PyPI Now Supports Project Archival

Support for marking projects as archived has landed on PyPI. Maintainers can nowarchive a project to let users know that the project is not expected to receiveany more updates.

This allows users to make better decisions about which packages they depend on,especially regarding supply-chain security, since archived projects clearlysignal that no future security fixes or maintenance should be expected.

Project archival is not deletion: archiving a project does not remove it fromthe index, and does not prevent users from installing it. Archival is purelya

user-controlled marker that gives project owners the ability to signal aproject’s status; PyPI has no plans to delete or prune archived distributions.

Support for archival is built on top of the project quarantine feature. Readmore about that feature in PyPI’s December 2024 blogpost. You can also findmore details about the project archival’s implementation on the Trail of Bitsblog.

Archiving a project

Owners of a project can archive it by navigating to the project’s settings pageand scrolling down near the end to the following section:

As described in the warning message, archiving prevents new uploads to theproject. After archiving the project, users will see the following notice in theproject’s main PyPI page:

Maintainers are encouraged to make a final release before archiving, updatingthe project’s description with more context about the archival.

Finally, the project owners can always unarchive a project if needed.

Stay tuned

Project archival is the first step in a larger project, aimed at improving thelifecycle of projects on PyPI. That project includes evaluating additionalproject statuses (things like “deprecated” and “unmaintained”), as well aschanges to PyPI’s public APIs that will enableclients to retrieve and act on project status information. You can track ourprogress on these fronts by following along withwarehouse#16844!

Acknowledgements

This feature was developed by Trail of Bits. Wewould like to thank the PyPI admins and maintainers, including MikeFiedler and DustinIngram, for their time and consideration throughout thedesign and development process.

The funding for this feature’s development comes fromAlpha-Omega. Alpha-Omega’s mission is to protectsociety by catalyzing sustainable security improvements to the most criticalopen-source software projects and ecosystems.