public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/python-pip] rawhide: Update to 26.2.1 (rhbz#2511297)
@ 2026-09-10 11:17 Lumir Balhar
0 siblings, 0 replies; only message in thread
From: Lumir Balhar @ 2026-09-10 11:17 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/python-pip
Branch : rawhide
Commit : ff6cafd094c68f416108f620e94f3782609decf3
Author : Lumir Balhar <lbalhar@redhat.com>
Date : 2026-09-07T12:28:08+02:00
Stats : +83/-463 in 7 file(s)
URL : https://src.fedoraproject.org/rpms/python-pip/c/ff6cafd094c68f416108f620e94f3782609decf3?branch=rawhide
Log:
Update to 26.2.1 (rhbz#2511297)
Co-Authored-By: Miro Hrončok <miro@hroncok.cz>
---
diff --git a/10dfb6b900.patch b/10dfb6b900.patch
deleted file mode 100644
index 5b56c7e..0000000
--- a/10dfb6b900.patch
+++ /dev/null
@@ -1,347 +0,0 @@
-From 10dfb6b9005484578b386f64b9f36982e3dc6679 Mon Sep 17 00:00:00 2001
-From: Damian Shaw <damian.peter.shaw@gmail.com>
-Date: Tue, 30 Jun 2026 21:52:39 -0400
-Subject: [PATCH] Fix Link.filename decoding URL path twice (#14110)
-
-Link already percent-decodes the URL path into `self._path`, but
-`Link.filename` decoded the basename again, so a doubly-encoded
-separator was decoded twice: `%252F` became `%2F` in `__init__`, then
-`/` in `filename`, turning the single component `a%2Fb.whl` into
-`a/b.whl`.
-
-Drop the second decode, and add a `join_within_directory` helper so the
-download-path joins treat the name as a single path component.
----
- news/14110.bugfix.rst | 1 +
- src/pip/_internal/models/link.py | 63 ++++++++++---
- src/pip/_internal/network/download.py | 20 +++--
- src/pip/_internal/operations/prepare.py | 6 +-
- tests/unit/test_link.py | 113 +++++++++++++++++++++++-
- 5 files changed, 182 insertions(+), 21 deletions(-)
- create mode 100644 news/14110.bugfix.rst
-
-diff --git a/news/14110.bugfix.rst b/news/14110.bugfix.rst
-new file mode 100644
-index 0000000000..f7d4f78882
---- /dev/null
-+++ b/news/14110.bugfix.rst
-@@ -0,0 +1 @@
-+Fix ``Link.filename`` decoding the URL path twice.
-diff --git a/src/pip/_internal/models/link.py b/src/pip/_internal/models/link.py
-index 0a09c66222..cbbe945c17 100644
---- a/src/pip/_internal/models/link.py
-+++ b/src/pip/_internal/models/link.py
-@@ -13,6 +13,7 @@
- from typing import (
- Any,
- NamedTuple,
-+ NewType,
- )
-
- from pip._internal.exceptions import InvalidEggFragment
-@@ -30,6 +31,49 @@
- logger = logging.getLogger(__name__)
-
-
-+# A single path component: percent-decoded once and reduced to a basename, so it
-+# contains no path separator and is not a ``.`` or ``..`` reference. The empty
-+# string means "no component".
-+PathComponent = NewType("PathComponent", str)
-+
-+
-+def _to_path_component(name: str) -> PathComponent:
-+ """Reduce ``name`` to a single path component, or ``""`` if it has none.
-+
-+ ``os.path.basename`` drops any directory part, drive letter, or separator;
-+ a ``.``, ``..``, or empty result is not a component and becomes ``""``.
-+ """
-+ name = os.path.basename(name)
-+ if name in ("", os.curdir, os.pardir):
-+ return PathComponent("")
-+
-+ return PathComponent(name)
-+
-+
-+def as_path_component(name: str) -> PathComponent:
-+ """Like ``_to_path_component`` but reject the empty result.
-+
-+ Use where a file is about to be written, so a missing name is an error
-+ rather than a silent fallback to the directory itself.
-+ """
-+ component = _to_path_component(name)
-+ if not component:
-+ raise ValueError(f"Unexpected file name derived from URL: {name!r}")
-+
-+ return component
-+
-+
-+def join_within_directory(directory: str, component: PathComponent) -> str:
-+ """Join a single path ``component`` onto ``directory``.
-+
-+ ``component`` is a :data:`PathComponent`, so by type it has no separator and
-+ is not a ``.`` or ``..`` reference; the result can never escape ``directory``.
-+ Requiring ``PathComponent`` rather than ``str`` lets the type checker enforce
-+ at the call site that the name was reduced to a safe component beforehand.
-+ """
-+ return os.path.join(directory, component)
-+
-+
- # Order matters, earlier hashes have a precedence over later hashes for what
- # we will pick to use.
- _SUPPORTED_HASHES = ("sha512", "sha384", "sha256", "sha224", "sha1", "md5")
-@@ -424,18 +468,13 @@ def redacted_url(self) -> str:
- return redact_auth_from_url(self.url)
-
- @property
-- def filename(self) -> str:
-- path = self.path.rstrip("/")
-- name = posixpath.basename(path)
-- if not name:
-- # Make sure we don't leak auth information if the netloc
-- # includes a username and password.
-- netloc, user_pass = split_auth_from_netloc(self.netloc)
-- return netloc
--
-- name = urllib.parse.unquote(name)
-- assert name, f"URL {self._url!r} produced no filename"
-- return name
-+ def filename(self) -> PathComponent:
-+ name = _to_path_component(posixpath.basename(self.path.rstrip("/")))
-+ if name:
-+ return name
-+
-+ # No component in the path; fall back to the netloc, dropping any auth.
-+ return _to_path_component(split_auth_from_netloc(self.netloc)[0])
-
- @property
- def file_path(self) -> str:
-diff --git a/src/pip/_internal/network/download.py b/src/pip/_internal/network/download.py
-index 039b268878..6faafb5cb0 100644
---- a/src/pip/_internal/network/download.py
-+++ b/src/pip/_internal/network/download.py
-@@ -19,7 +19,12 @@
-
- from pip._internal.cli.progress_bars import BarType, get_download_progress_renderer
- from pip._internal.exceptions import IncompleteDownloadError, NetworkConnectionError
--from pip._internal.models.link import Link
-+from pip._internal.models.link import (
-+ Link,
-+ PathComponent,
-+ as_path_component,
-+ join_within_directory,
-+)
- from pip._internal.network.cache import SafeFileCache, is_from_cache
- from pip._internal.network.session import CacheControlAdapter, PipSession
- from pip._internal.network.utils import HEADERS, raise_for_status, response_chunks
-@@ -121,11 +126,14 @@ def parse_content_disposition(content_disposition: str, default_filename: str) -
- return filename or default_filename
-
-
--def _get_http_response_filename(resp: Response, link: Link) -> str:
-+def _get_http_response_filename(resp: Response, link: Link) -> PathComponent:
- """Get an ideal filename from the given HTTP response, falling back to
- the link filename if not provided.
-+
-+ The result is validated as a single path component, so it can be joined onto
-+ a download directory without escaping it.
- """
-- filename = link.filename # fallback
-+ filename: str = link.filename # fallback
- # Have a look at the Content-Disposition header for a better guess
- content_disposition = resp.headers.get("content-disposition")
- if content_disposition:
-@@ -139,7 +147,7 @@ def _get_http_response_filename(resp: Response, link: Link) -> str:
- ext = os.path.splitext(resp.url)[1]
- if ext:
- filename += ext
-- return filename
-+ return as_path_component(filename)
-
-
- @dataclass
-@@ -192,7 +200,9 @@ def __call__(self, link: Link, location: str) -> tuple[str, str]:
- resp = self._http_get(link)
- download_size = _get_http_response_size(resp)
-
-- filepath = os.path.join(location, _get_http_response_filename(resp, link))
-+ filepath = join_within_directory(
-+ location, _get_http_response_filename(resp, link)
-+ )
- with open(filepath, "wb") as content_file:
- download = _FileDownload(link, content_file, download_size)
- self._process_response(download, resp)
-diff --git a/src/pip/_internal/operations/prepare.py b/src/pip/_internal/operations/prepare.py
-index afcc0376da..3b44403e0d 100644
---- a/src/pip/_internal/operations/prepare.py
-+++ b/src/pip/_internal/operations/prepare.py
-@@ -29,7 +29,7 @@
- from pip._internal.index.package_finder import PackageFinder
- from pip._internal.metadata import BaseDistribution, get_metadata_distribution
- from pip._internal.models.direct_url import ArchiveInfo, DirectUrl
--from pip._internal.models.link import Link
-+from pip._internal.models.link import Link, join_within_directory
- from pip._internal.models.wheel import Wheel
- from pip._internal.network.download import Downloader
- from pip._internal.network.lazy_wheel import (
-@@ -201,7 +201,7 @@ def _check_download_dir(
- """Check download_dir for previously downloaded file with correct hash
- If a correct file is found return its path else None
- """
-- download_path = os.path.join(download_dir, link.filename)
-+ download_path = join_within_directory(download_dir, link.filename)
-
- if not os.path.exists(download_path):
- return None
-@@ -687,7 +687,7 @@ def save_linked_requirement(self, req: InstallRequirement) -> None:
- # No distribution was downloaded for this requirement.
- return
-
-- download_location = os.path.join(self.download_dir, link.filename)
-+ download_location = join_within_directory(self.download_dir, link.filename)
- if not os.path.exists(download_location):
- shutil.copy(req.local_file_path, download_location)
- download_path = display_path(download_location)
-diff --git a/tests/unit/test_link.py b/tests/unit/test_link.py
-index c49f8547ac..bc8cb8ab9b 100644
---- a/tests/unit/test_link.py
-+++ b/tests/unit/test_link.py
-@@ -1,9 +1,17 @@
- from __future__ import annotations
-
-+import os
-+import posixpath
-+
- import pytest
-
- from pip._internal.exceptions import InvalidEggFragment, PipError
--from pip._internal.models.link import Link, links_equivalent
-+from pip._internal.models.link import (
-+ Link,
-+ as_path_component,
-+ join_within_directory,
-+ links_equivalent,
-+)
- from pip._internal.utils.hashes import Hashes
-
-
-@@ -29,6 +37,13 @@ def test_repr(self, url: str, expected: str) -> None:
- ("https://example.com/path/page.html", "page.html"),
- # Test a quoted character.
- ("https://example.com/path/page%231.html", "page#1.html"),
-+ # A doubly-encoded separator must stay encoded: the path is decoded
-+ # exactly once, so the file name keeps its literal "%2F" instead of
-+ # collapsing into a "/".
-+ (
-+ "https://example.com/a%252Fb.whl",
-+ "a%2Fb.whl",
-+ ),
- (
- "http://yo/myproject-1.0%2Bfoobar.0-py2.py3-none-any.whl",
- "myproject-1.0+foobar.0-py2.py3-none-any.whl",
-@@ -49,6 +64,52 @@ def test_filename(self, url: str, expected: str) -> None:
- link = Link(url)
- assert link.filename == expected
-
-+ @pytest.mark.parametrize(
-+ "url",
-+ [
-+ "https://example.com/a%252Fb.whl",
-+ "https://example.com/%252e%252e%252fb.whl",
-+ ],
-+ )
-+ def test_filename_decoded_once_stays_single_component(self, url: str) -> None:
-+ # The path is decoded exactly once, so an encoded separator stays
-+ # encoded and the file name remains a single path component rather
-+ # than collapsing into a "/"-separated path.
-+ filename = Link(url).filename
-+ assert not posixpath.isabs(filename)
-+ assert posixpath.basename(filename) == filename
-+
-+ @pytest.mark.parametrize(
-+ "url",
-+ [
-+ "https://example.com/..",
-+ "https://example.com/.",
-+ "https://example.com/foo/%2e%2e",
-+ ],
-+ )
-+ def test_filename_parent_reference_falls_back_to_netloc(self, url: str) -> None:
-+ # A path that is only a "." or ".." reference has no usable file name,
-+ # so filename falls back to the netloc rather than handing back a
-+ # traversal component that could escape a download directory.
-+ assert Link(url).filename == "example.com"
-+
-+ @pytest.mark.parametrize(
-+ "url",
-+ [
-+ # A path-less URL whose authority looks like a traversal: the netloc
-+ # fallback must still reduce to a single path component.
-+ "http://..\\..\\..\\evil.whl",
-+ "http://../",
-+ "http://..",
-+ ],
-+ )
-+ def test_filename_is_always_a_path_component(self, url: str) -> None:
-+ # filename must never carry a separator or parent reference, so joining
-+ # it onto a directory can never escape that directory.
-+ name = Link(url).filename
-+ assert os.path.basename(name) == name
-+ assert name not in (os.curdir, os.pardir)
-+
- def test_splitext(self) -> None:
- assert ("wheel", ".whl") == Link("http://yo/wheel.whl").splitext()
-
-@@ -244,3 +305,53 @@ def test_links_equivalent(url1: str, url2: str) -> None:
- )
- def test_links_equivalent_false(url1: str, url2: str) -> None:
- assert not links_equivalent(Link(url1), Link(url2))
-+
-+
-+@pytest.mark.parametrize(
-+ "name",
-+ [
-+ "wheel.whl",
-+ "myproject-1.0+foobar.0-py2.py3-none-any.whl",
-+ # A literal "%2F" is a normal file name, not a separator.
-+ "a%2Fb.whl",
-+ ],
-+)
-+def test_as_path_component_keeps_plain_name(name: str) -> None:
-+ assert as_path_component(name) == name
-+
-+
-+@pytest.mark.parametrize(
-+ "name",
-+ [
-+ os.path.join(os.sep, "abs", "pkg.whl"),
-+ os.path.join("..", "pkg.whl"),
-+ os.path.join("nested", "pkg.whl"),
-+ ],
-+)
-+def test_as_path_component_reduces_to_basename(name: str) -> None:
-+ # A name carrying directory components is reduced to its basename, so the
-+ # result always stays inside the directory it is later joined onto.
-+ assert as_path_component(name) == os.path.basename(name)
-+
-+
-+@pytest.mark.parametrize("name", ["", ".", "..", "/", os.path.join("sub", "..")])
-+def test_as_path_component_rejects_empty_or_parent_reference(name: str) -> None:
-+ with pytest.raises(ValueError):
-+ as_path_component(name)
-+
-+
-+@pytest.mark.parametrize(
-+ "name",
-+ [
-+ "pkg.whl",
-+ # A literal "%2F" is a normal file name, not a separator.
-+ "a%2Fb.whl",
-+ ],
-+)
-+def test_join_within_directory_stays_inside(name: str) -> None:
-+ # The component is joined onto the directory as its final element, so the
-+ # result stays inside the directory.
-+ directory = os.path.join("base", "downloads")
-+ joined = join_within_directory(directory, as_path_component(name))
-+ assert joined == os.path.join(directory, name)
-+ assert os.path.basename(joined) == name
diff --git a/14301.patch b/14301.patch
new file mode 100644
index 0000000..ab0607d
--- /dev/null
+++ b/14301.patch
@@ -0,0 +1,67 @@
+From 9f88eb8a9bf2f3e76c552178f3d58203d4296810 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+Date: Mon, 7 Sep 2026 12:23:09 +0200
+Subject: [PATCH] Explicitly set the level of captured logging in
+ test_keyring_cli_outdated_version
+
+When updating pip from 26.1.2 to 26.2.1 in Fedora,
+we realized that the test_keyring_cli_outdated_version test is flaky.
+This is not necessarily new in 26.2.1, we just noticed it now.
+
+Often 1 or more of the parametrized runs fail with:
+
+ AssertionError: assert 7 == 1
+
+This is caused by VERBOSE and DEBUG log messages:
+
+ ------------------------------ Captured log call -------------------------------
+ DEBUG pip._internal.network.auth:auth.py:381 Found index url http://example.com/path2/
+ VERBOSE pip._internal.network.auth:_log.py:23 Keyring provider requested: subprocess
+ VERBOSE pip._internal.network.auth:_log.py:23 Keyring provider set: subprocess with executable keyring
+ DEBUG pip._internal.network.auth:auth.py:294 Keyring is skipped due to an exception
+ Traceback (most recent call last):
+ File ".../usr/lib/python3.15/site-packages/pip/_internal/network/auth.py", line 290, in _get_keyring_auth
+ return self.keyring_provider.get_auth_info(url, username)
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
+ File ".../usr/lib/python3.15/site-packages/pip/_internal/network/auth.py", line 122, in get_auth_info
+ return self._get_creds(url, username)
+ ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
+ File ".../usr/lib/python3.15/site-packages/pip/_internal/network/auth.py", line 154, in _get_creds
+ raise RuntimeError(
+ ...<2 lines>...
+ )
+ RuntimeError: Keyring util is outdated; must be at least version 25.2.1, please upgrade it
+ WARNING pip._internal.network.auth:auth.py:296 Keyring is skipped due to an exception: Keyring util is outdated; must be at least version 25.2.1, please upgrade it
+ VERBOSE pip._internal.network.auth:_log.py:23 Keyring provider requested: subprocess
+ VERBOSE pip._internal.network.auth:_log.py:23 Keyring provider set: disabled
+
+We run the test suite with pytest-xdist and it seems to me that other tests
+are manipulating the log level,
+and the flakiness depends on which worker runs which tests.
+
+Set the log level explicitly to make the assumptions of the test more sane.
+---
+ tests/unit/test_network_auth.py | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tests/unit/test_network_auth.py b/tests/unit/test_network_auth.py
+index d10130510e..216b9e03e5 100644
+--- a/tests/unit/test_network_auth.py
++++ b/tests/unit/test_network_auth.py
+@@ -4,6 +4,7 @@
+ import contextlib
+ import functools
+ import json
++import logging
+ import os
+ import subprocess
+ import sys
+@@ -713,6 +714,8 @@ def test_keyring_cli_outdated_version(
+ url: str,
+ expect: tuple[str | None, str | None],
+ ) -> None:
++ caplog.set_level(logging.INFO)
++
+ keyring_subprocess = KeyringSubprocessResult()
+ keyring_subprocess.old_version = True
+
diff --git a/4c6d7471de.patch b/4c6d7471de.patch
deleted file mode 100644
index d107561..0000000
--- a/4c6d7471de.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 4c6d7471dec62fb004a47a7c2164b6b5b089ac06 Mon Sep 17 00:00:00 2001
-From: Richard Si <sichard26@gmail.com>
-Date: Fri, 5 Jun 2026 15:44:14 -0400
-Subject: [PATCH] Also fix user site patching in test suite
-
----
- tests/lib/venv.py | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/tests/lib/venv.py b/tests/lib/venv.py
-index 67b01d9f31..4e86b92b3b 100644
---- a/tests/lib/venv.py
-+++ b/tests/lib/venv.py
-@@ -174,11 +174,13 @@ def _customize_site(self) -> None:
- site.ENABLE_USER_SITE = {self._user_site_packages}
- # First, drop system-sites related paths.
- original_sys_path = sys.path[:]
-+ # To discover system-sites related paths, clear sys.path
-+ # and build a new one with only system paths.
-+ sys.path = []
- known_paths = set()
- for path in site.getsitepackages():
- site.addsitedir(path, known_paths=known_paths)
-- system_paths = sys.path[len(original_sys_path):]
-- for path in system_paths:
-+ for path in sys.path:
- if path in original_sys_path:
- original_sys_path.remove(path)
- sys.path = original_sys_path
diff --git a/6099a54ddd.patch b/6099a54ddd.patch
deleted file mode 100644
index 0bc8ea7..0000000
--- a/6099a54ddd.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 6099a54dddbfbc7fb912d53b6adad5ff6b8d1745 Mon Sep 17 00:00:00 2001
-From: Richard Si <sichard26@gmail.com>
-Date: Fri, 5 Jun 2026 15:03:38 -0400
-Subject: [PATCH] Fix sitecustomize.py used for build isolation on Python 3.15+
-
-The sitecustomize.py file pip uses to isolate build subprocesses from
-the parent environment discovers system related paths by calling
-site.addsitedir() for every system site-packages path and observing
-what new entries are appended to sys.path.
-
-This breaks since Python 3.15b2 due to two changes:
-
-- site.addsitedir() won't add a path if it already exists in sys.path
-
-- site.addsitedir() won't re-execute .pth files if called for a known
- directory (which includes the system sites because known_path is
- mutated by addsitedir before it checks for .pth files)
-
-To cope with this, temporarily clear sys.path before using
-site.addsitedir() to discover all system paths for exclusion.
----
- news/14033.bugfix.rst | 1 +
- src/pip/_internal/build_env.py | 14 +++++++++-----
- 2 files changed, 10 insertions(+), 5 deletions(-)
- create mode 100644 news/14033.bugfix.rst
-
-diff --git a/news/14033.bugfix.rst b/news/14033.bugfix.rst
-new file mode 100644
-index 0000000000..404196a2f0
---- /dev/null
-+++ b/news/14033.bugfix.rst
-@@ -0,0 +1 @@
-+Prevent system packages from leaking into isolated build environments on Python 3.15
-diff --git a/src/pip/_internal/build_env.py b/src/pip/_internal/build_env.py
-index 1a42a9d411..7639dabcad 100644
---- a/src/pip/_internal/build_env.py
-+++ b/src/pip/_internal/build_env.py
-@@ -468,15 +468,19 @@ def __init__(self, installer: BuildEnvironmentInstaller) -> None:
- """
- import os, site, sys
-
-- # First, drop system-sites related paths.
-+ # First, discover all system-sites related paths.
- original_sys_path = sys.path[:]
-+ # Clear sys.path so addsitedir() will add system site paths and paths
-+ # added by contained .pth files to sys.path reliably. This is necessary
-+ # since Python 3.15, which notably no longer re-executes .pth files for
-+ # known paths.
-+ sys.path = []
- known_paths = set()
- for path in {system_sites!r}:
- site.addsitedir(path, known_paths=known_paths)
-- system_paths = set(
-- os.path.normcase(path)
-- for path in sys.path[len(original_sys_path):]
-- )
-+ system_paths = set(os.path.normcase(path) for path in sys.path)
-+
-+ # Drop discovered system-sites related paths.
- original_sys_path = [
- path for path in original_sys_path
- if os.path.normcase(path) not in system_paths
diff --git a/python-pip.spec b/python-pip.spec
index 732bf9c..3fcf89f 100644
--- a/python-pip.spec
+++ b/python-pip.spec
@@ -6,7 +6,7 @@
%bcond man 1
%global srcname pip
-%global base_version 26.1.2
+%global base_version 26.2.1
%global upstream_version %{base_version}%{?prerel}
%global python_wheel_name %{srcname}-%{upstream_version}-py3-none-any.whl
@@ -95,24 +95,12 @@ Patch: dummy-certifi.patch
# We don't need a layer to check that, as we're by default in an offline environment
Patch: downstream-remove-pytest-subket.patch
-# Fix sitecustomize.py used for build isolation on Python 3.15+
-Patch: https://github.com/pypa/pip/commit/6099a54ddd.patch
-
-# Fix user-site path ordering in the test suite on Python 3.15+
-# The same CPython gh-149819 change that broke build env isolation also broke
-# _customize_site() in tests/lib/venv.py: site.addsitedir() no longer
-# re-appends paths already in sys.path, so the detection of system-site paths
-# produces an empty list and user site ends up after venv site-packages instead
-# of before it, causing user-site install/uninstall tests to operate on the
-# wrong installation.
-Patch: https://github.com/pypa/pip/commit/4c6d7471de.patch
-
# Allow flit-core 4 to build pip
# https://github.com/pypa/pip/commit/09a03f6cfa (non-existing files removed)
Patch: 09a03f6cfa.patch
-# CVE-2026-13346: Link.filename double URL decode allows path traversal
-Patch: https://github.com/pypa/pip/commit/10dfb6b900.patch
+# Fix for flaky test_keyring_cli_outdated_version, proposed upstream.
+Patch: https://github.com/pypa/pip/pull/14301.patch
# Remove -s from Python shebang - ensure that packages installed with pip
# to user locations are seen by pip itself
@@ -131,23 +119,23 @@ Packages" or "Pip Installs Python".
# %%{_rpmconfigdir}/pythonbundles.py --namespace 'python%%{1}dist' src/pip/_vendor/vendor.txt
%global bundled() %{expand:
Provides: bundled(python%{1}dist(cachecontrol)) = 0.14.4
-Provides: bundled(python%{1}dist(certifi)) = 2026.2.25
-Provides: bundled(python%{1}dist(distlib)) = 0.4
+Provides: bundled(python%{1}dist(certifi)) = 2026.6.17
+Provides: bundled(python%{1}dist(distlib)) = 0.4.2
Provides: bundled(python%{1}dist(distro)) = 1.9
-Provides: bundled(python%{1}dist(idna)) = 3.11
+Provides: bundled(python%{1}dist(idna)) = 3.18
Provides: bundled(python%{1}dist(msgpack)) = 1.1.2
Provides: bundled(python%{1}dist(packaging)) = 26.2
-Provides: bundled(python%{1}dist(platformdirs)) = 4.5.1
-Provides: bundled(python%{1}dist(pygments)) = 2.19.2
+Provides: bundled(python%{1}dist(platformdirs)) = 4.10
+Provides: bundled(python%{1}dist(pygments)) = 2.20
Provides: bundled(python%{1}dist(pyproject-hooks)) = 1.2
-Provides: bundled(python%{1}dist(requests)) = 2.33.1
+Provides: bundled(python%{1}dist(requests)) = 2.34.2
Provides: bundled(python%{1}dist(resolvelib)) = 1.2.1
Provides: bundled(python%{1}dist(rich)) = 14.2
Provides: bundled(python%{1}dist(setuptools)) = 70.3
-Provides: bundled(python%{1}dist(tomli)) = 2.3.1
+Provides: bundled(python%{1}dist(tomli)) = 2.4.1
Provides: bundled(python%{1}dist(tomli-w)) = 1.2
Provides: bundled(python%{1}dist(truststore)) = 0.10.4
-Provides: bundled(python%{1}dist(urllib3)) = 2.6.3
+Provides: bundled(python%{1}dist(urllib3)) = 2.7
}
# Some manylinux1 wheels need libcrypt.so.1.
@@ -336,6 +324,9 @@ pytest_k="$pytest_k and not (functional and bazaar)"
pytest_k="$pytest_k and not test_all_fields and not test_report_mixed_not_found and not test_basic_show" # "Editable project location" missing
pytest_k="$pytest_k and not test_basic_install_from_wheel"
pytest_k="$pytest_k and not test_check_unsupported"
+# these require cmake/keyring wheels not available locally
+pytest_k="$pytest_k and not test_build_env_can_still_access_python_tools_on_system_path"
+pytest_k="$pytest_k and not test_build_dependency_install_uses_same_keyring_as_root"
%pytest -n auto -m 'not network' -k "$(echo $pytest_k)" \
--ignore tests/functional/test_proxy.py # no proxy.py in Fedora
diff --git a/remove-existing-dist-only-if-path-conflicts.patch b/remove-existing-dist-only-if-path-conflicts.patch
index 02d0c69..d73d66c 100644
--- a/remove-existing-dist-only-if-path-conflicts.patch
+++ b/remove-existing-dist-only-if-path-conflicts.patch
@@ -90,7 +90,7 @@ index a74200a..99738cc 100644
import logging
+import sys
+import sysconfig
- from collections.abc import Iterable, Iterator, Mapping, Sequence
+ from collections.abc import Callable, Iterable, Iterator, Mapping, Sequence
from typing import (
TYPE_CHECKING,
@@ -674,6 +676,16 @@ class Factory:
diff --git a/sources b/sources
index 786a390..1c36098 100644
--- a/sources
+++ b/sources
@@ -1,4 +1,4 @@
SHA512 (setuptools-79.0.1-py3-none-any.whl) = fef6cfc6f95a5bb7320f1680e1c665cb8d9a4e4227cde4d8aab8a50bed4bcf04320085b9d7d5343359f887008db5c5a861e57f3d08b7b0b2311a28adaeee6b4a
SHA512 (flit_core-3.12.0-py3-none-any.whl) = 790c12b1f43201e365fb3f8f2f0a54e1a578876799dfdf8bfeea679a25ea096bf62946d006618c1458ae6e37ce6d00998f37e9aba426d5ab80d32ef2d75da4e0
-SHA512 (pip-26.1.2.tar.gz) = e29c98a7da5e329183b7eef86a66f9d6c3473051f64aa6e762714306148547eb0de4220824484071822a9a62bd01a62a09ab16bba4c26e4b847bfc2609728608
SHA512 (coverage-0-py3-none-any.whl) = e734192565347010efe68f8ba600254259c9b647f3c553fd4e5d87b1d7f955cb15d6f7d807716f4a6415d239beed945fbec7210feaf502e9cc849c332845926e
+SHA512 (pip-26.2.1.tar.gz) = 03a00bdc4387a4e7e4e54672e9198893500d279912ece4cd144f015c568c974ecc2c3c7bd6abf108df852302ddd49468ef0bc514ca4323ee037d754e2fbfaee0
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-10 11:17 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-10 11:17 [rpms/python-pip] rawhide: Update to 26.2.1 (rhbz#2511297) Lumir Balhar
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox