alt-python311-pip (21.3.1-4) stable; urgency=medium

  * SECURITY UPDATE: Mercurial option injection via crafted VCS revision
    - debian/patches/CVE-2023-5752.patch: pass the revision to hg as --rev=<rev>
    - CVE-2023-5752
  * SECURITY UPDATE: arbitrary file overwrite via symlinks in sdist tarballs
    - debian/patches/CVE-2025-8869.patch: check symlink targets stay inside the
      extraction directory in untar_file
    - CVE-2025-8869
  * SECURITY UPDATE: archive confusion via tar/ZIP polyglot files
    - debian/patches/CVE-2026-3219.patch: order unpack_file checks by confidence
      and reject ambiguous archive signatures
    - CVE-2026-3219
  * SECURITY UPDATE: path traversal via string-prefix sibling directories
    - debian/patches/CVE-2026-1703.patch: use os.path.commonpath instead of
      commonprefix in is_within_directory
    - CVE-2026-1703
  * SECURITY UPDATE: code execution via post-install pip self-version check
    - debian/patches/CVE-2026-6357.patch: fetch version info before command
      execution, only emit the upgrade warning afterwards
    - CVE-2026-6357

 -- Viktor Borzov <vborzov@cloudlinux.com>  Tue, 21 Jul 2026 14:08:39 -0400

alt-python311-pip (21.3.1-3) stable; urgency=medium

  * include setuptools wheel in pip-wheel package so ensurepip works when
    building venvs with alt-python-internal

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Mon, 30 Mar 2026 00:00:00 +0000

alt-python311-pip (21.3.1-2) stable; urgency=medium

  * ALTPYTH-595: Build alt-python packages for Debian 12 and 13 on ARM

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Fri, 27 Mar 2026 00:00:00 +0000

alt-python311-pip (21.3.1-1) stable; urgency=medium

  * initial build

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 19 Dec 2022 13:20:00 +0300
