Repository navigation
[3.9.25.1] Upgrade bundled pip to 26.0.1.post2 (certifi 2026.10.23) - #109
Merged
Merged
Conversation
ensurepip now bundles the ActiveState security release of pip 26.0.1.post2 instead of 26.0.1.post1: https://github.com/ActiveState/pip/releases/tag/26.0.1.post2 Its vendored certifi moves from 2026.10.19 to 2026.10.23, which also removes the emSign Root CA - C1 and emSign ECC Root CA - C3 roots, so emSign Root CA - G1 is the only emSign root left (follow-up to GHSA-6q48-6c7w-9gw2). Nothing else in pip changes. The NEWS entry and the 3.9 What's New note are updated to match. Wheel sha256 b3fe7b5facd4aab5c11a14cf6a689b71045525c2b8dd35d6a6b45b2e83c0e7c5, matching the release notes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ezequielp-activestate
approved these changes
Oct 28, 2026
ezequielp-activestate
left a comment
ezequielp-activestate
left a comment
There was a problem hiding this comment.
No blockers. The bundled pip wheel is byte-identical to the asset on the ActiveState pip 26.0.1.post2 release (sha256 b3fe7b5f…), the 26.0.1.post1 wheel is removed, and _PIP_VERSION matches. In a Python 3.9 venv, python -m ensurepip from this tree installs pip 26.0.1.post2 and setuptools 82.0.1.post1, and pip's vendored certifi is 2026.10.23 with emSign Root CA - G1 as its only emSign root, as What's New and the NEWS entry now say.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #88 for 3.9.25.1. It moves ensurepip's bundled pip from 26.0.1.post1 to ActiveState/pip 26.0.1.post2. Tracking: Linear PROD-1555.
Why
pip 26.0.1.post1 vendored certifi 2026.10.19, which removed only emSign ECC Root CA - G3 and still trusted emSign Root CA - C1 and emSign ECC Root CA - C3 (raised in the review of #91). 26.0.1.post2 vendors certifi 2026.10.23, which drops both, so emSign Root CA - G1 is now the only emSign root (follow-up to GHSA-6q48-6c7w-9gw2). Nothing else in pip changes.
Change
Lib/ensurepip/_bundled/pip-26.0.1.post2-py3-none-any.whlreplaces 26.0.1.post1. It's the release asset, sha256b3fe7b5f…e7c5._PIP_VERSIONis set to"26.0.1.post2".Testing (Linux x86_64, our 3.9.25.1 build with this branch's
ensurepip)test_ensurepippasses.--without-pipvenv,python -m ensurepip --upgradeinstalls pip 26.0.1.post2 and setuptools 82.0.1.post1.pip download six==1.16.0from PyPI works.