← Back to issue list

build(deps): update dependency pip to v25 [security] (hotfix/2.7) - autoclosed

View original Github issue

Metadata

Project
craft-parts
Number
#1337
Type
pull request
State
closed
Author
renovate[bot]
Labels
PR: Dependencies
Created
Updated
Closed

Current evaluation

Renovate's pip 24.0-to-25.2 security update for hotfix/2.7 was auto-closed unmerged; no replacement PR or resolving commit was found.

Resolution: closed stale

Reason: PR #1337 was auto-closed without being merged after prolonged inactivity. It received no comments or approvals, and repository history showed no resolving commit or replacement update.

Evaluated by: mr-cal-bot

No scores available.

Issue body

> [!NOTE] > Mend has cancelled [the proposed renaming](https://redirect.github.com/renovatebot/renovate/discussions/37842) of the Renovate GitHub app being renamed to `mend[bot]`. > > This notice will be removed on 2025-10-07. <hr> This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [pip](https://redirect.github.com/pypa/pip) ([changelog](https://pip.pypa.io/en/stable/news/)) | `==24.0` -> `==25.2` | [![age](https://developer.mend.io/api/mc/badges/age/pypi/pip/25.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pip/24.0/25.2?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. ### GitHub Vulnerability Alerts #### [CVE-2025-8869](https://nvd.nist.gov/vuln/detail/CVE-2025-8869) ### Summary In the fallback extraction path for source distributions, `pip` used Python’s `tarfile` module without verifying that symbolic/hard link targets resolve inside the intended extraction directory. A malicious sdist can include links that escape the target directory and overwrite arbitrary files on the invoking host during `pip install`. ### Impact Successful exploitation enables arbitrary file overwrite outside the build/extraction directory on the machine running `pip`. This can be leveraged to tamper with configuration or startup files and may lead to further code execution depending on the environment, but the direct, guaranteed impact is integrity compromise on the vulnerable system. ### Conditions The issue is triggered when installing an attacker-controlled sdist (e.g., from an index or URL) and the fallback extraction code path is used. No special privileges are required beyond running `pip install`; active user action is necessary. ### Remediation Upgrade to **pip 25.2** or later, which validates member paths and rejects unsafe link targets. Using a Python interpreter that implements the safe-extraction behavior described by **PEP 706** provides additional defense in depth for other `tarfile` issues but is not a substitute for upgrading pip for this specific flaw. --- ### Release Notes <details> <summary>pypa/pip (pip)</summary> ### [`v25.2`](https://redirect.github.com/pypa/pip/compare/25.1.1...25.2) [Compare Source](https://redirect.github.com/pypa/pip/compare/25.1.1...25.2) ### [`v25.1.1`](https://redirect.github.com/pypa/pip/compare/25.1...25.1.1) [Compare Source](https://redirect.github.com/pypa/pip/compare/25.1...25.1.1) ### [`v25.1`](https://redirect.github.com/pypa/pip/compare/25.0.1...25.1) [Compare Source](https://redirect.github.com/pypa/pip/compare/25.0.1...25.1) ### [`v25.0.1`](https://redirect.github.com/pypa/pip/compare/25.0...25.0.1) [Compare Source](https://redirect.github.com/pypa/pip/compare/25.0...25.0.1) ### [`v25.0`](https://redirect.github.com/pypa/pip/compare/24.3.1...25.0) [Compare Source](https://redirect.github.com/pypa/pip/compare/24.3.1...25.0) ### [`v24.3.1`](https://redirect.github.com/pypa/pip/compare/24.3...24.3.1) [Compare Source](https://redirect.github.com/pypa/pip/compare/24.3...24.3.1) ### [`v24.3`](https://redirect.github.com/pypa/pip/compare/24.2...24.3) [Compare Source](https://redirect.github.com/pypa/pip/compare/24.2...24.3) ### [`v24.2`](https://redirect.github.com/pypa/pip/compare/24.1.2...24.2) [Compare Source](https://redirect.github.com/pypa/pip/compare/24.1.2...24.2) ### [`v24.1.2`](https://redirect.github.com/pypa/pip/compare/24.1.1...24.1.2) [Compare Source](https://redirect.github.com/pypa/pip/compare/24.1.1...24.1.2) ### [`v24.1.1`](https://redirect.github.com/pypa/pip/compare/24.1...24.1.1) [Compare Source](https://redirect.github.com/pypa/pip/compare/24.1...24.1.1) ### [`v24.1`](https://redirect.github.com/pypa/pip/compare/24.0...24.1) [Compare Source](https://redirect.github.com/pypa/pip/compare/24.0...24.1) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/craft-parts). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS45Ny4xMCIsInVwZGF0ZWRJblZlciI6IjQxLjEzMS45IiwidGFyZ2V0QnJhbmNoIjoiaG90Zml4LzIuNyIsImxhYmVscyI6WyJQUjogRGVwZW5kZW5jaWVzIl19-->

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed stale Renovate's pip 24.0-to-25.2 security update for hotfix/2.7 was auto-closed unmerged; no replacement PR or resolving commit was found.
stealth/space-bunny-alpha — closed stale Renovate's pip 24.0-to-25.2 security update for hotfix/2.7 was auto-closed unmerged after 359 days; no resolving commit or replacement was found.
stealth/space-bunny-alpha — closed stale Renovate's pip 24.0-to-25.2 security update for hotfix/2.7 was auto-closed unmerged, with no activity for 359 days; no resolving commit or replacement was found.
qwen/qwen3.6-35b-a3b — — Renovate bot pull request updating pip to v25.2 to address CVE-2025-8869 was automatically closed without being merged. The PR was autoclosed by Renovate, leaving the security update unapplied.
qwen3.6-35b-a3b-mtp-q6 — — The Renovate pull request updating pip to v25.2 for CVE-2025-8869 was autoclosed by the bot without merging. The security update was not applied through this PR.

Update history

No update history recorded yet.

Related issues

Issue Project State Summary Similarity
#1336 build(deps): update dependency pip to v25 [security] (hotfix/2.20) - autoclosed craft-parts closed Renovate PR #1336 proposed upgrading pip from 24.0 to 25.2 for CVE-2025-8869 on hotfix/2.20, but was autoclosed unmerged despite passing CI.
94%
#1335 build(deps): update dependency pip to v25 [security] (main) - autoclosed craft-parts closed Renovate's pip 24.0 to 25.2 security update for CVE-2025-8869 was autoclosed unmerged after 359 days; no resolving PR or commit was found.
93%
#959 build(deps): update dependency pip to v24.3.1 (main) - autoclosed craft-parts closed Renovate PR #959 proposed updating pip from 24.0 to 24.3.1 but was autoclosed unmerged after 623 days; no replacement or resolving commit was identified.
86%
#2292 build(deps): update dependency setuptools to v78 [security] (hotfix/2.7) - autoclosed charmcraft closed Renovate's setuptools 78.1.1 security update for hotfix/2.7 was autoclosed unmerged after prolonged inactivity; numerous CI jobs failed and no resolving commit was recorded.
78%
#2293 build(deps): update dependency setuptools to v78 [security] (hotfix/3.4) - autoclosed charmcraft closed Renovate's setuptools 78.1.1 security update for hotfix/3.4 was autoclosed unmerged after 483 days; no resolving commit landed.
78%
#2562 build(deps): update dependency ops to v2.15.0 [security] (hotfix/4.1) - autoclosed charmcraft closed Renovate's ops 2.5.0-to-2.15.0 security update was autoclosed unmerged; no replacement PR or resolving commit is evidenced.
78%
#1921 build(deps): update dependency requests to v2.32.2 [security] (hotfix/2.7) - autoclosed charmcraft closed Renovate PR #1921 proposed requests 2.32.2 for hotfix/2.7 but was autoclosed unmerged after receiving no review or CI.
77%
#4987 build(deps): update dependency setuptools to v70 [security] (hotfix/8.3) - autoclosed snapcraft closed Renovate’s setuptools 70 security hotfix for hotfix/8.3 was auto-closed unmerged after prolonged inactivity; no review, CI, or resolving commit landed.
76%
#2625 build(deps): update dependency poetry to v2.3.3 [security] (hotfix/3.5) - autoclosed charmcraft closed Renovate's Poetry 2.3.3 security bump for hotfix/3.5 was autoclosed unmerged; the same CVE-2026-34591 fix landed via #2624 (5b858d29) on main and #2628 (36f30ad6) on hotfix/4.2.
76%
#5550 build(deps): update dependency requests to v2.32.4 [security] (hotfix/7.5) - autoclosed snapcraft closed Autoclosed unmerged; the requests 2.32.4 security update landed on hotfix/8.9 via merged #5551 (fc81a5369), not hotfix/7.5.
76%