Update bundled pip to 26.2.2 #159894
Description
Feature or enhancement
Update ensurepip’s bundled pip from 26.2.1 to 26.2.2.
pip 26.2.2 updates its bundled certifi trust bundle to 2026.10.19. This removes emSign Root CA - G3 following the revocation of affected G3 intermediates for CA compromise, while retaining the unaffected emSign roots.
- pip release: https://pypi.org/project/pip/26.2.2/
- pip changelog: https://pip.pypa.io/en/stable/news/#v26-2-2
- certifi update details: Why was emSign removed? certifi/python-certifi#439 (comment)
Has this already been discussed elsewhere?
This is a minor feature, which does not need previous discussion elsewhere
Activity
pythongh-159894: Upgrade bundled pip to 26.2.2
gh-159894: Upgrade bundled pip to 26.2.2 (#159910)
[3.14] gh-159894: Upgrade bundled pip to 26.2.2 (GH-159910) (#159942)
[3.15] gh-159894: Upgrade bundled pip to 26.2.2 (GH-159910) (#159941)
[3.13] gh-159894: Upgrade bundled pip to 26.2.2 (GH-159910) (#159943)
mayeut commentedon Oct 21, 2026
Given this is a security related upgrade rather than a regular pip upgrade, shouldn't this be back ported to 3.11 & 3.12 as well ?
StanFromIreland commentedon Oct 21, 2026
As noted in the announcement, we don't update pip for those versions, 3.13 was an exception.
pythongh-159894: Upgrade bundled pip to 26.2.2 (3.10.22.x)