2025 Anaconda.org User Research study feedback

[matthewfeickert]

Collected information from members of Scientific Python for the Anaconda.org User Research study interview @matthewfeickert has scheduled on 2025-05-07.

---

Service so far has been quite useful, especially for providing infrastructure for the whole development community to be able to test against collectively.

Specific examples:

Having an obvious place to put free-threaded wheels was really nice for some projects depending on NumPy getting off the ground before numpy 2.1 came out

---

Features

• Lack of CORS headers means that installing WASM wheels from Anaconda.org in a browser isn't supported
  • From Use cibuildwheel to build WASM/Pyodide wheels for scikit-image, push nightlies to Anaconda.org scikit-image/scikit-image#7440 (comment) it appears that this has been resolved in 2025 (Web proxy to work around the lack of CORS headers for nightly wheels uploaded to the Anaconda.org index pyodide/pyodide#4898 (comment)) and there is now at least scikit-learn support (DOC Use nightly WASM wheels for JupyterLite in the dev documentation scikit-learn/scikit-learn#31085).
  • Example:

import micropip
await micropip.install(["numpy"], pre=True, index_urls="https://pypi.anaconda.org/scientific-python-nightly-wheels/simple")

import numpy as np
np.__version__  # 2.3.0.dev0+git20250503.00f2733

• Add CORS headers on HTTP exceptions
  • c.f. 2025 Anaconda.org User Research study feedback #130 (comment)
• Implement PEP 658 and PEP 714.
  • c.f. 2025 Anaconda.org User Research study feedback #130 (comment)
• Project creation requires maintenance team to manually pushing a wheel to Anaconda.org and then going through a multistage process in the web UI (which is very slow) to create a group that manages the project. Would be great if this could be streamlined and if the project could be created when a dev wheel is uploaded for the first time by project maintainers.
  • Specific steps of current workflow:
    • Upload project wheel
    • Create new group in https://anaconda.org/scientific-python-nightly-wheels/groups
    • Add group members (https://anaconda.org/scientific-python-nightly-wheels/groups/<package name>)
    • Give members administration permissions in settings (https://anaconda.org/scientific-python-nightly-wheels/groups/<package name>/settings)
    • Type package name in to then add the package name to the group (https://anaconda.org/scientific-python-nightly-wheels/groups/<package name>/packages)
  • Proposed (2025 Anaconda.org User Research study feedback #130 (comment)) alternative workflow that allows project creation without upload:
    • An admin of the org creates a project.
    • Add managers to the project and set permissions.
    • Managers can upload with their personal token and all is set.

Security

• General improvements to security tools like adding MFA support and OIDC (similar to Trusted Publishers).

[agriyakhetarpal]

On the CORS headers topic, it would be nice if Anaconda.org could also consider adding CORS headers on HTTP exceptions. They were added soon after the Simple API via pypi/warehouse#16339. Partly due to this limitation and our to-be expanded usage for this index for WASM wheels in the coming time, we've been thinking of dropping checks for these completely: pyodide/micropip#225

Also, a slight correction if I may: the comment "means that WASM wheels aren't supported" should be "installing WASM wheels in a browser isn't supported", as the act of uploading WASM wheels has been long supported – unlike PyPI, Anaconda.org doesn't disallow doing this.

(I'm not a member of the Scientific Python organisation, but I have been contributing to the ecosystem for quite some time now, so I thought this should be an appropriate place to add this point!)

[agriyakhetarpal]

Another note I wanted to post as a separate comment that is also super relevant in the context of WASM wheels: I've noted that the Anaconda.org server does not yet implement PEP 658 and PEP 714. Context: we've been thinking about improving pyodide/micropip's resolver in favour of using a backtracking one instead to ameliorate scenarios around complex resolution cases, or simple ones which don't resolve satisfactorily (which have happened much more often than we have expected!), and in regard to this we have already added support for these PEPs on the client side via pyodide/micropip#139. However, the lack of support on the server/index side from Anaconda.org means that it will cause micropip to download multiple wheels for several packages when using said index, potentially consuming a lot of bandwidth in the browser. Having support for these PEPs would be pretty useful, as micropip would then be able to resolve dependencies from the *.whl.metadata files before downloading the wheels.

[tupui]

For the project creation, it would be best if it could be created without any upload. The flow would be more secure:

1. An admin of the org creates a project
2. Add managers to the project and set permissions
3. Managers can upload with their personal token and all is set.

[matthewfeickert]

Thanks @agriyakhetarpal! This is all noted / corrected and linked from the first post in the Issue now. 👍

@tupui SGTM RE: project creation.