[dependabot]

Bumps pip from 26.2.2 to 26.3.

Changelog

Sourced from pip's changelog.

26.3 (2026-11-02)

Improved Documentation

• Clarify in the security policy that pip has never considered installing untrusted wheels safe. This is because Python's import system is dynamic, so pip cannot guarantee that installing a wheel will not execute third-party code. ([#14412](https://github.com/pypa/pip/issues/14412) <https://github.com/pypa/pip/issues/14412>_)

Deprecations and Removals

• Block unexpected imports during installation, warn about unsafe imports afterward, and improve recovery from interrupted installations. ([#13842](https://github.com/pypa/pip/issues/13842) <https://github.com/pypa/pip/issues/13842>_)

Features

• Show build backend warnings for local source directories and log them at debug level for other sources. ([#14372](https://github.com/pypa/pip/issues/14372) <https://github.com/pypa/pip/issues/14372>_)
• Add support for selecting extras in pylock.toml files with -r pylock.toml[extra1,extra2]. ([#14205](https://github.com/pypa/pip/issues/14205) <https://github.com/pypa/pip/issues/14205>_)
• Allow --group to select non-default groups from local pylock files, e.g. --group pylock.toml:docs. ([#14390](https://github.com/pypa/pip/issues/14390) <https://github.com/pypa/pip/issues/14390>_)
• Support --no-binary with -r pylock.toml. Before, pip would get the sdist from the index instead of the locked URL, or fail if no wheel were available in the lock file. ([#14187](https://github.com/pypa/pip/issues/14187) <https://github.com/pypa/pip/issues/14187>_)
• Speed up installing a wheel with console scripts by not resolving every PATH entry. ([#14235](https://github.com/pypa/pip/issues/14235) <https://github.com/pypa/pip/issues/14235>_)
• Clarify the warning for ~-prefixed leftover distribution directories. ([#11849](https://github.com/pypa/pip/issues/11849) <https://github.com/pypa/pip/issues/11849>_)

Bug Fixes

• Report build-backend import failures as pip errors instead of displaying an uncaught traceback. ([#12248](https://github.com/pypa/pip/issues/12248) <https://github.com/pypa/pip/issues/12248>_)
• No longer log the "pip is looking at multiple versions of a package" message until pip has looked at at least two versions of that package. ([#12928](https://github.com/pypa/pip/issues/12928) <https://github.com/pypa/pip/issues/12928>_)
• Fix pip's self version check reporting an outdated version from the environment instead of the running pip when run as a zipapp. ([#13084](https://github.com/pypa/pip/issues/13084) <https://github.com/pypa/pip/issues/13084>_)
• Fix a fatal error when using the PIP_CONFIG_FILE environment variable with pip config set. ([#13279](https://github.com/pypa/pip/issues/13279) <https://github.com/pypa/pip/issues/13279>_)
• Avoid misleading error messages that include extra markers such as ; extra == "..." when installing packages. ([#13618](https://github.com/pypa/pip/issues/13618) <https://github.com/pypa/pip/issues/13618>_)
• When installing to a custom --prefix, use the posix_prefix scheme when running from a Debian patched Python distribution to avoid a superfluous /local/ subdirectory. ([#13634](https://github.com/pypa/pip/issues/13634) <https://github.com/pypa/pip/issues/13634>_)
• Refuse to follow an HTTP redirect to a file: URL. ([#14171](https://github.com/pypa/pip/issues/14171) <https://github.com/pypa/pip/issues/14171>_)
• Prevent wheel cache origin mismatch warnings from exposing URL credentials. ([#14232](https://github.com/pypa/pip/issues/14232) <https://github.com/pypa/pip/issues/14232>_)
• Report the incomplete-download error on Windows, not a PermissionError. ([#14237](https://github.com/pypa/pip/issues/14237) <https://github.com/pypa/pip/issues/14237>_)
• Fix the global configuration location on macOS in virtual environments created from Homebrew Python. ([#14303](https://github.com/pypa/pip/issues/14303) <https://github.com/pypa/pip/issues/14303>_)
• Reject extra arguments to pip config edit instead of silently ignoring them. ([#14347](https://github.com/pypa/pip/issues/14347) <https://github.com/pypa/pip/issues/14347>_)
• Honor supplied hashes when using --no-require-hashes. ([#14355](https://github.com/pypa/pip/issues/14355) <https://github.com/pypa/pip/issues/14355>_)

... (truncated)

Commits

• 191854f Bump for release
• 063058b Update AUTHORS.txt
• d1a81c8 Merge pull request #14233 from carrerasdarren-cell/fix/cache-origin-redact-auth
• 942a415 Merge pull request #14423 from notatallshaw/fix/pkg-resources-deadline-20261102
• f424f1a Merge pull request #14424 from notatallshaw/vendor/msgpack-1.2.4-20261102
• 720a89a Merge branch 'main' into fix/cache-origin-redact-auth
• 8e3414c Merge pull request #14247 from notatallshaw/enforce-import-block
• 5156e03 Upgrade msgpack to 1.2.4
• 95e2e6b Merge branch 'main' into enforce-import-block
• 3859fd1 Defer pkg_resources metadata errors until pip 27.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)