diff --git a/.fmf/version b/.fmf/version
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/.fmf/version
@@ -0,0 +1 @@
+1
diff --git a/.gitignore b/.gitignore
index 8e24ed4..72d39d5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,4 +4,4 @@
 /pip/
 /results_python-pip/
 *.rpm
-
+*.whl
diff --git a/downstream-remove-pytest-subket.patch b/downstream-remove-pytest-subket.patch
new file mode 100644
index 0000000..564794c
--- /dev/null
+++ b/downstream-remove-pytest-subket.patch
@@ -0,0 +1,54 @@
+From 35378ae02912d704d466e4809070e17a8d13ad0a Mon Sep 17 00:00:00 2001
+From: Karolina Surma <ksurma@redhat.com>
+Date: Thu, 7 Aug 2025 15:05:34 +0200
+Subject: [PATCH] Downstream-Only: Remove pytest-subket from tests
+
+---
+ tests/conftest.py | 17 -----------------
+ 1 file changed, 17 deletions(-)
+
+diff --git a/tests/conftest.py b/tests/conftest.py
+index c98b871..ada7a7e 100644
+--- a/tests/conftest.py
++++ b/tests/conftest.py
+@@ -451,18 +451,6 @@ def coverage_install(
+     return _common_wheel_editable_install(tmpdir_factory, common_wheels, "coverage")
+ 
+ 
+-@pytest.fixture(scope="session")
+-def socket_install(tmpdir_factory: pytest.TempPathFactory, common_wheels: Path) -> Path:
+-    lib_dir = _common_wheel_editable_install(
+-        tmpdir_factory, common_wheels, "pytest_subket"
+-    )
+-    # pytest-subket is only included so it can intercept and block unexpected
+-    # network requests. It should NOT be visible to the pip under test.
+-    dist_info = next(lib_dir.glob("*.dist-info"))
+-    shutil.rmtree(dist_info)
+-    return lib_dir
+-
+-
+ def install_pth_link(
+     venv: VirtualEnvironment, project_name: str, lib_dir: Path
+ ) -> None:
+@@ -480,7 +468,6 @@ def virtualenv_template(
+     setuptools_install: Path,
+     wheel_install: Path,
+     coverage_install: Path,
+-    socket_install: Path,
+ ) -> VirtualEnvironment:
+     venv_type: VirtualEnvironmentType
+     if request.config.getoption("--use-venv"):
+@@ -495,10 +482,6 @@ def virtualenv_template(
+     # Install setuptools, wheel, pytest-subket, and pip.
+     install_pth_link(venv, "setuptools", setuptools_install)
+     install_pth_link(venv, "wheel", wheel_install)
+-    install_pth_link(venv, "pytest_subket", socket_install)
+-    # Also copy pytest-subket's .pth file so it can intercept socket calls.
+-    with open(venv.site / "pytest_socket.pth", "w") as f:
+-        f.write(socket_install.joinpath("pytest_socket.pth").read_text())
+ 
+     pth, dist_info = pip_editable_parts
+ 
+-- 
+2.50.1
+
diff --git a/dummy-certifi.patch b/dummy-certifi.patch
index 8896ce8..ce34415 100644
--- a/dummy-certifi.patch
+++ b/dummy-certifi.patch
@@ -1,31 +1,32 @@
-From 09c983fdeabe3fa0b90b73f32ddf84a61e498e09 Mon Sep 17 00:00:00 2001
+From 7b5fbac83944e3a0dd975ff17b69358791b68721 Mon Sep 17 00:00:00 2001
 From: Karolina Surma <ksurma@redhat.com>
-Date: Tue, 15 Nov 2022 09:22:46 +0100
+Date: Thu, 27 Jun 2024 10:38:53 +0200
 Subject: [PATCH] Dummy certifi patch
 
 ---
- src/pip/_vendor/certifi/core.py | 105 ++------------------------------
- 1 file changed, 6 insertions(+), 99 deletions(-)
+ src/pip/_vendor/certifi/core.py | 80 +++------------------------------
+ 1 file changed, 6 insertions(+), 74 deletions(-)
 
 diff --git a/src/pip/_vendor/certifi/core.py b/src/pip/_vendor/certifi/core.py
-index c3e5466..eb297f7 100644
+index 2f2f7e0..bec6595 100644
 --- a/src/pip/_vendor/certifi/core.py
 +++ b/src/pip/_vendor/certifi/core.py
-@@ -4,105 +4,12 @@ certifi.py
+@@ -4,80 +4,12 @@ certifi.py
  
  This module returns the installation location of cacert.pem or its contents.
  """
 -import sys
+-import atexit
  
+-def exit_cacert_ctx() -> None:
+-    _CACERT_CTX.__exit__(None, None, None)  # type: ignore[union-attr]
 +# The RPM-packaged certifi always uses the system certificates
 +def where() -> str:
-+    return '/etc/pki/tls/certs/ca-bundle.crt'
++    return '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem'
+ 
  
 -if sys.version_info >= (3, 11):
-+def contents() -> str:
-+    with open(where(), encoding='utf=8') as data:
-+        return data.read()
- 
+-
 -    from importlib.resources import as_file, files
 -
 -    _CACERT_CTX = None
@@ -52,13 +53,14 @@ index c3e5466..eb297f7 100644
 -            # we will also store that at the global level as well.
 -            _CACERT_CTX = as_file(files("pip._vendor.certifi").joinpath("cacert.pem"))
 -            _CACERT_PATH = str(_CACERT_CTX.__enter__())
+-            atexit.register(exit_cacert_ctx)
 -
 -        return _CACERT_PATH
 -
 -    def contents() -> str:
 -        return files("pip._vendor.certifi").joinpath("cacert.pem").read_text(encoding="ascii")
 -
--elif sys.version_info >= (3, 7):
+-else:
 -
 -    from importlib.resources import path as get_path, read_text
 -
@@ -87,42 +89,15 @@ index c3e5466..eb297f7 100644
 -            # we will also store that at the global level as well.
 -            _CACERT_CTX = get_path("pip._vendor.certifi", "cacert.pem")
 -            _CACERT_PATH = str(_CACERT_CTX.__enter__())
+-            atexit.register(exit_cacert_ctx)
 -
 -        return _CACERT_PATH
 -
 -    def contents() -> str:
 -        return read_text("pip._vendor.certifi", "cacert.pem", encoding="ascii")
--
--else:
--    import os
--    import types
--    from typing import Union
--
--    Package = Union[types.ModuleType, str]
--    Resource = Union[str, "os.PathLike"]
--
--    # This fallback will work for Python versions prior to 3.7 that lack the
--    # importlib.resources module but relies on the existing `where` function
--    # so won't address issues with environments like PyOxidizer that don't set
--    # __file__ on modules.
--    def read_text(
--        package: Package,
--        resource: Resource,
--        encoding: str = 'utf-8',
--        errors: str = 'strict'
--    ) -> str:
--        with open(where(), encoding=encoding) as data:
--            return data.read()
--
--    # If we don't have importlib.resources, then we will just do the old logic
--    # of assuming we're on the filesystem and munge the path directly.
--    def where() -> str:
--        f = os.path.dirname(__file__)
--
--        return os.path.join(f, "cacert.pem")
--
--    def contents() -> str:
--        return read_text("pip._vendor.certifi", "cacert.pem", encoding="ascii")
++def contents() -> str:
++    with open(where(), encoding='utf=8') as data:
++        return data.read()
 -- 
-2.37.3
+2.50.1
 
diff --git a/no-version-warning.patch b/no-version-warning.patch
deleted file mode 100644
index 6c34bec..0000000
--- a/no-version-warning.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/src/pip/_vendor/packaging/version.py b/src/pip/_vendor/packaging/version.py
-index de9a09a..154e94d 100644
---- a/src/pip/_vendor/packaging/version.py
-+++ b/src/pip/_vendor/packaging/version.py
-@@ -108,11 +108,6 @@ class LegacyVersion(_BaseVersion):
-         self._version = str(version)
-         self._key = _legacy_cmpkey(self._version)
- 
--        warnings.warn(
--            "Creating a LegacyVersion has been deprecated and will be "
--            "removed in the next major release",
--            DeprecationWarning,
--        )
- 
-     def __str__(self) -> str:
-         return self._version
diff --git a/nowarn-pip._internal.main.patch b/nowarn-pip._internal.main.patch
deleted file mode 100644
index 68f5971..0000000
--- a/nowarn-pip._internal.main.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From 8dd3793d1bab226cec9c5c49b01718a9634bc403 Mon Sep 17 00:00:00 2001
-From: Karolina Surma <ksurma@redhat.com>
-Date: Mon, 10 May 2021 16:48:49 +0200
-Subject: [PATCH] Don't warn the user about pip._internal.main() entrypoint
-
-In Fedora, we use that in ensurepip and users cannot do anything about it,
-this warning is juts moot. Also, the warning breaks CPython test suite.
-
-Co-Authored-By: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
----
- src/pip/_internal/__init__.py          |  2 +-
- src/pip/_internal/utils/entrypoints.py | 19 ++++++++++---------
- tests/functional/test_cli.py           |  3 ++-
- 3 files changed, 13 insertions(+), 11 deletions(-)
-
-diff --git a/src/pip/_internal/__init__.py b/src/pip/_internal/__init__.py
-index 6afb5c6..faf25af 100755
---- a/src/pip/_internal/__init__.py
-+++ b/src/pip/_internal/__init__.py
-@@ -16,4 +16,4 @@ def main(args: (Optional[List[str]]) = None) -> int:
-     """
-     from pip._internal.utils.entrypoints import _wrapper
- 
--    return _wrapper(args)
-+    return _wrapper(args, _nowarn=True)
-diff --git a/src/pip/_internal/utils/entrypoints.py b/src/pip/_internal/utils/entrypoints.py
-index f292c64..2e29a5e 100644
---- a/src/pip/_internal/utils/entrypoints.py
-+++ b/src/pip/_internal/utils/entrypoints.py
-@@ -20,7 +20,7 @@ if WINDOWS:
-     ]
- 
- 
--def _wrapper(args: Optional[List[str]] = None) -> int:
-+def _wrapper(args: Optional[List[str]] = None, _nowarn: bool = False) -> int:
-     """Central wrapper for all old entrypoints.
- 
-     Historically pip has had several entrypoints defined. Because of issues
-@@ -32,14 +32,15 @@ def _wrapper(args: Optional[List[str]] = None) -> int:
-     directing them to an appropriate place for help, we now define all of
-     our old entrypoints as wrappers for the current one.
-     """
--    sys.stderr.write(
--        "WARNING: pip is being invoked by an old script wrapper. This will "
--        "fail in a future version of pip.\n"
--        "Please see https://github.com/pypa/pip/issues/5599 for advice on "
--        "fixing the underlying issue.\n"
--        "To avoid this problem you can invoke Python with '-m pip' instead of "
--        "running pip directly.\n"
--    )
-+    if not _nowarn:
-+        sys.stderr.write(
-+            "WARNING: pip is being invoked by an old script wrapper. This will "
-+            "fail in a future version of pip.\n"
-+            "Please see https://github.com/pypa/pip/issues/5599 for advice on "
-+            "fixing the underlying issue.\n"
-+            "To avoid this problem you can invoke Python with '-m pip' instead of "
-+            "running pip directly.\n"
-+        )
-     return main(args)
- 
- 
-diff --git a/tests/functional/test_cli.py b/tests/functional/test_cli.py
-index 3e85703..f86c392 100644
---- a/tests/functional/test_cli.py
-+++ b/tests/functional/test_cli.py
-@@ -43,4 +43,5 @@ def test_entrypoints_work(entrypoint: str, script: PipTestEnvironment) -> None:
-     result = script.pip("-V")
-     result2 = script.run("fake_pip", "-V", allow_stderr_warning=True)
-     assert result.stdout == result2.stdout
--    assert "old script wrapper" in result2.stderr
-+    if entrypoint[0] != "fake_pip = pip._internal:main":
-+        assert "old script wrapper" in result2.stderr
--- 
-2.35.3
-
diff --git a/plan.fmf b/plan.fmf
new file mode 100644
index 0000000..72ad07b
--- /dev/null
+++ b/plan.fmf
@@ -0,0 +1,111 @@
+execute:
+  how: tmt
+
+discover:
+  - name: tests_python
+    how: shell
+    url: https://src.fedoraproject.org/tests/python.git
+    tests:
+    - name: smoke36
+      path: /smoke
+      test: VERSION=3.6 TOX=false ./venv.sh
+    - name: smoke39
+      path: /smoke
+      test: VERSION=3.9 ./venv.sh
+    - name: smoke310
+      path: /smoke
+      test: VERSION=3.10 ./venv.sh
+    - name: smoke311
+      path: /smoke
+      test: VERSION=3.11 ./venv.sh
+    - name: smoke312
+      path: /smoke
+      test: VERSION=3.12 ./venv.sh
+    - name: smoke313
+      path: /smoke
+      test: VERSION=3.13 ./venv.sh
+    - name: smoke314
+      path: /smoke
+      test: VERSION=3.14 ./venv.sh
+    - name: smoke315
+      path: /smoke
+      test: VERSION=3.15 ./venv.sh
+    - name: smoke39_virtualenv
+      path: /smoke
+      test: VERSION=3.9 METHOD=virtualenv ./venv.sh
+    - name: smoke310_virtualenv
+      path: /smoke
+      test: VERSION=3.10 METHOD=virtualenv ./venv.sh
+    - name: smoke311_virtualenv
+      path: /smoke
+      test: VERSION=3.11 METHOD=virtualenv ./venv.sh
+    - name: smoke312_virtualenv
+      path: /smoke
+      test: VERSION=3.12 METHOD=virtualenv ./venv.sh
+    - name: smoke313_virtualenv
+      path: /smoke
+      test: VERSION=3.13 METHOD=virtualenv ./venv.sh
+    - name: smoke314_virtualenv
+      path: /smoke
+      test: VERSION=3.14 METHOD=virtualenv ./venv.sh
+    - name: smoke315_virtualenv
+      path: /smoke
+      test: VERSION=3.15 METHOD=virtualenv ./venv.sh
+  - name: rpms_pyproject-rpm-macros
+    how: shell
+    url: https://src.fedoraproject.org/rpms/pyproject-rpm-macros.git
+    tests:
+    - name: pyproject_pytest
+      path: /tests
+      test: ./mocktest.sh python-pytest
+    - name: pyproject_entrypoints
+      path: /tests
+      test: ./mocktest.sh python-entrypoints
+    - name: pyproject_pluggy
+      path: /tests
+      test: ./mocktest.sh python-pluggy
+    - name: pyproject_clikit
+      path: /tests
+      test: ./mocktest.sh python-clikit
+  - name: same_repo
+    how: shell
+    dist-git-source: true
+    dist-git-download-only: true
+    tests:
+    - name: mock_bootstrap_build
+      test: |
+        cd $TMT_SOURCE_DIR &&
+        $TMT_TREE/../discover/rpms_pyproject-rpm-macros/tests/tests/mocktest.sh python-pip --without tests --without man
+    - name: pip_install_upgrade
+      path: /tests/pip_install_upgrade/
+      test: ./runtest.sh
+    - name: bash_completion
+      path: /tests/bash_completion
+      test: ./pip_completion_full_test.sh
+prepare:
+  - name: Install dependencies
+    how: install
+    package:
+    - gcc
+    - virtualenv
+    - python3.6-devel
+    - python3.9-devel
+    - python3.10-devel
+    - python3.11-devel
+    - python3.12-devel
+    - python3.13-devel
+    - python3.14-devel
+    - python3.15-devel
+    - python3-devel
+    - python3-tox
+    - mock
+    - rpmdevtools
+    - rpm-build
+    - grep
+    - util-linux
+    - shadow-utils
+    - expect
+    - dnf
+  - name: Update packages
+    how: shell
+    script: dnf upgrade -y
diff --git a/python-pip.spec b/python-pip.spec
index 452ec3d..8dc0aff 100644
--- a/python-pip.spec
+++ b/python-pip.spec
@@ -1,12 +1,12 @@
 # The original RHEL N+1 content set is defined by (build)dependencies
-# of the packages in Fedora ELN. Hence we disable tests and documentation here
+# of the packages in Fedora ELN. Hence we disable tests here
 # to prevent pulling many unwanted packages in.
-# We intentionally keep this enabled on EPEL.
-%bcond tests %[%{defined fedora} || %{defined epel}]
-%bcond doc %[%{defined fedora} || %{defined epel}]
+%bcond tests %{defined fedora}
+# Whether to build the manual pages (useful for bootstrapping Sphinx)
+%bcond man 1
 
 %global srcname pip
-%global base_version 23.3.2
+%global base_version 25.3
 %global upstream_version %{base_version}%{?prerel}
 %global python_wheel_name %{srcname}-%{upstream_version}-py3-none-any.whl
 
@@ -18,38 +18,56 @@ Summary:        A tool for installing and managing Python packages
 # We bundle a lot of libraries with pip, which itself is under MIT license.
 # Here is the list of the libraries with corresponding licenses:
 
-# appdirs: MIT
 # certifi: MPL-2.0
-# chardet: LGPL-2.1-only
-# colorama: BSD-3-Clause
 # CacheControl: Apache-2.0
+# dependency-groups: MIT
 # distlib: Python-2.0.1
 # distro: Apache-2.0
-# html5lib: MIT
 # idna: BSD-3-Clause
-# ipaddress: Python-2.0.1
 # msgpack: Apache-2.0
 # packaging: Apache-2.0 OR BSD-2-Clause
-# progress: ISC
+# platformdirs: MIT
 # pygments: BSD-2-Clause
-# pyparsing: MIT
 # pyproject-hooks: MIT
 # requests: Apache-2.0
 # resolvelib: ISC
 # rich: MIT
 # setuptools: MIT
-# six: MIT
-# tenacity: Apache-2.0
 # truststore: MIT
 # tomli: MIT
-# typing-extensions: Python-2.0.1
+# tomli-w: MIT
 # urllib3: MIT
-# webencodings: BSD-3-Clause
 
-License:        MIT AND Python-2.0.1 AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause)
+License:        MIT AND Python-2.0.1 AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause)
 URL:            https://pip.pypa.io/
 Source0:        https://github.com/pypa/pip/archive/%{upstream_version}/%{srcname}-%{upstream_version}.tar.gz
 
+# The following sources are wheels used only for tests.
+# They are not bundled in the built package and do not contribute to the overall license.
+# They are pre-built but only contain text files, rebuilding them in %%build has very little benefit.
+
+# setuptools.whl
+# We cannot use RPM-packaged python-setuptools-wheel because upstream pins to <80.
+# See https://github.com/pypa/pip/pull/13357 for rationale.
+Source1:        https://files.pythonhosted.org/packages/0d/6d/b4752b044bf94cb802d88a888dc7d288baaf77d7910b7dedda74b5ceea0c/setuptools-79.0.1-py3-none-any.whl
+
+# wheel.whl
+# We cannot use RPM-packaged python-wheel-wheel because we intent to drop that package in wheel 0.46+.
+# That version of wheel has runtime dependencies and is generally useless as a standalone wheel.
+# See https://github.com/pypa/pip/pull/13382 as an attempt to drop the requirement from pip tests.
+Source2:        https://files.pythonhosted.org/packages/0b/2c/87f3254fd8ffd29e4c02732eee68a83a1d3c346ae39bc6822dcbcb697f2b/wheel-0.45.1-py3-none-any.whl
+
+# flit_core.whl
+# This is not built as RPM-packaged wheel in Fedora at all.
+Source3:        https://files.pythonhosted.org/packages/f2/65/b6ba90634c984a4fcc02c7e3afe523fef500c4980fec67cc27536ee50acf/flit_core-3.12.0-py3-none-any.whl
+
+# coverage.whl
+# There is no RPM-packaged python-coverage-wheel, the package is archful.
+# Upstream uses this to measure coverage, which we don't.
+# This is a dummy placeholder package that only contains empty coverage.process_startup().
+# That way, we don't need to patch the usage out of conftest.py.
+Source4:        coverage-0-py3-none-any.whl
+
 BuildArch:      noarch
 
 %if %{with tests}
@@ -57,8 +75,15 @@ BuildRequires:  /usr/bin/git
 BuildRequires:  /usr/bin/hg
 BuildRequires:  /usr/bin/bzr
 BuildRequires:  /usr/bin/svn
-BuildRequires:  python-setuptools-wheel
-BuildRequires:  python-wheel-wheel
+BuildRequires:  python%{python3_pkgversion}-pytest-xdist
+%endif
+
+%if %{with man}
+# docs/requirements.txt contains many sphinx extensions
+# however, we only build the manual pages thanks to
+# https://github.com/pypa/pip/pull/13168
+# We also always use the "main" Sphinx, not python%%{python3_pkgversion}-sphinx
+BuildRequires:  python3-sphinx
 %endif
 
 # Prevent removing of the system packages installed under /usr/lib
@@ -72,15 +97,19 @@ Patch:          remove-existing-dist-only-if-path-conflicts.patch
 # The same patch is a part of the RPM-packaged python-certifi
 Patch:          dummy-certifi.patch
 
-# Don't warn the user about pip._internal.main() entrypoint
-# In Fedora, we use that in ensurepip and users cannot do anything about it,
-# this warning is juts moot. Also, the warning breaks CPython test suite.
-Patch:          nowarn-pip._internal.main.patch
+# pytest-subket has been introduced to intercept network calls
+# https://github.com/pypa/pip/commit/a4b40f62332ccb3228b12cc5ae1493c75177247a
+# We don't need a layer to check that, as we're by default in an offline environment
+Patch:          downstream-remove-pytest-subket.patch
 
-# Don't warn the user about packaging's LegacyVersion being deprecated.
-# (This also breaks Python's test suite when warnings are treated as errors.)
-# Upstream issue: https://github.com/pypa/packaging/issues/368
-Patch:          no-version-warning.patch
+# Patch for the bundled urllib3 for CVE-2025-50181
+# Redirects are not disabled when retries are disabled on PoolManager instantiation
+# Upstream fix: https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857
+Patch:          urllib3-CVE-2025-50181.patch
+
+# Remove -s from Python shebang - ensure that packages installed with pip
+# to user locations are seen by pip itself
+%undefine _py3_shebang_s
 
 %description
 pip is a package management system used to install and manage software packages
@@ -94,30 +123,25 @@ Packages" or "Pip Installs Python".
 # You can generate it with:
 # %%{_rpmconfigdir}/pythonbundles.py --namespace 'python%%{1}dist' src/pip/_vendor/vendor.txt
 %global bundled() %{expand:
-Provides: bundled(python%{1}dist(cachecontrol)) = 0.13.1
-Provides: bundled(python%{1}dist(certifi)) = 2023.7.22
-Provides: bundled(python%{1}dist(chardet)) = 5.1
-Provides: bundled(python%{1}dist(colorama)) = 0.4.6
-Provides: bundled(python%{1}dist(distlib)) = 0.3.6
-Provides: bundled(python%{1}dist(distro)) = 1.8
-Provides: bundled(python%{1}dist(idna)) = 3.4
-Provides: bundled(python%{1}dist(msgpack)) = 1.0.5
-Provides: bundled(python%{1}dist(packaging)) = 21.3
-Provides: bundled(python%{1}dist(platformdirs)) = 3.8.1
-Provides: bundled(python%{1}dist(pygments)) = 2.15.1
-Provides: bundled(python%{1}dist(pyparsing)) = 3.1
-Provides: bundled(python%{1}dist(pyproject-hooks)) = 1
-Provides: bundled(python%{1}dist(requests)) = 2.31
-Provides: bundled(python%{1}dist(resolvelib)) = 1.0.1
-Provides: bundled(python%{1}dist(rich)) = 13.4.2
-Provides: bundled(python%{1}dist(setuptools)) = 68
-Provides: bundled(python%{1}dist(six)) = 1.16
-Provides: bundled(python%{1}dist(tenacity)) = 8.2.2
-Provides: bundled(python%{1}dist(truststore)) = 0.8
-Provides: bundled(python%{1}dist(tomli)) = 2.0.1
-Provides: bundled(python%{1}dist(typing-extensions)) = 4.7.1
-Provides: bundled(python%{1}dist(urllib3)) = 1.26.17
-Provides: bundled(python%{1}dist(webencodings)) = 0.5.1
+Provides: bundled(python%{1}dist(cachecontrol)) = 0.14.3
+Provides: bundled(python%{1}dist(certifi)) = 2025.10.5
+Provides: bundled(python%{1}dist(dependency-groups)) = 1.3.1
+Provides: bundled(python%{1}dist(distlib)) = 0.4
+Provides: bundled(python%{1}dist(distro)) = 1.9
+Provides: bundled(python%{1}dist(idna)) = 3.10
+Provides: bundled(python%{1}dist(msgpack)) = 1.1.2
+Provides: bundled(python%{1}dist(packaging)) = 25
+Provides: bundled(python%{1}dist(platformdirs)) = 4.5
+Provides: bundled(python%{1}dist(pygments)) = 2.19.2
+Provides: bundled(python%{1}dist(pyproject-hooks)) = 1.2
+Provides: bundled(python%{1}dist(requests)) = 2.32.5
+Provides: bundled(python%{1}dist(resolvelib)) = 1.2.1
+Provides: bundled(python%{1}dist(rich)) = 14.2
+Provides: bundled(python%{1}dist(setuptools)) = 70.3
+Provides: bundled(python%{1}dist(tomli)) = 2.3
+Provides: bundled(python%{1}dist(tomli-w)) = 1.2
+Provides: bundled(python%{1}dist(truststore)) = 0.10.4
+Provides: bundled(python%{1}dist(urllib3)) = 1.26.20
 }
 
 # Some manylinux1 wheels need libcrypt.so.1.
@@ -150,17 +174,16 @@ BuildRequires:  python%{python3_pkgversion}-devel
 # Note that the package prefix is always python3-, even if we build for 3.X
 # The minimal version is for bundled provides verification script
 BuildRequires:  python3-rpm-generators >= 11-8
-BuildRequires:  python%{python3_pkgversion}-setuptools
-BuildRequires:  python%{python3_pkgversion}-wheel
+BuildRequires:  pyproject-rpm-macros
+BuildRequires:  python%{python3_pkgversion}-flit-core
 BuildRequires:  bash-completion
 BuildRequires:  ca-certificates
 Requires:       ca-certificates
 
 # Virtual provides for the packages bundled by pip:
-%{bundled 3}
+%{bundled %{python3_pkgversion}}
 
 Provides:       pip = %{version}-%{release}
-Conflicts:      python-pip < %{version}-%{release}
 
 %description -n python%{python3_pkgversion}-%{srcname}
 pip is a package management system used to install and manage software packages
@@ -168,26 +191,13 @@ written in Python. Many packages can be found in the Python Package Index
 (PyPI). pip is a recursive acronym that can stand for either "Pip Installs
 Packages" or "Pip Installs Python".
 
-%if %{with doc}
-%package doc
-Summary:        A documentation for a tool for installing and managing Python packages
-
-BuildRequires:  python%{python3_pkgversion}-sphinx
-BuildRequires:  python%{python3_pkgversion}-sphinx-inline-tabs
-BuildRequires:  python%{python3_pkgversion}-sphinx-copybutton
-BuildRequires:  python%{python3_pkgversion}-myst-parser
-
-%description doc
-A documentation for a tool for installing and managing Python packages
-
-%endif
 
 %package -n     %{python_wheel_pkg_prefix}-%{srcname}-wheel
 Summary:        The pip wheel
 Requires:       ca-certificates
 
 # Virtual provides for the packages bundled by pip:
-%{bundled 3}
+%{bundled %{python3_pkgversion}}
 
 # This is only relevant for Pythons that are older than 3.12 and don't use their own bundled wheels
 # It is also only relevant when this wheel is shared across multiple Pythons
@@ -195,8 +205,6 @@ Requires:       ca-certificates
 %{crypt_compat_recommends 3.11}
 %{crypt_compat_recommends 3.10}
 %{crypt_compat_recommends 3.9}
-%{crypt_compat_recommends 3.8}
-%{crypt_compat_recommends 3.7}
 %endif
 
 %description -n %{python_wheel_pkg_prefix}-%{srcname}-wheel
@@ -208,73 +216,67 @@ A Python wheel of pip to use with venv.
 # this goes together with patch4
 rm src/pip/_vendor/certifi/*.pem
 
-# Do not use furo as HTML theme in docs
-# furo is not available in Fedora
-sed -i '/html_theme = "furo"/d' docs/html/conf.py
-
-# towncrier extension for Sphinx is not yet available in Fedora
-sed -i '/"sphinxcontrib.towncrier",/d' docs/html/conf.py
-
-# tests expect wheels in here
-ln -s %{python_wheel_dir} tests/data/common_wheels
-
 # Remove windows executable binaries
 rm -v src/pip/_vendor/distlib/*.exe
-sed -i '/\.exe/d' setup.py
-
-# Remove RIGHT-TO-LEFT OVERRIDE from AUTHORS.txt
-# https://github.com/pypa/pip/pull/12046
-%{python3} -c 'from pathlib import Path; p = Path("AUTHORS.txt"); p.write_text("".join(c for c in p.read_text() if c != "\u202e"))'
+sed -i '/\.exe/d' pyproject.toml
 
 # Remove unused test requirements
-sed -Ei '/pytest-(cov|xdist|rerunfailures)/d' tests/requirements.txt
+sed -Ei '/(pytest-(cov|xdist|rerunfailures|subket)|proxy\.py)/d' pyproject.toml
+
+# Remove unused pytest-subket options
+sed -Ei '/(--disable-socket|--allow-unix-socket|--allow-hosts=localhost)/d' pyproject.toml
+
+%if %{with tests}
+# tests expect wheels in here
+mkdir tests/data/common_wheels
+cp -a %{SOURCE1} %{SOURCE2} %{SOURCE3} %{SOURCE4} tests/data/common_wheels
+%endif
 
 
 %if %{with tests}
 %generate_buildrequires
 # we only use this to generate test requires
 # the "pyproject" part is explicitly disabled as it generates a requirement on pip
-%pyproject_buildrequires -N tests/requirements.txt
+%pyproject_buildrequires -N -g test
 %endif
 
 
 %build
-%py3_build_wheel
-
-%if %{with doc}
 export PYTHONPATH=./src/
-# from tox.ini
-sphinx-build-3 -b html docs/html docs/build/html
-sphinx-build-3 -b man  docs/man  docs/build/man  -c docs/html
-rm -rf docs/build/html/{.doctrees,.buildinfo}
+%pyproject_wheel
+
+%if %{with man}
+sphinx-build -t man -b man -d docs/build/doctrees/man -c docs/html docs/man docs/build/man
 %endif
 
 
 %install
-# The following is similar to %%pyproject_install, but we don't have
-# /usr/bin/pip yet, so we install using the wheel directly.
-# (This is not standard wheel usage, but the pip wheel supports it -- see
-#  pip/__main__.py)
-%{python3} dist/%{python_wheel_name}/pip install \
-    --root %{buildroot} \
-    --no-deps \
-    --disable-pip-version-check \
-    --progress-bar off \
-    --verbose \
-    --ignore-installed \
-    --no-warn-script-location \
-    --no-index \
-    --no-cache-dir \
-    --find-links dist \
-    'pip==%{upstream_version}'
+export PYTHONPATH=./src/
+%pyproject_install
+%pyproject_save_files -l pip
 
-%if %{with doc}
+# We'll install pip as pip3.X
+# Later we'll provide symbolic links, manpage links and bashcompletion fixes for alternative names
+%if "%{python3_pkgversion}" == "3"
+%global alternate_names pip-%{python3_version} pip-3 pip3 pip
+%else
+%global alternate_names pip-%{python3_version}
+%endif
+
+# Provide symlinks to executables
+mv %{buildroot}%{_bindir}/pip %{buildroot}%{_bindir}/pip%{python3_version}
+rm %{buildroot}%{_bindir}/pip3
+for pip in %{alternate_names}; do
+ln -s ./pip%{python3_version} %{buildroot}%{_bindir}/$pip
+done
+
+%if %{with man}
 pushd docs/build/man
 install -d %{buildroot}%{_mandir}/man1
 for MAN in *1; do
-install -pm0644 $MAN %{buildroot}%{_mandir}/man1/$MAN
-for pip in "pip3" "pip-3" "pip%{python3_version}" "pip-%{python3_version}"; do
-echo ".so $MAN" > %{buildroot}%{_mandir}/man1/${MAN/pip/$pip}
+install -pm0644 $MAN %{buildroot}%{_mandir}/man1/${MAN/pip/pip%{python3_version}}
+for pip in %{alternate_names}; do
+echo ".so ${MAN/pip/pip%{python3_version}}" > %{buildroot}%{_mandir}/man1/${MAN/pip/$pip}
 done
 done
 popd
@@ -282,76 +284,74 @@ popd
 
 mkdir -p %{buildroot}%{bash_completions_dir}
 PYTHONPATH=%{buildroot}%{python3_sitelib} \
-    %{buildroot}%{_bindir}/pip completion --bash \
-    > %{buildroot}%{bash_completions_dir}/pip3
+    %{buildroot}%{_bindir}/pip%{python3_version} completion --bash \
+    > %{buildroot}%{bash_completions_dir}/pip%{python3_version}
 
-# Make bash completion apply to all the 5 symlinks we install
-sed -i -e "s/^\\(complete.*\\) pip\$/\\1 pip pip{,-}{3,%{python3_version}}/" \
-    -e s/_pip_completion/_pip3_completion/ \
-    %{buildroot}%{bash_completions_dir}/pip3
-
-
-# Provide symlinks to executables to comply with Fedora guidelines for Python
-ln -s ./pip%{python3_version} %{buildroot}%{_bindir}/pip-%{python3_version}
-ln -s ./pip-%{python3_version} %{buildroot}%{_bindir}/pip-3
-
-
-# Make sure the INSTALLER is not pip and remove RECORD
-# %%pyproject macros do this for all packages
-echo rpm > %{buildroot}%{python3_sitelib}/pip-%{upstream_version}.dist-info/INSTALLER
-rm %{buildroot}%{python3_sitelib}/pip-%{upstream_version}.dist-info/RECORD
+# Make bash completion apply to all alternate names symlinks we install
+sed -i -e "s/^\\(complete.*\\) pip%{python3_version}\$/\\1 pip%{python3_version} %{alternate_names}/" \
+    -e s/_pip_completion/_pip%{python3_version_nodots}_completion/ \
+    %{buildroot}%{bash_completions_dir}/pip%{python3_version}
 
+# Install the built wheel and inject SBOM into it (if the macro is available)
 mkdir -p %{buildroot}%{python_wheel_dir}
-install -p dist/%{python_wheel_name} -t %{buildroot}%{python_wheel_dir}
+install -p %{_pyproject_wheeldir}/%{python_wheel_name} -t %{buildroot}%{python_wheel_dir}
+%{?python_wheel_inject_sbom:%python_wheel_inject_sbom %{buildroot}%{python_wheel_dir}/%{python_wheel_name}}
 
 
 %check
 # Verify bundled provides are up to date
 %{_rpmconfigdir}/pythonbundles.py src/pip/_vendor/vendor.txt --compare-with '%{bundled 3}'
 
+# Verify no unwanted files are present in the package
+grep "exe$" %{pyproject_files} && exit 1 || true
+grep "pem$" %{pyproject_files} && exit 1 || true
+
 # Verify we can at least run basic commands without crashing
-%{py3_test_envvars} %{buildroot}%{_bindir}/pip --help
-%{py3_test_envvars} %{buildroot}%{_bindir}/pip list
-%{py3_test_envvars} %{buildroot}%{_bindir}/pip show pip
+%{py3_test_envvars} %{buildroot}%{_bindir}/pip%{python3_version} --help
+%{py3_test_envvars} %{buildroot}%{_bindir}/pip%{python3_version} list
+%{py3_test_envvars} %{buildroot}%{_bindir}/pip%{python3_version} show pip
 
 %if %{with tests}
 # Upstream tests
 # bash completion tests only work from installed package
 pytest_k='not completion'
+# this clashes with our PYTHONPATH
+pytest_k="$pytest_k and not environments_with_no_pip"
+# this seems to require internet (despite no network marker)
+# added in https://github.com/pypa/pip/pull/13378 TODO drop this in the next release
+pytest_k="$pytest_k and not test_prompt_for_keyring_if_needed and not test_double_install_fail and not test_install_sdist_links and not test_lock_vcs and not test_lock_archive and not test_backend_sees_config_via_sdist"
+# this cannot import breezy, TODO investigate
+pytest_k="$pytest_k and not (functional and bazaar)"
+# failures to investigate
+pytest_k="$pytest_k and not test_all_fields and not test_report_mixed_not_found and not test_basic_show"  # "Editable project location" missing
+pytest_k="$pytest_k and not test_basic_install_from_wheel"
+pytest_k="$pytest_k and not test_check_unsupported"
 
-# --deselect'ed tests are not compatible with the latest virtualenv
-# These files contain almost 500 tests so we should enable them back
-# as soon as pip will be compatible upstream
-# https://github.com/pypa/pip/pull/8441
-%pytest -m 'not network' -k "$(echo $pytest_k)" \
-    --deselect tests/functional --deselect tests/lib/test_lib.py
+%pytest -n auto -m 'not network' -k "$(echo $pytest_k)" \
+    --ignore tests/functional/test_proxy.py  # no proxy.py in Fedora
 %endif
 
 
-%files -n python%{python3_pkgversion}-%{srcname}
+%files -n python%{python3_pkgversion}-%{srcname} -f %{pyproject_files}
 %doc README.rst
-%license %{python3_sitelib}/pip-%{upstream_version}.dist-info/LICENSE.txt
-%if %{with doc}
-%{_mandir}/man1/pip.*
-%{_mandir}/man1/pip-*.*
-%{_mandir}/man1/pip3.*
-%{_mandir}/man1/pip3-*.*
+%if %{with man}
+%if "%{python3_pkgversion}" == "3"
+%{_mandir}/man1/pip{,3,-3}.1.*
+%{_mandir}/man1/pip{,3,-3}-[^3]*.1.*
 %endif
+%{_mandir}/man1/pip{,-}%{python3_version}.1.*
+%{_mandir}/man1/pip{,-}%{python3_version}-*.1.*
+%endif
+%if "%{python3_pkgversion}" == "3"
 %{_bindir}/pip
 %{_bindir}/pip3
 %{_bindir}/pip-3
+%endif
 %{_bindir}/pip%{python3_version}
 %{_bindir}/pip-%{python3_version}
-%{python3_sitelib}/pip*
 %dir %{bash_completions_dir}
-%{bash_completions_dir}/pip3
+%{bash_completions_dir}/pip%{python3_version}
 
-%if %{with doc}
-%files doc
-%license LICENSE.txt
-%doc README.rst
-%doc docs/build/html
-%endif
 
 %files -n %{python_wheel_pkg_prefix}-%{srcname}-wheel
 %license LICENSE.txt
diff --git a/remove-existing-dist-only-if-path-conflicts.patch b/remove-existing-dist-only-if-path-conflicts.patch
index 3a9ea25..d280f34 100644
--- a/remove-existing-dist-only-if-path-conflicts.patch
+++ b/remove-existing-dist-only-if-path-conflicts.patch
@@ -1,5 +1,5 @@
-From 2c3f3a590ddfc151a456b44a5f96f0f603d178e9 Mon Sep 17 00:00:00 2001
-From: Lumir Balhar <lbalhar@redhat.com>
+From d5cb806a14bb50a96484bca6536e81f2ac316b9d Mon Sep 17 00:00:00 2001
+From: Karolina Surma <ksurma@redhat.com>
 Date: Wed, 16 Feb 2022 08:36:21 +0100
 Subject: [PATCH] Prevent removing of the system packages installed under
  /usr/lib when pip install --upgrade is executed.
@@ -23,11 +23,11 @@ Co-Authored-By: Karolina Surma <ksurma@redhat.com>
  4 files changed, 27 insertions(+), 3 deletions(-)
 
 diff --git a/src/pip/_internal/metadata/base.py b/src/pip/_internal/metadata/base.py
-index 151fd6d..f9109cd 100644
+index 230e114..8bd5d31 100644
 --- a/src/pip/_internal/metadata/base.py
 +++ b/src/pip/_internal/metadata/base.py
-@@ -28,7 +28,7 @@ from pip._vendor.packaging.utils import NormalizedName
- from pip._vendor.packaging.version import LegacyVersion, Version
+@@ -23,7 +23,7 @@ from pip._vendor.packaging.utils import NormalizedName, canonicalize_name
+ from pip._vendor.packaging.version import Version
  
  from pip._internal.exceptions import NoneMetadataError
 -from pip._internal.locations import site_packages, user_site
@@ -35,7 +35,7 @@ index 151fd6d..f9109cd 100644
  from pip._internal.models.direct_url import (
      DIRECT_URL_METADATA_NAME,
      DirectUrl,
-@@ -560,6 +560,16 @@ class BaseDistribution(Protocol):
+@@ -575,6 +575,16 @@ class BaseDistribution(Protocol):
              for extra in self._iter_egg_info_extras():
                  metadata["Provides-Extra"] = extra
  
@@ -53,10 +53,10 @@ index 151fd6d..f9109cd 100644
  class BaseEnvironment:
      """An environment containing distributions to introspect."""
 diff --git a/src/pip/_internal/req/req_install.py b/src/pip/_internal/req/req_install.py
-index a1e376c..ed7facf 100644
+index c9f6bff..c101826 100644
 --- a/src/pip/_internal/req/req_install.py
 +++ b/src/pip/_internal/req/req_install.py
-@@ -416,7 +416,7 @@ class InstallRequirement:
+@@ -453,7 +453,7 @@ class InstallRequirement:
                          f"lack sys.path precedence to {existing_dist.raw_name} "
                          f"in {existing_dist.location}"
                      )
@@ -66,13 +66,13 @@ index a1e376c..ed7facf 100644
          else:
              if self.editable:
 diff --git a/src/pip/_internal/resolution/legacy/resolver.py b/src/pip/_internal/resolution/legacy/resolver.py
-index fb49d41..040f2c1 100644
+index 33a4fdc..1fe886e 100644
 --- a/src/pip/_internal/resolution/legacy/resolver.py
 +++ b/src/pip/_internal/resolution/legacy/resolver.py
-@@ -325,7 +325,9 @@ class Resolver(BaseResolver):
-         """
+@@ -322,7 +322,9 @@ class Resolver(BaseResolver):
          # Don't uninstall the conflict if doing a user install and the
          # conflict is not a user install.
+         assert req.satisfied_by is not None
 -        if not self.use_user_site or req.satisfied_by.in_usersite:
 +        if ((not self.use_user_site
 +                or req.satisfied_by.in_usersite)
@@ -81,19 +81,19 @@ index fb49d41..040f2c1 100644
          req.satisfied_by = None
  
 diff --git a/src/pip/_internal/resolution/resolvelib/factory.py b/src/pip/_internal/resolution/resolvelib/factory.py
-index a4c24b5..e7e2da9 100644
+index f23e4cd..1bada79 100644
 --- a/src/pip/_internal/resolution/resolvelib/factory.py
 +++ b/src/pip/_internal/resolution/resolvelib/factory.py
-@@ -1,6 +1,8 @@
+@@ -3,6 +3,8 @@ from __future__ import annotations
  import contextlib
  import functools
  import logging
 +import sys
 +import sysconfig
+ from collections.abc import Iterable, Iterator, Mapping, Sequence
  from typing import (
      TYPE_CHECKING,
-     Dict,
-@@ -549,6 +551,16 @@ class Factory:
+@@ -615,6 +617,16 @@ class Factory:
          if dist is None:  # Not installed, no uninstallation required.
              return None
  
@@ -111,5 +111,5 @@ index a4c24b5..e7e2da9 100644
          # be uninstalled, no matter it's in global or user site, because the
          # user site installation has precedence over global.
 -- 
-2.35.3
+2.50.1
 
diff --git a/sources b/sources
index 3ed3c55..48867fb 100644
--- a/sources
+++ b/sources
@@ -1 +1,5 @@
-SHA512 (pip-23.3.2.tar.gz) = 976c6ab9959805f4d20d4bdedb4dabc95dd55f1ec78773f63f738599bbe44e766ad3a1394bee052a2c2386826d67686ad456726373345ba9e0d555fd251dff09
+SHA512 (pip-25.3.tar.gz) = f50db092213ec3bb819d3da5669f73d119b5ec7f7ac5e8a587a17c27eafa32bc17a057df09389c526a3769ef3577f5553187d54ceffa89aed63f4b4498ff044e
+SHA512 (setuptools-79.0.1-py3-none-any.whl) = fef6cfc6f95a5bb7320f1680e1c665cb8d9a4e4227cde4d8aab8a50bed4bcf04320085b9d7d5343359f887008db5c5a861e57f3d08b7b0b2311a28adaeee6b4a
+SHA512 (wheel-0.45.1-py3-none-any.whl) = 86c16248ec804ee0ac95d43b03d47351dceb534d0cdc4025ca1eb073e39e539de44c870b9261f0373144e1537f0e42675a759a318a8d5d346bbd9efcb704061d
+SHA512 (flit_core-3.12.0-py3-none-any.whl) = 790c12b1f43201e365fb3f8f2f0a54e1a578876799dfdf8bfeea679a25ea096bf62946d006618c1458ae6e37ce6d00998f37e9aba426d5ab80d32ef2d75da4e0
+SHA512 (coverage-0-py3-none-any.whl) = e734192565347010efe68f8ba600254259c9b647f3c553fd4e5d87b1d7f955cb15d6f7d807716f4a6415d239beed945fbec7210feaf502e9cc849c332845926e
diff --git a/tests/bash_completion/main.fmf b/tests/bash_completion/main.fmf
new file mode 100644
index 0000000..cde6f68
--- /dev/null
+++ b/tests/bash_completion/main.fmf
@@ -0,0 +1,35 @@
+summary: PIP bash completion functionality smoke test
+description: |
+    Comprehensive test for pip bash completion functionality on Fedora/RHEL systems.
+
+    The test performs the following steps:
+    1. Finds the bash completion script in the given (e.g. python3-pip) RPM package
+    2. Discovers all pip executables in the package (e.g. /usr/bin/pip and /usr/bin/pip3.14)
+    3. Sources the completion script and verifies completion for all executables is registered
+    4. Runs functional TAB completion tests using expect (for regular and POSIX mode of Bash)
+    5. Validates that completion works for basic pip commands
+
+    This is a smoke test to ensure pip bash completion is properly
+    installed and functional after package installation.
+
+component:
+    - python3-pip
+
+test: ./pip_completion_full_test.sh
+
+framework: shell
+
+duration: 5m
+tier: 1
+
+
+require:
+    - python3-pip
+    - bash-completion
+    - expect
+    - rpm
+    - bash
+
+
+environment:
+    PACKAGE: python3-pip
diff --git a/tests/bash_completion/pip_completion_full_test.sh b/tests/bash_completion/pip_completion_full_test.sh
new file mode 100755
index 0000000..94fcdb9
--- /dev/null
+++ b/tests/bash_completion/pip_completion_full_test.sh
@@ -0,0 +1,88 @@
+#!/bin/bash
+
+# Comprehensive PIP bash completion test for RHEL
+# Finds completion scripts from RPM, tests all pip binaries, and runs functional tests
+
+PACKAGE="${PACKAGE:-python3-pip}"
+
+
+# Step 1: Find bash completion scripts in python3-pip RPM package
+echo "Step 1: Finding bash completion scripts in $PACKAGE RPM package..."
+
+COMPLETION_FILE=$(rpm -ql $PACKAGE 2>/dev/null | grep -E "/usr/share/bash-completion/completions/" || true)
+
+if [[ -z "$COMPLETION_FILE" ]]; then
+    echo "✗ No bash completion files found in $PACKAGE package"
+    exit 1
+fi
+
+# Check if there's exactly one completion file
+COMPLETION_FILE_COUNT=$(echo "$COMPLETION_FILE" | wc -l)
+
+if [[ $COMPLETION_FILE_COUNT -gt 1 ]]; then
+    echo "✗ Multiple bash completion files found in $PACKAGE package:"
+    echo "$COMPLETION_FILE" | sed 's/^/  - /'
+    echo "Expected exactly one completion file, found $COMPLETION_FILE_COUNT"
+    exit 1
+fi
+
+
+echo "✓ Found completion file from $PACKAGE package:"
+echo "$COMPLETION_FILE" | sed 's/^/  - /'
+
+# Step 2: Find all pip binaries
+echo
+echo "Step 2: Finding all pip binaries..."
+PIP_BINARIES=()
+PIP_FILES=$(rpm -ql $PACKAGE | grep /bin/p)
+for pip_file in $PIP_FILES; do
+    if [[ -x "$pip_file" ]]; then
+        pip_cmd=$(basename "$pip_file")
+        PIP_BINARIES+=("$pip_cmd")
+        echo "✓ Found: $pip_cmd -> $pip_file"
+    fi
+done
+
+if [[ ${#PIP_BINARIES[@]} -eq 0 ]]; then
+    echo "✗ No pip binaries found"
+    exit 1
+fi
+
+echo "Total pip binaries found: ${#PIP_BINARIES[@]}"
+
+# Step 3: Source completion scripts and test each binary
+echo
+echo "Step 3: Testing completion for each pip binary..."
+
+for AS_POSIX in 0 1; do
+    if [[ $AS_POSIX -eq 1 ]]; then
+        echo "Testing in POSIX mode"
+        POSIX="--posix"
+    else
+        echo "Testing in non-POSIX mode"
+        POSIX=""
+    fi
+
+    echo "Sourcing: $COMPLETION_FILE"
+    if bash --norc $POSIX -c "source $COMPLETION_FILE" ; then
+        echo "✓ Successfully sourced $COMPLETION_FILE"
+    else
+        echo "! Warning: Failed to source $COMPLETION_FILE"
+        exit 1
+    fi
+
+    export AS_POSIX
+    for pip_exec in "${PIP_BINARIES[@]}"; do
+        echo "Running expect test with $COMPLETION_FILE and $pip_exec..."
+        if ./test_pip_completion.exp "$COMPLETION_FILE" "$pip_exec"; then
+            echo "✓ Functional test passed"
+        else
+            echo "✗ Functional test failed"
+            exit 1
+        fi
+    done
+
+done
+
+
+echo "✓ All tests completed successfully!"
diff --git a/tests/bash_completion/test_pip_completion.exp b/tests/bash_completion/test_pip_completion.exp
new file mode 100755
index 0000000..4389174
--- /dev/null
+++ b/tests/bash_completion/test_pip_completion.exp
@@ -0,0 +1,117 @@
+#!/usr/bin/expect -f
+
+# PIP bash completion smoke test using expect
+# Tests actual TAB completion functionality
+# Usage: test_pip_completion.exp [completion_file] [pip_binary]
+
+set timeout 5
+
+
+set completion_file [lindex $argv 0]
+set pip_exec [lindex $argv 1]
+
+
+puts "=== PIP Bash Completion Test (using expect) ==="
+puts "Testing completion file: $completion_file"
+puts "Testing pip binary: $pip_exec"
+
+# Check if completion file exists first
+if {![file exists $completion_file]} {
+    puts "✗ Completion file not found: $completion_file"
+    exit 1
+}
+puts "✓ Completion file found: $completion_file"
+
+# Start bash shell
+if {[info exists env(AS_POSIX)] && $env(AS_POSIX) == "1"} {
+    spawn bash --norc --posix
+} else {
+    spawn bash --norc
+}
+expect "$ "
+
+# Source the completion file
+send "source $completion_file\r"
+expect "$ "
+puts "Attempted to source completion file"
+
+# Test 1: Basic pip command completion
+puts "\nTest 1: Testing '$pip_exec ' + TAB completion..."
+send "$pip_exec "
+sleep 0.1
+# Send TAB TAB using hex codes
+send "\x09\x09"
+expect {
+    -re "(install|uninstall|list|show)" {
+        puts "✓ Basic pip commands found in completion"
+        expect "$ "
+    }
+    -re "Display all" {
+        puts "✓ Completion showing options menu"
+        send "n\r"
+        expect "$ "
+    }
+    timeout {
+        puts "✗ Timeout waiting for completion - test failed"
+        exit 1
+    }
+}
+
+# Clear the line and ensure clean prompt
+send "\x03"
+expect "$ "
+send "\r"
+expect "$ "
+
+# Test 2: Test partial command completion (simpler test)
+puts "\nTest 2: Testing '$pip_exec insta' + TAB completion..."
+send "$pip_exec insta"
+sleep 0.1
+# Single TAB for completion
+send "\x09"
+expect {
+    -re "install" {
+        puts "✓ Partial command completion works (insta -> install)"
+        expect "$ "
+    }
+    timeout {
+        puts "✗ Timeout on partial completion test - test failed"
+        exit 1
+    }
+}
+
+# Clear the line and ensure clean prompt
+send "\x03"
+expect "$ "
+send "\r"
+expect "$ "
+
+# Test 3: Test help completion
+puts "\nTest 3: Testing '$pip_exec --' + TAB completion..."
+send "$pip_exec --"
+sleep 0.1
+send "\x09\x09"
+expect {
+    -re "(--help|--version)" {
+        puts "✓ Command options found in completion"
+        expect "$ "
+    }
+    timeout {
+        puts "✗ Timeout on options completion test - test failed"
+        exit 1
+    }
+}
+
+# Final cleanup - make sure we're at clean prompt
+send "\x03"
+expect "$ "
+send "\r"
+expect "$ "
+
+# Exit bash cleanly
+send "exit\r"
+expect eof
+
+puts "\n=== Completion Test Complete ==="
+puts "PIP bash completion functionality tested!"
+
diff --git a/tests/pip_install_upgrade/runtest.sh b/tests/pip_install_upgrade/runtest.sh
index 40e14a3..4c520f5 100755
--- a/tests/pip_install_upgrade/runtest.sh
+++ b/tests/pip_install_upgrade/runtest.sh
@@ -18,14 +18,14 @@ RPM_BUILD_ROOT=/ /usr/bin/pip install 'Pello==1.0.1'
 /usr/bin/pip freeze | grep '^Pello==1\.0\.2$'
 
 # Both installations should still exist
-test -d "${RPM_SITELIB}/Pello-1.0.1-py${PYTHON_VERSION}.egg-info" || test -d "${RPM_SITELIB}/Pello-1.0.1.dist-info"
+test -d "${RPM_SITELIB}/pello-1.0.1.dist-info"
 test -d "${LOCAL_SITELIB}/Pello-1.0.2.dist-info"
 
 # Let's ditch the local one
 /usr/bin/pip uninstall --yes Pello
 
 # It should only remove one of them
-test -d "${RPM_SITELIB}/Pello-1.0.1-py${PYTHON_VERSION}.egg-info" || test -d "${RPM_SITELIB}/Pello-1.0.1.dist-info"
+test -d "${RPM_SITELIB}/pello-1.0.1.dist-info"
 ! test -d "${LOCAL_SITELIB}/Pello-1.0.2.dist-info"
 
 # And pip should still see the RPM-installed one
diff --git a/tests/tests.yml b/tests/tests.yml
deleted file mode 100644
index 51248e2..0000000
--- a/tests/tests.yml
+++ /dev/null
@@ -1,95 +0,0 @@
----
-- hosts: localhost
-  roles:
-  - role: standard-test-basic
-    tags:
-    - classic
-    repositories:
-    - repo: "https://src.fedoraproject.org/tests/python.git"
-      dest: "python"
-    - repo: "https://src.fedoraproject.org/rpms/pyproject-rpm-macros.git"
-      dest: "pyproject-rpm-macros"
-    tests:
-    - smoke35_optional:
-        dir: python/smoke
-        run: VERSION=3.5 INSTALL_OR_SKIP=true ./venv.sh
-    - smoke36:
-        dir: python/smoke
-        run: VERSION=3.6 ./venv.sh
-    - smoke37:
-        dir: python/smoke
-        run: VERSION=3.7 INSTALL_OR_SKIP=true ./venv.sh
-    - smoke38:
-        dir: python/smoke
-        run: VERSION=3.8 ./venv.sh
-    - smoke39:
-        dir: python/smoke
-        run: VERSION=3.9 ./venv.sh
-    - smoke310:
-        dir: python/smoke
-        run: VERSION=3.10 ./venv.sh
-    - smoke311:
-        dir: python/smoke
-        run: VERSION=3.11 ./venv.sh
-    - smoke312:
-        dir: python/smoke
-        run: VERSION=3.12 ./venv.sh
-    - smoke27:
-        dir: python/smoke
-        run: VERSION=2.7 METHOD=virtualenv ./venv.sh
-    - smoke35_virtualenv_optional:
-        dir: python/smoke
-        run: VERSION=3.5 METHOD=virtualenv INSTALL_OR_SKIP=true ./venv.sh
-    - smoke36_virtualenv:
-        dir: python/smoke
-        run: VERSION=3.6 METHOD=virtualenv ./venv.sh
-    - smoke37_virtualenv:
-        dir: python/smoke
-        run: VERSION=3.7 METHOD=virtualenv INSTALL_OR_SKIP=true ./venv.sh
-    - smoke38_virtualenv:
-        dir: python/smoke
-        run: VERSION=3.8 METHOD=virtualenv ./venv.sh
-    - smoke39_virtualenv:
-        dir: python/smoke
-        run: VERSION=3.9 METHOD=virtualenv ./venv.sh
-    - smoke310_virtualenv:
-        dir: python/smoke
-        run: VERSION=3.10 METHOD=virtualenv ./venv.sh
-    - smoke311_virtualenv:
-        dir: python/smoke
-        run: VERSION=3.11 METHOD=virtualenv ./venv.sh
-    - smoke312_virtualenv:
-        dir: python/smoke
-        run: VERSION=3.12 METHOD=virtualenv ./venv.sh
-    - pyproject_pytest:
-        dir: pyproject-rpm-macros/tests
-        run: ./mocktest.sh python-pytest
-    - pyproject_entrypoints:
-        dir: pyproject-rpm-macros/tests
-        run: ./mocktest.sh python-entrypoints
-    - pyproject_pluggy:
-        dir: pyproject-rpm-macros/tests
-        run: ./mocktest.sh python-pluggy
-    - pyproject_clikit:
-        dir: pyproject-rpm-macros/tests
-        run: ./mocktest.sh python-clikit
-    - pip_install_upgrade
-    required_packages:
-    - gcc
-    - virtualenv
-    - python2.7
-    - python3.6
-    - python3.8
-    - python3.9
-    - python3.10-devel
-    - python3.11-devel
-    - python3.12-devel
-    - python2-devel
-    - python3-devel
-    - python3-tox
-    - mock
-    - rpmdevtools
-    - rpm-build
-    - grep
-    - util-linux
-    - shadow-utils
diff --git a/urllib3-CVE-2025-50181.patch b/urllib3-CVE-2025-50181.patch
new file mode 100644
index 0000000..05e6353
--- /dev/null
+++ b/urllib3-CVE-2025-50181.patch
@@ -0,0 +1,51 @@
+From b3d543d7e16af844394316360ef1bf0b9d10f1b1 Mon Sep 17 00:00:00 2001
+From: Illia Volochii <illia.volochii@gmail.com>
+Date: Wed, 18 Jun 2025 16:25:01 +0300
+Subject: [PATCH] Security fix for CVE-2025-50181
+
+Co-authored-by: Seth Michael Larson <sethmichaellarson@gmail.com>
+Co-authored-by: Quentin Pradet <quentin.pradet@gmail.com>
+Co-authored-by: Seth Michael Larson <sethmichaellarson@gmail.com>
+---
+ src/pip/_vendor/urllib3/poolmanager.py | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/src/pip/_vendor/urllib3/poolmanager.py b/src/pip/_vendor/urllib3/poolmanager.py
+index fb51bf7..a8de7c6 100644
+--- a/src/pip/_vendor/urllib3/poolmanager.py
++++ b/src/pip/_vendor/urllib3/poolmanager.py
+@@ -170,6 +170,22 @@ class PoolManager(RequestMethods):
+ 
+     def __init__(self, num_pools=10, headers=None, **connection_pool_kw):
+         RequestMethods.__init__(self, headers)
++        if "retries" in connection_pool_kw:
++            retries = connection_pool_kw["retries"]
++            if not isinstance(retries, Retry):
++                # When Retry is initialized, raise_on_redirect is based
++                # on a redirect boolean value.
++                # But requests made via a pool manager always set
++                # redirect to False, and raise_on_redirect always ends
++                # up being False consequently.
++                # Here we fix the issue by setting raise_on_redirect to
++                # a value needed by the pool manager without considering
++                # the redirect boolean.
++                raise_on_redirect = retries is not False
++                retries = Retry.from_int(retries, redirect=False)
++                retries.raise_on_redirect = raise_on_redirect
++                connection_pool_kw = connection_pool_kw.copy()
++                connection_pool_kw["retries"] = retries
+         self.connection_pool_kw = connection_pool_kw
+         self.pools = RecentlyUsedContainer(num_pools)
+ 
+@@ -389,7 +405,7 @@ class PoolManager(RequestMethods):
+             kw["body"] = None
+             kw["headers"] = HTTPHeaderDict(kw["headers"])._prepare_for_method_change()
+ 
+-        retries = kw.get("retries")
++        retries = kw.get("retries", response.retries)
+         if not isinstance(retries, Retry):
+             retries = Retry.from_int(retries, redirect=redirect)
+ 
+-- 
+2.51.0
+