unstale

pypi / pip

pip

What changed in pip 25 to 26, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-27.

5 security

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

pip 264 changes

Security 4

  • pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory

    26.1.2security advisory

  • pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

    26.1security advisory

  • pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

    26.1security advisory

  • pip Path Traversal vulnerability

    26.0security advisory

pip 251 changes

Security 1

  • pip's fallback tar extraction doesn't check symbolic links point to extraction directory

    25.3security advisory