Skip to content

[3.9.25.1] Upgrade bundled pip to 26.0.1.post3 (vendored urllib3 1.26.20.post4) #112

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
icanhasmath merged 1 commit into from
Oct 28, 2026
Merged

[3.9.25.1] Upgrade bundled pip to 26.0.1.post3 (vendored urllib3 1.26.20.post4) #112

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions Doc/whatsnew/3.9.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1726,14 +1726,17 @@ ssl
ensurepip
---------

* The bundled ``pip`` is upgraded from 23.0.1 to 26.0.1.post2, the ActiveState
* The bundled ``pip`` is upgraded from 23.0.1 to 26.0.1.post3, the ActiveState
security release of pip 26.0.1 (the last pip that supports Python 3.9).
pip loads its own vendored ``certifi`` CA bundle in addition to the system
trust store; the bundle in 26.0.1.post2 (certifi 2026.10.23) drops the
trust store; the bundle in 26.0.1.post3 (certifi 2026.10.23) drops the
emSign ECC Root CA - G3, emSign Root CA - C1 and emSign ECC Root CA - C3
roots of the compromised eMudhra/emSign CA, leaving emSign Root CA - G1 as
the only emSign root. The release also patches CVE-2026-3219,
CVE-2026-6357, CVE-2026-8643 and CVE-2026-13346.
CVE-2026-6357, CVE-2026-8643 and CVE-2026-13346, and its vendored urllib3
(ActiveState 1.26.20.post4) fixes CVE-2025-50181, CVE-2025-66418,
CVE-2025-66471, CVE-2026-21441, CVE-2026-44431, CVE-2026-97687 and
CVE-2026-97689.
* The bundled ``setuptools`` is upgraded from 79.0.1 to 82.0.1.post1, the
ActiveState security release of setuptools 82.0.1 (the last setuptools that
supports Python 3.9), fixing CVE-2026-59890. setuptools removed
Expand Down
2 changes: 1 addition & 1 deletion Lib/ensurepip/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@

__all__ = ["version", "bootstrap"]
_SETUPTOOLS_VERSION = "82.0.1.post1"
_PIP_VERSION = "26.0.1.post2"
_PIP_VERSION = "26.0.1.post3"
_PROJECTS = [
("setuptools", _SETUPTOOLS_VERSION, "py3"),
("pip", _PIP_VERSION, "py3"),
Expand Down
Binary file renamed ...bundled/pip-26.0.1.post2-py3-none-any.whl → ...bundled/pip-26.0.1.post3-py3-none-any.whl
View file
Open in desktop
Binary file not shown.
7 changes: 5 additions & 2 deletions Misc/NEWS.d/next/Security/2026-10-27-12-00-00.gh-issue-159894.AsPip9.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
Upgrade the bundled pip in :mod:`ensurepip` to the ActiveState security
release 26.0.1.post2 (the last pip that supports Python 3.9). Its vendored
release 26.0.1.post3 (the last pip that supports Python 3.9). Its vendored
certifi 2026.10.23 drops the emSign ECC Root CA - G3, emSign Root CA - C1 and
emSign ECC Root CA - C3 roots of the compromised eMudhra/emSign CA
(GHSA-6q48-6c7w-9gw2); emSign Root CA - G1 is the only emSign root left. It
also patches CVE-2026-3219, CVE-2026-6357, CVE-2026-8643 and CVE-2026-13346.
also patches CVE-2026-3219, CVE-2026-6357, CVE-2026-8643 and CVE-2026-13346,
and vendors ActiveState's urllib3 1.26.20.post4, which fixes CVE-2025-50181,
CVE-2025-66418, CVE-2025-66471, CVE-2026-21441, CVE-2026-44431,
CVE-2026-97687 and CVE-2026-97689.
Loading