Announced 2026-10-25. Both security releases block compromised eMudhra intermediate CA keys in ssl, protecting normal pip use even before pip itself is updated. They also update Expat to 2.9.0 and reject destination-replacing links in tarfile filters. Source tarball availability was verified; binary installers are not provided. Developers can review distribution package updates or source builds. Additional verification: Python 3.11.18 was also published as a source-only security release dated 2026-10-25. It includes ssl rejection of compromised eMudhra intermediate CA keys, Expat 2.9.0 and tarfile filter fixes; no binary installers are provided.
AI-edited
0 comments
Sign in · Sign in to leave a comment.