Blog: PyPI in 2025: A Year in Review

https://news.ycombinator.com/rss Hits: 14
Summary

new features organizations security PyPI in 2025: A Year in Review As 2025 comes to a close, it's time to look back at another busy year for the Python Package Index. This year, we've focused on delivering critical security enhancements, rolling out powerful new features for organizations, improving the overall user experience for the millions of developers who rely on PyPI every day, and responding to a number of security incidents with transparency. But first, let's look at some numbers that illustrate the sheer scale of PyPI in 2025: More than 3.9 million new files published More than 130,000 new projects created 1.92 exabytes of total data transferred 2.56 trillion total requests served 81,000 requests per second on average These numbers are a testament to the continued growth and vibrancy of the Python community. Let's dive into some of the key improvements we've made to PyPI this year. Security First, Security Always Security is our top priority, and in 2025 we've shipped a number of features to make PyPI more secure than ever. Enhanced Two-Factor Authentication (2FA) for Phishing Resistance We've made significant improvements to our 2FA implementation, starting with email verification for TOTP-based logins. This adds an extra layer of security to your account by requiring you to confirm your login from a trusted device, when using a phishable 2FA method like TOTP. Since rolling out these changes, we've seen: more than 52% of active users with non-phishable 2FA enabled more than 45,000 total unique verified logins Trusted Publishing and Attestations Trusted publishing continues to be a cornerstone of our security strategy. This year, we've expanded support to include GitLab Self-Managed instances, allowing maintainers to automate their release process without needing to manage long-lived API tokens. We've also introduced support for custom OIDC issuers for organizations, giving companies more control over their publishing pipelines. Adoption of trusted publish...

First seen: 2025-12-31 22:09

Last seen: 2026-01-01 11:10