diff --git a/don-t-split-git-references-on-unicode-separators.patch b/don-t-split-git-references-on-unicode-separators.patch
new file mode 100644
index 0000000..707e1e8
--- /dev/null
+++ b/don-t-split-git-references-on-unicode-separators.patch
@@ -0,0 +1,34 @@
+From 71ded0935e6c87d6e14439f667990de18bf82cb0 Mon Sep 17 00:00:00 2001
+From: Karolina Surma <ksurma@redhat.com>
+Date: Mon, 17 May 2021 13:34:47 +0200
+Subject: [PATCH] Don't split git references on unicode separators
+
+---
+ src/pip/_internal/vcs/git.py | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/src/pip/_internal/vcs/git.py b/src/pip/_internal/vcs/git.py
+index a9c7fb6..b38625e 100644
+--- a/src/pip/_internal/vcs/git.py
++++ b/src/pip/_internal/vcs/git.py
+@@ -142,9 +142,15 @@ class Git(VersionControl):
+             pass
+ 
+         refs = {}
+-        for line in output.strip().splitlines():
++        # NOTE: We do not use splitlines here since that would split on other
++        #       unicode separators, which can be maliciously used to install a
++        #       different revision.
++        for line in output.strip().split("\n"):
++            line = line.rstrip("\r")
++            if not line:
++                continue
+             try:
+-                sha, ref = line.split()
++                sha, ref = line.split(" ", maxsplit=2)
+             except ValueError:
+                 # Include the offending line to simplify troubleshooting if
+                 # this error ever occurs.
+-- 
+2.31.1
+
diff --git a/python-pip.spec b/python-pip.spec
index e1a1b86..74093da 100644
--- a/python-pip.spec
+++ b/python-pip.spec
@@ -19,7 +19,7 @@ Name:           python-%{srcname}
 # When updating, update the bundled libraries versions bellow!
 # You can use vendor_meta.sh in the dist git repo
 Version:        %{base_version}%{?prerel:~%{prerel}}
-Release:        1%{?dist}
+Release:        4%{?dist}
 Summary:        A tool for installing and managing Python packages
 
 # We bundle a lot of libraries with pip, which itself is under MIT license.
@@ -92,6 +92,18 @@ Patch4:         dummy-certifi.patch
 # this warning is juts moot. Also, the warning breaks CPython test suite.
 Patch5:         nowarn-pip._internal.main.patch
 
+# Don't split git references on unicode separators,
+# which could be maliciously used to install a different revision on the
+# repository.
+# Security patch backported from pip 21.1.1
+# Upstream PR: https://github.com/pypa/pip/pull/9827
+Patch8:         don-t-split-git-references-on-unicode-separators.patch
+
+# Don't put an underscore in the version portion of Python 3.10 compatibility tags
+# From https://github.com/pypa/packaging/pull/355 (merged upstream)
+# Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1999035
+Patch9:         python3.10-abi-tag-fix.patch
+
 # Downstream only patch
 # Users might have local installations of pip from using
 # `pip install --user --upgrade pip` on older/newer versions.
@@ -268,6 +280,9 @@ ln -s %{python_wheeldir} tests/data/common_wheels
 # As of 20.1b1, this workaround was sufficient to get around the missing dependency
 sed -i -e 's/csv23/csv/g' tests/lib/wheel.py
 
+# Remove windows executable binaries
+rm -v src/pip/_vendor/distlib/*.exe
+sed -i '/\.exe/d' setup.py
 
 %build
 %py3_build_wheel
@@ -401,6 +416,17 @@ pytest_k='not completion and
 %{python_wheeldir}/%{python_wheelname}
 
 %changelog
+* Wed Oct 06 2021 Charalampos Stratakis <cstratak@redhat.com> - 20.2.2-4
+- Remove bundled windows executables
+- Resolves: rhbz#2005453
+
+* Mon Aug 30 2021 Miro Hrončok <mhroncok@redhat.com> - 20.2.2-3
+- Properly recognize Python 3.10 wheel tags
+- Fixes: rhbz#1999035
+
+* Mon May 17 2021 Karolina Surma <ksurma@redhat.com> - 20.2.2-2
+- Backport security fix from pip 21.1.1
+
 * Wed Aug 05 2020 Tomas Orsava <torsava@redhat.com> - 20.2.2-1
 - Update to 20.2.2 (#1838553)
 
diff --git a/python3.10-abi-tag-fix.patch b/python3.10-abi-tag-fix.patch
new file mode 100644
index 0000000..a1399af
--- /dev/null
+++ b/python3.10-abi-tag-fix.patch
@@ -0,0 +1,33 @@
+From a6253448766965e34f1d0dd58cdf317790d25dd7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+Date: Tue, 24 Nov 2020 12:06:14 +0100
+Subject: [PATCH] Don't put an underscore in the version portion of Python 3.10
+ compatibility tags
+
+PEP 641 is rejected.
+
+See https://discuss.python.org/t/5513/42
+See https://www.python.org/dev/peps/pep-0641/
+
+Fixes https://github.com/pypa/packaging/issues/372
+
+Co-authored-by: Pradyun Gedam <pradyunsg@users.noreply.github.com>
+---
+
+diff --git a/src/pip/_vendor/packaging/tags.py b/src/pip/_vendor/packaging/tags.py
+index 9064910..5d901e9 100644
+--- a/src/pip/_vendor/packaging/tags.py
++++ b/src/pip/_vendor/packaging/tags.py
+@@ -722,11 +722,7 @@ def interpreter_version(**kwargs):
+ 
+ def _version_nodot(version):
+     # type: (PythonVersion) -> str
+-    if any(v >= 10 for v in version):
+-        sep = "_"
+-    else:
+-        sep = ""
+-    return sep.join(map(str, version))
++    return "".join(map(str, version))
+ 
+ 
+ def sys_tags(**kwargs):