Skip to content

gh-159894: Upgrade bundled pip to 26.2.2 - #159910

Merged
StanFromIreland merged 1 commit into
python:mainfrom
notatallshaw:gh-159894-pip-26.2.2
Oct 20, 2026
Merged

gh-159894: Upgrade bundled pip to 26.2.2#159910
StanFromIreland merged 1 commit into
python:mainfrom
notatallshaw:gh-159894-pip-26.2.2

Conversation

@notatallshaw

@notatallshaw notatallshaw commented Oct 20, 2026

Copy link
Copy Markdown
Contributor

Update ensurepip's bundled pip from 26.2.1 to 26.2.2.

@bedevere-app bedevere-app Bot mentioned this pull request Oct 20, 2026
Closed
StanFromIreland
StanFromIreland reviewed Oct 20, 2026
View reviewed changes
Comment thread Misc/NEWS.d/next/Library/2026-10-20-13-15-00.gh-issue-159894.8Kp4mN.rst Outdated
@hugovk hugovk added needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes labels Oct 20, 2026
StanFromIreland
StanFromIreland reviewed Oct 20, 2026
View reviewed changes
Comment thread Misc/NEWS.d/next/Library/2026-10-20-13-15-00.gh-issue-159894.8Kp4mN.rst Outdated
StanFromIreland
StanFromIreland approved these changes Oct 20, 2026
View reviewed changes

@StanFromIreland StanFromIreland left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

(In the future, please try to avoid force-pushing, see the devguide for more information.)

@StanFromIreland
StanFromIreland enabled auto-merge (squash) October 20, 2026 17:38
@notatallshaw

notatallshaw commented Oct 20, 2026

Copy link
Copy Markdown
Contributor Author

(In the future, please try to avoid force-pushing, see the devguide for more information.)

Noted and apologies, I don't think I've ever got feedback before on updating a pip PR and I was trying to address this quickly so I didn't consult the dev guide.

@StanFromIreland

StanFromIreland commented Oct 20, 2026

Copy link
Copy Markdown
Member

No worries, it's all good here, this isn't a particularly large PR anyway :-)

@Yhg1s Yhg1s added the needs backport to 3.13 only security fixes label Oct 20, 2026
@StanFromIreland
StanFromIreland merged commit 39d7c0f into python:main Oct 20, 2026
60 checks passed
@miss-islington-app

miss-islington-app Bot commented Oct 20, 2026

Copy link
Copy Markdown

Thanks @notatallshaw for the PR, and @StanFromIreland for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14, 3.15.
🐍🍒⛏🤖

@bedevere-app

bedevere-app Bot commented Oct 20, 2026

Copy link
Copy Markdown

GH-159941 is a backport of this pull request to the 3.15 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label Oct 20, 2026
@bedevere-app

bedevere-app Bot commented Oct 20, 2026

Copy link
Copy Markdown

GH-159942 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Oct 20, 2026
@bedevere-app

bedevere-app Bot commented Oct 20, 2026

Copy link
Copy Markdown

GH-159943 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label Oct 20, 2026
hugovk pushed a commit that referenced this pull request Oct 20, 2026
@miss-islington @notatallshaw
[3.14] gh-159894: Upgrade bundled pip to 26.2.2 (GH-159910) (#159942)
ce7dafd 
gh-159894: Upgrade bundled pip to 26.2.2 (GH-159910)
(cherry picked from commit 39d7c0f)

Co-authored-by: Damian Shaw <damian.peter.shaw@gmail.com>
hugovk pushed a commit that referenced this pull request Oct 20, 2026
@miss-islington @notatallshaw
[3.15] gh-159894: Upgrade bundled pip to 26.2.2 (GH-159910) (#159941)
576b233 
gh-159894: Upgrade bundled pip to 26.2.2 (GH-159910)
(cherry picked from commit 39d7c0f)

Co-authored-by: Damian Shaw <damian.peter.shaw@gmail.com>
Yhg1s pushed a commit that referenced this pull request Oct 21, 2026
@miss-islington @notatallshaw
[3.13] gh-159894: Upgrade bundled pip to 26.2.2 (GH-159910) (#159943)
d811ad4 
gh-159894: Upgrade bundled pip to 26.2.2 (GH-159910)
(cherry picked from commit 39d7c0f)

Co-authored-by: Damian Shaw <damian.peter.shaw@gmail.com>
@yosifkit yosifkit mentioned this pull request Oct 21, 2026
Merged
icanhasmath added a commit to ActiveState/cpython that referenced this pull request Oct 28, 2026
@icanhasmath
pythongh-159894: Upgrade bundled pip to 26.2.2 (3.10.22.x)
005744b 
Upstream upgraded ensurepip's bundled pip to 26.2.2 only on 3.13+
(pythonGH-159910, cherry picked to 3.13 as d811ad4); the security-only
3.11 branch kept pip 24.0 and relies on the pythongh-160040 ssl denylist.
3.10 has no upstream release left, and the pip 23.0.1 it bundles
carries a vendored certifi that still trusts the compromised eMudhra
emSign root, so every venv created with ensurepip started out with a
pip that loads those CAs. pip 26.2.2 supports Python >= 3.10.

Wheel sha256 fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70,
matching PyPI and the hash published in the python.org eMudhra
advisory.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hugovk hugovk hugovk approved these changes
@StanFromIreland StanFromIreland StanFromIreland approved these changes
@pfmoore pfmoore Awaiting requested review from pfmoore pfmoore is a code owner
@pradyunsg pradyunsg Awaiting requested review from pradyunsg pradyunsg is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@notatallshaw @StanFromIreland @hugovk @Yhg1s