Release 25.0.1.post2

ActiveState security release on the Python 3.8 pip 25.0.1 line. Merged in #13.

CVE	Advisory	Status
—	GHSA-6q48-6c7w-9gw2 (follow-up)	Patched: vendored certifi 2026.10.19 → 2026.10.23

What changed:

• Two more emSign roots are dropped: emSign Root CA - C1 and emSign ECC Root CA - C3. They come from the same eMudhra/emSign CA key compromise as emSign ECC Root CA - G3, which the previous release removed.
• emSign Root CA - G1 is now the only emSign root in the bundle.
• Nothing else in pip changes.

Validated on the built wheel, in python:3.8-slim:

• Version: pip reports 25.0.1.post2, and the vendored certifi reports 2026.10.23.
• Roots: the bundle has 118 roots, and G1 is the only emSign root.
• Network: a real pip download from PyPI works.
• Diff from the previous release: the wheel differs from the previous release's only in the vendored certifi files, pip/__init__.py, RECORD and the metadata version.

sha256

• pip-25.0.1.post2.tar.gz: 9247655893552ea118e49e20153c705e092a84f616d58f8ec6152c3d3c8a2b4c
• pip-25.0.1.post2-py3-none-any.whl: 5e2925ce7f2c9cfceebe11d47b525d59a8338bd359186bd9ccb1a46555d806de