alt-python37-pip (20.2.4-6) stable; urgency=medium

  * ALTPYTH-612: rename the Debian source package from "pip" to
    alt-python37-pip so it no longer collides with the other interpreter
    tracks that ship pip. All tracks published a source package called
    "pip", so their .dsc and source tarballs carried identical file names
    with different contents in the shared per-distribution repository.
    The RPM spec and the Alpine APKBUILD already used the per-track name.
    Binary package names are unchanged.

 -- Juan-Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 03 Sep 2026 07:45:00 +0000

pip (20.2.4-5) stable; urgency=medium

  * SECURITY UPDATE: directory escape via Link.filename decoding the URL path twice
    - debian/patches/CVE-2026-13346.patch: decode the URL path once and reduce the
      file name to a single path component
    - CVE-2026-13346

 -- Davit Sargsyan <dsargsyan@cloudlinux.com>  Mon, 24 Aug 2026 15:30:00 -0400

pip (20.2.4-4) stable; urgency=medium

  * SECURITY UPDATE: Fix revision hijacking via unicode separators in git references
    - debian/patches/CVE-2021-3572.patch: Fix revision hijacking via unicode separators in git references
    - CVE-2021-3572

 -- Juan-Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 27 Jul 2026 07:30:00 -0400

pip (20.2.4-3) stable; urgency=medium

  * SECURITY UPDATE: Fix Mercurial argument injection via crafted revision string
    - debian/patches/CVE-2023-5752.patch: Fix Mercurial argument injection via crafted revision string
    - CVE-2023-5752
  * SECURITY UPDATE: Fix arbitrary file write via symlink in source distribution tarball
    - debian/patches/CVE-2025-8869.patch: Fix arbitrary file write via symlink in source distribution tarball
    - CVE-2025-8869
  * SECURITY UPDATE: Fix path traversal via sibling-directory prefix match in tarball extraction
    - debian/patches/CVE-2026-1703.patch: Fix path traversal via sibling-directory prefix match in tarball extraction
    - CVE-2026-1703
  * SECURITY UPDATE: Fix archive-format confusion when unpacking ambiguous archives
    - debian/patches/CVE-2026-3219.patch: Fix archive-format confusion when unpacking ambiguous archives
    - CVE-2026-3219
  * SECURITY UPDATE: Fix code execution via module import during post-install pip self-version check
    - debian/patches/CVE-2026-6357.patch: Fix code execution via module import during post-install pip self-version check
    - CVE-2026-6357
  * SECURITY UPDATE: Fix arbitrary file write via path traversal in wheel entry point script name
    - debian/patches/CVE-2026-8643.patch: Fix arbitrary file write via path traversal in wheel entry point script name
    - CVE-2026-8643

 -- Viktor Borzov <vborzov@cloudlinux.com>  Sat, 25 Jul 2026 06:54:21 -0400

pip (20.2.4-2) stable; urgency=medium

  * ALTPYTH-393: fix cert path

 --  Sergey Fokin <sfokin@cloudlinux.com>  Wed, 15 Oct 2021 11:20:00 +3000

pip (20.2.4-1) stable; urgency=medium

  * initial build

 --  Sergey Fokin <sfokin@cloudlinux.com>  Thu, 07 Oct 2021 19:12:25 +3000
