[icanhasmath]

Releases 3.7.17.10: the 3.7.17.9 core with ensurepip bundling pip 24.0.post5 instead of 24.0.post4.

pip 24.0.post5 (release, ActiveState/pip#17) upgrades pip's vendored idna from 3.4 to 3.7, which fixes CVE-2024-3651: crafted host names made idna.encode() take quadratic time. The rest of pip is unchanged from 24.0.post4.

Changes

• Lib/ensurepip/_bundled/: the wheel is replaced with pip-24.0.post5-py3-none-any.whl, the release asset (sha256 d9d6b5a5217f2745c1f719e62076cffb924d038dd3833732858f884a131d3b69), and _PIP_VERSION is updated to match.
• Include/patchlevel.h: PY_VERSION is now 3.7.17.10.
• There's a new Security NEWS entry and a new "Notable changes in 3.7.17.10" section in Doc/whatsnew/3.7.rst.

setuptools stays at 68.0.0.post3, and OpenSSL support is unchanged from 3.7.17.9.

Tested on a Linux build against OpenSSL 3.5.9:

• The interpreter reports 3.7.17.10, and sys.version_info is still (3, 7, 17, 'final', 0).
• test_ensurepip, test_venv, test_platform, test_sys, test_sysconfig, test_site and test_distutils all pass.
• A venv created by python -m venv gets pip 24.0.post5 with vendored idna 3.7. The crafted 6,002-character label is rejected in 0.002 s. pip download works, and setuptools 68.0.0.post3 imports.

After merge: tag v3.7.17.10 and publish a release (not Latest), add inventory language/python 3.7.17.10 based on 3.7.17.9, rebuild Core-Python-3.7, and run core QA.

[ezequielp-activestate]

Approving. No blockers.

What I checked

• The bundled pip-24.0.post5-py3-none-any.whl is byte-identical to the asset on the 24.0.post5 release. Its sha256 is d9d6b5a5…3d3b69, matching the description. The 24.0.post5 tag points at the merge commit of ActiveState/pip#17.
• The wheel's pip/ tree matches the tag's src/pip. The only files missing from the wheel are the LICENSE, py.typed and .pyi files that pip never ships.
• Compared with the 24.0.post4 wheel it replaces, the only changes are in pip/__init__.py (the version), _vendor/vendor.txt, _vendor/idna/* and the dist-info.
• The old wheel is removed (it shows as a rename), and _PIP_VERSION and PY_VERSION are updated to match. setuptools is untouched.
• Python 3.7 (python:3.7 container):
  • Installing the bundled wheel into a venv gives pip 24.0.post5 with vendored idna 3.7.
  • The crafted CVE-2024-3651 label at n = 2000 is rejected in 0.002 s.
  • pip download six works.

Not checked: I didn't build the interpreter or run test_ensurepip/test_venv myself. The description says those pass.