8.0.0

8.0.0

New Features

• Mirror PEP 658 / PEP 714 core metadata files: when upstream advertises a core-metadata checksum for a release file (live on pypi.org's JSON API since warehouse #20193), the extracted metadata is downloaded to RELEASE_FILE.metadata alongside the release file and checksum verified. Generated simple indexes advertise the files via the PEP 714 data-core-metadata (+ legacy data-dist-info-metadata) HTML attributes and the core-metadata JSON key, letting pip resolve dependencies without downloading full release files. Controlled by the new [mirror] core-metadata option (default true). bandersnatch verify re-fetches missing/corrupt core metadata files (use --json-update to backfill an existing mirror) and bandersnatch delete removes them. Checksum selection prefers the configured digest_name, then sha256, then any hashlib supported digest upstream offers PR #2311
• Verify abstraction layer: add Storage.verify_files(), Storage.iter_package_files(), Storage.set_hash(), and Storage.delete_package_file() so each storage backend can implement integrity checking optimally. The filesystem default retains existing behaviour; the S3 backend now uses concurrent HeadObject calls with stored sha256 metadata, eliminating full-file downloads on the happy path. PLUGIN_API_REVISION bumped to 2. PR #2286
• New [s3] verify_concurrency option (default 50) controls the maximum number of simultaneous S3 API calls during bandersnatch verify. Verify runs on its own thread pool and HTTP connection pool sized to this value, decoupled from [mirror] workers (capped at 10 for PyPI politeness) since verify only touches your own bucket. Tune relative to your S3 request-rate limit and mirror size.
• S3 client is now configured with botocore adaptive retry mode so transient SlowDown throttle responses from S3 are absorbed automatically rather than crashing a long-running verify run. The retry ceiling is configurable via the new [s3] max_attempts option (default 10). A WARNING is logged if throttling persists after all retries.
• bandersnatch verify now honours compare-method and digest_name config settings (previously always performed a sha256 hash regardless of config). The S3 backend's verify_files honours compare-method too: stat mode trusts a matching upload time with no content read, while hash mode always confirms content.
• S3 verify now back-fills hash metadata for legacy objects on first verify (unless --dry-run), making future runs use only fast HeadObject calls; upload time and digest are validated and stored via the storage backend, with .s3keep logic moved fully into the S3 plugin.
• Core verify and mirror flows now rely on storage backend methods (set_hash, etc.) for hash and metadata handling, enabling backend-specific optimizations.
• Mirror skip checks use Storage.release_file_is_current(); S3 certifies with one HeadObject, migrates legacy objects on first check, and stamps metadata on PutObject. Storage plugins must accept optional file_metadata on rewrite(). PR #2296
• Remove legacy XML-RPC support paths; metadata sync now uses only the PEP 691 Simple API PR #2276
• Allow configuring any PEP691 compliant digest that the index offers PR #2262
• Use hashlib.file_digest() to calculate file hashes when verifying PR #2277
• Add new versions_count_project_metadata filter plugin to filter packages by total version count PR #2281
• Update get_hash() method for filesystem storage backend to use hashlib.file_digest() PR #2288
• bandersnatch verify logs the count and total size of release files it downloads (or would download with --dry-run); release files without a usable size in metadata are skipped; --delete dry-run and delete actions log via the application logger. PR #2290

CI / test

• Add Python 3.15 to CI matrix and supported versions PR #2239
• Declare workflow-level permissions: contents: read on the 8 remaining workflows (CVE-2025-30066 hardening) PR #2241
• Skip base class tests in test runs PR #2263
• Transitioned from unittest.TestCase to pytest fixtures (PR #2265, PR #2273, PR #2274)
• Replace MinIO Docker container with moto in-memory mock for S3 tests PR #2272
• Bump filelock to 3.29.6 and update lock-file assertions to expect the persisted .lock file on Unix; filelock >=3.29.5 keeps Unix lock files after release (filelock PR #577) to avoid a lock-reuse race, while Windows still best-effort removes it PR #2304

Documentation

• Docs: add troubleshooting for Simple API JSON mirroring PR #2145
• Docs: list all supported python versions for exclude_platform in filtering configuration PR #2232
• Docs: document running the full test suite against a specific Python version via Docker

Bug Fixes

• Fix cleanup = true deleting the live simple index directory of mixed case package names (e.g. ACMPlus) on case insensitive filesystems (macOS APFS / Windows NTFS): the legacy non PEP 503 dir and the normalized dir are the same directory there, so cleanup now skips dirs that resolve to the live simple dir PR #2311
• Drop setuptools from runtime requirements: nothing in bandersnatch imports setuptools/pkg_resources anymore (plugin loading uses importlib.metadata), so it is no longer declared in install_requires or the pinned requirements files. It remains only as the PEP 517 build backend in pyproject.toml PR #2306
• Fix broken bandersnatch_docker_compose symlinks (Dockerfile, nginx.conf) whose targets included a trailing newline, leaving them unresolvable on disk PR #2280
• Fix mirror --force-check to reset the mirror serial via the configured storage backend so it works with non-local backends such as S3 (previously used a local shutil.move() to /tmp) Issue #2278, PR #2279
• Demote per-package filter matching logs from INFO to DEBUG to reduce noise during mirror and verify runs PR #2193
• Exclude PEP 600 manylinux_2_* wheel tags when exclude_platform = linux is configured PR #2151

7.1.0

New Features

• Make filesystem permissions management configurable PR #2137

7.0.1

New Features

• Add musllinux platform tag to list of excludable Linux platforms PR #2109

7.0.0

New Features / big changes

• Default to simple API for api-method for package listing PR #2089
  • Replaces xmlrpc on PyPI and paves the way for it to be deprecated
    • It also allows mirrors to mirror from other mirrors
• Remove py3.11 support PR #2082
• Remove swift support PR #2081

CI / test

• Move all main CI integration tests to simple API
  • One dedicated 3.14 xmlrpc test left until deletion
• Unittests only test simple API

6.8.0

New Features

• Declare support for python 3.14 PR #2079
  • Move Docker to 3.14 too PR #2080

Cut release w/3.14 + switch support so we can make larger changes for 7.0.0 ...

6.7.0

New Features

• Declare support for python 3.13 PR #1848
• Add support PEP691 simple API for package metadata (off by default till 7.0) PR #2075

Bug Fixes

• Support reading HTTP proxy URLs from environment variables, and SOCKS proxy URLs from the 'mirror.proxy' config option PR #1861
• Remove usage of deprecated datetime.datetime.utcnow()
• Make our custom Exceptions pass B042 (#2074)

CI

• Dependabot reviewers configuration option being replaced by code owners PR #1943

6.6.0

Sorry for the long gap between releases!

New Features

• Add arbitrary configuration option for S3 Storage Backend Boto3 calls PR #1697
• Add pytest marker to allow skipping of S3 tests PR #1766
• Added HTTPS support in Docker Compose + Enabled bind-mount volume for Nginx config + add documentation in README.md PR #1653
• Initial support for python 3.12 PR #1728
• Move Docker images to 3.12 PR #1733
  • Removing swift builds due to lack or assistance - Happy to bring back if you're willing to help maintain
• Move black, mypy + pyupgrade to >= 3.11 codebase PR #1734
• Allow non-HTTPS-enabled mirrors PR #1765
• Correct example config PR #1807

Documentation

• Updated documentation for [mirror] configuration options PR #1669
• Updated documentation PR #1760

Bug Fixes

• Fix event loop usage and test setup to move to latest test deps PR #1829
• Fix filtering for verify to fix deletion PR #1690
• Drop types-pkg_resources PR #1793
• Fix config file value interpolation for the diff-file option PR #1715
• Fix diff-file being created when the option wasn't set PR #1716
• Provide default values for most config options in the [mirror] section PR #1740
• Fix command execution by runner.py - PR #1753

Deprecation

• Move from pkg_resources to importlib_metadata for filter entry point usage PR #1739

6.5.0

New Features

• Add option to filter releases based on upload time PR #1594
• project_requirements_pinned with a pinned version (range) disables additional release filter for this package PR #1601

6.4.0

• Move JSON Simple API to version 1.1 (as per PEP700) PR #1557
• Move to >= 3.10 project PR #1457

Bug Fixes

• Support py2 + py3 bdist file name filtering PR #1495

6.3.0

Bug Fixes

• Fix digest used for file hashes in PEP 691 simple JSON file output PR #1442
  • The digest_name setting from configuration (default value: sha256) will now be used for both HTML and JSON files.
  • This mirrors pypi.org ("Warehouse") behavior
  • Please use bandersnatch mirror --force-check to regenerate all your mirror's simple API
    • bandersnatch sync could also be a way to update important packages faster too