{"slug": "pip", "name": "pip", "category": "dev-libs", "category_name": "Libraries and frameworks", "description": "", "recommenders": 1, "commenters": 9, "warners": 5, "score": -2.69, "rising": -0.33, "first": "2025-11-29", "latest": "2026-10-22", "why": "a new hot package manager comes around that basically does nothing better then pip", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 1, "neutral": 3, "compare": 0, "warn": 5}, "spark": [0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0], "listed": false, "loved": [], "caveat": "", "short_quote": "a new hot package manager comes around that basically does nothing better then pip", "icon": false, "domain": null, "github_repo": null, "official_url": "", "pricing": "", "aliases": ["pip"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 763473184, "item_id": 47717074, "url": "https://news.ycombinator.com/item?id=47717074", "by": "evill33t", "date": "2026-04-10", "stance": "recommend", "quote": "a new hot package manager comes around that basically does nothing better then pip", "excerpt": "Because every few month a new hot package manager comes around that basically does nothing better then pip - the acclaimed 10x more speed doesn't really matter for installing dependencies and why should we use something that's not even written in python?", "context": "", "use_case": "Python dependency installation", "switched_from": "", "story": "Why Aren't We Uv Yet?"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 803041969, "item_id": 50190123, "url": "https://news.ycombinator.com/item?id=50190123", "by": "joshheitzman", "date": "2026-10-22", "stance": "warn", "quote": "Seems like pip doesn't have a way to exclude packages", "excerpt": "Seems like pip doesn't have a way to exclude packages although it was requested at least once: https://github.com/pypa/pip/issues/10797 Just checked if litellm crept in with any packages I installed recently. Fortunately it didn't, but I'm working on an OSS AI agent harness so its certainly a concern and I'd like just flatout block litellm so I don't have to worry about picking it up as transitive dependency. Guess I", "context": "", "use_case": "Python package installation", "switched_from": "", "story": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor"}, {"id": 775644770, "item_id": 48477798, "url": "https://news.ycombinator.com/item?id=48477798", "by": "cookiengineer", "date": "2026-06-10", "stance": "warn", "quote": "they will happily execute the malware payloads on install", "excerpt": "> \"cd folder\" does nothing. That's like recommending to use the xterm on Windows. Statistically, nobody uses their computer that way anymore. The world has moved on since the 1990s. I was only not affected because I use a heavily customized VIM, but even there can I not control how package managers like npm, pip or composer or go are behaving, because they will happily execute the malware payloads on install. And tim", "context": "", "use_case": "package management", "switched_from": "", "story": "Microsoft's open source tools were hacked to steal passwords of AI developers"}, {"id": 759360961, "item_id": 47460060, "url": "https://news.ycombinator.com/item?id=47460060", "by": "ghshephard", "date": "2026-03-20", "stance": "warn", "quote": "constant issues with pip/virtualenvwrappers", "excerpt": "All of them (well - no HPUX in 15+ years, and I've never used uv in Solaris, or AIX) - but the major two client side environments that I use 'uv' in would be WSL2+Ubuntu/ext4 (work) and macOS/APFS at home. But - neither the speed nor constant issues with pip/virtualenvwrappers are really a function of the OS/File System. A frequent theme in this thread (probably most clearly described in https://news.ycombinator.com/", "context": "", "use_case": "Python package management", "switched_from": "", "story": "Astral to Join OpenAI"}, {"id": 741260784, "item_id": 46328799, "url": "https://news.ycombinator.com/item?id=46328799", "by": "zahlman", "date": "2025-12-19", "stance": "warn", "quote": "(They're usually pip's fault. Pip is bad.)", "excerpt": "> I just always feel frustrated, that during the great breakup from 2-3, they didn't try to fix more of the known issues Absolutely agreed. I would rather they left 2.x in someone else's hands entirely. Instead they were ultimately forced to produce 2.7, wheedle and bargain to not have to produce 2.8, and give 2.7 an extended support window instead; and they still got complaints and abuse from people upset about maki", "context": "", "use_case": "Python package installation", "switched_from": "", "story": "Breaking Changes in Python-3.14"}]}], "who": [], "tags": [], "use_cases": ["python package management", "python package installation", "installing python dependencies", "package management", "python dependency installation"], "compared": [{"slug": "uv", "name": "uv", "co": 17, "switched_from": 0, "switched_to": 5}, {"slug": "poetry", "name": "Poetry", "co": 5, "switched_from": 0, "switched_to": 0}, {"slug": "claude", "name": "Claude", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "conda", "name": "Conda", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=50192900", "title": "CVE-2026-111943: Compromised Intermediate Certificate Authority", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=50181114", "title": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49506142", "title": "uv: Deduplicate all files in the wheel cache", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48457830", "title": "Microsoft's open source tools were hacked to steal passwords of AI developers", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47716778", "title": "Why Aren't We Uv Yet?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47438723", "title": "Astral to Join OpenAI", "mentions": 1}], "sentiment_by_month": {"2025-11": {"warn": 1}, "2025-12": {"warn": 1, "neutral": 1}, "2026-01": {}, "2026-02": {}, "2026-03": {"warn": 1}, "2026-04": {"recommend": 1}, "2026-05": {}, "2026-06": {"warn": 1}, "2026-07": {}, "2026-08": {"neutral": 1}, "2026-09": {}, "2026-10": {"warn": 1, "neutral": 1}}, "quotes": [{"id": 803118128, "item_id": 50194883, "url": "https://news.ycombinator.com/item?id=50194883", "by": "jrmg", "date": "2026-10-22", "stance": "neutral", "quote": "Yes, I use all these things", "excerpt": "And since before that, when we started turning to additional packages managers installed with package managers. Pip etc. mean that an \u201capt upgrade\u201d isn\u2019t enough, when it really \u201cshould\u201d be (used to be) in a well managed system. Then we layered _another_ level of package management on top with Flatpak etc. I don\u2019t think anyone has _really_ been - in practice - able to understand how many versions of Python (or shells ", "context": "", "use_case": "Python package management", "switched_from": "", "story": "CVE-2026-111943: Compromised Intermediate Certificate Authority"}, {"id": 803041969, "item_id": 50190123, "url": "https://news.ycombinator.com/item?id=50190123", "by": "joshheitzman", "date": "2026-10-22", "stance": "warn", "quote": "Seems like pip doesn't have a way to exclude packages", "excerpt": "Seems like pip doesn't have a way to exclude packages although it was requested at least once: https://github.com/pypa/pip/issues/10797 Just checked if litellm crept in with any packages I installed recently. Fortunately it didn't, but I'm working on an OSS AI agent harness so its certainly a concern and I'd like just flatout block litellm so I don't have to worry about picking it up as transitive dependency. Guess I", "context": "", "use_case": "Python package installation", "switched_from": "", "story": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor"}, {"id": 792156657, "item_id": 49509791, "url": "https://news.ycombinator.com/item?id=49509791", "by": "apple1417", "date": "2026-08-31", "stance": "neutral", "quote": "the worst number they ever give for pip is 7s", "excerpt": "I have never gotten the speed argument either. Yes it's noticeably faster - but in all my projects it's 1s vs 0.1s, not enough to make a meaningful difference. Even in their benchmarks, the worst number they ever give for pip is 7s [1] (and those numbers are 2+ years old, with python's improvements pip should be doing a little better now). I just can't say I've ever cared about installing dependencies, something you ", "context": "", "use_case": "installing Python dependencies", "switched_from": "", "story": "uv: Deduplicate all files in the wheel cache"}, {"id": 775644770, "item_id": 48477798, "url": "https://news.ycombinator.com/item?id=48477798", "by": "cookiengineer", "date": "2026-06-10", "stance": "warn", "quote": "they will happily execute the malware payloads on install", "excerpt": "> \"cd folder\" does nothing. That's like recommending to use the xterm on Windows. Statistically, nobody uses their computer that way anymore. The world has moved on since the 1990s. I was only not affected because I use a heavily customized VIM, but even there can I not control how package managers like npm, pip or composer or go are behaving, because they will happily execute the malware payloads on install. And tim", "context": "", "use_case": "package management", "switched_from": "", "story": "Microsoft's open source tools were hacked to steal passwords of AI developers"}, {"id": 763473184, "item_id": 47717074, "url": "https://news.ycombinator.com/item?id=47717074", "by": "evill33t", "date": "2026-04-10", "stance": "recommend", "quote": "a new hot package manager comes around that basically does nothing better then pip", "excerpt": "Because every few month a new hot package manager comes around that basically does nothing better then pip - the acclaimed 10x more speed doesn't really matter for installing dependencies and why should we use something that's not even written in python?", "context": "", "use_case": "Python dependency installation", "switched_from": "", "story": "Why Aren't We Uv Yet?"}, {"id": 759360961, "item_id": 47460060, "url": "https://news.ycombinator.com/item?id=47460060", "by": "ghshephard", "date": "2026-03-20", "stance": "warn", "quote": "constant issues with pip/virtualenvwrappers", "excerpt": "All of them (well - no HPUX in 15+ years, and I've never used uv in Solaris, or AIX) - but the major two client side environments that I use 'uv' in would be WSL2+Ubuntu/ext4 (work) and macOS/APFS at home. But - neither the speed nor constant issues with pip/virtualenvwrappers are really a function of the OS/File System. A frequent theme in this thread (probably most clearly described in https://news.ycombinator.com/", "context": "", "use_case": "Python package management", "switched_from": "", "story": "Astral to Join OpenAI"}, {"id": 742351393, "item_id": 46396962, "url": "https://news.ycombinator.com/item?id=46396962", "by": "w10-1", "date": "2025-12-26", "stance": "neutral", "quote": "What I don't like about uv (or pip or many other package managers)", "excerpt": "I like the implication that we can have an alternative to uv speed-wise, but I think reliability and understandability are more important in this context (so this comment is a bit off-topic). What I want from a package manager is that it just works. That's what I mostly like about uv. Many of the changes that made speed possible were to reduce the complexity and thus the likelihood of things not working. What I don't", "context": "", "use_case": "Python package management", "switched_from": "", "story": "How uv got so fast"}, {"id": 741260784, "item_id": 46328799, "url": "https://news.ycombinator.com/item?id=46328799", "by": "zahlman", "date": "2025-12-19", "stance": "warn", "quote": "(They're usually pip's fault. Pip is bad.)", "excerpt": "> I just always feel frustrated, that during the great breakup from 2-3, they didn't try to fix more of the known issues Absolutely agreed. I would rather they left 2.x in someone else's hands entirely. Instead they were ultimately forced to produce 2.7, wheedle and bargain to not have to produce 2.8, and give 2.7 an extended support window instead; and they still got complaints and abuse from people upset about maki", "context": "", "use_case": "Python package installation", "switched_from": "", "story": "Breaking Changes in Python-3.14"}, {"id": 737447248, "item_id": 46090453, "url": "https://news.ycombinator.com/item?id=46090453", "by": "kgwxd", "date": "2025-11-29", "stance": "warn", "quote": "That environment and pip stuff is terrible.", "excerpt": "I tried learning Python recently to move away from .NET. Wish I hadn't spent so much time reading about the language before actually trying to do a real world project. That environment and pip stuff is terrible. Where did they get the idea to do that? No other language I've come across has tooling that ridiculous. I switched to Go instead.", "context": "moving away from .NET", "use_case": "Python package management", "switched_from": "", "story": "Xkcd: Python Environment (2018)"}]}