alt-python314-pip (24.0-3) stable; urgency=medium

  * SECURITY UPDATE: doubly-encoded package URL could escape the download directory
    - debian/patches/CVE-2026-13346.patch: stop decoding the URL path a second time
      in Link.filename and route the download-path joins through join_within_directory
      so the name is always a single path component
    - CVE-2026-13346
  * SECURITY UPDATE: symlink path traversal during tar extraction
    - debian/patches/CVE-2025-8869.patch: verify a symlink member's target stays
      inside the archive before extracting it in untar_file
    - CVE-2025-8869
  * SECURITY UPDATE: directory-containment check bypassed by shared name prefix
    - debian/patches/CVE-2026-1703.patch: make is_within_directory compare the
      resolved paths directly instead of using os.path.commonprefix, so a
      sibling sharing a name prefix is rejected while a real child under a
      doubled-slash root is still accepted
    - CVE-2026-1703
  * SECURITY UPDATE: ambiguous archive signature confused pip's format detection
    - debian/patches/CVE-2026-3219.patch: order the archive-format checks by
      reliability and reject files matching both zip and tar signatures
    - CVE-2026-3219
  * SECURITY UPDATE: self-version check imported modules after installing wheels
    - debian/patches/CVE-2026-6357.patch: split the pip self-version check into a
      fetch phase before the command runs and an emit phase after it
    - CVE-2026-6357
  * SECURITY UPDATE: wheel entry point names could escape the scripts directory
    - debian/patches/CVE-2026-8643.patch: reject console_scripts/gui_scripts entry
      point names that resolve outside the scripts directory
    - CVE-2026-8643

 -- Davit Sargsyan <dsargsyan@cloudlinux.com>  Mon, 24 Aug 2026 16:21:57 +0000

alt-python314-pip (24.0-2) stable; urgency=medium

  * ALTPYTH-595: Build alt-python packages for Debian 12 and 13 on ARM

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Fri, 27 Mar 2026 00:00:00 +0000

alt-python314-pip (24.0-1) stable; urgency=medium

  * ALTPYTH-587: Initial build for Python 3.14

 -- Davit Sargsyan <dsargsyan@cloudlinux.com>  Wed, 18 Feb 2026 00:00:00 +0000
