Why do PyPI abandonment requests take so much longer than six weeks?

The six weeks describes the reachability stage, not necessarily a deadline for the entire request. Someone still has to review the evidence and decide whether a transfer is appropriate. Time spent waiting in a queue can also make the whole process much longer than the contact period.

That distinction doesn't make a long wait less frustrating, especially if there are few updates. But three messages and six weeks aren't the whole decision.

Transferring a package name is a pretty serious security decision. An old package can still be installed by existing users, and giving its name to the wrong person could expose those users to malicious code. No recent releases or working project links don't automatically settle who should control the name.

Scale and manual review are likely part of it. PyPI has a huge number of packages, and checking ownership and abandonment isn't something that can safely be reduced to an automatic inactivity timer. Limited volunteer time can leave requests waiting even when the checks themselves seem straightforward.

If the goal is to publish a new project rather than continue the old one, picking an unused name may be the quickest route. It avoids waiting for a transfer and makes it less likely that users mistake the new project for an update to the old package.

There's also a broader policy disagreement here. One alternative would be to mark abandoned projects and point users toward replacements instead of transferring names. That would mean users have to change their dependencies themselves, but it would avoid some takeover risks. That is a proposed alternative, not how the current process necessarily works.