Skip to content

Release 26.0.1.post2

Choose a tag to compare

View all tags
@icanhasmath icanhasmath released this 28 Oct 16:44
· 0 commits to main since this release
26.0.1.post2
69d4143
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ActiveState security release on the Python 3.9 pip 26.0.1 line. Merged in #14.

CVE Advisory Status
— GHSA-6q48-6c7w-9gw2 (follow-up) Patched: vendored certifi 2026.10.19 → 2026.10.23

What changed:

  • Two more emSign roots are dropped: emSign Root CA - C1 and emSign ECC Root CA - C3. They come from the same eMudhra/emSign CA key compromise as emSign ECC Root CA - G3, which the previous release removed.
  • emSign Root CA - G1 is now the only emSign root in the bundle.
  • Nothing else in pip changes.

Validated on the built wheel, in python:3.9-slim:

  • Version: pip reports 26.0.1.post2, and the vendored certifi reports 2026.10.23.
  • Roots: the bundle has 118 roots, and G1 is the only emSign root.
  • Network: a real pip download from PyPI works.
  • Diff from the previous release: the wheel differs from the previous release's only in the vendored certifi files, pip/__init__.py, RECORD and the metadata version.

sha256

  • pip-26.0.1.post2.tar.gz: 6861db248e0b4574f45730ce6a4321da325572f6f74433e9cc7e9245298ced14
  • pip-26.0.1.post2-py3-none-any.whl: b3fe7b5facd4aab5c11a14cf6a689b71045525c2b8dd35d6a6b45b2e83c0e7c5
Assets 4
Loading