Please update pip to at least version of pip 25.2

[combro2k]

There is a 5 day old reported vulnerability: GHSA-4xh5-x5gv-qwph
Can you please update python 3.12 based images with pip version at least 25.2?
To be specific the -slim one :-)

[ad-m-ss]

These images by design use the pip/setuptools versions that are bundled with the version of Python being installed.

Python 3.11 comes with setuptools v65.5.0: https://github.com/python/cpython/tree/3.11/Lib/ensurepip/_bundled

So this is expected, and not something that will be changed in these images. (Updating to setuptools 70+ would be a breaking change for a start.)

You will either need to either:

1. Update to Python 3.12 or newer (which no longer bundles setuptools)
2. Update setuptools in your own Dockerfile
3. Ask upstream CPython to update to newer setuptools in Python 3.11
4. Suppress the vulnerability alert if appropriate (you didn't say what vulnerability you were referring to, but it's quite possible it's a non-issue in practice - many setuptools codepaths are not used when it's used as a pip build backend, or need several other criteria to be a problem etc)

See also:

• Vulnerability with setuptools < 70.0.0 (CVE-2024-6345) #942
• Stop including setuptools and wheel in Python 3.12+ images #952

See: #1012 (comment)

Therefore you should raise that request upstream, or update yourself.

[mabecke]

Hi @ad-m-ss I see that for 3.13 the bundled pip was updated to 25.3 last week https://github.com/python/cpython/tree/3.13/Lib/ensurepip/_bundled

Seems like this change isn't going through for the built image, as 3.13 still has pip 25.1 even though it was recently re-built.

Can we please re-open the issue? Or would you prefer to have a new one specifically for 3.13 and pip 25.3?

Thanks

[ad-m-ss]

What do you mean by re-open? I do not have authority to close / open anything here, and it looks it was never closed. I am just watching and know a little policies.

[tianon]

If you look at python/cpython@9a3a147, you'll see that it's not part of any release tags yet (you can compare that to an older commit like python/cpython@1ba09b2 which was included in 3.13.6+ to see what I mean), so that means it should be part of the next 3.13 release.

See also python/cpython@v3.13.9...3.13 for a full list of what might be in that next release (comparing the latest release tag, v3.13.9 to that in-progress 3.13 release branch).

[tianon]

(As a matter of process: if that stays for the release and doesn't get reverted, the bump will happen automatically as part of / with the release bump.)