build(deps): update dependency pip to v25 [security] (hotfix/2.20) - autoclosed
Metadata
Current evaluation
Renovate PR #1336 proposed upgrading pip from 24.0 to 25.2 for CVE-2025-8869 on hotfix/2.20, but was autoclosed unmerged despite passing CI.
Resolution: closed stale
Reason: PR #1336 was explicitly marked as autoclosed and remained unmerged. Repository records show passing checks, no reviewer comments, and no resolving commit, indicating inactivity rather than a delivered fix.
Evaluated by: mr-cal-bot
No scores available.
Issue body
> [!NOTE]
> Mend has cancelled [the proposed renaming](https://redirect.github.com/renovatebot/renovate/discussions/37842) of the Renovate GitHub app being renamed to `mend[bot]`.
>
> This notice will be removed on 2025-10-07.
<hr>
This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| [pip](https://redirect.github.com/pypa/pip) ([changelog](https://pip.pypa.io/en/stable/news/)) | `==24.0` -> `==25.2` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
### GitHub Vulnerability Alerts
#### [CVE-2025-8869](https://nvd.nist.gov/vuln/detail/CVE-2025-8869)
### Summary
In the fallback extraction path for source distributions, `pip` used Python’s `tarfile` module without verifying that symbolic/hard link targets resolve inside the intended extraction directory. A malicious sdist can include links that escape the target directory and overwrite arbitrary files on the invoking host during `pip install`.
### Impact
Successful exploitation enables arbitrary file overwrite outside the build/extraction directory on the machine running `pip`. This can be leveraged to tamper with configuration or startup files and may lead to further code execution depending on the environment, but the direct, guaranteed impact is integrity compromise on the vulnerable system.
### Conditions
The issue is triggered when installing an attacker-controlled sdist (e.g., from an index or URL) and the fallback extraction code path is used. No special privileges are required beyond running `pip install`; active user action is necessary.
### Remediation
Upgrade to **pip 25.2** or later, which validates member paths and rejects unsafe link targets. Using a Python interpreter that implements the safe-extraction behavior described by **PEP 706** provides additional defense in depth for other `tarfile` issues but is not a substitute for upgrading pip for this specific flaw.
---
### Release Notes
<details>
<summary>pypa/pip (pip)</summary>
### [`v25.2`](https://redirect.github.com/pypa/pip/compare/25.1.1...25.2)
[Compare Source](https://redirect.github.com/pypa/pip/compare/25.1.1...25.2)
### [`v25.1.1`](https://redirect.github.com/pypa/pip/compare/25.1...25.1.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/25.1...25.1.1)
### [`v25.1`](https://redirect.github.com/pypa/pip/compare/25.0.1...25.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/25.0.1...25.1)
### [`v25.0.1`](https://redirect.github.com/pypa/pip/compare/25.0...25.0.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/25.0...25.0.1)
### [`v25.0`](https://redirect.github.com/pypa/pip/compare/24.3.1...25.0)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.3.1...25.0)
### [`v24.3.1`](https://redirect.github.com/pypa/pip/compare/24.3...24.3.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.3...24.3.1)
### [`v24.3`](https://redirect.github.com/pypa/pip/compare/24.2...24.3)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.2...24.3)
### [`v24.2`](https://redirect.github.com/pypa/pip/compare/24.1.2...24.2)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.1.2...24.2)
### [`v24.1.2`](https://redirect.github.com/pypa/pip/compare/24.1.1...24.1.2)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.1.1...24.1.2)
### [`v24.1.1`](https://redirect.github.com/pypa/pip/compare/24.1...24.1.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.1...24.1.1)
### [`v24.1`](https://redirect.github.com/pypa/pip/compare/24.0...24.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.0...24.1)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/craft-parts).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS45Ny4xMCIsInVwZGF0ZWRJblZlciI6IjQxLjEzMS45IiwidGFyZ2V0QnJhbmNoIjoiaG90Zml4LzIuMjAiLCJsYWJlbHMiOlsiUFI6IERlcGVuZGVuY2llcyJdfQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | Renovate PR #1336 proposed upgrading pip from 24.0 to 25.2 for CVE-2025-8869 on hotfix/2.20, but was autoclosed unmerged despite passing CI. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate PR #1336 proposed pip 25.2 for CVE-2025-8869 on hotfix/2.20 but was autoclosed unmerged. CI had passed, with no reviewer comments or resolving commit identified. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate autoclosed the unmerged pip 25.2 update for CVE-2025-8869 on hotfix/2.20 despite all CI checks passing. | |
| qwen/qwen3.6-35b-a3b | — | — | Renovate autoclosed this dependency update after CI checks passed. The PR proposed upgrading pip to v25.2 to patch CVE-2025-8869. Automatic closure indicates the change was merged, superseded, or the target branch was deleted. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Automated dependency update to pip v25.2 for CVE-2025-8869 was autoclosed without merging. The pull request was abandoned or superseded, likely due to branch deletion or a conflicting hotfix update. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1337 build(deps): update dependency pip to v25 [security] (hotfix/2.7) - autoclosed | craft-parts | closed | Renovate's pip 24.0-to-25.2 security update for hotfix/2.7 was auto-closed unmerged; no replacement PR or resolving commit was found. | |
| #1335 build(deps): update dependency pip to v25 [security] (main) - autoclosed | craft-parts | closed | Renovate's pip 24.0 to 25.2 security update for CVE-2025-8869 was autoclosed unmerged after 359 days; no resolving PR or commit was found. | |
| #959 build(deps): update dependency pip to v24.3.1 (main) - autoclosed | craft-parts | closed | Renovate PR #959 proposed updating pip from 24.0 to 24.3.1 but was autoclosed unmerged after 623 days; no replacement or resolving commit was identified. | |
| #6221 build(deps): bump pip | snapcraft | merged | Merged PR #6221 in commit 948f284fa, updating the pip build dependency to resolve an OSV security vulnerability. | |
| #6008 build(deps-dev): bump pip from 25.3 to 26.0 | snapcraft | closed | Dependabot's pip 25.3→26.0 bump was closed unmerged; @bepri noted "Fixed by #6011" and Dependabot stopped notifying. PR #6011 (build: fix CVEs, commit a8213b7c) updated pip and protobuf in uv.lock. | |
| #1097 build(deps): update dependency setuptools to v78 [security] (hotfix/2.4) - autoclosed | craft-parts | closed | Renovate PR #1097 was autoclosed unmerged after 493 days, leaving setuptools 75.7.0 in hotfix/2.4; Ubuntu 20.04 tests and linters were failing. | |
| #1921 build(deps): update dependency requests to v2.32.2 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Renovate PR #1921 proposed requests 2.32.2 for hotfix/2.7 but was autoclosed unmerged after receiving no review or CI. | |
| #6286 build(deps): bump pip | snapcraft | merged | Merged PR #6286 (commit ff4e5adfd) bumped pip v26.1 -> v26.1.2 in the spread-test workflow requirements to clear an OSV advisory. | |
| #2625 build(deps): update dependency poetry to v2.3.3 [security] (hotfix/3.5) - autoclosed | charmcraft | closed | Renovate's Poetry 2.3.3 security bump for hotfix/3.5 was autoclosed unmerged; the same CVE-2026-34591 fix landed via #2624 (5b858d29) on main and #2628 (36f30ad6) on hotfix/4.2. | |
| #2292 build(deps): update dependency setuptools to v78 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Renovate's setuptools 78.1.1 security update for hotfix/2.7 was autoclosed unmerged after prolonged inactivity; numerous CI jobs failed and no resolving commit was recorded. |