[icanhasmath]

Security release pip 24.0.post3 for the Python 3.7 line. Follow-up to GHSA-6q48-6c7w-9gw2, the eMudhra/emSign CA key compromise.

Change

• certifi: the vendored copy moves from 2026.10.19 to 2026.10.23, which is upstream certifi 2026.10.23. Its cacert.pem is byte-identical to the one in the PyPI wheel (sha256 e9b54de7…61d1).
• Removed roots: this drops emSign Root CA - C1 and emSign ECC Root CA - C3. The previous release already removed emSign ECC Root CA - G3, so emSign Root CA - G1 is now the only emSign root in the bundle.
• What changed in the package: only cacert.pem and the certifi version (in __init__.py and vendor.txt). pip's certifi patches are unchanged. The pip version is bumped to 24.0.post3, and NEWS.rst gets the release entry.

Validation (in python:3.7-slim)

• Build and install: I built the sdist and wheel the same way as the previous release and installed the wheel into a fresh environment. pip --version reports 24.0.post3.
• Vendored certifi: it reports 2026.10.23, the bundle has 118 roots and the only emSign root is G1, and certifi.contents() works.
• Network: pip download six==1.16.0 from PyPI works.
• Comparison with the previous release's assets:
  • Wheel: identical apart from pip/__init__.py, pip/_vendor/certifi/__init__.py, pip/_vendor/certifi/cacert.pem and pip/_vendor/vendor.txt, plus RECORD and the Version: line in METADATA.
  • sdist: changes the same four files, plus NEWS.rst and PKG-INFO.

After merge: tag 24.0.post3 and publish a GitHub release with the wheel and sdist.

[ezequielp-activestate]

No blockers. The vendored cacert.pem is byte-identical to the one in certifi 2026.10.23 on PyPI (sha256 2ef52ad5…). Against the base branch it removes exactly two roots, emSign Root CA - C1 and emSign ECC Root CA - C3, and adds none, leaving emSign Root CA - G1 as the only emSign root, as the changelog says. The pip version (24.0.post3), the vendored certifi __version__ and vendor.txt agree. Not run on Python 3.7; the bundle is the same file that works on the 2.7, 3.8 and 3.9 lines.