alt-python312-pip (23.3.1-3) stable; urgency=medium

  * SECURITY UPDATE: symlink extraction escape in the tarfile fallback
    - debian/patches/CVE-2025-8869.patch: validate that a symlink member's
      target resolves inside the tar archive, in the extraction fallback used
      on Pythons without PEP 706 tarfile filtering
    - CVE-2025-8869
  * SECURITY UPDATE: path traversal into prefix-sharing sibling directories
    - debian/patches/CVE-2026-1703.patch: replace the os.path.commonprefix
      containment test in is_within_directory with an explicit path-component
      check
    - CVE-2026-1703
  * SECURITY UPDATE: archive type confusion for concatenated tar+zip files
    - debian/patches/CVE-2026-3219.patch: choose the archive format in order
      of decreasing reliability and reject files that identify as both zip
      and tar
    - CVE-2026-3219
  * SECURITY UPDATE: self version-check imported just-installed modules
    - debian/patches/CVE-2026-6357.patch: split the self version-update check
      so the network fetch and version computation run before the command
      body, and skip it entirely for "pip install pip"
    - CVE-2026-6357
  * SECURITY UPDATE: entry point names installed outside the scripts directory
    - debian/patches/CVE-2026-8643.patch: reject console/gui script entry
      point names that resolve to a path outside the scripts directory
    - CVE-2026-8643
  * SECURITY UPDATE: doubly-encoded package URL could escape the download directory
    - debian/patches/CVE-2026-13346.patch: stop decoding the URL path a second time
      in Link.filename and route the download-path joins through join_within_directory
      so the name is always a single path component
    - CVE-2026-13346

 -- Davit Sargsyan <dsargsyan@cloudlinux.com>  Mon, 24 Aug 2026 12:00:00 +0000

alt-python312-pip (23.3.1-2) stable; urgency=medium

  * ALTPYTH-595: Build alt-python packages for Debian 12 and 13 on ARM

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Fri, 27 Mar 2026 00:00:00 +0000

alt-python312-pip (23.3.1-1) stable; urgency=medium

  * initial build

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 7 Dec 2023 13:20:00 +0100
