Repository navigation
fix(pypi): upgrade pip to 26.2.2 and pip-tools to 7.6.2 - #4310
Merged
rickeylev merged 3 commits intoOct 23, 2026
Merged
Conversation
`pip` versions prior to 26.2.2 bundle an older `certifi` release that still trusts the distrusted eMudhra (`emSign ECC Root CA - G3`) root certificate when `pip` makes network requests during requirements locking, sdist builds, or wheel fallback downloads. Upgrade the internal `pip` dependency to 26.2.2 so `pip` uses the updated `certifi` bundle, and upgrade `pip-tools` to 7.6.2 for compatibility with `pip` 26.2.2. Work towards bazel-contrib#4299
pip-tools 7.6.2 requires typing-extensions when running under Python < 3.11. Add pypi__typing_extensions to internal PyPI dependencies and wire it into pip_compile.
Regenerate internal PyPI tooling dependencies using update_pip_deps so all wheel-building and requirements-locking dependencies stay in sync with pip 26.2.2 and pip-tools 7.6.2. Configure update_pip_deps to resolve universal wheels under Python 3.10 so platform-specific wheels and Python >3.10 versions are not selected. Work towards bazel-contrib#4299
Collaborator
Author
|
Actually, instead of just the minimal necessary, I've changed this to upgrade the full closure of pip deps instead of what-appears-to-be-the-minimal. There's 16 other packages whose versions get bumped, so I'm worried that, without those, pip won't function correctly in some edge case we don't test. With having moved most of our things to uv, our coverage of the pip-based paths is increasingly poor. |
rickeylev
enabled auto-merge
October 22, 2026 19:28
jvolkman
approved these changes
Oct 23, 2026
Merged
via the queue into
bazel-contrib:main
with commit Oct 23, 2026
f6d70c6
19 of 21 checks passed
Collaborator
Author
|
Created release tracking issue #4321 (Release 2.4.4) with this PR added to the backports checklist. |
rickeylev
added a commit
that referenced
this pull request
Oct 23, 2026
`pip` versions prior to 26.2.2 bundle an older `certifi` release that still trusts the distrusted eMudhra (`emSign ECC Root CA - G3`) root certificate when `pip` makes network requests during requirements locking, sdist builds, or wheel fallback downloads. Upgrade the internal `pip` dependency to 26.2.2 so `pip` uses the updated `certifi` bundle, and upgrade `pip-tools` to 7.6.2 for compatibility with `pip` 26.2.2. Work towards #4299 (cherry picked from commit f6d70c6) Work towards #4321
rickeylev
pushed a commit
to rickeylev/rules_python
that referenced
this pull request
Oct 23, 2026
Updates CHANGELOG.md and removes news files for backports: - bazel-contrib#4310 Work towards bazel-contrib#4321 Release-Tracking-Issue: bazel-contrib#4321 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pipversions prior to 26.2.2 bundle an oldercertifirelease thatstill trusts the distrusted eMudhra (
emSign ECC Root CA - G3) rootcertificate when
pipmakes network requests during requirementslocking, sdist builds, or wheel fallback downloads.
Upgrade the internal
pipdependency to 26.2.2 sopipuses theupdated
certifibundle, and upgradepip-toolsto 7.6.2 forcompatibility with
pip26.2.2.Work towards #4299