build(deps): update dependency pip to v25 [security] (hotfix/2.20) - autoclosed
Metadata
Current evaluation
Renovate autoclosed this dependency update after CI checks passed. The PR proposed upgrading pip to v25.2 to patch CVE-2025-8869. Automatic closure indicates the change was merged, superseded, or the target branch was deleted.
Suggested action: —
No scores available.
Issue body
> [!NOTE]
> Mend has cancelled [the proposed renaming](https://redirect.github.com/renovatebot/renovate/discussions/37842) of the Renovate GitHub app being renamed to `mend[bot]`.
>
> This notice will be removed on 2025-10-07.
<hr>
This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| [pip](https://redirect.github.com/pypa/pip) ([changelog](https://pip.pypa.io/en/stable/news/)) | `==24.0` -> `==25.2` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
### GitHub Vulnerability Alerts
#### [CVE-2025-8869](https://nvd.nist.gov/vuln/detail/CVE-2025-8869)
### Summary
In the fallback extraction path for source distributions, `pip` used Python’s `tarfile` module without verifying that symbolic/hard link targets resolve inside the intended extraction directory. A malicious sdist can include links that escape the target directory and overwrite arbitrary files on the invoking host during `pip install`.
### Impact
Successful exploitation enables arbitrary file overwrite outside the build/extraction directory on the machine running `pip`. This can be leveraged to tamper with configuration or startup files and may lead to further code execution depending on the environment, but the direct, guaranteed impact is integrity compromise on the vulnerable system.
### Conditions
The issue is triggered when installing an attacker-controlled sdist (e.g., from an index or URL) and the fallback extraction code path is used. No special privileges are required beyond running `pip install`; active user action is necessary.
### Remediation
Upgrade to **pip 25.2** or later, which validates member paths and rejects unsafe link targets. Using a Python interpreter that implements the safe-extraction behavior described by **PEP 706** provides additional defense in depth for other `tarfile` issues but is not a substitute for upgrading pip for this specific flaw.
---
### Release Notes
<details>
<summary>pypa/pip (pip)</summary>
### [`v25.2`](https://redirect.github.com/pypa/pip/compare/25.1.1...25.2)
[Compare Source](https://redirect.github.com/pypa/pip/compare/25.1.1...25.2)
### [`v25.1.1`](https://redirect.github.com/pypa/pip/compare/25.1...25.1.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/25.1...25.1.1)
### [`v25.1`](https://redirect.github.com/pypa/pip/compare/25.0.1...25.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/25.0.1...25.1)
### [`v25.0.1`](https://redirect.github.com/pypa/pip/compare/25.0...25.0.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/25.0...25.0.1)
### [`v25.0`](https://redirect.github.com/pypa/pip/compare/24.3.1...25.0)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.3.1...25.0)
### [`v24.3.1`](https://redirect.github.com/pypa/pip/compare/24.3...24.3.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.3...24.3.1)
### [`v24.3`](https://redirect.github.com/pypa/pip/compare/24.2...24.3)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.2...24.3)
### [`v24.2`](https://redirect.github.com/pypa/pip/compare/24.1.2...24.2)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.1.2...24.2)
### [`v24.1.2`](https://redirect.github.com/pypa/pip/compare/24.1.1...24.1.2)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.1.1...24.1.2)
### [`v24.1.1`](https://redirect.github.com/pypa/pip/compare/24.1...24.1.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.1...24.1.1)
### [`v24.1`](https://redirect.github.com/pypa/pip/compare/24.0...24.1)
[Compare Source](https://redirect.github.com/pypa/pip/compare/24.0...24.1)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/craft-parts).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS45Ny4xMCIsInVwZGF0ZWRJblZlciI6IjQxLjEzMS45IiwidGFyZ2V0QnJhbmNoIjoiaG90Zml4LzIuMjAiLCJsYWJlbHMiOlsiUFI6IERlcGVuZGVuY2llcyJdfQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Renovate autoclosed this dependency update after CI checks passed. The PR proposed upgrading pip to v25.2 to patch CVE-2025-8869. Automatic closure indicates the change was merged, superseded, or the target branch was deleted. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Automated dependency update to pip v25.2 for CVE-2025-8869 was autoclosed without merging. The pull request was abandoned or superseded, likely due to branch deletion or a conflicting hotfix update. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1337 build(deps): update dependency pip to v25 [security] (hotfix/2.7) - autoclosed | craft-parts | closed | Renovate bot pull request updating pip to v25.2 to address CVE-2025-8869 was automatically closed without being merged. The PR was autoclosed by Renovate, leaving the security update unapplied. | |
| #1335 build(deps): update dependency pip to v25 [security] (main) - autoclosed | craft-parts | closed | Renovate autoclosed this pull request to update pip to v25.2 for CVE-2025-8869 without merging. The security update was abandoned due to bot inactivity or configuration, leaving the dependency unchanged. | |
| #959 build(deps): update dependency pip to v24.3.1 (main) - autoclosed | craft-parts | closed | Dependency update for pip to v24.3.1 was autoclosed without merging. Despite passing CI checks and receiving approvals, the pull request was automatically closed due to inactivity or configuration rules. | |
| #6286 build(deps): bump pip | snapcraft | merged | Merged a dependency update bumping pip from v26.1 to v26.1.2 to resolve an OSV security vulnerability. Approved by reviewers and integrated after passing CI checks. | |
| #1117 build(deps): update dependency requests to v2.32.4 [security] (main) - autoclosed | craft-parts | closed | Renovate autoclosed the pull request updating requests to v2.32.4 for CVE-2024-47081. The security update was automatically closed and unmerged, likely due to CI failures or being superseded. | |
| #1921 build(deps): update dependency requests to v2.32.2 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Renovate bot pull request updating requests to v2.32.2 to address CVE-2024-35195 was autoclosed. The dependency update was not merged and remains abandoned, likely due to branch deletion or being superseded by another resolution. | |
| #2625 build(deps): update dependency poetry to v2.3.3 [security] (hotfix/3.5) - autoclosed | charmcraft | closed | Renovate-generated PR to update poetry to v2.3.3 for CVE-2026-34591 security patch was autoclosed without merging. The dependency update was abandoned. | |
| #5550 build(deps): update dependency requests to v2.32.4 [security] (hotfix/7.5) - autoclosed | snapcraft | closed | Automated dependency update to requests v2.32.4 for CVE-2024-47081 was autoclosed without merging. The security patch was abandoned and not applied to the repository. | |
| #6008 build(deps-dev): bump pip from 25.3 to 26.0 | snapcraft | closed | Superseded by PR #6011. Dependabot closed this pip version bump after the update was resolved in another pull request. | |
| #2292 build(deps): update dependency setuptools to v78 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Autoclosed and abandoned without merging. Renovate proposed updating setuptools to v78.1.1 to address CVE-2025-47273, but multiple CI checks failed and the branch was automatically closed. |