bpo-46985: Upgrade bundled pip to 22.0.4 #31819

pradyunsg · 2022-03-11T13:38:12Z

~/Developer/OSS/cpython
❯ sha256sum ./Lib/ensurepip/_bundled/pip-22.0.4-py3-none-any.whl 
c6aca0f2f081363f689f041d90dab2a07a9a07fb840284db2218117a52da800b  ./Lib/ensurepip/_bundled/pip-22.0.4-py3-none-any.whl

That matches the hash on PyPI: https://pypi.org/project/pip/#copy-hash-modal-3c7d56c4-b870-46df-b7ea-70d95882728f

https://bugs.python.org/issue46985

pradyunsg · 2022-03-11T13:43:08Z

If someone wants to validate the file I've added here, you can download it directly from GitHub ¹ and verify that the hash matches what's on PyPI. Or... You can trust that I'm not trying to inject malicious code into CPython. :)

https://github.com/python/cpython/raw/e1dbf7bf8190f9f7f839ad8cc288a3063eaa942c/Lib/ensurepip/_bundled/pip-22.0.4-py3-none-any.whl ↩

uranusjr

Also looking forward to backporting this to 3.9 to quelch a warning on distutils/sysconfig behaviour mismatch.

pradyunsg · 2022-03-12T08:52:48Z

IIUC, we should probably backport this all the way down to 3.7.

uranusjr · 2022-03-12T09:51:19Z

I’m not sure what the backporting strategy is, but only 3.9 and 3.10 are showing the distutils warning from ensurepip right now, so that’s what I care most.

JelleZijlstra · 2022-03-13T02:50:18Z

Seems like we haven't upgraded the bundled pip/setuptools on the security fix branches in the past (e.g. #25576).

pradyunsg · 2022-03-13T08:15:36Z

Alrighty, then backporting down to 3.9 it is! :)

ned-deily · 2022-03-13T18:13:48Z

There appear to be a couple of security issues that have been fixed in some of the vendored packages within the pip wheel (for example, CVE-2021-33503 in urllib3) since the 3.8 and 3.7 branches were last updated so I think it would be better to backport to them. I'll defer to @ambv for 3.8 but 3.7 is even older.

miss-islington · 2022-03-13T18:14:23Z

Thanks @pradyunsg for the PR, and @ned-deily for merging it 🌮🎉.. I'm working now to backport this PR to: 3.7, 3.8, 3.9, 3.10.
🐍🍒⛏🤖

bedevere-bot · 2022-03-13T18:14:44Z

GH-31849 is a backport of this pull request to the 3.10 branch.

miss-islington · 2022-03-13T18:14:45Z

Sorry, @pradyunsg and @ned-deily, I could not cleanly backport this to 3.8 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker d87f1b787ed38dfd307d82452f2efe9dc5b93942 3.8

(cherry picked from commit d87f1b7) Co-authored-by: Pradyun Gedam <pgedam@bloomberg.net>

miss-islington · 2022-03-13T18:14:47Z

Sorry @pradyunsg and @ned-deily, I had trouble checking out the 3.7 backport branch.
Please backport using cherry_picker on command line.
cherry_picker d87f1b787ed38dfd307d82452f2efe9dc5b93942 3.7

bedevere-bot · 2022-03-13T18:14:48Z

GH-31850 is a backport of this pull request to the 3.9 branch.

(cherry picked from commit d87f1b7) Co-authored-by: Pradyun Gedam <pgedam@bloomberg.net>

(cherry picked from commit d87f1b7)

bedevere-bot · 2022-03-13T18:45:09Z

GH-31851 is a backport of this pull request to the 3.8 branch.

bedevere-bot · 2022-03-13T18:46:44Z

GH-31852 is a backport of this pull request to the 3.7 branch.

(cherry picked from commit d87f1b7) Co-authored-by: Pradyun Gedam <pgedam@bloomberg.net> Automerge-Triggered-By: GH:ned-deily

(cherry picked from commit d87f1b7)

(cherry picked from commit d87f1b7) Co-authored-by: Pradyun Gedam <pgedam@bloomberg.net>

* main: (94 commits) Revert "bpo-46986: Upgrade bundled setuptools to 60.9.3 (pythonGH-31820)" (pythonGH-31879) bpo-30677: [doc] mention that os.mkdir() can raise FileNotFoundError (pythonGH-31548) git ignore Lib/site-packages (pythonGH-31862) bpo-31415: importtime was made by Inada Naoki (pythonGH-31875) bpo-46920: Remove code that has explainers why it was disabled (pythonGH-31813) bpo-46920: Remove disabled debug code added decades ago and likely unnecessary (pythonGH-31812) bpo-46920: Remove code that has no explainer why it was disabled (pythonGH-31814) bpo-46906: Mention native endian in PyFloat_Pack8() doc (pythonGH-31866) bpo-40280: select: Use NULL for empty fdset (pythonGH-31865) CI: Fix patchcheck (pythonGH-31708) bpo-46987: Remove _PySys_GetObjectId / _PySys_GetObjectId (pythonGH-31835) bpo-46994: Accept explicit contextvars.Context in asyncio create_task() API (pythonGH-31837) bpo-39829: Fix `__len__()` is called twice in list() constructor (pythonGH-31816) bpo-47003: Cleanup _overlapped module (pythonGH-31848) bpo-47004: Sync with importlib_metadata 4.11.3. (python#31854) bpo-46986: Upgrade bundled setuptools to 60.9.3 (pythonGH-31820) bpo-46985: Upgrade bundled pip to 22.0.4 (pythonGH-31819) bpo-46805: Add low level UDP socket functions to asyncio (pythonGH-31455) bpo-46995: Deprecate missing asyncio.Task.set_name() for third-party task implementations (pythonGH-31838) bpo-43215: Document Happy Eyeballs args of asyncio.open_connection (pythonGH-24525) ...

(cherry picked from commit d87f1b7) Co-authored-by: Pradyun Gedam <pgedam@bloomberg.net>

pradyunsg added 2 commits Mar 11, 2022

bpo-46985: Upgrade bundled pip to 22.0.4

b47333d

📰

e1dbf7b

bedevere-bot added the awaiting review label Mar 11, 2022

the-knights-who-say-ni added the CLA signed label Mar 11, 2022

pradyunsg mentioned this pull request Mar 11, 2022

bpo-46986: Upgrade bundled setuptools to 60.9.3 #31820

Merged

uranusjr approved these changes Mar 12, 2022

View changes

bedevere-bot added awaiting core review and removed awaiting review labels Mar 12, 2022

FFY00 approved these changes Mar 12, 2022

View changes

FFY00 requested a review from jaraco Mar 12, 2022

JelleZijlstra added needs backport to 3.9 needs backport to 3.10 labels Mar 13, 2022

ned-deily added needs backport to 3.7 needs backport to 3.8 labels Mar 13, 2022

ned-deily merged commit d87f1b7 into python:main Mar 13, 2022
12 checks passed

bedevere-bot removed awaiting core review needs backport to 3.10 labels Mar 13, 2022

miss-islington pushed a commit to miss-islington/cpython that referenced this issue Mar 13, 2022

bpo-46985: Upgrade bundled pip to 22.0.4 (pythonGH-31819)

34a5939

(cherry picked from commit d87f1b7) Co-authored-by: Pradyun Gedam <pgedam@bloomberg.net>

miss-islington assigned ned-deily Mar 13, 2022

bedevere-bot removed the needs backport to 3.9 label Mar 13, 2022

miss-islington pushed a commit to miss-islington/cpython that referenced this issue Mar 13, 2022

bpo-46985: Upgrade bundled pip to 22.0.4 (pythonGH-31819)

76c41e5

(cherry picked from commit d87f1b7) Co-authored-by: Pradyun Gedam <pgedam@bloomberg.net>

ned-deily pushed a commit to ned-deily/cpython that referenced this issue Mar 13, 2022

bpo-46985: Upgrade bundled pip to 22.0.4 (pythonGH-31819)

4b1f8d0

(cherry picked from commit d87f1b7)

bedevere-bot removed the needs backport to 3.8 label Mar 13, 2022

bedevere-bot removed the needs backport to 3.7 label Mar 13, 2022

miss-islington added a commit that referenced this issue Mar 13, 2022

[3.10] bpo-46985: Upgrade bundled pip to 22.0.4 (GH-31819) (GH-31849)

1ceda97

(cherry picked from commit d87f1b7) Co-authored-by: Pradyun Gedam <pgedam@bloomberg.net> Automerge-Triggered-By: GH:ned-deily

miss-islington added a commit that referenced this issue Mar 13, 2022

[3.9] bpo-46985: Upgrade bundled pip to 22.0.4 (GH-31819) (GH-31850)

4f340b0

(cherry picked from commit d87f1b7) Co-authored-by: Pradyun Gedam <pgedam@bloomberg.net> Automerge-Triggered-By: GH:ned-deily

ned-deily pushed a commit to ned-deily/cpython that referenced this issue Mar 13, 2022

bpo-46985: Upgrade bundled pip to 22.0.4 (pythonGH-31819)

ce76409

(cherry picked from commit d87f1b7)

ned-deily added a commit that referenced this issue Mar 13, 2022

bpo-46985: Upgrade bundled pip to 22.0.4 (GH-31819) (GH-31852)

5a8e968

(cherry picked from commit d87f1b7) Co-authored-by: Pradyun Gedam <pgedam@bloomberg.net>

pradyunsg deleted the pip-22-0-upgrade branch Mar 14, 2022

ambv pushed a commit that referenced this issue Mar 15, 2022

bpo-46985: Upgrade bundled pip to 22.0.4 (GH-31819) (GH-31851)

7a315d8

(cherry picked from commit d87f1b7) Co-authored-by: Pradyun Gedam <pgedam@bloomberg.net>

asvetlov pushed a commit to YvesDup/cpython that referenced this issue Mar 25, 2022

bpo-46985: Upgrade bundled pip to 22.0.4 (pythonGH-31819)

26ff4cb

python / cpython Public

bpo-46985: Upgrade bundled pip to 22.0.4 #31819

bpo-46985: Upgrade bundled pip to 22.0.4 #31819

pradyunsg commented Mar 11, 2022 •

edited by bedevere-bot

pradyunsg commented Mar 11, 2022

uranusjr left a comment

pradyunsg commented Mar 12, 2022 •

edited

uranusjr commented Mar 12, 2022

JelleZijlstra commented Mar 13, 2022

pradyunsg commented Mar 13, 2022

ned-deily commented Mar 13, 2022

miss-islington commented Mar 13, 2022

bedevere-bot commented Mar 13, 2022

miss-islington commented Mar 13, 2022

miss-islington commented Mar 13, 2022

bedevere-bot commented Mar 13, 2022

bedevere-bot commented Mar 13, 2022

bedevere-bot commented Mar 13, 2022

python / cpython Public

bpo-46985: Upgrade bundled pip to 22.0.4 #31819

bpo-46985: Upgrade bundled pip to 22.0.4 #31819

Conversation

pradyunsg commented Mar 11, 2022 • edited by bedevere-bot

pradyunsg commented Mar 11, 2022

Footnotes

uranusjr left a comment

pradyunsg commented Mar 12, 2022 • edited

uranusjr commented Mar 12, 2022

JelleZijlstra commented Mar 13, 2022

pradyunsg commented Mar 13, 2022

ned-deily commented Mar 13, 2022

miss-islington commented Mar 13, 2022

bedevere-bot commented Mar 13, 2022

miss-islington commented Mar 13, 2022

miss-islington commented Mar 13, 2022

bedevere-bot commented Mar 13, 2022

bedevere-bot commented Mar 13, 2022

bedevere-bot commented Mar 13, 2022

pradyunsg commented Mar 11, 2022 •

edited by bedevere-bot

pradyunsg commented Mar 12, 2022 •

edited