← Back to issue list

build(deps): update dependency pip to v25 [security] (hotfix/2.7) - autoclosed

View original Github issue

Metadata

Project
craft-parts
Number
#1337
Type
pull request
State
closed
Author
renovate[bot]
Labels
PR: Dependencies
Created
Updated
Closed

Current evaluation

Renovate bot pull request updating pip to v25.2 to address CVE-2025-8869 was automatically closed without being merged. The PR was autoclosed by Renovate, leaving the security update unapplied.

Suggested action: —

No scores available.

Issue body

> [!NOTE] > Mend has cancelled [the proposed renaming](https://redirect.github.com/renovatebot/renovate/discussions/37842) of the Renovate GitHub app being renamed to `mend[bot]`. > > This notice will be removed on 2025-10-07. <hr> This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [pip](https://redirect.github.com/pypa/pip) ([changelog](https://pip.pypa.io/en/stable/news/)) | `==24.0` -> `==25.2` | [![age](https://developer.mend.io/api/mc/badges/age/pypi/pip/25.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pip/24.0/25.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. ### GitHub Vulnerability Alerts #### [CVE-2025-8869](https://nvd.nist.gov/vuln/detail/CVE-2025-8869) ### Summary In the fallback extraction path for source distributions, `pip` used Python’s `tarfile` module without verifying that symbolic/hard link targets resolve inside the intended extraction directory. A malicious sdist can include links that escape the target directory and overwrite arbitrary files on the invoking host during `pip install`. ### Impact Successful exploitation enables arbitrary file overwrite outside the build/extraction directory on the machine running `pip`. This can be leveraged to tamper with configuration or startup files and may lead to further code execution depending on the environment, but the direct, guaranteed impact is integrity compromise on the vulnerable system. ### Conditions The issue is triggered when installing an attacker-controlled sdist (e.g., from an index or URL) and the fallback extraction code path is used. No special privileges are required beyond running `pip install`; active user action is necessary. ### Remediation Upgrade to **pip 25.2** or later, which validates member paths and rejects unsafe link targets. Using a Python interpreter that implements the safe-extraction behavior described by **PEP 706** provides additional defense in depth for other `tarfile` issues but is not a substitute for upgrading pip for this specific flaw. --- ### Release Notes <details> <summary>pypa/pip (pip)</summary> ### [`v25.2`](https://redirect.github.com/pypa/pip/compare/25.1.1...25.2) [Compare Source](https://redirect.github.com/pypa/pip/compare/25.1.1...25.2) ### [`v25.1.1`](https://redirect.github.com/pypa/pip/compare/25.1...25.1.1) [Compare Source](https://redirect.github.com/pypa/pip/compare/25.1...25.1.1) ### [`v25.1`](https://redirect.github.com/pypa/pip/compare/25.0.1...25.1) [Compare Source](https://redirect.github.com/pypa/pip/compare/25.0.1...25.1) ### [`v25.0.1`](https://redirect.github.com/pypa/pip/compare/25.0...25.0.1) [Compare Source](https://redirect.github.com/pypa/pip/compare/25.0...25.0.1) ### [`v25.0`](https://redirect.github.com/pypa/pip/compare/24.3.1...25.0) [Compare Source](https://redirect.github.com/pypa/pip/compare/24.3.1...25.0) ### [`v24.3.1`](https://redirect.github.com/pypa/pip/compare/24.3...24.3.1) [Compare Source](https://redirect.github.com/pypa/pip/compare/24.3...24.3.1) ### [`v24.3`](https://redirect.github.com/pypa/pip/compare/24.2...24.3) [Compare Source](https://redirect.github.com/pypa/pip/compare/24.2...24.3) ### [`v24.2`](https://redirect.github.com/pypa/pip/compare/24.1.2...24.2) [Compare Source](https://redirect.github.com/pypa/pip/compare/24.1.2...24.2) ### [`v24.1.2`](https://redirect.github.com/pypa/pip/compare/24.1.1...24.1.2) [Compare Source](https://redirect.github.com/pypa/pip/compare/24.1.1...24.1.2) ### [`v24.1.1`](https://redirect.github.com/pypa/pip/compare/24.1...24.1.1) [Compare Source](https://redirect.github.com/pypa/pip/compare/24.1...24.1.1) ### [`v24.1`](https://redirect.github.com/pypa/pip/compare/24.0...24.1) [Compare Source](https://redirect.github.com/pypa/pip/compare/24.0...24.1) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/craft-parts). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS45Ny4xMCIsInVwZGF0ZWRJblZlciI6IjQxLjEzMS45IiwidGFyZ2V0QnJhbmNoIjoiaG90Zml4LzIuNyIsImxhYmVscyI6WyJQUjogRGVwZW5kZW5jaWVzIl19-->

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.6-35b-a3b — — Renovate bot pull request updating pip to v25.2 to address CVE-2025-8869 was automatically closed without being merged. The PR was autoclosed by Renovate, leaving the security update unapplied.
qwen3.6-35b-a3b-mtp-q6 — — The Renovate pull request updating pip to v25.2 for CVE-2025-8869 was autoclosed by the bot without merging. The security update was not applied through this PR.

Update history

No update history recorded yet.

Related issues

Issue Project State Summary Similarity
#1336 build(deps): update dependency pip to v25 [security] (hotfix/2.20) - autoclosed craft-parts closed Renovate autoclosed this dependency update after CI checks passed. The PR proposed upgrading pip to v25.2 to patch CVE-2025-8869. Automatic closure indicates the change was merged, superseded, or the target branch was deleted.
93%
#1335 build(deps): update dependency pip to v25 [security] (main) - autoclosed craft-parts closed Renovate autoclosed this pull request to update pip to v25.2 for CVE-2025-8869 without merging. The security update was abandoned due to bot inactivity or configuration, leaving the dependency unchanged.
92%
#1921 build(deps): update dependency requests to v2.32.2 [security] (hotfix/2.7) - autoclosed charmcraft closed Renovate bot pull request updating requests to v2.32.2 to address CVE-2024-35195 was autoclosed. The dependency update was not merged and remains abandoned, likely due to branch deletion or being superseded by another resolution.
80%
#959 build(deps): update dependency pip to v24.3.1 (main) - autoclosed craft-parts closed Dependency update for pip to v24.3.1 was autoclosed without merging. Despite passing CI checks and receiving approvals, the pull request was automatically closed due to inactivity or configuration rules.
79%
#1119 build(deps): update dependency requests to v2.32.4 [security] (hotfix/2.7) - autoclosed craft-parts closed A dependency update to requests v2.32.4 addressing CVE-2024-47081 was autoclosed by the Renovate bot. The security patch was abandoned or superseded without merging.
78%
#1117 build(deps): update dependency requests to v2.32.4 [security] (main) - autoclosed craft-parts closed Renovate autoclosed the pull request updating requests to v2.32.4 for CVE-2024-47081. The security update was automatically closed and unmerged, likely due to CI failures or being superseded.
77%
#4773 chore(deps): update dependency pip to v23 [security] - autoclosed snapcraft closed Automatically closed without merging. The Renovate bot dependency update upgrading pip to v23.3 to address CVE-2023-5752 was abandoned, likely due to staleness or repository configuration.
77%
#1518 build(deps): update dependency requests to v2.33.0 [security] (hotfix/2.28) - autoclosed craft-parts closed The dependency update to requests v2.33.0 for CVE-2026-25645 was autoclosed by Renovate and never merged. The automation tool abandoned the change, leaving the security patch unapplied in the hotfix branch.
76%
#2291 build(deps): update dependency setuptools to v78 [security] (main) - autoclosed charmcraft closed Renovate bot PR updating setuptools to v78.1.1 to patch CVE-2025-47273 was autoclosed and abandoned. The security update was not merged.
76%
#4920 build(deps): update dependency setuptools to v70 [security] (hotfix/8.3) - autoclosed snapcraft closed Closed without merging. Renovate proposed updating setuptools to v70.0.0 to fix CVE-2024-6345. The branch was manually modified, causing the bot to skip autoclosing. The update was ultimately abandoned.
76%