Skip to content

Release 24.0.post3

Choose a tag to compare

View all tags
@icanhasmath icanhasmath released this 28 Oct 16:44
· 0 commits to main since this release
24.0.post3
25c9472
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ActiveState security release on the Python 3.7 pip 24.0 line. Merged in #12.

CVE Advisory Status
— GHSA-6q48-6c7w-9gw2 (follow-up) Patched: vendored certifi 2026.10.19 → 2026.10.23

What changed:

  • Two more emSign roots are dropped: emSign Root CA - C1 and emSign ECC Root CA - C3. They come from the same eMudhra/emSign CA key compromise as emSign ECC Root CA - G3, which the previous release removed.
  • emSign Root CA - G1 is now the only emSign root in the bundle.
  • Nothing else in pip changes.

Validated on the built wheel, in python:3.7-slim:

  • Version: pip reports 24.0.post3, and the vendored certifi reports 2026.10.23.
  • Roots: the bundle has 118 roots, and G1 is the only emSign root.
  • Network: a real pip download from PyPI works.
  • Diff from the previous release: the wheel differs from the previous release's only in the vendored certifi files, pip/__init__.py, RECORD and the metadata version.

sha256

  • pip-24.0.post3.tar.gz: 223f92bdcb53730d1d2086661e8918f235c81562adbc5cdc6c90c4896e11b7a5
  • pip-24.0.post3-py3-none-any.whl: 2cda945c314810ab760bd913874e11c13faca17e64544320fccd90bf7532587f
Assets 4
Loading