diff --git a/python-pip.spec b/python-pip.spec index 69a90aa..7861c2e 100644 --- a/python-pip.spec +++ b/python-pip.spec @@ -6,7 +6,7 @@ %bcond man 1 %global srcname pip -%global base_version 26.0.1 +%global base_version 26.1.1 %global upstream_version %{base_version}%{?prerel} %global python_wheel_name %{srcname}-%{upstream_version}-py3-none-any.whl @@ -20,7 +20,6 @@ Summary: A tool for installing and managing Python packages # certifi: MPL-2.0 # CacheControl: Apache-2.0 -# dependency-groups: MIT # distlib: Python-2.0.1 # distro: Apache-2.0 # idna: BSD-3-Clause @@ -96,11 +95,6 @@ Patch: dummy-certifi.patch # We don't need a layer to check that, as we're by default in an offline environment Patch: downstream-remove-pytest-subket.patch -# Patch for the bundled urllib3 for CVE-2025-50181 -# Redirects are not disabled when retries are disabled on PoolManager instantiation -# Upstream fix: https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857 -Patch: urllib3-CVE-2025-50181.patch - # Remove -s from Python shebang - ensure that packages installed with pip # to user locations are seen by pip itself %undefine _py3_shebang_s @@ -118,24 +112,23 @@ Packages" or "Pip Installs Python". # %%{_rpmconfigdir}/pythonbundles.py --namespace 'python%%{1}dist' src/pip/_vendor/vendor.txt %global bundled() %{expand: Provides: bundled(python%{1}dist(cachecontrol)) = 0.14.4 -Provides: bundled(python%{1}dist(certifi)) = 2026.1.4 -Provides: bundled(python%{1}dist(dependency-groups)) = 1.3.1 +Provides: bundled(python%{1}dist(certifi)) = 2026.2.25 Provides: bundled(python%{1}dist(distlib)) = 0.4 Provides: bundled(python%{1}dist(distro)) = 1.9 Provides: bundled(python%{1}dist(idna)) = 3.11 Provides: bundled(python%{1}dist(msgpack)) = 1.1.2 -Provides: bundled(python%{1}dist(packaging)) = 26 +Provides: bundled(python%{1}dist(packaging)) = 26.2 Provides: bundled(python%{1}dist(platformdirs)) = 4.5.1 Provides: bundled(python%{1}dist(pygments)) = 2.19.2 Provides: bundled(python%{1}dist(pyproject-hooks)) = 1.2 -Provides: bundled(python%{1}dist(requests)) = 2.32.5 +Provides: bundled(python%{1}dist(requests)) = 2.33.1 Provides: bundled(python%{1}dist(resolvelib)) = 1.2.1 Provides: bundled(python%{1}dist(rich)) = 14.2 Provides: bundled(python%{1}dist(setuptools)) = 70.3 -Provides: bundled(python%{1}dist(tomli)) = 2.3 +Provides: bundled(python%{1}dist(tomli)) = 2.3.1 Provides: bundled(python%{1}dist(tomli-w)) = 1.2 Provides: bundled(python%{1}dist(truststore)) = 0.10.4 -Provides: bundled(python%{1}dist(urllib3)) = 1.26.20 +Provides: bundled(python%{1}dist(urllib3)) = 2.6.3 } # Some manylinux1 wheels need libcrypt.so.1. diff --git a/remove-existing-dist-only-if-path-conflicts.patch b/remove-existing-dist-only-if-path-conflicts.patch index d280f34..02d0c69 100644 --- a/remove-existing-dist-only-if-path-conflicts.patch +++ b/remove-existing-dist-only-if-path-conflicts.patch @@ -1,4 +1,4 @@ -From d5cb806a14bb50a96484bca6536e81f2ac316b9d Mon Sep 17 00:00:00 2001 +From a12217cf8f9bf3ab8e39d9bcc6b42e7043e79b08 Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Wed, 16 Feb 2022 08:36:21 +0100 Subject: [PATCH] Prevent removing of the system packages installed under @@ -53,10 +53,10 @@ index 230e114..8bd5d31 100644 class BaseEnvironment: """An environment containing distributions to introspect.""" diff --git a/src/pip/_internal/req/req_install.py b/src/pip/_internal/req/req_install.py -index c9f6bff..c101826 100644 +index aad2f0e..7b385b1 100644 --- a/src/pip/_internal/req/req_install.py +++ b/src/pip/_internal/req/req_install.py -@@ -453,7 +453,7 @@ class InstallRequirement: +@@ -439,7 +439,7 @@ class InstallRequirement: f"lack sys.path precedence to {existing_dist.raw_name} " f"in {existing_dist.location}" ) @@ -66,7 +66,7 @@ index c9f6bff..c101826 100644 else: if self.editable: diff --git a/src/pip/_internal/resolution/legacy/resolver.py b/src/pip/_internal/resolution/legacy/resolver.py -index 33a4fdc..1fe886e 100644 +index 6cc6311..4188ef1 100644 --- a/src/pip/_internal/resolution/legacy/resolver.py +++ b/src/pip/_internal/resolution/legacy/resolver.py @@ -322,7 +322,9 @@ class Resolver(BaseResolver): @@ -81,11 +81,11 @@ index 33a4fdc..1fe886e 100644 req.satisfied_by = None diff --git a/src/pip/_internal/resolution/resolvelib/factory.py b/src/pip/_internal/resolution/resolvelib/factory.py -index f23e4cd..1bada79 100644 +index a74200a..99738cc 100644 --- a/src/pip/_internal/resolution/resolvelib/factory.py +++ b/src/pip/_internal/resolution/resolvelib/factory.py -@@ -3,6 +3,8 @@ from __future__ import annotations - import contextlib +@@ -4,6 +4,8 @@ import contextlib + import copy import functools import logging +import sys @@ -93,7 +93,7 @@ index f23e4cd..1bada79 100644 from collections.abc import Iterable, Iterator, Mapping, Sequence from typing import ( TYPE_CHECKING, -@@ -615,6 +617,16 @@ class Factory: +@@ -674,6 +676,16 @@ class Factory: if dist is None: # Not installed, no uninstallation required. return None @@ -111,5 +111,5 @@ index f23e4cd..1bada79 100644 # be uninstalled, no matter it's in global or user site, because the # user site installation has precedence over global. -- -2.50.1 +2.54.0 diff --git a/sources b/sources index 5cd1652..a50ad4c 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ -SHA512 (pip-26.0.1.tar.gz) = 3786df7522ea65bc20fb9885ce5c2ddc60200a536a1f754a8d7dc278115c73258863e4c51ac7e9a60dda0b70263730dc194f70e1e8f8d00178a8b3c724333bf0 SHA512 (setuptools-79.0.1-py3-none-any.whl) = fef6cfc6f95a5bb7320f1680e1c665cb8d9a4e4227cde4d8aab8a50bed4bcf04320085b9d7d5343359f887008db5c5a861e57f3d08b7b0b2311a28adaeee6b4a SHA512 (flit_core-3.12.0-py3-none-any.whl) = 790c12b1f43201e365fb3f8f2f0a54e1a578876799dfdf8bfeea679a25ea096bf62946d006618c1458ae6e37ce6d00998f37e9aba426d5ab80d32ef2d75da4e0 +SHA512 (pip-26.1.1.tar.gz) = 777fab14b5e7e7edeffbc7ae86f4e6061e9f7cf43adcaebcb4d099c184c4f2ad6a63019a70d95b98b631821c3472713c9545fb8d65b684da67cfc31ee9293054 SHA512 (coverage-0-py3-none-any.whl) = e734192565347010efe68f8ba600254259c9b647f3c553fd4e5d87b1d7f955cb15d6f7d807716f4a6415d239beed945fbec7210feaf502e9cc849c332845926e diff --git a/urllib3-CVE-2025-50181.patch b/urllib3-CVE-2025-50181.patch deleted file mode 100644 index 05e6353..0000000 --- a/urllib3-CVE-2025-50181.patch +++ /dev/null @@ -1,51 +0,0 @@ -From b3d543d7e16af844394316360ef1bf0b9d10f1b1 Mon Sep 17 00:00:00 2001 -From: Illia Volochii -Date: Wed, 18 Jun 2025 16:25:01 +0300 -Subject: [PATCH] Security fix for CVE-2025-50181 - -Co-authored-by: Seth Michael Larson -Co-authored-by: Quentin Pradet -Co-authored-by: Seth Michael Larson ---- - src/pip/_vendor/urllib3/poolmanager.py | 18 +++++++++++++++++- - 1 file changed, 17 insertions(+), 1 deletion(-) - -diff --git a/src/pip/_vendor/urllib3/poolmanager.py b/src/pip/_vendor/urllib3/poolmanager.py -index fb51bf7..a8de7c6 100644 ---- a/src/pip/_vendor/urllib3/poolmanager.py -+++ b/src/pip/_vendor/urllib3/poolmanager.py -@@ -170,6 +170,22 @@ class PoolManager(RequestMethods): - - def __init__(self, num_pools=10, headers=None, **connection_pool_kw): - RequestMethods.__init__(self, headers) -+ if "retries" in connection_pool_kw: -+ retries = connection_pool_kw["retries"] -+ if not isinstance(retries, Retry): -+ # When Retry is initialized, raise_on_redirect is based -+ # on a redirect boolean value. -+ # But requests made via a pool manager always set -+ # redirect to False, and raise_on_redirect always ends -+ # up being False consequently. -+ # Here we fix the issue by setting raise_on_redirect to -+ # a value needed by the pool manager without considering -+ # the redirect boolean. -+ raise_on_redirect = retries is not False -+ retries = Retry.from_int(retries, redirect=False) -+ retries.raise_on_redirect = raise_on_redirect -+ connection_pool_kw = connection_pool_kw.copy() -+ connection_pool_kw["retries"] = retries - self.connection_pool_kw = connection_pool_kw - self.pools = RecentlyUsedContainer(num_pools) - -@@ -389,7 +405,7 @@ class PoolManager(RequestMethods): - kw["body"] = None - kw["headers"] = HTTPHeaderDict(kw["headers"])._prepare_for_method_change() - -- retries = kw.get("retries") -+ retries = kw.get("retries", response.retries) - if not isinstance(retries, Retry): - retries = Retry.from_int(retries, redirect=redirect) - --- -2.51.0 -