Repository navigation

pip 26.0.1.post1 (Py3.9): backport four pip CVEs; vendored certifi 2026.10.19 - #7

Merged

icanhasmath merged 12 commits into

26.0.1.xfrom

26.0.1-security

Oct 22, 2026

Merged

pip 26.0.1.post1 (Py3.9): backport four pip CVEs; vendored certifi 2026.10.19#7
icanhasmath merged 12 commits into
26.0.1.xfrom
26.0.1-security

Commits on Oct 21, 2026
- Backport CVE-2026-3219: disambiguate tar/zip archive detection in unpack_file
  
  icanhasmath
  and
  claude
  committed
  2ecdab3
- Backport CVE-2026-8643: reject entry point names that escape the scripts dir
  
  icanhasmath
  and
  claude
  committed
  744cc6a
- Backport CVE-2026-13346: stop Link.filename decoding the URL path twice
  
  icanhasmath
  and
  claude
  committed
  3f09648
- Backport CVE-2026-6357: run the pip self-version check before installing
  
  icanhasmath
  and
  claude
  committed
  4e9db32
- Upgrade vendored certifi to 2026.10.19
  
  icanhasmath
  and
  claude
  committed
  3e9477a
- Release 26.0.1.post1: backport four pip CVEs and vendored certifi 2026.10.19
  
  icanhasmath
  and
  claude
  committed
  d6dd06e
Commits on Oct 22, 2026
- Review: harden the CVE-2025-8869 fix (port pypa/pip#14127)
  
  icanhasmath
  and
  claude
  committed
  dc64865
- Review: root-safe path containment for is_within_directory and _script_within_dir
  
  icanhasmath
  and
  claude
  committed
  4949a21
- Review: accept normalized member names in is_symlink_target_in_tar
  
  icanhasmath
  and
  claude
  committed
  6fd12e2
- Review: report an unsafe download file name as a pip error, not a traceback
  
  icanhasmath
  and
  claude
  committed
  2d186fb
- Review: let _arg_refers_to_pip tolerate a bare ValueError
  
  icanhasmath
  and
  claude
  committed
  49ce20b
- Review: NEWS — render notes, record review fixes
  
  icanhasmath
  and
  claude
  committed
  8bc4ab8

Commits

Commits on Oct 21, 2026

Commits on Oct 22, 2026