Use two-factor auth to improve your PyPI account's security

To increase the security of Python package downloads, we're beginning to introduce two-factor authentication (2FA) as a login security option on the Python Package Index. This is thanks to a grant from the Open Technology Fund; coordinated by the Packaging Working Group of the Python Software Foundation.

Starting today, the canonical Python Package Index at PyPI.org and the test site at test.pypi.org offer 2FA for all users. We encourage project maintainers and owners to log in and go to their Account Settings to add a second factor. This will help improve the security of their PyPI user accounts, and thus reduce the risk of vandals, spammers, and thieves gaining account access.

PyPI's maintainers tested this new feature throughout May and fixed several resulting bug reports; regardless, you might find a new issue. If you find any potential security vulnerabilities, please follow our published security policy. (Please don't report security issues in Warehouse via GitHub, IRC, or mailing lists. Instead, please directly email one or more of our maintainers.) If you find an issue that is not a security vulnerability, please report it via GitHub.

PyPI currently supports a single 2FA method: generating a code through a Time-based One-time Password (TOTP) application. After you set up 2FA on your PyPI account, then you must provide a TOTP (along with your username and password) to log in. Therefore, to use 2FA on PyPI, you'll need to provision an application (usually a mobile phone app) in order to generate authentication codes; see our FAQ for suggestions and pointers.

You'll need to verify your primary email address on your Test PyPI and/or PyPI accounts before setting up 2FA. You can also do that in your Account Settings.

Currently, only TOTP is supported as a 2FA method. Also, 2FA only affects login via the website which safeguards against malicious changes to project ownership, deletion of old releases, and account take overs. Package uploads will continue to work without 2FA codes being provided.

But we're not done! We're currently working on WebAuthn-based multi-factor authentication, which will let you use, for instance, Yubikeys for your second factor. Then we'll add API keys for package upload, then an advanced audit trail of sensitive user actions. More details are in our progress reports.

Thanks to the Open Technology Fund for funding this work. And please sign up for the PyPI Announcement Mailing List for future updates.

Farewell, Python 3.4

It's with a note of sadness that I announce the final retirement of Python 3.4.  The final release was back in March, but I didn't get around to actually closing and deleting the 3.4 branch until this morning.

Python 3.4 introduced many features we all enjoy in modern Python--the asyncio, ensurepip, and enum packages, just to name three.  It's a release I hope we all remember fondly.


My eternal thanks to all the members of the release team that worked on Python 3.4:

Georg Brandl
Julien Palard

Martin von Löwis

Ned Deily
Steve Dower
Terry Reedy

and all the engineers of the Python infrastructure team.

Special thanks to Benjamin Peterson and Ned Deily, who frequently scurried around behind the scenes cleaning up the messes I cluelessly left in my wake.


Having closed 3.4, I am now retired as Python 3.4 Release Manager.  I regret to inform all of you that you're still stuck with me as Python 3.5 Release Manager until sometime next year.

Python 3.8.0a3 is now available for testing

Go get it here:
https://www.python.org/downloads/release/python-380a3/

The most visible change so far is probably the implementation of PEP 572: Assignment Expressions.  For a detailed list of changes, see:
https://docs.python.org/3.8/whatsnew/changelog.html

Python 3.8.0a3 is the third of four planned alpha releases of Python 3.8, the next feature release of Python.  During the alpha phase, Python 3.8 remains under heavy development: additional features will be added and existing features may be modified or deleted.  Please keep in mind that this is a preview release and its use is not recommended for production environments.  The last alpha release, Python 3.8.0a4, is planned for 2019-04-29.

Thanks to all of the many volunteers who help make Python development and these releases possible!  Please consider supporting our efforts by volunteering yourself or through organization contributions to the Python Software Foundation.

Python 3.7.3 is now available

Python 3.7.3 is now available. 3.7.3 is the next maintenance release of Python 3.7, the latest feature release of Python.  You can find the release files, a link to the changelog, and more information here:

    https://www.python.org/downloads/release/python-373/

See the What’s New In Python 3.7 document for more information about the many new features and optimizations included in the 3.7 series.  Detailed information about the changes made in 3.7.3 can be found in its change log.

Thanks to all of the many volunteers who help make Python Development and these releases possible!  Please consider supporting our efforts by volunteering yourself or through organization contributions to the Python Software Foundation.

Python 3.4.10 is now available

Python 3.4.10 is now available.  You can download it here.

Python 3.4.10 is the final release in the Python 3.4 series.  As of this release, the 3.4 branch has been retired, no further changes to 3.4 will be accepted, and no new releases will be made.  This is standard Python policy; Python releases get five years of support and are then retired.

If you're still using Python 3.4, you should consider upgrading to the current version--3.7.2 as of this writing.  Newer versions of Python have many new features, performance improvements, and bug fixes, which should all serve to enhance your Python programming experience.

We in the Python core development community thank you for your interest in 3.4, and we wish you all the best!

Python 3.5.7 is now available

Python 3.5.7 is now available.  You can download Python 3.5.7 here.

Python 3.7.3rc1 is now available for testing

Python 3.7.3rc1 is now available for testing. 3.7.3rc1 is the release preview of the next maintenance release of Python 3.7, the latest feature release of Python. Assuming no critical problems are found prior to 2019-03-25, no code changes are planned between now and the final release. This release candidate is intended to give you the opportunity to test the new security and bug fixes in 3.7.3. We strongly encourage you to test your projects and report issues found to bugs.python.org as soon as possible. Please keep in mind that this is a preview release and, thus, its use is not recommended for production environments.

You can find the release files, a link to the changelog, and more information here:

    https://www.python.org/downloads/release/python-373rc1/