Repository navigation

pip 21.3.1.post1 (Py3.6): backport seven pip CVEs; vendored certifi 2026.10.19.post1 - #4

Merged

icanhasmath merged 18 commits into

21.3.1.xfrom

21.3.1-security

Oct 22, 2026

Merged

pip 21.3.1.post1 (Py3.6): backport seven pip CVEs; vendored certifi 2026.10.19.post1#4
icanhasmath merged 18 commits into
21.3.1.xfrom
21.3.1-security

Commits on Oct 21, 2026
- Backport CVE-2023-5752: prevent option injection via Mercurial revision
  
  icanhasmath
  and
  claude
  committed
  ceff283
- Backport CVE-2026-1703: use os.path.commonpath in is_within_directory
  
  icanhasmath
  and
  claude
  committed
  1ce8f44
- Backport CVE-2025-8869: validate tar symlink targets during extraction
  
  icanhasmath
  and
  claude
  committed
  dff2368
- Backport CVE-2026-3219: disambiguate tar/zip archive detection in unpack_file
  
  icanhasmath
  and
  claude
  committed
  5e44cc3
- Backport CVE-2026-8643: reject entry point names that escape the scripts dir
  
  icanhasmath
  and
  claude
  committed
  1dd6590
- Backport CVE-2026-13346: stop Link.filename decoding the URL path twice
  
  icanhasmath
  and
  claude
  committed
  afe0929
- Backport CVE-2026-6357: run the self-version check before installing
  
  icanhasmath
  and
  claude
  committed
  fd30acd
- Upgrade vendored certifi to 2026.10.19.post1
  
  icanhasmath
  and
  claude
  committed
  e65adb4
- Release 21.3.1.post1: backport seven pip CVEs; vendored certifi 2026.10.19.post1
  
  icanhasmath
  and
  claude
  committed
  35fd99d
Commits on Oct 22, 2026
- Review: harden CVE-2025-8869 fix against symlink traversal (pypa/pip#14127)
  
  icanhasmath
  and
  claude
  committed
  61f744b
- Review: root-safe path containment for is_within_directory and _script_within_dir
  
  icanhasmath
  and
  claude
  committed
  65f3121
- Review: pass Mercurial revisions as --rev=<rev> (pypa/pip#12373)
  
  icanhasmath
  and
  claude
  committed
  1f35dbc
- Review: run the pre-command version check inside pip's error handling
  
  icanhasmath
  and
  claude
  committed
  fb2e14d
- Review: accept normalized member names in is_symlink_target_in_tar
  
  icanhasmath
  and
  claude
  committed
  960bde6
- Review: report unsafe download file names as a pip error, not a traceback
  
  icanhasmath
  and
  claude
  committed
  188d999
- Review: NEWS — render notes, record review fixes
  
  icanhasmath
  and
  claude
  committed
  440ee95
- Review: stop _tar_member_paths at a fixed point
  
  icanhasmath
  and
  claude
  committed
  e710286
- Review: let a symlink resolve to an explicit archive root
  
  icanhasmath
  and
  claude
  committed
  ac20817

Commits

Commits on Oct 21, 2026

Commits on Oct 22, 2026