From 40d51760691c876f90e18b25a95f12cd06ea02f0 Mon Sep 17 00:00:00 2001 From: Joachim Rosskopf Date: Sat, 5 Sep 2026 11:45:38 +0200 Subject: [PATCH] chore(deps): raise the pip floor past CVE-2026-8643 pip < 26.1.2 treats console_scripts and gui_scripts entry points as paths rather than file names, without checking that the resolved absolute path stays inside the installation directory. A crafted wheel can therefore write its entry-point wrappers anywhere the installing user can write. CVSS v4.0 4.1 (MEDIUM), 8.0 (HIGH) on Red Hat's v3.1 assessment. The root project pins pip for the .venv that rfc/test/parallel runs under (see its README: "uv run pytest rfc/test/parallel"), so the vulnerable version was genuinely installed, not merely recorded in a lockfile. uv resolves the new floor to 26.2.1. uv 0.12.9 also rewrites the lockfile header from revision 1 to 3; that is the current on-disk format, unrelated to the bump. Reported in #141. --- pyproject.toml | 2 +- uv.lock | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 022e51d..8ca1a85 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -5,5 +5,5 @@ description = "Python helper for the Duckdb python extension" readme = "README.md" requires-python = ">=3.13" dependencies = [ - "pip>=25.0.1", + "pip>=26.1.2", ] diff --git a/uv.lock b/uv.lock index 4d605f5..820d263 100644 --- a/uv.lock +++ b/uv.lock @@ -1,5 +1,5 @@ version = 1 -revision = 1 +revision = 3 requires-python = ">=3.13" [[package]] @@ -11,13 +11,13 @@ dependencies = [ ] [package.metadata] -requires-dist = [{ name = "pip", specifier = ">=25.0.1" }] +requires-dist = [{ name = "pip", specifier = ">=26.1.2" }] [[package]] name = "pip" -version = "25.0.1" +version = "26.2.1" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/70/53/b309b4a497b09655cb7e07088966881a57d082f48ac3cb54ea729fd2c6cf/pip-25.0.1.tar.gz", hash = "sha256:88f96547ea48b940a3a385494e181e29fb8637898f88d88737c5049780f196ea", size = 1950850 } +sdist = { url = "https://files.pythonhosted.org/packages/ae/15/4500e320e6b101ec3b719ae85b697d9940b6cda672bc555bd6016fc60c6f/pip-26.2.1.tar.gz", hash = "sha256:f6ad667e89a1fe78046c8f13232b247200f5258d7828f3f7883d660878e0813f", size = 1848877, upload-time = "2026-08-04T22:51:14.148Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/c9/bc/b7db44f5f39f9d0494071bddae6880eb645970366d0a200022a1a93d57f5/pip-25.0.1-py3-none-any.whl", hash = "sha256:c46efd13b6aa8279f33f2864459c8ce587ea6a1a59ee20de055868d8f7688f7f", size = 1841526 }, + { url = "https://files.pythonhosted.org/packages/f3/6e/1736e5b4ae2b778ef2f81c47d797de9f891d4d8acb047a24ca37a60294dd/pip-26.2.1-py3-none-any.whl", hash = "sha256:71138adf1f4ca900cdb7d289c21b7494329f2332b6d85f0e1c42108c0384ed3e", size = 1816632, upload-time = "2026-08-04T22:51:12.472Z" }, ]