Release 21.3.1.post2

ActiveState security release on the Python 3.6 pip 21.3.1 line. Merged in #11.

CVE	Advisory	Status
—	GHSA-6q48-6c7w-9gw2 (follow-up)	Patched: vendored certifi 2026.10.19.post1 → 2026.10.23.post1

What changed:

• Two more emSign roots are dropped: emSign Root CA - C1 and emSign ECC Root CA - C3. They come from the same eMudhra/emSign CA key compromise as emSign ECC Root CA - G3, which the previous release removed.
• emSign Root CA - G1 is now the only emSign root in the bundle.
• Nothing else in pip changes.

Validated on the built wheel, in python:3.6-slim:

• Version: pip reports 21.3.1.post2, and the vendored certifi reports 2026.10.23.post1.
• Roots: the bundle has 118 roots, and G1 is the only emSign root.
• Network: a real pip download from PyPI works.
• Diff from the previous release: the wheel differs from the previous release's only in the vendored certifi files, pip/__init__.py, RECORD and the metadata version.

sha256

• pip-21.3.1.post2.tar.gz: b0b5d96153bafd8bb4ada675d05a29e2d19532bb9eae7f640193fa5614602be2
• pip-21.3.1.post2-py3-none-any.whl: 20734063e0605b6a4f7d7a270a04e1529af87ee9f6d22cf5f08bbcc6b0ead7ba