build(deps): update dependency pip to v25 [security] (main) - autoclosed
Metadata
Current evaluation
Renovate's pip 24.0 to 25.2 security update for CVE-2025-8869 was autoclosed unmerged after 359 days; no resolving PR or commit was found.
Resolution: closed stale
Reason: The PR remained pending with no reviewers or comments and was automatically closed unmerged after prolonged inactivity. Repository history showed no commit or follow-up PR implementing the pip 25.2 update.
Evaluated by: mr-cal-bot
No scores available.
Issue body
> [!NOTE]
> Mend has cancelled [the proposed renaming](https://redirect.github.com/renovatebot/renovate/discussions/37842) of the Renovate GitHub app being renamed to `mend[bot]`.
>
> This notice will be removed on 2025-10-07.
<hr>
This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| [pip](https://redirect.github.com/pypa/pip) ([changelog](https://pip.pypa.io/en/stable/news/)) | `==24.0` -> `==25.2` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2025-8869](https://nvd.nist.gov/vuln/detail/CVE-2025-8869)
### Summary
In the fallback extraction path for source distributions, `pip` used Python’s `tarfile` module without verifying that symbolic/hard link targets resolve inside the intended extraction directory. A malicious sdist can include links that escape the target directory and overwrite arbitrary files on the invoking host during `pip install`.
### Impact
Successful exploitation enables arbitrary file overwrite outside the build/extraction directory on the machine running `pip`. This can be leveraged to tamper with configuration or startup files and may lead to further code execution depending on the environment, but the direct, guaranteed impact is integrity compromise on the vulnerable system.
### Conditions
The issue is triggered when installing an attacker-controlled sdist (e.g., from an index or URL) and the fallback extraction code path is used. No special privileges are required beyond running `pip install`; active user action is necessary.
### Remediation
Upgrade to **pip 25.2** or later, which validates member paths and rejects unsafe link targets. Using a Python interpreter that implements the safe-extraction behavior described by **PEP 706** provides additional defense in depth for other `tarfile` issues but is not a substitute for upgrading pip for this specific flaw.
---
### Release Notes
<details>
<summary>pypa/pip (pip)</summary>
### [`v25.2`](https://redirect.github.com/pypa/pip/compare/25.1.1...25.2)
[Compare Source](https://redirect.github.com/pypa/pip/compare/25.1.1...25.2)
### [`v25.1.1`](https://redirect.github.com/pypa/pip/compare/25.1...25.1.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/25.1...25.1.1)
### [`v25.1`](https://redirect.github.com/pypa/pip/compare/25.0.1...25.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/25.0.1...25.1)
### [`v25.0.1`](https://redirect.github.com/pypa/pip/compare/25.0...25.0.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/25.0...25.0.1)
### [`v25.0`](https://redirect.github.com/pypa/pip/compare/24.3.1...25.0)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.3.1...25.0)
### [`v24.3.1`](https://redirect.github.com/pypa/pip/compare/24.3...24.3.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.3...24.3.1)
### [`v24.3`](https://redirect.github.com/pypa/pip/compare/24.2...24.3)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.2...24.3)
### [`v24.2`](https://redirect.github.com/pypa/pip/compare/24.1.2...24.2)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.1.2...24.2)
### [`v24.1.2`](https://redirect.github.com/pypa/pip/compare/24.1.1...24.1.2)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.1.1...24.1.2)
### [`v24.1.1`](https://redirect.github.com/pypa/pip/compare/24.1...24.1.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.1...24.1.1)
### [`v24.1`](https://redirect.github.com/pypa/pip/compare/24.0...24.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.0...24.1)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/craft-parts).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS45Ny4xMCIsInVwZGF0ZWRJblZlciI6IjQxLjEzMS45IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJQUjogRGVwZW5kZW5jaWVzIl19-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | Renovate's pip 24.0 to 25.2 security update for CVE-2025-8869 was autoclosed unmerged after 359 days; no resolving PR or commit was found. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate PR #1335 proposed upgrading pip from 24.0 to 25.2 for CVE-2025-8869, but was autoclosed unmerged after 359 days; no resolving PR or commit was found. | |
| qwen/qwen3.6-35b-a3b | — | — | Renovate autoclosed this pull request to update pip to v25.2 for CVE-2025-8869 without merging. The security update was abandoned due to bot inactivity or configuration, leaving the dependency unchanged. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Autoclosed without merging. The security update to pip v25.2 for CVE-2025-8869 was abandoned, likely due to branch staleness or being superseded. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1337 build(deps): update dependency pip to v25 [security] (hotfix/2.7) - autoclosed | craft-parts | closed | Renovate's pip 24.0-to-25.2 security update for hotfix/2.7 was auto-closed unmerged; no replacement PR or resolving commit was found. | |
| #1336 build(deps): update dependency pip to v25 [security] (hotfix/2.20) - autoclosed | craft-parts | closed | Renovate PR #1336 proposed upgrading pip from 24.0 to 25.2 for CVE-2025-8869 on hotfix/2.20, but was autoclosed unmerged despite passing CI. | |
| #959 build(deps): update dependency pip to v24.3.1 (main) - autoclosed | craft-parts | closed | Renovate PR #959 proposed updating pip from 24.0 to 24.3.1 but was autoclosed unmerged after 623 days; no replacement or resolving commit was identified. | |
| #2291 build(deps): update dependency setuptools to v78 [security] (main) - autoclosed | charmcraft | closed | Renovate's setuptools 78.1.1 security update was autoclosed unmerged; no corresponding version bump or resolving commit was found. | |
| #6246 build(deps): update dependency mypy to v2 (main) - autoclosed | snapcraft | closed | Renovate’s mypy 2.1.0 update was autoclosed unmerged after lint/files and several integration and security checks failed; no resolving commit landed. | |
| #2293 build(deps): update dependency setuptools to v78 [security] (hotfix/3.4) - autoclosed | charmcraft | closed | Renovate's setuptools 78.1.1 security update for hotfix/3.4 was autoclosed unmerged after 483 days; no resolving commit landed. | |
| #6125 build(deps): update dependency requests to v2.33.0 [security] (main) - autoclosed | snapcraft | closed | Renovate PR #6125 (requests 2.32.5->2.33.0, CVE-2026-25645) was autoclosed as a duplicate; the same bump was merged via Dependabot PR #6127 in commit fce681014. | |
| #6008 build(deps-dev): bump pip from 25.3 to 26.0 | snapcraft | closed | Dependabot's pip 25.3→26.0 bump was closed unmerged; @bepri noted "Fixed by #6011" and Dependabot stopped notifying. PR #6011 (build: fix CVEs, commit a8213b7c) updated pip and protobuf in uv.lock. | |
| #6221 build(deps): bump pip | snapcraft | merged | Merged PR #6221 in commit 948f284fa, updating the pip build dependency to resolve an OSV security vulnerability. | |
| #2292 build(deps): update dependency setuptools to v78 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Renovate's setuptools 78.1.1 security update for hotfix/2.7 was autoclosed unmerged after prolonged inactivity; numerous CI jobs failed and no resolving commit was recorded. |