pass thru --uploaded-prior-to on Pip v26.0 by cburroughs · Pull Request #3131 · pex-tool/pex

cburroughs · 2026-03-27T20:09:37Z

Pip 26.0 adds support for --uploaded-prior-to for filtering packages by their upload time to an index. See
https://pip.pypa.io/en/stable/user_guide/#filtering-by-upload-time for details.

This change passes through --uploaded-prior-to on recent enough Pip versions, and emits a warning on older ones.

NOTE: When Pip is building an sdist, this setting also applies to build dependencies and it is thus easy when using far-in-the-past values to end up in a tangle of incompatible Python/setuptools versions. This is out of Pex's control, but might be the first thing you hit if you are like me and reach for old cowsay versions right away.

closes #3128

Pip 26.0 adds support for --uploaded-prior-to for filtering packages by their upload time to an index. See <https://pip.pypa.io/en/stable/user_guide/#filtering-by-upload-time> for details. This change passes through --uploaded-prior-to on recent enough Pip versions, and emits a warning on older ones. NOTE: When Pip is building an sdist, this setting also applies to build dependencies and it is thus easy when using far-in-the-past values to end up in a tangle of incompatible Python/setuptools versions. This is out of Pex's control, but might be the first thing you hit if you are like me and reach for old `cowsay` versions right away. closes pex-tool#3128

jsirois

Thanks @cburroughs! I expect you'll get test failures. You should be able to ./duvrc.sh test-py27-integration ... to test older versions assuming you have docker installed. If you happen to have old pythons installed, then just uv run dev-cmd test-py27-integration ... will do it of course. This is how I generally attack 1st, but I have all the old interpreter versions installed locally.

Please also bump pex/version.py to 2.92.0 and add a CHANGES.md entry. I'll release this as soon as it's green.

jsirois · 2026-03-27T20:36:56Z

tests/integration/cli/commands/test_lock_uploaded_prior_to.py

+        "--pip-version",
+        "26.0",


I assume this will fail on the py27 and py38 shards. I'd think you'd need a @pytest.mark.skipif and an appropriate condition guarding this test and the test below.

Aha, even fails on new Pythons:

pip: ERROR: Index http://127.0.0.1:49291/root/pypi/+simple/cowsay/ does not provide upload-time metadata.

N.B.: I use --devpi for tests by default for less flake / better netizen. You can bypass this in a test with one of these approaches:

pex/tests/integration/test_keyring_support.py

Lines 171 to 181 in 093dc1b

@pytest.fixture

def devpi_clean_env():

# type: () -> Mapping[str, Any]

# These will be set when tests are run with --devpi, and we want to unset them to

# ensure our Pex command line config above is what is used.

return dict(

_PEX_USE_PIP_CONFIG=None,

PIP_INDEX_URL=None,

PIP_TRUSTED_HOST=None,

)

pex/tests/integration/test_discussion_2979.py

Lines 310 to 313 in cc11c8e

# This test has problems completing its resolve just using --devpi, so we ensure PyPI is

# also used.

"--use-pip-config",

env=make_env(PIP_EXTRA_INDEX_URL=PYPI),

And the devpi support is an open issue: devpi/devpi#1061

jsirois · 2026-03-27T20:38:34Z

tests/integration/cli/commands/test_lock_uploaded_prior_to.py

+    assert Version("6.0") == locked_resolve.locked_requirements[0].pin.version
+
+
+def test_uploaded_prior_to_far_future_allows_latest(tmpdir):


Why? I'm not seeing how this tests your Pex integration. It seems to test Pip.

jsirois · 2026-03-27T20:39:28Z

tests/resolve/test_resolver_options.py

    assert [] == mac_scoped_repos.in_scope_find_links(ProjectName("torch"))
+
+
+def test_resolver_uploaded_prior_to_passthru(parser):


This is fine, but I view unit tests as useless in the best case, and detrimental to refactors in the worst when you have an IT that covers like you do.

jsirois · 2026-03-27T20:53:03Z

pex/pip/tool.py

+                warn_msg = (
+                    "The `--uploaded-prior-to` was set but Pip v{THIS_VERSION} "
+                    "does not support the `--uploaded-prior-to` option (which "
+                    "is only available in Pip v{VERSION_26_0} and later "
+                    "versions).  Consequently, Pex is ignoring the "
+                    "`--uploaded-prior-to` option for this particular Pip "
+                    "invocation.".format(
+                        THIS_VERSION=version,
+                        VERSION_26_0=PipVersion.v26_0,
+                    )
+                )
+                pex_warnings.warn(warn_msg)


@cburroughs does the hard error on Pip's part when --uploaded-prior-to metadata is not available from the index suggest your warning should be an error as well? I meant to note this earlier in the review, but the Pip error prompts me to re-consider this. Can you think of a good + real reason to not hard error?. Hard errors are nice because you can relax them later and not break anyone. The reverse is not true, and I'm bound by Pex ethics to never break anyone.

cburroughs self-assigned this Mar 27, 2026

jsirois approved these changes Mar 27, 2026

View reviewed changes

jsirois reviewed Mar 27, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

pass thru --uploaded-prior-to on Pip v26.0#3131

pass thru --uploaded-prior-to on Pip v26.0#3131
cburroughs wants to merge 1 commit intopex-tool:mainfrom
cburroughs:csb/uploaded-prior-to

cburroughs commented Mar 27, 2026

Uh oh!

jsirois left a comment •

edited

Loading

Uh oh!

jsirois Mar 27, 2026

Uh oh!

jsirois Mar 27, 2026 •

edited

Loading

Uh oh!

jsirois Mar 27, 2026

Uh oh!

jsirois Mar 27, 2026

Uh oh!

jsirois Mar 27, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	@pytest.fixture
	def devpi_clean_env():
	# type: () -> Mapping[str, Any]

	# These will be set when tests are run with --devpi, and we want to unset them to
	# ensure our Pex command line config above is what is used.
	return dict(
	_PEX_USE_PIP_CONFIG=None,
	PIP_INDEX_URL=None,
	PIP_TRUSTED_HOST=None,
	)

	# This test has problems completing its resolve just using --devpi, so we ensure PyPI is
	# also used.
	"--use-pip-config",
	env=make_env(PIP_EXTRA_INDEX_URL=PYPI),

		assert Version("6.0") == locked_resolve.locked_requirements[0].pin.version


		def test_uploaded_prior_to_far_future_allows_latest(tmpdir):

		assert [] == mac_scoped_repos.in_scope_find_links(ProjectName("torch"))


		def test_resolver_uploaded_prior_to_passthru(parser):

Uh oh!

Conversation

cburroughs commented Mar 27, 2026

Uh oh!

jsirois left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jsirois Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

jsirois Mar 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jsirois Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

jsirois Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

jsirois Mar 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jsirois left a comment •

edited

Loading

jsirois Mar 27, 2026 •

edited

Loading

jsirois Mar 27, 2026 •

edited

Loading