PEP 440

Should Python Libraries Raise Minimum Dependency Versions to Block Vulnerable Releases?

Seth Larson of the Python Software Foundation argues that library maintainers should not automatically raise the minimum allowed version of a dependency after a vulnerability is disclosed. He states that dependency metadata exists to declare compatibility, while security decisions belong to the application owner who controls the final build. The recommendation has sparked debate in the Python community, with some maintainers supporting the separation of concerns and others viewing security constraints as part of library support obligations. CodeScoring’s analysis examines the practical impact on the ecosystem, noting that over 10,000 packages depend on urllib3 and tens of thousands more rely on numpy, requests, and pandas. The piece concludes that version bounds may incorporate security considerations only after evaluating real usage, affected versions, and downstream compatibility, but they cannot replace application-level vulnerability management with lockfiles and tools such as pip-audit.