diff mbox series

[08/12] python3-pip: upgrade 26.2.2 -> 26.3

Message ID 20261103092800.39286-9-jaipaul.cheernam@est.tech
State New
Headers show
Series Upgrades on 3rd Nov | expand

Commit Message

Jaipaul Cheernam Nov. 3, 2026, 9:27 a.m. UTC 
26.3 (2026-11-02)
=================

Improved Documentation
----------------------

- Clarify in the security policy that pip has never considered installing
  untrusted wheels safe. This is because Python's import system is dynamic, so
  pip cannot guarantee that installing a wheel will not execute third-party
  code. (`#14412 < >`_)

Deprecations and Removals
-------------------------

- Block unexpected imports during installation, warn about unsafe imports
  afterward, and improve recovery from interrupted installations. (`#13842 <
  >`_)

Features
--------

- Show build backend warnings for local source directories and log them at debug
  level for other sources. (`#14372 < >`_)
- Add support for selecting extras in pylock.toml files with ``-r
  pylock.toml[extra1,extra2]``. (`#14205 < >`_)
- Allow ``--group`` to select non-default groups from local pylock files,
  e.g. ``--group pylock.toml:docs``. (`#14390 < >`_)
- Support ``--no-binary`` with ``-r pylock.toml``. Before, pip would get the
  sdist from the index instead of the locked URL, or fail if no wheel were
  available in the lock file. (`#14187 < >`_)
- Speed up installing a wheel with console scripts by not resolving every
  ``PATH`` entry. (`#14235 < >`_)
- Clarify the warning for ``~``-prefixed leftover distribution directories.
  (`#11849 < >`_)

Bug Fixes
---------

- Report build-backend import failures as pip errors instead of displaying an
  uncaught traceback. (`#12248 < >`_)
- No longer log the "pip is looking at multiple versions of a package" message
  until pip has looked at at least two versions of that package. (`#12928 < >`_)
- Fix ``pip``'s self version check reporting an outdated version from the
  environment instead of the running pip when run as a zipapp. (`#13084 < >`_)
- Fix a fatal error when using the ``PIP_CONFIG_FILE`` environment variable with
  ``pip config set``. (`#13279 < >`_)
- Avoid misleading error messages that include extra markers such as
  ``; extra == "..."`` when installing packages. (`#13618 < >`_)
- When installing to a custom ``--prefix``, use the ``posix_prefix`` scheme
  when running from a Debian patched Python distribution to avoid a superfluous
  ``/local/`` subdirectory. (`#13634 < >`_)
- Refuse to follow an HTTP redirect to a ``file:`` URL. (`#14171 < >`_)
- Prevent wheel cache origin mismatch warnings from exposing URL credentials.
  (`#14232 < >`_)
- Report the incomplete-download error on Windows, not a ``PermissionError``.
  (`#14237 < >`_)
- Fix the global configuration location on macOS in virtual environments created
  from Homebrew Python. (`#14303 < >`_)
- Reject extra arguments to ``pip config edit`` instead of silently ignoring
  them. (`#14347 < >`_)
- Honor supplied hashes when using ``--no-require-hashes``. (`#14355 < >`_)
- Fix wheel installation with data files when the installation prefix is a
  filesystem root. (`#14358 < >`_)
- Restore support for UTF-8 configuration files when Python's UTF-8 mode is
  enabled. (`#14367 < >`_)
- Restore vendored Requests' PyOpenSSL fallback on non-Windows systems without
  importing PyOpenSSL on Windows. (`#14402 < >`_)
- Respect configured network settings while checking build constraint files.
  (`#14403 < >`_)
- Apply PyPI's direct URL dependency restriction to extras and cached wheels.
  (`#14341 < >`_)
- Fix a crash when installing or uninstalling a distribution with an invalid
  entry point. (`#8573 < >`_)
- Fail with a clearer error message on invalid configuration values. (`#8671 <
  >`_)
- Keep ``--version`` available only for pip and prevent its use in subcommands.
  (`#9456 < >`_)

Vendored Libraries
------------------

- Upgrade certifi to 2026.10.23
- Upgrade distlib to 0.4.4
- Upgrade idna to 3.20
- Upgrade msgpack to 1.2.4
- Upgrade packaging to 26.3
- Upgrade platformdirs to 4.12.4
- Upgrade pygments to 2.21.0
- Upgrade pyproject-hooks to 1.3.3
- Upgrade rich to 15.0.0
- Downgrade tomli to 2.3.2 to retain TOML 1.0 parsing on Python 3.10.
- Upgrade truststore to 0.10.5
- Upgrade urllib3 to 2.8.0

Process
-------

- Allow pip itself to be built with flit-core 4.

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 .../python/python3-pip/no_shebang_mangling.patch            | 6 +++---
 .../python/{python3-pip_26.2.2.bb => python3-pip_26.3.bb}   | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)
 rename meta/recipes-devtools/python/{python3-pip_26.2.2.bb => python3-pip_26.3.bb} (97%)
diff mbox series

Patch

diff --git a/meta/recipes-devtools/python/python3-pip/no_shebang_mangling.patch b/meta/recipes-devtools/python/python3-pip/no_shebang_mangling.patch
index f388928230..998d8a73cf 100644
--- a/meta/recipes-devtools/python/python3-pip/no_shebang_mangling.patch
+++ b/meta/recipes-devtools/python/python3-pip/no_shebang_mangling.patch
@@ -1,4 +1,4 @@ 
-From ea75b7fc017f7a1a3a47e9e2bef21209f0f36a04 Mon Sep 17 00:00:00 2001
+From 717c440db8787fda9fb2abf207fe894e291ce0f0 Mon Sep 17 00:00:00 2001
 From: Richard Purdie <richard.purdie@linuxfoundation.org>
 Date: Wed, 23 Feb 2022 12:27:06 +0000
 Subject: [PATCH] python3-pip: Don't change shebang
@@ -13,7 +13,7 @@  Upstream-Status: Inappropriate [OE specific config]
  1 file changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/src/pip/_vendor/distlib/scripts.py b/src/pip/_vendor/distlib/scripts.py
-index ac9e909..1faa5b6 100644
+index 0338012..64b00a2 100644
 --- a/src/pip/_vendor/distlib/scripts.py
 +++ b/src/pip/_vendor/distlib/scripts.py
 @@ -157,6 +157,8 @@ class ScriptMaker(object):
@@ -25,7 +25,7 @@  index ac9e909..1faa5b6 100644
          if os.name != 'posix':
              simple_shebang = True
          elif getattr(sys, "cross_compiling", False):
-@@ -367,7 +369,7 @@ class ScriptMaker(object):
+@@ -373,7 +375,7 @@ class ScriptMaker(object):
                  return
  
              match = FIRST_LINE_RE.match(first_line.replace(b'\r\n', b'\n'))
diff --git a/meta/recipes-devtools/python/python3-pip_26.2.2.bb b/meta/recipes-devtools/python/python3-pip_26.3.bb
similarity index 97%
rename from meta/recipes-devtools/python/python3-pip_26.2.2.bb
rename to meta/recipes-devtools/python/python3-pip_26.3.bb
index c83c9e4468..a6ce6a1fbc 100644
--- a/meta/recipes-devtools/python/python3-pip_26.2.2.bb
+++ b/meta/recipes-devtools/python/python3-pip_26.3.bb
@@ -26,7 +26,7 @@  inherit pypi python_flit_core
 
 SRC_URI += "file://no_shebang_mangling.patch"
 
-SRC_URI[sha256sum] = "3a8e5c800492787f33a4114ef54444546c340df428974ebba17e0fd47e11af2f"
+SRC_URI[sha256sum] = "6c36ae7da8695be67e3cd9f7d87919667ced53f57ce2ede75d89b5912ed2bc4c"
 
 CVE_PRODUCT = "pypa:pip"