Repository navigation
Update the bundled version of pip to 23.3.1 #112516
Description
Feature or enhancement
Proposal:
Update the bundled pip in ensurepip to the latest version of pip (23.3.1).
This ensures that users who install newest release of Python get the newest version of pip. Also the latest pip version includes a couple of security improvements, fix of CVE-2023-5752 and updated urllib3.
Has this already been discussed elsewhere?
This is a minor feature, which does not need previous discussion elsewhere
Links to previous discussion of this feature:
No response
Activity
gh-112516: Update bundled pip version to 23.3.1 (gh-112517)
pythongh-112516: Update bundled pip version to 23.3.1 (pythongh-112517)
[3.11] pythongh-112516: Update bundled pip version to 23.3.1 (pythong…
schribl commentedon Dec 8, 2023
@pfmoore Sorry to ping you on this closed issue, but as mentioned here and in #112710 the update of pip is also fixing at least one security issue in the urllib3 vendored by pip. So is this something that should be considered to also be backported to the Python versions in security maintenance mode?
pfmoore commentedon Dec 8, 2023
When 23.3.2 is released it will be included in ensurepip and backported according to the normal rules. We don't backport to distributions in security maintenance (source distribution only) mode, though.
pythongh-112516: Update bundled pip version to 23.3.1 (pythongh-112517)
pythongh-112516: Update bundled pip version to 23.3.1 (pythongh-112517)