build(deps): update dependency pip to v25 [security] (main) - autoclosed
Metadata
Current evaluation
Renovate autoclosed this pull request to update pip to v25.2 for CVE-2025-8869 without merging. The security update was abandoned due to bot inactivity or configuration, leaving the dependency unchanged.
Suggested action: —
No scores available.
Issue body
> [!NOTE]
> Mend has cancelled [the proposed renaming](https://redirect.github.com/renovatebot/renovate/discussions/37842) of the Renovate GitHub app being renamed to `mend[bot]`.
>
> This notice will be removed on 2025-10-07.
<hr>
This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| [pip](https://redirect.github.com/pypa/pip) ([changelog](https://pip.pypa.io/en/stable/news/)) | `==24.0` -> `==25.2` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2025-8869](https://nvd.nist.gov/vuln/detail/CVE-2025-8869)
### Summary
In the fallback extraction path for source distributions, `pip` used Python’s `tarfile` module without verifying that symbolic/hard link targets resolve inside the intended extraction directory. A malicious sdist can include links that escape the target directory and overwrite arbitrary files on the invoking host during `pip install`.
### Impact
Successful exploitation enables arbitrary file overwrite outside the build/extraction directory on the machine running `pip`. This can be leveraged to tamper with configuration or startup files and may lead to further code execution depending on the environment, but the direct, guaranteed impact is integrity compromise on the vulnerable system.
### Conditions
The issue is triggered when installing an attacker-controlled sdist (e.g., from an index or URL) and the fallback extraction code path is used. No special privileges are required beyond running `pip install`; active user action is necessary.
### Remediation
Upgrade to **pip 25.2** or later, which validates member paths and rejects unsafe link targets. Using a Python interpreter that implements the safe-extraction behavior described by **PEP 706** provides additional defense in depth for other `tarfile` issues but is not a substitute for upgrading pip for this specific flaw.
---
### Release Notes
<details>
<summary>pypa/pip (pip)</summary>
### [`v25.2`](https://redirect.github.com/pypa/pip/compare/25.1.1...25.2)
[Compare Source](https://redirect.github.com/pypa/pip/compare/25.1.1...25.2)
### [`v25.1.1`](https://redirect.github.com/pypa/pip/compare/25.1...25.1.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/25.1...25.1.1)
### [`v25.1`](https://redirect.github.com/pypa/pip/compare/25.0.1...25.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/25.0.1...25.1)
### [`v25.0.1`](https://redirect.github.com/pypa/pip/compare/25.0...25.0.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/25.0...25.0.1)
### [`v25.0`](https://redirect.github.com/pypa/pip/compare/24.3.1...25.0)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.3.1...25.0)
### [`v24.3.1`](https://redirect.github.com/pypa/pip/compare/24.3...24.3.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.3...24.3.1)
### [`v24.3`](https://redirect.github.com/pypa/pip/compare/24.2...24.3)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.2...24.3)
### [`v24.2`](https://redirect.github.com/pypa/pip/compare/24.1.2...24.2)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.1.2...24.2)
### [`v24.1.2`](https://redirect.github.com/pypa/pip/compare/24.1.1...24.1.2)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.1.1...24.1.2)
### [`v24.1.1`](https://redirect.github.com/pypa/pip/compare/24.1...24.1.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.1...24.1.1)
### [`v24.1`](https://redirect.github.com/pypa/pip/compare/24.0...24.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.0...24.1)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/craft-parts).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS45Ny4xMCIsInVwZGF0ZWRJblZlciI6IjQxLjEzMS45IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJQUjogRGVwZW5kZW5jaWVzIl19-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Renovate autoclosed this pull request to update pip to v25.2 for CVE-2025-8869 without merging. The security update was abandoned due to bot inactivity or configuration, leaving the dependency unchanged. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Autoclosed without merging. The security update to pip v25.2 for CVE-2025-8869 was abandoned, likely due to branch staleness or being superseded. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1337 build(deps): update dependency pip to v25 [security] (hotfix/2.7) - autoclosed | craft-parts | closed | Renovate bot pull request updating pip to v25.2 to address CVE-2025-8869 was automatically closed without being merged. The PR was autoclosed by Renovate, leaving the security update unapplied. | |
| #1336 build(deps): update dependency pip to v25 [security] (hotfix/2.20) - autoclosed | craft-parts | closed | Renovate autoclosed this dependency update after CI checks passed. The PR proposed upgrading pip to v25.2 to patch CVE-2025-8869. Automatic closure indicates the change was merged, superseded, or the target branch was deleted. | |
| #959 build(deps): update dependency pip to v24.3.1 (main) - autoclosed | craft-parts | closed | Dependency update for pip to v24.3.1 was autoclosed without merging. Despite passing CI checks and receiving approvals, the pull request was automatically closed due to inactivity or configuration rules. | |
| #1117 build(deps): update dependency requests to v2.32.4 [security] (main) - autoclosed | craft-parts | closed | Renovate autoclosed the pull request updating requests to v2.32.4 for CVE-2024-47081. The security update was automatically closed and unmerged, likely due to CI failures or being superseded. | |
| #1921 build(deps): update dependency requests to v2.32.2 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Renovate bot pull request updating requests to v2.32.2 to address CVE-2024-35195 was autoclosed. The dependency update was not merged and remains abandoned, likely due to branch deletion or being superseded by another resolution. | |
| #2291 build(deps): update dependency setuptools to v78 [security] (main) - autoclosed | charmcraft | closed | Renovate bot PR updating setuptools to v78.1.1 to patch CVE-2025-47273 was autoclosed and abandoned. The security update was not merged. | |
| #4986 build(deps): update dependency setuptools to v70 [security] (main) - autoclosed | snapcraft | closed | Dependency update to setuptools v70.0.0 for CVE-2024-6345 was autoclosed without merging. Renovate automatically closed the branch, likely superseded by another update or applied separately. | |
| #6125 build(deps): update dependency requests to v2.33.0 [security] (main) - autoclosed | snapcraft | closed | Renovate automatically closed the requests v2.33.0 security update without merging. The PR was abandoned due to inactivity and unresolved CI checks, leaving the dependency outdated. | |
| #6286 build(deps): bump pip | snapcraft | merged | Merged a dependency update bumping pip from v26.1 to v26.1.2 to resolve an OSV security vulnerability. Approved by reviewers and integrated after passing CI checks. | |
| #4773 chore(deps): update dependency pip to v23 [security] - autoclosed | snapcraft | closed | Automatically closed without merging. The Renovate bot dependency update upgrading pip to v23.3 to address CVE-2023-5752 was abandoned, likely due to staleness or repository configuration. |