Skip to content

Release 20.3.4.post4

Choose a tag to compare

View all tags
@icanhasmath icanhasmath released this 28 Oct 16:44
· 2837 commits to main since this release
20.3.4.post4
29feaea
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ActiveState security release on the Python 2.7 pip 20.3.4 line. Merged in #10.

CVE Advisory Status
— GHSA-6q48-6c7w-9gw2 (follow-up) Patched: vendored certifi 2026.10.19.post1 → 2026.10.23.post1

What changed:

  • Two more emSign roots are dropped: emSign Root CA - C1 and emSign ECC Root CA - C3. They come from the same eMudhra/emSign CA key compromise as emSign ECC Root CA - G3, which the previous release removed.
  • emSign Root CA - G1 is now the only emSign root in the bundle.
  • Nothing else in pip changes.

Validated on the built wheel, in python:2.7-slim:

  • Version: pip reports 20.3.4.post4, and the vendored certifi reports 2026.10.23.post1.
  • Roots: the bundle has 118 roots, and G1 is the only emSign root.
  • Network: a real pip download from PyPI works.
  • Diff from the previous release: the wheel differs from the previous release's only in the vendored certifi files, pip/__init__.py, RECORD and the metadata version.

sha256

  • pip-20.3.4.post4.tar.gz: 89d4303fa7eb2b0e56a3498424eee39913f530400e78f34805963b30a04f7579
  • pip-20.3.4.post4-py2.py3-none-any.whl: 53eba7622664cacd5dc58bff49691157169b70ae2784361d0ba92e96715cd7c7
Assets 4
Loading