CVS commit: pkgsrc/devel/py-pip

"Thomas Klausner" <[email protected]> Sat, 8 Aug 2026 07:40:20 +0000
Newsgroups gmane.os.netbsd.devel.pkgsrc.cvs
Message-ID <[email protected]> 
Module Name:	pkgsrc
Committed By:	wiz
Date:		Sat Aug  8 07:40:20 UTC 2026

Modified Files:
	pkgsrc/devel/py-pip: Makefile PLIST distinfo
	pkgsrc/devel/py-pip/patches:
	    patch-src_pip___internal_operations_install_wheel.py
Added Files:
	pkgsrc/devel/py-pip/patches:
	    patch-src_pip___internal_build__env_virtual.py
Removed Files:
	pkgsrc/devel/py-pip/patches: patch-src_pip___internal_build__env.py

Log Message:
py-pip: update to 26.2.1.

26.2.1 (2026-08-04)

Bug Fixes

    Reallow keyring installed in a (non-activated) virtual environment
    to be be used via the import provider method while installing
    build dependencies. (#14227)

26.2 (2026-07-29)

Deprecations and Removals

    Newly published packages will no longer be immediately visible
    to pip if the index uses caching. To install a newly published
    package, use --refresh-package. (#13680)

    Drop support for detecting legacy, non-PEP 405, virtualenv (<
    20) environments. (#14062)

    Constraints files, including PIP_CONSTRAINT, no longer affect
    isolated build environments. Use --build-constraint or the
    PIP_BUILD_CONSTRAINT environment variable to constrain build
    dependencies instead.

    The --use-feature=build-constraint flag is now always enabled
    and has no effect. (#14094)

Features

    Declare support for Python 3.15 (#14208)

    Support self-referential extras officially. pip has supported
    this by accident since version 21.2. (#11296)

    Add --only-deps flag to instruct pip to select only the
    dependencies of supplied packages. It cannot be used with
    --no-deps, -r, --group, or --requirements-from-script. (#11440)

    Cache simple responses in accordance to their Cache-Control
    header instead of always revalidating on every request. To
    refresh cached package index responses and ensure newly published
    packages are found, use --refresh-package <package>. (#13680)

    Add --no-require-hashes to disable automatic enablement of
    --require-hashes when encountering a requirement with hashes.
    (#14169)

    Honor --only-final when sourcing requirements with -r pylock.toml.
    (#13950)

    Add support for pylock.toml upload-time field, so --uploaded-prior-to
    works with -r pylock.toml. (#14168)

    Better error messages in case of conflicts with requirements
    from -r pylock.toml. (#13963)

    Add experimental support for isolating build subprocesses by
    creating standard virtual environments. This will fix most (if
    not all) subtle isolation issues that can lead to broken builds
    exclusive to pip. The feature can be enabled via
    --use-feature=venv-isolation and will be enabled by default in
    a future release.

    Note that the feature has limited compatibility with
    --use-feature=inprocess-build-deps. While most builds should
    work with both features enabled, there are known edge cases.
    inprocess-build-deps will not be enabled by default until they
    are fixed. (#14070)

    Present more informative diagnostic errors on uncaught network
    errors. (#14115)

    Allow opting out of Git partial clones with
    PIP_NO_PARTIAL_CLONE_FOR_BROKEN_GIT_SERVER. (#11043)

    Add a --no-proxy-env (or --proxy "") option to ignore proxies
    configured via non-pip environment variables or configuration
    files. A proxy set with --proxy is still used. (#5378)

    Add support for pulling username from keyring subprocess provider
    (#12543)

    Speedup tab autocompletion by lazy-importing certain modules.
    (#4768)

    Improve cached wheel lookup performance when many cached wheels
    are checked for compatibility. (#14122)

    Speed up path compaction when displaying uninstall changes.
    (#14107)

Bug Fixes

    Only emit the invalid-metadata warning once per location per run, instead of repeating it during the same command. (#11436)
    Handle BrokenPipeError when pip output is piped to a command that closes early. (#11608)
    Follow symlinks while checking if installed scripts are on PATH. (#11953)
    Stop dropping extras from messages about candidates with inconsistent metadata. (#12023)
    Stop animating progress bars and status spinners when running on CI, even if FORCE_COLOR is set. (#13354)
    Ensure truststore feature remains active while initially connecting to a HTTPS proxy. (#13465)
    Address encoding warnings emitted when Python's UTF-8 Mode is enabled by continuing to use the configured locale. (#13922)
    Raise an error when the PEP 658 .metadata file used during dependency resolution disagrees with the downloaded wheel's METADATA on Name, Version, Requires-Dist, Requires-Python or Provides-Extra. (#13983)
    Prevent system packages from leaking into isolated build environments on Python 3.15 (#14033)
    Never use persistent wheel cache for local directory requirements even if there is a matching entry. (#14044)
    Avoid re-fetching a pinned Git commit that is already present locally. (#14055)
    Report the correct configuration level for cert in pip debug output. (#14056)
    Fix pip show crash when a distribution has no Metadata-Version. (#14057)
    Remove empty http-v2 cache directories when running pip cache purge. (#14058)
    Report a copy failure in pip wheel instead of a misleading build failure. (#14059)
    Make pip install conflict checks independent of installed distribution iteration order. (#14074)
    Fix ProtocolError exceptions raised after an incomplete download from bypassing download resume logic and leading to a crash. (#14079)
    Fix caching bug where local directory requirements would be cached if the directory name contains a dash. (#14080)
    Avoid reparsing distribution metadata when formatting the default pip list columns output with the importlib backend. (#14089)
    Fix decoding the URL path twice while determining a link filename (CVE-2026-13346). (#14110)
    Avoid reading installed file lists in pip show unless --files is used. (#14117)
    Additional rejection of tar archives that write outside the target directory through symlink traversal when extracting on Python versions pre-PEP 706. (#14127)
    Fix pip list --not-required listing dependencies of packages excluded with --exclude. (#14129)
    Fail an interrupted download instead of corrupting the saved file when the server resumes a range request from a different offset than was requested. (#14131)
    Fix option errors printing the usage message with raw Rich markup. (#14136)
    platformdirs 4.6.0+ adds support for XDG_* environment variables on macOS, so some directory locations may change if any of these are set:
        XDG_CACHE_HOME: The pip cache directory will be at $XDG_CACHE_HOME/pip.
        XDG_DATA_DIRS: The global configuration file will be inside $XDG_DATA_DIRS/pip
        XDG_DATA_HOME: The user configuration file will be inside $XDG_DATA_HOME/pip, if the directory exists (#14142)
    Recover credentials embedded in a redirect Location URL when handling a 401 response, even under --no-input. Previously this extraction was gated behind keyring being enabled, so --no-input (with the default keyring provider) caused downloads that rely on a cross-origin redirect with embedded credentials to fail with 401. (#14182)
    Reject a package path in a pylock.toml fetched from a URL when it resolves outside the lock file's own location, so a remote lock file can no longer point at the local filesystem or another host. (#14159)
    Respect --uploaded-prior-to, --no-binary, --only-binary, and --prefer-binary in pip list --outdated and pip list --uptodate when determining the latest available version. (#14190)
    Show a clear error instead of a traceback for an invalid requirement marker. (#6385)

Vendored Libraries

    Upgrade certifi to 2026.6.17
    Upgrade distlib to 0.4.2
    Upgrade idna to 3.18
    Upgrade platformdirs to 4.10.0
    Upgrade pygments to 2.20.0
    Upgrade requests to 2.34.2
    Upgrade tomli to 2.4.1
    Upgrade urllib3 to 2.7.0

Process

    Include a CycloneDX SBOM (Software Bill of Materials) file alongside vendored libraries.


To generate a diff of this commit:
cvs rdiff -u -r1.92 -r1.93 pkgsrc/devel/py-pip/Makefile
cvs rdiff -u -r1.53 -r1.54 pkgsrc/devel/py-pip/PLIST
cvs rdiff -u -r1.77 -r1.78 pkgsrc/devel/py-pip/distinfo
cvs rdiff -u -r1.9 -r0 \
    pkgsrc/devel/py-pip/patches/patch-src_pip___internal_build__env.py
cvs rdiff -u -r0 -r1.1 \
    pkgsrc/devel/py-pip/patches/patch-src_pip___internal_build__env_virtual.py
cvs rdiff -u -r1.2 -r1.3 \
    pkgsrc/devel/py-pip/patches/patch-src_pip___internal_operations_install_wheel.py

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
(unnamed) (text/x-diff, 10.9 KB) 
Modified files:

Index: pkgsrc/devel/py-pip/Makefile
diff -u pkgsrc/devel/py-pip/Makefile:1.92 pkgsrc/devel/py-pip/Makefile:1.93
--- pkgsrc/devel/py-pip/Makefile:1.92	Mon Jun  1 07:33:11 2026
+++ pkgsrc/devel/py-pip/Makefile	Sat Aug  8 07:40:20 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.92 2026/06/01 07:33:11 adam Exp $
+# $NetBSD: Makefile,v 1.93 2026/08/08 07:40:20 wiz Exp $
 
-DISTNAME=	pip-26.1.2
+DISTNAME=	pip-26.2.1
 PKGNAME=	${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=	devel python
 MASTER_SITES=	${MASTER_SITE_PYPI:=p/pip/}
@@ -24,7 +24,7 @@ PY_RENAME_BINARIES+=	pip
 
 post-install:
 	cd ${DESTDIR}${PREFIX}/${PYSITELIB}/pip/_internal && \
-	${RM} build_env.py.orig commands/install.py.orig \
+	${RM} build_env/virtual.py.orig commands/install.py.orig \
 		operations/install/wheel.py.orig \
 		req/__init__.py.orig req/req_install.py.orig
 	${RM} -f ${DESTDIR}${PREFIX}/bin/pip3

Index: pkgsrc/devel/py-pip/PLIST
diff -u pkgsrc/devel/py-pip/PLIST:1.53 pkgsrc/devel/py-pip/PLIST:1.54
--- pkgsrc/devel/py-pip/PLIST:1.53	Sun May 10 13:50:11 2026
+++ pkgsrc/devel/py-pip/PLIST	Sat Aug  8 07:40:20 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.53 2026/05/10 13:50:11 wiz Exp $
+@comment $NetBSD: PLIST,v 1.54 2026/08/08 07:40:20 wiz Exp $
 bin/pip-${PYVERSSUFFIX}
 ${PYSITELIB}/${WHEEL_INFODIR}/METADATA
 ${PYSITELIB}/${WHEEL_INFODIR}/RECORD
@@ -38,9 +38,24 @@ ${PYSITELIB}/pip/__pip-runner__.pyo
 ${PYSITELIB}/pip/_internal/__init__.py
 ${PYSITELIB}/pip/_internal/__init__.pyc
 ${PYSITELIB}/pip/_internal/__init__.pyo
-${PYSITELIB}/pip/_internal/build_env.py
-${PYSITELIB}/pip/_internal/build_env.pyc
-${PYSITELIB}/pip/_internal/build_env.pyo
+${PYSITELIB}/pip/_internal/build_env/__init__.py
+${PYSITELIB}/pip/_internal/build_env/__init__.pyc
+${PYSITELIB}/pip/_internal/build_env/__init__.pyo
+${PYSITELIB}/pip/_internal/build_env/base.py
+${PYSITELIB}/pip/_internal/build_env/base.pyc
+${PYSITELIB}/pip/_internal/build_env/base.pyo
+${PYSITELIB}/pip/_internal/build_env/installer.py
+${PYSITELIB}/pip/_internal/build_env/installer.pyc
+${PYSITELIB}/pip/_internal/build_env/installer.pyo
+${PYSITELIB}/pip/_internal/build_env/noop.py
+${PYSITELIB}/pip/_internal/build_env/noop.pyc
+${PYSITELIB}/pip/_internal/build_env/noop.pyo
+${PYSITELIB}/pip/_internal/build_env/venv.py
+${PYSITELIB}/pip/_internal/build_env/venv.pyc
+${PYSITELIB}/pip/_internal/build_env/venv.pyo
+${PYSITELIB}/pip/_internal/build_env/virtual.py
+${PYSITELIB}/pip/_internal/build_env/virtual.pyc
+${PYSITELIB}/pip/_internal/build_env/virtual.pyo
 ${PYSITELIB}/pip/_internal/cache.py
 ${PYSITELIB}/pip/_internal/cache.pyc
 ${PYSITELIB}/pip/_internal/cache.pyo
@@ -483,6 +498,7 @@ ${PYSITELIB}/pip/_vendor/README.rst
 ${PYSITELIB}/pip/_vendor/__init__.py
 ${PYSITELIB}/pip/_vendor/__init__.pyc
 ${PYSITELIB}/pip/_vendor/__init__.pyo
+${PYSITELIB}/pip/_vendor/bom.cdx.json
 ${PYSITELIB}/pip/_vendor/cachecontrol/LICENSE.txt
 ${PYSITELIB}/pip/_vendor/cachecontrol/__init__.py
 ${PYSITELIB}/pip/_vendor/cachecontrol/__init__.pyc
@@ -570,6 +586,12 @@ ${PYSITELIB}/pip/_vendor/idna/LICENSE.md
 ${PYSITELIB}/pip/_vendor/idna/__init__.py
 ${PYSITELIB}/pip/_vendor/idna/__init__.pyc
 ${PYSITELIB}/pip/_vendor/idna/__init__.pyo
+${PYSITELIB}/pip/_vendor/idna/__main__.py
+${PYSITELIB}/pip/_vendor/idna/__main__.pyc
+${PYSITELIB}/pip/_vendor/idna/__main__.pyo
+${PYSITELIB}/pip/_vendor/idna/cli.py
+${PYSITELIB}/pip/_vendor/idna/cli.pyc
+${PYSITELIB}/pip/_vendor/idna/cli.pyo
 ${PYSITELIB}/pip/_vendor/idna/codec.py
 ${PYSITELIB}/pip/_vendor/idna/codec.pyc
 ${PYSITELIB}/pip/_vendor/idna/codec.pyo
@@ -680,6 +702,9 @@ ${PYSITELIB}/pip/_vendor/platformdirs/__
 ${PYSITELIB}/pip/_vendor/platformdirs/__main__.py
 ${PYSITELIB}/pip/_vendor/platformdirs/__main__.pyc
 ${PYSITELIB}/pip/_vendor/platformdirs/__main__.pyo
+${PYSITELIB}/pip/_vendor/platformdirs/_xdg.py
+${PYSITELIB}/pip/_vendor/platformdirs/_xdg.pyc
+${PYSITELIB}/pip/_vendor/platformdirs/_xdg.pyo
 ${PYSITELIB}/pip/_vendor/platformdirs/android.py
 ${PYSITELIB}/pip/_vendor/platformdirs/android.pyc
 ${PYSITELIB}/pip/_vendor/platformdirs/android.pyo
@@ -793,6 +818,9 @@ ${PYSITELIB}/pip/_vendor/requests/__vers
 ${PYSITELIB}/pip/_vendor/requests/_internal_utils.py
 ${PYSITELIB}/pip/_vendor/requests/_internal_utils.pyc
 ${PYSITELIB}/pip/_vendor/requests/_internal_utils.pyo
+${PYSITELIB}/pip/_vendor/requests/_types.py
+${PYSITELIB}/pip/_vendor/requests/_types.pyc
+${PYSITELIB}/pip/_vendor/requests/_types.pyo
 ${PYSITELIB}/pip/_vendor/requests/adapters.py
 ${PYSITELIB}/pip/_vendor/requests/adapters.pyc
 ${PYSITELIB}/pip/_vendor/requests/adapters.pyo
@@ -826,6 +854,7 @@ ${PYSITELIB}/pip/_vendor/requests/models
 ${PYSITELIB}/pip/_vendor/requests/packages.py
 ${PYSITELIB}/pip/_vendor/requests/packages.pyc
 ${PYSITELIB}/pip/_vendor/requests/packages.pyo
+${PYSITELIB}/pip/_vendor/requests/py.typed
 ${PYSITELIB}/pip/_vendor/requests/sessions.py
 ${PYSITELIB}/pip/_vendor/requests/sessions.pyc
 ${PYSITELIB}/pip/_vendor/requests/sessions.pyo

Index: pkgsrc/devel/py-pip/distinfo
diff -u pkgsrc/devel/py-pip/distinfo:1.77 pkgsrc/devel/py-pip/distinfo:1.78
--- pkgsrc/devel/py-pip/distinfo:1.77	Mon Jun  1 07:33:11 2026
+++ pkgsrc/devel/py-pip/distinfo	Sat Aug  8 07:40:20 2026
@@ -1,10 +1,10 @@
-$NetBSD: distinfo,v 1.77 2026/06/01 07:33:11 adam Exp $
+$NetBSD: distinfo,v 1.78 2026/08/08 07:40:20 wiz Exp $
 
-BLAKE2s (pip-26.1.2.tar.gz) = 63b672062862ee6d87932b830ed5c011f4f11a6f623680ba4c0d6ab16410c797
-SHA512 (pip-26.1.2.tar.gz) = 0f04c3867fcd0c707e9b532f9b85940e7fd3d822b6d71ce418d2f75746449cd12a1b85bee75c88ada1336c26d5ea2886340f70a1a0c0612534108a2d2145ebf7
-Size (pip-26.1.2.tar.gz) = 1840799 bytes
-SHA1 (patch-src_pip___internal_build__env.py) = b154cb3557521fa35f238a5706f1e9ac46fb0420
+BLAKE2s (pip-26.2.1.tar.gz) = 34fbd8e263dc19543697f3339555362c79a1994816eaf6dc94d9ddb7700ae806
+SHA512 (pip-26.2.1.tar.gz) = 8a892d364ad065c4f4371aa8b1b409155adde02a6103a8f2a90c592afc5cec6de02b75ff10f967aafcd2033a54156c02326f1e8e2503dd9f51f42995d9303f73
+Size (pip-26.2.1.tar.gz) = 1848877 bytes
+SHA1 (patch-src_pip___internal_build__env_virtual.py) = 237e2e409c8f3332bd5c77531865520fb086c521
 SHA1 (patch-src_pip___internal_commands_install.py) = 2f78c5af7c677d052a2275488dcda2f7b86c6e51
-SHA1 (patch-src_pip___internal_operations_install_wheel.py) = c9573b09f697713e2666680e0884ec6156350dc3
+SHA1 (patch-src_pip___internal_operations_install_wheel.py) = 51b2802eae961b63c2d785fff190027516a9206e
 SHA1 (patch-src_pip___internal_req_____init____.py) = 2bd5e0d18493b25bbd8dc533ffa3189e3e4038ba
 SHA1 (patch-src_pip___internal_req_req__install.py) = 534c68eec2c75ea3dbd8fce89c458ba2109e8fc5

Index: pkgsrc/devel/py-pip/patches/patch-src_pip___internal_operations_install_wheel.py
diff -u pkgsrc/devel/py-pip/patches/patch-src_pip___internal_operations_install_wheel.py:1.2 pkgsrc/devel/py-pip/patches/patch-src_pip___internal_operations_install_wheel.py:1.3
--- pkgsrc/devel/py-pip/patches/patch-src_pip___internal_operations_install_wheel.py:1.2	Sat Aug  2 17:24:33 2025
+++ pkgsrc/devel/py-pip/patches/patch-src_pip___internal_operations_install_wheel.py	Sat Aug  8 07:40:20 2026
@@ -1,14 +1,14 @@
-$NetBSD: patch-src_pip___internal_operations_install_wheel.py,v 1.2 2025/08/02 17:24:33 adam Exp $
+$NetBSD: patch-src_pip___internal_operations_install_wheel.py,v 1.3 2026/08/08 07:40:20 wiz Exp $
 
 Allow pip install --executable=/path to set path in script #! lines.
 https://github.com/pypa/pip/issues/12087
 https://github.com/pypa/pip/pull/12088
 
---- src/pip/_internal/operations/install/wheel.py.orig	2025-07-30 21:31:52.000000000 +0000
+--- src/pip/_internal/operations/install/wheel.py.orig	2026-08-04 22:28:08.000000000 +0000
 +++ src/pip/_internal/operations/install/wheel.py
-@@ -417,6 +417,10 @@ class PipScriptMaker(ScriptMaker):
- """
-     )
+@@ -425,6 +425,10 @@ class PipScriptMaker(ScriptMaker):
+             sys.exit(%(func)s())
+ """)
  
 +    def __init__(self, executable, *args, **kwargs):
 +        super().__init__(*args, **kwargs)
@@ -17,7 +17,7 @@ https://github.com/pypa/pip/pull/12088
      def make(
          self, specification: str, options: dict[str, Any] | None = None
      ) -> list[str]:
-@@ -429,6 +433,7 @@ def _install_wheel(  # noqa: C901, PLR09
+@@ -437,6 +441,7 @@ def _install_wheel(  # noqa: C901, PLR0915 function is
      wheel_zip: ZipFile,
      wheel_path: str,
      scheme: Scheme,
@@ -25,16 +25,16 @@ https://github.com/pypa/pip/pull/12088
      pycompile: bool = True,
      warn_script_location: bool = True,
      direct_url: DirectUrl | None = None,
-@@ -630,7 +635,7 @@ def _install_wheel(  # noqa: C901, PLR09
+@@ -640,7 +645,7 @@ def _install_wheel(  # noqa: C901, PLR0915 function is
                          record_installed(pyc_record_path, pyc_path)
          logger.debug(stdout.getvalue())
  
 -    maker = PipScriptMaker(None, scheme.scripts)
 +    maker = PipScriptMaker(executable, None, scheme.scripts)
  
-     # Ensure old scripts are overwritten.
-     # See https://github.com/pypa/pip/issues/1800
-@@ -727,6 +732,7 @@ def install_wheel(
+     # Embed the target environment's interpreter in console-script launchers
+     # rather than the one running pip, so an in-process install into another
+@@ -743,6 +748,7 @@ def install_wheel(
      wheel_path: str,
      scheme: Scheme,
      req_description: str,
@@ -42,7 +42,7 @@ https://github.com/pypa/pip/pull/12088
      pycompile: bool = True,
      warn_script_location: bool = True,
      direct_url: DirectUrl | None = None,
-@@ -739,6 +745,7 @@ def install_wheel(
+@@ -756,6 +762,7 @@ def install_wheel(
                  wheel_zip=z,
                  wheel_path=wheel_path,
                  scheme=scheme,

Added files:

Index: pkgsrc/devel/py-pip/patches/patch-src_pip___internal_build__env_virtual.py
diff -u /dev/null pkgsrc/devel/py-pip/patches/patch-src_pip___internal_build__env_virtual.py:1.1
--- /dev/null	Sat Aug  8 07:40:20 2026
+++ pkgsrc/devel/py-pip/patches/patch-src_pip___internal_build__env_virtual.py	Sat Aug  8 07:40:20 2026
@@ -0,0 +1,26 @@
+$NetBSD: patch-src_pip___internal_build__env_virtual.py,v 1.1 2026/08/08 07:40:20 wiz Exp $
+
+Copy distutils distro config file to overlay.
+https://github.com/pypa/pip/issues/10949
+
+--- src/pip/_internal/build_env/virtual.py.orig	2026-08-08 07:34:39.398485754 +0000
++++ src/pip/_internal/build_env/virtual.py
+@@ -6,6 +6,8 @@ from collections.abc import Iterable
+ import textwrap
+ from collections import OrderedDict
+ from collections.abc import Iterable
++from shutil import copy
++from sysconfig import get_paths
+ from types import TracebackType
+ from typing import TYPE_CHECKING
+ 
+@@ -58,6 +60,9 @@ class VirtualBuildEnvironment(BuildEnvironment):
+         self._site_dir = os.path.join(temp_dir.path, "site")
+         if not os.path.exists(self._site_dir):
+             os.mkdir(self._site_dir)
++        distutils_distro_config = get_paths()["platlib"] + "/_distutils_system_mod.py"
++        if os.path.exists(distutils_distro_config):
++            copy(distutils_distro_config, self._site_dir)
+         with open(
+             os.path.join(self._site_dir, "sitecustomize.py"), "w", encoding="utf-8"
+         ) as fp: