CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

devel/py-pip23.3.2_4

Tool for installing and managing Python packages

Maintainer
python@FreeBSD.org
Packages
py312-pip 23.3.2_4
Upstream
Higher version available: 26.2.2
CPE
pypa:pip from the port
WWW
https://pip.pypa.io/en/latest/
Links
cgit · VuXML

Unaddressed (2) · The CVE record lists this version as affected, no VuXML entry names the CVE

CVE-2026-133465.6published 2026-07-29

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this…

CVE-2026-86434.1published 2026-06-01

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (0)

No VuXML entries for this package.

Commits (96)

Sunpoet Po-Chuan Hsieh (sunpoet) · 9.0.2
Update to 9.0.2

Changes:	https://github.com/pypa/pip/blob/master/NEWS.rst
e9fefdb236
Mathieu Arnold (mat) · 9.0.1
Convert Python ports to FLAVORS.

Ports using USE_PYTHON=distutils are now flavored.  They will
  automatically get flavors (py27, py34, py35, py36) depending on what
  versions they support.

  There is also a USE_PYTHON=flavors for ports that do not use distutils
  but need FLAVORS to be set.  A USE_PYTHON=noflavors can be set if
  using distutils but flavors are not wanted.

  A new USE_PYTHON=optsuffix that will add PYTHON_PKGNAMESUFFIX has been
  added to cope with Python ports that did not have the Python
  PKGNAMEPREFIX but are flavored.

  USES=python now also exports a PY_FLAVOR variable that contains the
  current python flavor.  It can be used in dependency lines when the
  port itself is not python flavored.  For example, deskutils/calibre.

  By default, all the flavors are generated.  To only generate flavors
  for the versions in PYTHON2_DEFAULT and PYTHON3_DEFAULT, define
  BUILD_DEFAULT_PYTHON_FLAVORS in your make.conf.

  In all the ports with Python dependencies, the *_DEPENDS entries MUST
  end with the flavor so that the framework knows which to build/use.
  This is done by appending '@${PY_FLAVOR}' after the origin (or
  @${FLAVOR} if in a Python module with Python flavors, as the content
  will be the same).  For example:

    RUN_DEPENDS= ${PYTHON_PKGNAMEPREFIX}six>0:devel/py-six@${PY_FLAVOR}

PR:		223071
Reviewed by:	portmgr, python
Sponsored by:	Absolight
Differential Revision:	https://reviews.freebsd.org/D12464
551be3c723
Ben Woods (woodsb02) · 9.0.1
[NEW] devel/py3-pip: Add Python 3.x version of this port

PR:		219833
PR:		212950
8e056b5e75
Wen Heping (wen) · 9.0.1
- Update to 9.0.1
abd9ce83ed
Wen Heping (wen) · 8.1.2
- Update to 8.1.2
07b20f48b1
Mathieu Arnold (mat) · 8.0.2
Remove ${PORTSDIR}/ from dependencies, categories d, e, f, and g.

With hat:	portmgr
Sponsored by:	Absolight
4e1b79a0a6
Sunpoet Po-Chuan Hsieh (sunpoet) · 8.0.2
- Update to 8.0.2 - Add NO_ARCH

Changes:	https://github.com/pypa/pip/blob/develop/CHANGES.txt
0df5f7da0e
Kubilay Kocak (koobs) · 7.1.2_1
devel/py-pip: Add pkg-message user WARNING

Add a pkg-message warning users not to use pip to install packages in
the system-wide Python environment location. This should have been done
a long time ago.

While I'm here:

- Add LICENSE_FILE
- Enable NO_ARCH
- Match *_DEPENDS versions to those in setup.py
- Fix incorrect pytest-xdist package name match

PR:		205881, 205819
Reported by:	many
Suggested by:	many
MFH:		2016Q1
d503aae1cb
Kurt Jaeger (pi) · 7.1.2
devel/py-pip: 7.0.3 -> 7.1.2

Changes:
  https://pip.pypa.io/en/stable/news/

See also: https://reviews.freebsd.org/D4106

PR:		204367
Reviewed by:	antoine, koobs, nivit
Approved by:	nivit (maintainer)
2be3a573f4
Dmitry Marakasov (amdmi3) · 7.0.3
Improve shebangfix framework

- Support multiple values in *_OLD_CMD, i.e. we can now fix both "/usr/bin/python" and "/usr/bin/env python" at the same time
- Default *_OLD_CMD values are now always appended, so you don't need to specify them in individual ports
- Add lua support (depends on USES=lua)
- Add more default values, such as "/usr/bin/env foo" for python, perl, bash, ruby and lua
- Shebangfix now matches whole words, e.g. we will no longer (erroneously) replace "/usr/bin/perl5.005" with "${perl_CMD}5.005" (but "/usr/bin/perl -tt" is still (correctly) replaced with "${perl_CMD} -tt")

Note that *_OLD_CMD items containing spaces must now be quoted (e.g. perl_OLD_CMD=/bin/perl /usr/bin/perl "/usr/bin/env perl")

Update shebangfix usage according to new rules in many ports:

- Remove *_OLD_CMD for patterns now replaced by default
- Quote custom *_OLD_CMD which contain spaces

Fix shebangfix usage in many ports (irrelevant to infrastructure change):

- Remove redundant SHEBANG_LANG (no need to duplicate default langs)
- Remove redundant *_CMD (such as python_CMD=${LOCALBASE}/bin/python${PYTHON_VER} when USES=python is present)
- Never use *_OLD_CMD in REINPLACE_CMD matchers, these should always look for exact string

Approved by:	portmgr (bapt)
Differential Revision:	D3756
67971bd0fb
Antoine Brodin (antoine) · 7.0.3
Switch default python_CMD used by shebangfix to ${PYTHON_CMD} for ports using python

PR:		201077
Reviewed by:	mat
With hat:	portmgr
Differential Revision:	https://reviews.freebsd.org/D2955
6e381a9d53
Kubilay Kocak (koobs) · 7.0.3
devel/py-pip: Fix pkg-plist (DOCS)

Update pkg-plist for DOCS option files that were missed in the last update
I committed.

Reported by:	mat
Approved by:	portmgr (blanket)
MFH:		2015Q3
12be60176b
Kubilay Kocak (koobs) · 7.0.3
devl/py-pip: Update to 7.0.3

- Update to 7.0.3
- Update pkg-plist
- USE_GITHUB to get test suite (PyPI sdist doesnt include them)
- Add TEST_DEPENDS and canonicalise regression-test: target
- Patch setup.cfg so that tests run properly
- Temporarily patch out versioned console_script's (pipX, pipX.Y)
  until USE_PYTHON=concurrent supports more granularity (coming soon).

Note: A couple of tests fail because of these missing console_scripts.

- Add USE_PYTHON=concurrent support accordingly.

While I'm here:

- Makefile: Sort sections
- Makefile: Whitespace align

Changes:

  https://pip.pypa.io/en/stable/news.html

PR:		200688
Approved by:	nivit (maintainer)
e99024e8cf
Nicola Vitale (nivit) · 6.1.1
- Update to 6.1.1

Relnotes:	https://pip.pypa.io/en/latest/news.html
6368a83530
Nicola Vitale (nivit) · 6.0.8
- Update to 6.0.8
270ae8cb98
Nicola Vitale (nivit) · 6.0.7
- Update to 6.0.7 - Sort USE_PYTHON values
76cad881b7
Nicola Vitale (nivit) · 6.0.6
- Update to 6.0.6 - Switch back to CHEESESHOP as download site   because doc sources are now included in the   distribution file - Update WWW address in pkg-descr

Relnotes:	https://pip.pypa.io/en/latest/news.html
1168607386
Baptiste Daroussin (bapt) · 1.5.6
Cleanup plist
5013f572c0
Marcus von Appen (mva) · 1.5.6
- Convert ports of devel/ to USES=python

Approved by:	portmgr (implicit)
89e07f4a18
Nicola Vitale (nivit) · 1.5.6
- Update to 1.5.6 - Use new options helper

Release Notes:	https://pip.pypa.io/en/latest/news.html
3a840a5cb9
Nicola Vitale (nivit) · 1.5.4
- Update to 1.5.4 - Use GitHub as download site, so we can  build docs - Build docs as HTML format with Sphinx - Add a regression-test target (not active at the moment, because   some tests fail) - Update pkg-descr

Release Notes:	http://www.pip-installer.org/en/latest/news.html
eeaf3324e3
Kubilay Kocak (koobs) · 1.5.2
devel/py-pip: Update to 1.5.2 and modernise

- Update to 1.5.2
- Remove LOCAL master site (CHEESESHOP is highly available)
- Enable STAGE support
- Enable AUTOPLIST, update pkg-plist
- Deprecate easy_install target
- Deprecate py3k-fix-pkg-plist.inc
- Deprecate OPTIONSFILE override
- PLIST_SUB is no longer necessary

Changes: https://github.com/pypa/pip/blob/1.5.2/CHANGES.txt

PR:		ports/186584
Approved by:	maintainer (via email)
124432c827
Baptiste Daroussin (bapt) · 1.4.1
Fix properties on pkg-plist
e04b632220
Baptiste Daroussin (bapt) · 1.4.1
Add NO_STAGE all over the place in preparation for the staging support (cat: devel part 3)
580a778a16
Nicola Vitale (nivit) · 1.4.1
- Update to 1.4.1 - Use shebangfix facility
2a54f010bc
Nicola Vitale (nivit) · 1.4
- Update to 1.4 - Fix WWW line in pkg-descr

Build log:	http://goo.gl/6UmyMk
Change log:	http://goo.gl/9pUy4v
d20d101a02
Nicola Vitale (nivit) · 1.3.1
- Fix build with redports.org and poudriere(8)

Build log:	http://goo.gl/sC2sr
Reported by:	olgeni, Sascha Holzleiter >sascha@root-login.org> (via private email)
aeec7b158d
Nicola Vitale (nivit) · 1.3.1
- Update to 1.3.1 - Trim Makefile header - Include fix of pkg-plist when Python ver >= 3.2

BuildLog:	http://goo.gl/dM1BH
2523d233f3
Nicola Vitale (nivit) · 1.2.1
- Update to 1.2.1

ChangeLog:	http://goo.gl/kdjka
BuildLog:	http://goo.gl/svYX4
9b3979a68c
Nicola Vitale (nivit) · 1.2
- Update to 1.2 - Add LICENSE (MIT) - Convert to the new options framework

ReleaseNotes:	http://goo.gl/FjWOP
BuildLog:	http://goo.gl/q2mBr
98ecec5402
Nicola Vitale (nivit) · 1.1
- Update to 1.1
2aedaca02c
Nicola Vitale (nivit) · 1.0.2
- Update to 1.0.2
8cc476fe76
Nicola Vitale (nivit) · 1.0.1
- Update to 1.0.1
86302f927b
Nicola Vitale (nivit) · 1.0
- Update to 1.0
b0800f214f
Nicola Vitale (nivit) · 0.8.3
- Update to 0.8.3 - Change web site URL in pkg-descr
310d8da7fa
Nicola Vitale (nivit) · 0.8.2
- Update to 0.8.2
b78b37212d
Nicola Vitale (nivit) · 0.8.1
- Update to 0.8.1
be43d49dfd
Nicola Vitale (nivit) · 0.8
- Update to 0.8 - Set USE_PYDISTUTILS to easy_install
784bce02b5
Nicola Vitale (nivit) · 0.7.1
- Update to 0.7.1
44e9c74fc4
Nicola Vitale (nivit) · 0.6.3
- Update to 0.6.3

Feature safe:	yes
ee2f875f3e
Nicola Vitale (nivit) · 0.6.1
- Update to 0.6.1 - Add devel/py-setuptools to RUN_DEPENDS
5f6ab393ad
Nicola Vitale (nivit) · 0.6
- Update to 0.6
a8abf045c9
Nicola Vitale (nivit) · 0.5.1
- Update to 0.5.1 - Install additional docs
ed032a989c
Nicola Vitale (nivit) · 0.4
- Update to 0.4
4b8e524111
Nicola Vitale (nivit) · 0.3.1
- Update to 0.3.1 - Use distutils instead of easy_install to install
2b4c2634e7
Nicola Vitale (nivit) · 0.2.1
pip is a replacement for easy_install. It uses mostly the same techniques for finding packages, so packages that were made easy_installable should be pip-installable as well.

pip is meant to improve on easy_install. Some of the improvements:

    * All packages are downloaded before installation. Partially-completed
      installation doesn't occur as a result.
    * Care is taken to present useful output on the console.
    * The reasons for actions are kept track of. For instance, if a package
      is being installed, pip keeps track of why that package was required.
    * Error messages should be useful.
    * Packages don't have to be installed as egg archives, they can be
      installed flat (while keeping the egg metadata).

WWW:	http://pip.openplans.org/
ba049a519e