| classifiers |
|
|---|---|
| description_content_type | text/x-rst |
| dynamic |
|
| keywords | pypi,realtime,cache,server |
| license_expression | MIT |
| license_file |
|
| maintainer_email | Florian Schulze <[email protected]> |
| metadata_version | 2.4 |
| project_urls |
|
| requires_dist |
|
| requires_python | >=3.11 |
| File | Tox results | History |
|---|---|---|
devpi_server-7.0.0.dev2-py3-none-any.whl
|
|
|
devpi_server-7.0.0.dev2.tar.gz
|
|
devpi-server: backend for hosting private package indexes and PyPI on-demand mirrors
PyPI on-demand package mirror
You can point uv, pip or another Python package installer to the root/pypi/+simple/ index, serving as a transparent on-demand mirror for PyPI-hosted packages.
User specific indexes
Each user (which can represent a person, project or team) can have multiple indexes, and can upload packages and documents to these indexes via standard twine or setup.py invocations. Users and indexes can be manipulated through devpi-client and a RESTful HTTP API.
Index inheritance
Each index can be configured to merge in other indexes so that it serves both its uploads and all releases from other index(es). For example, an index using root/pypi as a parent is a good place to test out a release candidate before you push it to PyPI.
Sensible defaults for a low friction deployment
Get started easily and deploy a devpi-server instance with pre-configured templates for nginx and process managers.
Separate tool for Packaging/Testing activities
The complementary devpi-client tool helps to manage users, indexes, logins and typical package upload and installation workflows.
See https://doc.devpi.net on how to get started and further documentation.
Support
If you find a bug, use the issue tracker at Github.
For general questions, use GitHub Discussions or the [email protected] mailing list.
For support contracts and paid help, contact mail at pyfidelity.com.
Changelog
7.0.0.dev2 (2026-04-30)
Deprecations and Removals
Removed deprecated devpiserver_auth_user hook.
Remove --keyfs-cache-size option and replace it with large_cache_size and small_cache_size storage options.
Deprecated get_possible_indexconfig_keys, get_default_config_items and normalize_indexconfig_value methods on index customizer in favor of new get_indexconfig_fields.
Removed lots of previously deprecated things.
Removed experimental --enable-core-metadata command line option, the feature is now always enabled.
Removed hash_spec from JSON responses, use hashes instead.
Deprecated devpiserver_indexconfig_defaults hook in favor of new devpiserver_indexconfig_fields hook.
Removed mirror_whitelist and replaced it with project_inheritance_rules in index configuration and inheritance_rules in the newly added project configuration. The replacement for the former default with an empty mirror_whitelist is block type:remote if local_exists. The replacement for * is allow all. To allow a specific project to be merged with upstream releases the new project config needs the inheritance_rules option to be set to allow all. For now these rules are the only possibilities matching the old functionality of mirror_whitelist.
Require at least Python 3.11.
Replaced devpiserver_storage_backend with new devpiserver_describe_storage_backend.
Fix #930: remove remaining uses of unmaintained py library.
Features
Support core-metadata hashes for local indexes. Refs #1018
Parse and store PEP 658 metadata hashes if a remote provides them. Refs #1018
Completely switch from requests to httpx.
The project REST API includes the project configuration and information about inheritance from base indexes when the v=2 query is added to the GET request. The inheritance information also includes warnings about inheritance cycles, missing bases and other problems.
The project REST API allows setting configuration via POST.
Support size and upload-time (refs #1061) fields from PEP 700 in JSON simple API version 1.1. If releases from remote indexes are included, the result API version is limited to the minimum supported version of all remotes.
Other Changes
Long descriptions in version metadata are now stored in files instead of the database. This is mostly transparent. If the file doesn’t exist (yet) on a replica, the json API will return a dictionary with the file information instead of a string.
Renamed the stage index to local. This affects the type field of the HTTP API.
Renamed mirror_whitelist_inheritance to trust_inheritance_rules_from and the values intersection to none, and union to type:not remote to make the intention more obvious.
Renamed devpiserver_get_mirror_auth hook to devpiserver_get_remote_auth.
Renamed the mirror index to remote. This affects the type field of the HTTP API and the “mirror_*” index options.
Renamed devpiserver_mirror_initialnames hook to devpiserver_remote_initialnames.
Renamed --mirror-cache-expiry/mirror_cache_expiry option to --remote-refresh-delay/remote_refresh_delay.
Replaced the default storage backend with a new one using SQLAlchemy and optimized database schema for size and performance.
6.20.0 (2026-04-30)
Features
Add experimental bare bones core-metadata ([PEP 658](https://peps.python.org/pep-0658/), [PEP 714](https://peps.python.org/pep-0714/)) support with --enable-core-metadata command line option and mirror_provides_core_metadata mirror index option. Refs #1018
Bug Fixes
Update replica status when the replica is waiting for new serials using the streaming changelog endpoint.
6.19.3 (2026-04-13)
Bug Fixes
Fix #1112: Parse simple JSON reply even with wrong content-type in reply if the body seems to contain JSON.
Return stale project list for mirrors when the lock can’t be acquired within the timeout.
Fix importing of toxresults from devpi-server 6.5.0 to 6.9.0 where the wrong hash was stored.
6.19.2 (2026-03-17)
Bug Fixes
Preserve log for documentation uploads in export.
Any missing file on mirrors will be ignored during event processing as is already the case in other places.
Use short timeout when project list is requested for has_project call on mirrors instead of the long one used for list_projects. This prevents installers from timing out and retrying several times.
Fix error handling for proxy requests from replica to primary.
Other Changes
Removed limit of reported missing files for devpi-fsck.
6.19.1 (2026-02-09)
Bug Fixes
Pin setuptools as pyramid still requires pkg_resources.
Always allow replicas to access deleted releases to get the proper 410 Gone instead of 403 Forbidden when devpi-lockdown is in use.