Skip to content

Fix build-only pip bootstrap HTTP parsing - #10

Merged
chen21019 merged 1 commit into
mainfrom
security/pip-bootstrap-refresh
Oct 23, 2026
Merged

chen21019 merged 1 commit into
mainfrom
security/pip-bootstrap-refresh

Conversation

@chen21019

Copy link
Copy Markdown

Rebuild the temporary pip installer from checksum-pinned official inputs and upstream vendoring with urllib3 2.8.0. Verify streaming/TLS before downloading build dependencies, then retire pip and seed wheels as before. This does not replace the already verified v0.20.15 runtime archive. Run existing full security gate and CodeQL before merge.

@chen21019
chen21019 marked this pull request as ready for review October 23, 2026 13:22
@chen21019
chen21019 requested a review from a team as a code owner October 23, 2026 13:22
@chen21019
chen21019 merged commit 55dfdcc into main Oct 23, 2026
5 checks passed
@chen21019
chen21019 deleted the security/pip-bootstrap-refresh branch October 23, 2026 13:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant