Repository navigation
Update bundled pip to 26.0.1 #144538
Description
Python 3.10's bundled pip (23.0.1) and setuptools (79.0.1) contain 5 known security vulnerabilities (CVEs). This is not a problem for the majority of users that can update those dependencies manually but it definitely is for users in managed environments like AWS Lambda.
| CVE ID | Component | Severity | Link |
|---|---|---|---|
| CVE-2023-5752 | pip | Medium | https://nvd.nist.gov/vuln/detail/CVE-2023-5752 |
| CVE-2025-8869 | pip | Moderate | https://ubuntu.com/security/CVE-2025-8869 |
| CVE-2026-1703 | pip | Low | https://nvd.nist.gov/vuln/detail/CVE-2026-1703 |
| CVE-2024-23949 | jaraco-context (setuptools) | High | https://ubuntu.com/security/CVE-2024-23949 |
| CVE-2026-24049 | wheel (setuptools) | High | https://www.thehackerwire.com/vulnerability/CVE-2026-24049/ |
I created a CR for that.
I know it's a big bump on a non execution context but a lot of users need this. I also propose to make a similar bump in all the other affected versions.
Python 3.11 - both pip and setuptools
Python 3.12 - both pip and setuptools
Python 3.13 - only pip
Python 3.14 - only pip
Activity
pfmoore commentedon Feb 6, 2026
I think it's perfectly fine for the pip RM to create the PR that updates ensurepip. It's a simple enough PR to create, and making it the RM's responsibility ensures that we schedule the update based on what happens in the pip release (a great example is this release, where you knew there was going to be a 26.0.1, so we held off creating the PR till that was released).
The CPython policy on ensurepip is simply "include the latest available version of pip", so there's no big question over what the PR should include.
Approving and merging the PR of course has to be done by a CPython core dev, but we have a couple of people who are both pip maintainers and core devs who can handle this, and if none of them are available, the other core devs can do so (often the CPython RM will be interested, and therefore able to help). Generally, I make sure I'm available to do the approve and merge, and I'll happily do so this time as well.
notatallshaw commentedon Feb 7, 2026
Raised #144556
gh-144538: Upgrade bundled pip to 26.0.1 (gh-144556)
pythongh-144538: Upgrade bundled pip to 26.0.1 (pythongh-144556)
pythongh-144538: Upgrade bundled pip to 26.0.1 (pythongh-144556)
[3.14] gh-144538: Upgrade bundled pip to 26.0.1 (gh-144556) (#144562)
[3.13] gh-144538: Upgrade bundled pip to 26.0.1 (gh-144556) (#144561)
hugovk commentedon Feb 7, 2026
pip has been updated to 26.0.1 for Python 3.13-3.15. The next 3.15 release is 10 February, and the next 3.13 and 3.14 are 7 April.
darklight3it commentedon Feb 9, 2026
@hugovk
sorry to answer only now but I got busy during the weekend.
Is there a clear policy about that? Something written about the older support the community agreed upon? I think this rule should be clear and unambiguous.
If it is possible that would be great. I don't know how the user experience will be then.
The user cannot patch the runtimes, they sit on managed Lambda and AWS provides the runtime itself without allowing to run
ensurepip.Users cannot easily move to new python versions and cannot change their model.
In Lambda it's only possible doing that if you are baking your own OCI image.
notatallshaw commentedon Feb 9, 2026
In this example AWS is responsible for the security of the images they are providing, and you should be filing issues with them.
AWS absolutely has the skill and engineering capability to determine which vendored projects should be included in security only releases of CPython.
I would again advise if this is a real issue that CPython remove all vendored projects from source only releases, forcing builders to make a choice about what to include.
pfmoore commentedon Feb 9, 2026
I agree with @notatallshaw here, with the exception that I wouldn't necessarily agree that the bundled pip wheels need to be removed from source-only releases. Making it harder for users to build their own Python from the supplied sources, just because a large organisation like AWS isn't ensuring that their builds (from the same sources) meet their users' needs, seems like the wrong trade-off.
Furthermore, if users can't do
python -m pip install --upgrade pipto upgrade the supplied pip to the latest version, then that would suggest that in the AWS environment, pip is unusable. Which begs the question of why anyone should care about the version of pip bundled with Python in any case.If this is purely about security scanners flagging false positives, then I don't think we should worry about it. Either the scanners can be updated, or the user can acknowledge that this is a false positive and move on.
hugovk commentedon Feb 9, 2026
Yes, https://devguide.python.org/developer-workflow/development-cycle/#security-branches says:
notatallshaw commentedon Feb 9, 2026
If this is a real security issue it is trivial for a builder to download the pip wheel, there are no platform tags to determine or dependencies to resolve, it's a single curl, or equivalent, command.
pythongh-144538: Upgrade bundled pip to 26.0.1 (pythongh-144556)
pythongh-144538: Upgrade bundled pip to 26.0.1 (pythongh-144556)