Please update pip to at least version of pip 25.2

There is a 5 day old reported vulnerability: GHSA-4xh5-x5gv-qwph
Can you please update python 3.12 based images with pip version at least 25.2?
To be specific the -slim one :-)

These images by design use the pip/setuptools versions that are bundled with the version of Python being installed.

Python 3.11 comes with setuptools v65.5.0: https://github.com/python/cpython/tree/3.11/Lib/ensurepip/_bundled

So this is expected, and not something that will be changed in these images. (Updating to setuptools 70+ would be a breaking change for a start.)

You will either need to either:

Update to Python 3.12 or newer (which no longer bundles setuptools)

Update setuptools in your own Dockerfile

Ask upstream CPython to update to newer setuptools in Python 3.11

Suppress the vulnerability alert if appropriate (you didn't say what vulnerability you were referring to, but it's quite possible it's a non-issue in practice - many setuptools codepaths are not used when it's used as a pip build backend, or need several other criteria to be a problem etc)

See also:

Vulnerability with setuptools < 70.0.0 (CVE-2024-6345) #942

Stop including setuptools and wheel in Python 3.12+ images #952

See: #1012 (comment)

Therefore you should raise that request upstream, or update yourself.

@ad-m-ss

Hi @ad-m-ss I see that for 3.13 the bundled pip was updated to 25.3 last week https://github.com/python/cpython/tree/3.13/Lib/ensurepip/_bundled

Seems like this change isn't going through for the built image, as 3.13 still has pip 25.1 even though it was recently re-built.

Can we please re-open the issue? Or would you prefer to have a new one specifically for 3.13 and pip 25.3?

Thanks

What do you mean by re-open? I do not have authority to close / open anything here, and it looks it was never closed. I am just watching and know a little policies.

If you look at python/cpython@9a3a147, you'll see that it's not part of any release tags yet (you can compare that to an older commit like python/cpython@1ba09b2 which was included in 3.13.6+ to see what I mean), so that means it should be part of the next 3.13 release.

See also python/cpython@v3.13.9...3.13 for a full list of what might be in that next release (comparing the latest release tag, v3.13.9 to that in-progress 3.13 release branch).

(As a matter of process: if that stays for the release and doesn't get reverted, the bump will happen automatically as part of / with the release bump.)

Could you confirm if the vulnerability reported in GHSA-4xh5-x5gv-qwph affects the current -slim image setup, or is it only relevant for other configurations?

$ docker run --rm --pull=always python:3.13-slim pip --version
3.13-slim: Pulling from library/python
26c307b5e35a: Already exists 
f5ea60e5d57e: Pull complete 
c915bfca5450: Pull complete 
31a024bb115a: Pull complete 
Digest: sha256:ffb752e139c0a19692a43af8d8523b274222dd68eebad5d583b45c2201c6e30a
Status: Downloaded newer image for python:3.13-slim
pip 26.2.1 from /usr/local/lib/python3.13/site-packages/pip (python 3.13)

vs https://github.com/advisories/GHSA-4xh5-x5gv-qwph's "Affected versions": "<= 25.2"

3.12 is still affected, which tracks because upstream (Python) hasn't backported that update:

$ docker run --rm --pull=always python:3.12-slim pip --version
3.12-slim: Pulling from library/python
26c307b5e35a: Already exists 
5a31db4cd478: Pull complete 
c85ad0bcaca8: Pull complete 
b3c7a9bdb4f2: Pull complete 
Digest: sha256:229a2c5bfa27522db7815ea81f9bed70af17ccb9de9fc7ad142b1877b5830d36
Status: Downloaded newer image for python:3.12-slim
pip 25.0.1 from /usr/local/lib/python3.12/site-packages/pip (python 3.12)

Just to close the loop here like #1142. There will likely not be a pip bump in 3.11 or 3.12 since we follow what upstream publishes (and they have chosen not to apply pip updates to security releases, see #1142 (comment)). We did bump it in the past and users suffered through many of those backward incompatible changes, so we don't do that anymore.

If users need an updated pip in 3.11 or 3.12, they should update it in their Dockerfile.

FROM python:3.11
RUN pip install --upgrade pip==26.2.2
# or whatever specific version you need

$ docker run -it --rm python:3.12 bash
root@3abaf4510826:/# pip --version
pip 25.0.1 from /usr/local/lib/python3.12/site-packages/pip (python 3.12)
root@3abaf4510826:/# pip install --upgrade pip==26.2.2
Requirement already satisfied: pip in /usr/local/lib/python3.12/site-packages (25.0.1)
Collecting pip
  Downloading pip-26.2.2-py3-none-any.whl.metadata (4.6 kB)
Downloading pip-26.2.2-py3-none-any.whl (1.8 MB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1.8/1.8 MB 48.0 MB/s eta 0:00:00
Installing collected packages: pip
  Attempting uninstall: pip
    Found existing installation: pip 25.0.1
    Uninstalling pip-25.0.1:
      Successfully uninstalled pip-25.0.1
Successfully installed pip-26.2.2
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager, possibly rendering your system unusable. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv. Use the --root-user-action option if you know what you are doing and want to suppress this warning.
root@3abaf4510826:/# pip --version
pip 26.2.2 from /usr/local/lib/python3.12/site-packages/pip (python 3.12)
root@3abaf4510826:/#

EDIT: If your starting version of pip isn't at least 26.2.2, you would need to pin hashes like https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576 to prevent MITM:

# for pip 26.2.2:
RUN pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"

Navigation Menu

Repository navigation

Please update pip to at least version of pip 25.2 #1080

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Please update pip to at least version of pip 25.2 #1080

Description

Activity

ad-m-ss commented on Sep 29, 2025

mabecke commented on Nov 10, 2025

ad-m-ss commented on Nov 10, 2025

tianon commented on Nov 10, 2025

tianon commented on Nov 10, 2025

yhdhvyfhv commented on Aug 11, 2026

tianon commented on Aug 11, 2026

tatumjakhiya26 commented on Sep 12, 2026

nicecartoon commented on Oct 12, 2026

jasminritik26 commented on Oct 15, 2026

yosifkit commented on Oct 21, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions