of the Tidelift revenue is routed to the individual project maintainers as per existing agreements, but otherwise, our funds are mostly sitting unused. PSF Accounting is unfortunately behind on our books, but as of March 31, 2025, the PyPA has ~63,000 USD in net assets. Our yearly revenues have fluctuated over the years, so it's hard to estimate, but on the *low* end, it seems like we're taking in ~6000 USD after current expenses. For context, the pip project is exploring the possibility of using PyPA funds to sponsor part-time contract development on pip. For this to be even administratively possible though, we need a mechanism for the PyPA to vote on whether to use its own money. While I'd prefer to keep the pip proposal under wraps until it is ready for feedback, I will share some details with y'all in the PyPA since it's relevant to the proposed amendment: - Sponsor me to work on pip on a contract part-time basis in Q3 2026 - ~1750 USD (or ~2400 CAD) over 11 weeks for 110 hours - I will work on a handful of high-value features and bugfixes, including - Improving pip's build isolation to use real virtual environments - Progress towards removing the legacy resolver (the original grant for the new resolver didn't result in the removal of the legacy resolver) - Improved errors - This will need to be investigated more carefully first, but likely work on configurable Index URL priority and a way to request --only-deps for a local project - General pip maintenance and development, modelled after the CPython DIR program The exact details are subject to change. (Yes, I know this mailing list is public. I'm just trying to not promise the world, i.e. DPO, everything when it's very possible that the pip proposal will fail at the pip core team stage.) I've thus drafted an amendment to PEP 609 that allows for votes on the use of PyPA funds. It's worth noting that under the fiscal sponsorship agreement, all disbursements are subject to final approval by the PSF. Since this is the first major amendment to PyPA's governance since the adoption of PEP 609, I thought I'd raise this for discussion before putting this amendment to a formal PyPA-committer vote. The details and discussion can be found on DPO: https://discuss.python.org/t/amending-pypa-governance-to-permit-for-use-of-… <https://discuss.python.org/t/amending-pypa-governance-to-permit-for-use-of-…> Your comments and feedback would be appreciated. *I ask that you send any replies to the DPO thread to avoid fragmenting the discussion.* All the best, *Richard Si *(he/him) GitHub: @ichard26

1 0

[Important] PSF Fiscal Sponsorees - Ongoing Communications Support & Info
by Marie Nordin Feb. 26, 2026

Feb. 26, 2026

Greetings, My name is Marie Nordin, and I work at the PSF as our Community Communications Manager. As you are most likely aware, the PSF Staff roster has shifted, so we’re working to ensure continuity in our support of PSF Fiscal Sponsorees. I’m reaching out to formally introduce myself and establish a direct line of contact so the PSF can effectively support your organization with communications. I’m looking forward to working with you to improve our communications and support for PSF Fiscal Sponsorees! If there is a direct contact for PyPA related communications, please let me know. Scope To get into a little more detail, the areas I expect us to collaborate on will include: - Quarterly check ins to gather your organization’s latest news to include in the PSF’s quarterly newsletter - A yearly check in to gather images or content for the PSF’s Annual Impact Report - Requests from your organization to share key social media posts (the PSF is currently active on LinkedIn, Bluesky, Mastodon, and X) - Improving our storytelling and promotion around the PSF’s Fiscal Sponsorees during our year-end fundraiser - Anything related to Fiscal Sponsoree participation at the PSF Booth at PyCon US Please note: I will not be your contact for anything accounting related. Please continue to email accounting(a)python.org for your accounting needs and inquiries. Mailing List We have set up a PSF Fiscal Sponsoree mailing list so I can send calls for content for the regular items I mentioned above (newsletter and annual impact report). The additional goal of the mailing list is to enable PSF Fiscal Sponsoree groups to communicate across organizations to help support knowledge-sharing and best practices (e.g. what sticker vendor is best, or what tools are organizations using to accomplish XYZ). Please request a subscription to the mailing list (ideally with an email address domain associated with your organization): https://mail.python.org/mailman3/lists/psf-fiscal-sponsorees.python.org/ You are welcome to share the mailing list invite with any co-organizers of your group. While it is not a requirement to subscribe, I would urge any group that wants to share content through the PSF newsletter or the PSF Annual Impact Report to have at least one individual subscribe. Annual Impact Report I have kicked off coordination of the PSF’s 2025 Annual Impact Report and would like to invite your organization to share images to be included in the report. This request is mostly relevant to organizations that run events or meetups, but if you have an idea for other types of content to include, please feel welcome to pitch it. Please share the images via response to this email or drop them in this google drive folder <https://drive.google.com/drive/folders/1hmsnK9klM09wZdCIdRnP_VL9D612wFzf?us…> with a clear title. Make sure to share any photographer credits that should be included with me, as well. The deadline for content is February 13th, 2026. Future calls for content for our annual impact reports will be sent via the psf-fiscal-sponsorees mailing list. Questions? As we work on evolving our support for our Fiscal Sponsorees, I am guessing questions may arise. Feel free to respond with any of your questions, and be sure to include Deb Nicholson (cc’ed here, deb(a)python.org). Cheers! Marie -- Marie Nordin Community Communications Manager Python Software Foundation <https://www.python.org/psf-landing/> she/her -- Marie Nordin Community Communications Manager Python Software Foundation <https://www.python.org/psf-landing/> she/her

2 2

[PROPOSAL] Adding Jacob Coffee (PSF) as Owner of the PyPA GitHub Organization
by Ee Durbin Feb. 3, 2026

Feb. 3, 2026

Hello PyPA! I’d like to propose that the PyPA add Jacob Coffee, Infrastructure Engineer at the Python Software Foundation, as an Owner of the PyPA GitHub Organization. Jacob has been working with me and the PSF for about a year and a half, and has shown an eagerness to support and administer CPython, the PSF, and PyPI. Having a dedicated staff person available to handle various admin tasks is a role that I have fulfilled for a long time! I believe my current Owner role on the org is “de facto” over time, but I am (not in anger) departing the PSF at the end of this week <https://pyfound.blogspot.com/2026/01/ee-departing-the-psf-staff.html>, and will available on a more volunteer basis moving forward. I don’t believe we have a governance structure in PEP 609 regarding GitHub Org Owner rights, but please correct me if I'm wrong. -Ee Durbin

14 14

December PyPA CI/CD Bug-o-Rama
by William Woodruff Nov. 29, 2025

Nov. 29, 2025

Hi PyPA Committers, This is an idea I've been discussing with Seth Larson (PSF SDIR, but who is also a PyPA member and therefore should be on this list). The TL;DR is this: I did an org-wide scan of PyPA using zizmor[1] a few days ago, and there are a couple of thousands of CI/CD findings that would ideally be addressed. Most of these aren't critical (in the sense that they don't pose an immediate risk to the ecosystem), but many are the kinds of latent risks/code injection weaknesses that make campaigns like the one we're currently seeing in npm land easier (with "Shai-Hulud"[2]). Basically, what I would like to do is dedicate some time (and snipe some of Seth's time) for fixing as many of these findings as possible in the month of December. Seth and I would basically do this in the clear: we'd work together and submit public PRs, which other PyPA members (respective owners of projects) would then review and merge. I'm starting this as a thread because this is a nontrivial undertaking, and it's going to involve a lot of public activity/review cycles. So, before I did it, I wanted to gather feedback, namely: 1. Does anybody think we should generally *not* do this? 2. Does anybody prefer we do *not* attempt CI/CD patches on their specific project(s)? If so, we're happy to avoid those projects; we don't want to add additional noise or maintenance burden to anybody who would find it stressful (especially given that it's the holiday season). 3. Finally, would anybody else like to help? I'm interested to hear peoples' thoughts, including frank opinions about whether this kind of mass initiative makes sense -- my approach over the last year has been to send fixes to projects on a one-off basis, but I think a "Bug-o-Rama" session could be really productive for clearing things out in bulk. As a last note, I've started this on-thread because it has a security-sensitive nature -- not one so critical that it needs an embargo or anything like that, but I figured it made sense to solicit thoughts/consensus here first rather than on DPO. However, I'm happy to move to DPO if there's consensus that that's a better venue, given that the work itself will be public as it happens anyways. Best, William (P.S. This is entirely an independent idea -- I'm not representing my employer or any interests other than my own desire to improve the security of the PyPA's projects.) [1]: https://docs.zizmor.sh/ [2]: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack

3 3

FYI Staffing Changes to PSF Accounting Team
by Phyllis Dobbs Sept. 5, 2025

Sept. 5, 2025

Hello, everyone, Laura Graves will be on leave starting in early October and plans to return in late January 2026. While Laura is on leave, we are bringing in a Temporary Staff Accountant named Connor Quilty. He'll begin onboarding with us early next week, so you all can expect to hear from him and see him on Slack and email soon as Laura hands off work. In additional good news for the Accounting Team, the new Finance Manager, Kelly Ragland, formally accepted our offer last night and will start September 22nd! She comes to us from the Colorado School of Mines and has lots of experience including fiscal sponsorees and nonprofit accounting, using CiviCRM, and developing Python scripts to automate reporting for her stakeholders at CSM. *As we make these staffing transitions, please contact accounting(a)python.org <accounting(a)python.org>* instead of team members individually so we can best manage work behind the scenes. Let us know if you have any questions! Sincerely, Phyllis A. Dobbs Controller Python Software Foundation

1 0