From 54ed4579c08cf46c708407dfca2571e5df5d1b5f Mon Sep 17 00:00:00 2001
From: rahul <rahul.tiwari@repl.it>
Date: Thu, 22 Oct 2026 08:05:59 +0000
Subject: [PATCH 1/2] security: refresh pip vendored CA data

Assisted-by: Replit
---
 pkgs/modules/python-base/default.nix |  2 +-
 pkgs/modules/python/pip.nix          |  5 ++++-
 pkgs/pip/default.nix                 | 12 ++++++++++++
 3 files changed, 17 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/pip/default.nix

diff --git a/pkgs/modules/python-base/default.nix b/pkgs/modules/python-base/default.nix
index b324b80c..262fa0af 100644
--- a/pkgs/modules/python-base/default.nix
+++ b/pkgs/modules/python-base/default.nix
@@ -33,7 +33,7 @@ in
 
   replit.packages = [
     binary-wrapped-python
-    pypkgs.pip
+    (pkgs.callPackage ../../pip { pip = pypkgs.pip; })
     pkgs.poetry
     pkgs.uv
   ];
diff --git a/pkgs/modules/python/pip.nix b/pkgs/modules/python/pip.nix
index 25aee8f5..7e822db3 100644
--- a/pkgs/modules/python/pip.nix
+++ b/pkgs/modules/python/pip.nix
@@ -1,7 +1,10 @@
 pkgs @ { pypkgs, ... }:
 
 let
-  pip = pypkgs.pip.overridePythonAttrs (old: rec {
+  patched-pip = pkgs.callPackage ../../pip {
+    pip = pypkgs.pip;
+  };
+  pip = patched-pip.overridePythonAttrs (old: rec {
     outputs = [
       "out"
     ];
diff --git a/pkgs/pip/default.nix b/pkgs/pip/default.nix
new file mode 100644
index 00000000..153924e8
--- /dev/null
+++ b/pkgs/pip/default.nix
@@ -0,0 +1,12 @@
+{ pip, fetchurl }:
+let
+  ca-bundle = fetchurl {
+    url = "https://raw.githubusercontent.com/certifi/python-certifi/2026.10.19/certifi/cacert.pem";
+    hash = "sha256-UPefmNrBkrINv3PzXFbwsMVXqyZ/9RmdERfMEYC3B4U=";
+  };
+in
+pip.overridePythonAttrs (old: {
+  postPatch = (old.postPatch or "") + ''
+    cp ${ca-bundle} src/pip/_vendor/certifi/cacert.pem
+  '';
+})

From a0d4d3263a2918aec34c96ef3be6b64ba3c462d5 Mon Sep 17 00:00:00 2001
From: rahul <rahul.tiwari@repl.it>
Date: Thu, 22 Oct 2026 08:14:38 +0000
Subject: [PATCH 2/2] python: upgrade pip to 26.2.2

Assisted-by: Replit
---
 pkgs/modules/python-base/default.nix |  2 +-
 pkgs/modules/python/pip.nix          |  7 +++----
 pkgs/pip/default.nix                 | 19 +++++++++----------
 3 files changed, 13 insertions(+), 15 deletions(-)

diff --git a/pkgs/modules/python-base/default.nix b/pkgs/modules/python-base/default.nix
index 262fa0af..906614bb 100644
--- a/pkgs/modules/python-base/default.nix
+++ b/pkgs/modules/python-base/default.nix
@@ -33,7 +33,7 @@ in
 
   replit.packages = [
     binary-wrapped-python
-    (pkgs.callPackage ../../pip { pip = pypkgs.pip; })
+    (pypkgs.callPackage ../../pip { })
     pkgs.poetry
     pkgs.uv
   ];
diff --git a/pkgs/modules/python/pip.nix b/pkgs/modules/python/pip.nix
index 7e822db3..125e42ab 100644
--- a/pkgs/modules/python/pip.nix
+++ b/pkgs/modules/python/pip.nix
@@ -1,10 +1,8 @@
 pkgs @ { pypkgs, ... }:
 
 let
-  patched-pip = pkgs.callPackage ../../pip {
-    pip = pypkgs.pip;
-  };
-  pip = patched-pip.overridePythonAttrs (old: rec {
+  upgraded-pip = pypkgs.callPackage ../../pip { };
+  pip = upgraded-pip.overridePythonAttrs (old: rec {
     outputs = [
       "out"
     ];
@@ -18,6 +16,7 @@ let
       pkgs.installShellFiles
       pypkgs.setuptools
       pypkgs.wheel
+      pypkgs.flit-core
     ];
   });
 
diff --git a/pkgs/pip/default.nix b/pkgs/pip/default.nix
index 153924e8..be78dffd 100644
--- a/pkgs/pip/default.nix
+++ b/pkgs/pip/default.nix
@@ -1,12 +1,11 @@
-{ pip, fetchurl }:
-let
-  ca-bundle = fetchurl {
-    url = "https://raw.githubusercontent.com/certifi/python-certifi/2026.10.19/certifi/cacert.pem";
-    hash = "sha256-UPefmNrBkrINv3PzXFbwsMVXqyZ/9RmdERfMEYC3B4U=";
+{ pip, fetchFromGitHub, flit-core }:
+pip.overridePythonAttrs (old: rec {
+  version = "26.2.2";
+  src = fetchFromGitHub {
+    owner = "pypa";
+    repo = "pip";
+    tag = version;
+    hash = "sha256-iH5O1kneYzoHpzbfgrJc/8gVr57CNX3/xpwel4ueNqE=";
   };
-in
-pip.overridePythonAttrs (old: {
-  postPatch = (old.postPatch or "") + ''
-    cp ${ca-bundle} src/pip/_vendor/certifi/cacert.pem
-  '';
+  nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ flit-core ];
 })