devpi-server: backend for hosting private package indexes and PyPI on-demand mirrors
PyPI on-demand package mirror
You can point uv, pip or another Python package installer to the root/pypi/+simple/ index, serving as a transparent on-demand mirror for PyPI-hosted packages.
User specific indexes
Each user (which can represent a person, project or team) can have multiple indexes, and can upload packages and documents to these indexes via standard twine or setup.py invocations. Users and indexes can be manipulated through devpi-client and a RESTful HTTP API.
Index inheritance
Each index can be configured to merge in other indexes so that it serves both its uploads and all releases from other index(es). For example, an index using root/pypi as a parent is a good place to test out a release candidate before you push it to PyPI.
Sensible defaults for a low friction deployment
Get started easily and deploy a devpi-server instance with pre-configured templates for nginx and process managers.
Separate tool for Packaging/Testing activities
The complementary devpi-client tool helps to manage users, indexes, logins and typical package upload and installation workflows.
See https://doc.devpi.net on how to get started and further documentation.
Support
If you find a bug, use the issue tracker at Github.
For general questions, use GitHub Discussions or the devpi-dev@python.org mailing list.
For support contracts and paid help, contact mail at pyfidelity.com.
Changelog
6.21.0 (2026-10-26)
Features
Use sha256 for login token signing. Existing tokens will be invalidated, but they are valid for only 10 hours anyway.
Bug Fixes
Block . and .. as user and index names. Reported by Zachariah Mithani [zachariah-mithani] (AploSec) https://github.com/devpi/devpi/security/advisories/GHSA-w72q-5vww-p2rh
Fix #1130: correctly compare content type header to ignore added parameters for API v1 JSON responses.
6.20.3 (2026-06-30)
Bug Fixes
Fix fetching files from re-created mirrors (for example after import or delete and create) without fetching simple project page first. This happens when uv uses a package URL directly from a lock file.
Search for METADATA file if the generated name with normalized project and version doesn’t match. This fixes serving core metadata for older wheels.
6.20.2 (2026-06-11)
Bug Fixes
Fix logic error which allowed unauthorized fetching of replication data. CVE-2026-54723 reported by Pavel Revak [pavelrevak] https://github.com/devpi/devpi/security/advisories/GHSA-m5pq-69xg-vcq3
6.20.1 (2026-05-11)
Bug Fixes
Pass through request headers when streaming .metadata from mirror. Refs #1018
6.20.0 (2026-04-30)
Features
Add experimental bare bones core-metadata ([PEP 658](https://peps.python.org/pep-0658/), [PEP 714](https://peps.python.org/pep-0714/)) support with --enable-core-metadata command line option and mirror_provides_core_metadata mirror index option. Refs #1018
Bug Fixes
Update replica status when the replica is waiting for new serials using the streaming changelog endpoint.
1 maintainer
Metadata
1 maintainer
Release files for devpi-server 6.21.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| devpi_server-6.21.0.tar.gz | 313.7 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| devpi_server-6.21.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 638.2 kB
Release files / devpi_server-6.21.0.tar.gz
| Download URL | devpi_server-6.21.0.tar.gz |
|---|---|
| Size | 313.7 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
7998d77b96fbc2996e384524039b4c5f3029fb5849dddb42fd6615293ac6eb0d
|
|
BLAKE2b-256 checksum How to use checksums |
26f012e2d886715b32d9119c680485b73ee0b5217bb9df2f2e50316e33679f35
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
devpi-server/7.0.0b14 (py3.11.11; darwin)
|
Release files / devpi_server-6.21.0-py3-none-any.whl
| Download URL | devpi_server-6.21.0-py3-none-any.whl |
|---|---|
| Size | 324.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
7facdfb0e900c1a8e3c2240c46c92dd14af110b8b55bd334aa6888d4508e5de4
|
|
BLAKE2b-256 checksum How to use checksums |
d09de49c07a9e4822dd47f0996d3e966940f787cca7a1183bfa33154e41c30bc
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
devpi-server/7.0.0b14 (py3.11.11; darwin)
|
Security for devpi-server 6.21.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
