Announced 2026-10-25. Both security releases block compromised eMudhra intermediate CA keys in ssl, protecting normal pip use even before pip itself is updated. They also update Expat to 2.9.0 and reject destination-replacing links in tarfile filters. Source tarball availability was verified; binary installers are not provided. Developers can review distribution package updates or source builds.
AI-edited
0 comments
Sign in · Sign in to leave a comment.