[icanhasmath]

Security release pip 26.0.1.post2 for the Python 3.9 line. Follow-up to GHSA-6q48-6c7w-9gw2, the eMudhra/emSign CA key compromise.

Change

• certifi: the vendored copy moves from 2026.10.19 to 2026.10.23, which is upstream certifi 2026.10.23. Its cacert.pem is byte-identical to the one in the PyPI wheel (sha256 e9b54de7…61d1).
• Removed roots: this drops emSign Root CA - C1 and emSign ECC Root CA - C3. The previous release already removed emSign ECC Root CA - G3, so emSign Root CA - G1 is now the only emSign root in the bundle.
• What changed in the package: only cacert.pem and the certifi version (in __init__.py and vendor.txt). pip's certifi patches are unchanged. The pip version is bumped to 26.0.1.post2, and NEWS.rst gets the release entry.

Validation (in python:3.9-slim)

• Build and install: I built the sdist and wheel the same way as the previous release and installed the wheel into a fresh environment. pip --version reports 26.0.1.post2.
• Vendored certifi: it reports 2026.10.23, the bundle has 118 roots and the only emSign root is G1, and certifi.contents() works.
• Network: pip download six==1.16.0 from PyPI works.
• Comparison with the previous release's assets:
  • Wheel: identical apart from pip/__init__.py, pip/_vendor/certifi/__init__.py, pip/_vendor/certifi/cacert.pem and pip/_vendor/vendor.txt, plus RECORD and the Version: line in METADATA.
  • sdist: changes the same four files, plus NEWS.rst and PKG-INFO.

After merge: tag 26.0.1.post2 and publish a GitHub release with the wheel and sdist.

[ezequielp-activestate]

No blockers. The vendored cacert.pem is byte-identical to the one in certifi 2026.10.23 on PyPI (sha256 2ef52ad5…). Against the base branch it removes exactly two roots, emSign Root CA - C1 and emSign ECC Root CA - C3, and adds none, leaving emSign Root CA - G1 as the only emSign root, as the changelog says. The pip version, the vendored certifi __version__ and vendor.txt agree. On Python 3.9, this tree's pip reports 26.0.1.post2, certifi where() points at the vendored bundle, and pip download six==1.16.0 from PyPI succeeds over TLS through it.