Repository navigation

pip 20.3.4.post3: backport CVE-2026-6357 (corrects earlier N/A) - #3

Merged

icanhasmath merged 10 commits into

20.3.4-security-3

Oct 22, 2026

Merged

pip 20.3.4.post3: backport CVE-2026-6357 (corrects earlier N/A)#3
icanhasmath merged 10 commits into
20.3.4.xfrom
20.3.4-security-3

Commits on Oct 21, 2026
- Backport CVE-2026-6357: run the self-version check before the command body
  
  icanhasmath
  and
  claude
  committed
  1fd2bae
- Release 20.3.4.post3: backport CVE-2026-6357
  
  icanhasmath
  and
  claude
  committed
  8448225
Commits on Oct 22, 2026
- Review: harden CVE-2025-8869 fix against symlink traversal (pypa/pip#14127)
  
  icanhasmath
  and
  claude
  committed
  4a2cae2
- Review: root-safe path containment for is_within_directory and _script_within_dir
  
  icanhasmath
  and
  claude
  committed
  ab0d758
- Review: accept normalized member names in is_symlink_target_in_tar
  
  icanhasmath
  and
  claude
  committed
  50b1582
- Review: pass the Mercurial revision as --rev=<rev> (pypa/pip#12373)
  
  icanhasmath
  and
  claude
  committed
  0889b6c
- Review: run the version-check fetch inside pip's error handling
  
  icanhasmath
  and
  claude
  committed
  e6de4a2
- Review: report unsafe download file names as a pip error
  
  icanhasmath
  and
  claude
  committed
  8de4ab1
- Review: NEWS — render notes, record review fixes
  
  icanhasmath
  and
  claude
  committed
  f93643b
- Review: stop _tar_member_paths at a fixed point
  
  icanhasmath
  and
  claude
  committed
  b3080f9