Release 24.0.post4

ActiveState security release on the Python 3.7 pip 24.0 line, bundled by CPython 3.7.17.8. Merged in #16.

CVE	Advisory	Status
CVE-2023-45803	GHSA-g4mx-q9vg-27p4	Patched (vendored urllib3)
CVE-2024-37891	GHSA-34jh-p97f-mpxf	Patched (vendored urllib3)
CVE-2025-50181	GHSA-pq67-6m6q-mj2v	Patched (vendored urllib3)
CVE-2025-66418	GHSA-gm62-xv2j-4w53	Patched (vendored urllib3)
CVE-2025-66471	GHSA-2xpw-w6gg-jr37	Patched (vendored urllib3)
CVE-2026-21441	GHSA-38jv-5279-wg99	Patched (vendored urllib3)
CVE-2026-44431	GHSA-qccp-gfcp-xxvc	Patched (vendored urllib3)
CVE-2026-97687	GHSA-8988-9cw3-xx77	Patched (vendored urllib3)
CVE-2026-97689	GHSA-vxq7-64xx-v4gw	Patched (vendored urllib3)
CVE-2024-47081	GHSA-9hjg-9r4m-mvj7	Patched (vendored requests)
CVE-2026-25645	GHSA-gc5v-m9x4-r6x2	Patched (vendored requests; defense in depth)
CVE-2024-35195	GHSA-9wx4-h78v-vm56	Not affected: pip never shares an adapter between verified and --trusted-host requests

What changed:

• Vendored urllib3 1.26.17 → ActiveState urllib3 1.26.20.post4, vendored with pip's own vendoring diff. The tree is identical to the one in pip 26.0.1.post3.
• Vendored requests stays at 2.31.0, the last release for Python 3.7, with the CVE-2024-47081 and CVE-2026-25645 fixes backported.
• certifi stays at 2026.10.23, so emSign Root CA - G1 is the only emSign root.

Validated on the built wheel, in python:3.7-slim:

• Versions: pip reports 24.0.post4, with vendored urllib3 1.26.20 (the fork), requests 2.31.0 and certifi 2026.10.23, and no RequestsDependencyWarning under -W error.
• CVE checks: a .netrc lookup for http://example.com:@attacker.com/ returns attacker.com's entry, and a planted cacert.pem is not reused.
• Network: a real pip download from PyPI works.

sha256

• pip-24.0.post4.tar.gz: 85db1f2616428747cf4d12486adeb9a1717a871179a483bfacd99c70c63f2561
• pip-24.0.post4-py3-none-any.whl: 749401b66b9dee893c560b12b8ee3b6f2d2d3600bdc047350c1a9d6db9047c17