Case Study: Pip Ships 18 Vendored Libraries With Their Licences, Except One NOTICE

Mon, 26 Oct 2026 00:00:00 +0000

pip, the tool that installs Python packages, can’t count on any other package being installed first. So it vendors what it needs: copies of 18 releases from PyPI, kept in src/pip/_vendor and listed in its vendor.txt. pip itself is MIT. Eight of the libraries it carries are MIT too and four are Apache-2.0. The rest are one each under BSD-3-Clause, BSD-2-Clause, ISC, MPL-2.0 and PSF-2.0, plus packaging, which offers a choice of Apache-2.0 or BSD-2-Clause.

Vendoring on remixware.com

Case Study: Pip Ships 18 Vendored Libraries With Their Licences, Except One NOTICE