Python Package Version (PEP 440) Regex for Python

What this pattern does

This page provides a comprehensive, battle-tested regular expression for matching python package version (pep 440), ported and verified for Python. A rigorously tested regex reduces debugging time and protects your application from edge-case failures. The snippet below is ready to drop into your Python project — whether you're validating in a Django view, a FastAPI endpoint, or a standalone data processing script.

Python Implementation

# Python Package Version (PEP 440)
# ReDoS-safe | RegexVault — Dev & Systems > SemVer

import re

python_package_version_pep_440_pattern = re.compile(r'^(?:([0-9]+)!)?([0-9]+(?:\.[0-9]+)*)(?:[-_.]?(?:a|alpha|b|beta|c|rc|preview)[-_.]?([0-9]+))?(?:[-_.]?post[-_.]?([0-9]+))?(?:[-_.]?dev[-_.]?([0-9]+))?(?:\+([a-zA-Z0-9]+(?:[-_.][a-zA-Z0-9]+)*))?$')

def validate_python_package_version_pep_440(value: str) -> bool:
    return bool(python_package_version_pep_440_pattern.fullmatch(value))

# Example
print(validate_python_package_version_pep_440("1.0"))  # True

Test Cases

When to use this pattern

This pattern is drawn from the Dev & Systems > SemVer category and carries a ReDoS-safe certification. That matters for Python developers because particularly important in Python web servers where CPU-bound regex operations can stall concurrent request handling. RegexVault audits patterns against known backtracking attack vectors, ensuring you have the necessary context before using this regex in a high-stakes production environment.

Common Pitfalls

Technical Notes

PEP 440 allows epoch (1!), pre-release suffixes (a/alpha/b/beta/rc), post-releases (.post1), dev releases (.dev1), and local version labels (+local). Use packaging.version.Version() in Python for canonical parsing.