Backport security fix from pip 21.1.1

python-pip.spec

@@ -19,7 +19,7 @@ Name:           python-%{srcname}
 # When updating, update the bundled libraries versions bellow!
 # You can use vendor_meta.sh in the dist git repo
 Version:        %{base_version}%{?prerel:~%{prerel}}
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        A tool for installing and managing Python packages
 
 # We bundle a lot of libraries with pip, which itself is under MIT license.
@@ -92,6 +92,13 @@ Patch4:         dummy-certifi.patch
 # this warning is juts moot. Also, the warning breaks CPython test suite.
 Patch5:         nowarn-pip._internal.main.patch
 
+# Don't split git references on unicode separators,
+# which could be maliciously used to install a different revision on the
+# repository.
+# Security patch backported from pip 21.1.1
+# Upstream PR: https://github.com/pypa/pip/pull/9827
+Patch8:         don-t-split-git-references-on-unicode-separators.patch
+
 # Downstream only patch
 # Users might have local installations of pip from using
 # `pip install --user --upgrade pip` on older/newer versions.
@@ -401,6 +408,9 @@ pytest_k='not completion and
 %{python_wheeldir}/%{python_wheelname}
 
 %changelog
+* Mon May 17 2021 Karolina Surma <ksurma@redhat.com> - 20.2.2-2
+- Backport security fix from pip 21.1.1
+
 * Wed Aug 05 2020 Tomas Orsava <torsava@redhat.com> - 20.2.2-1
 - Update to 20.2.2 (#1838553)