Release 23.3

[pfmoore]

We're due to do 23.3 in October. Filing this issue to track that.

@pypa/pip-committers anyone up for being RM this time?

[sbidoul]

I can take it. I will probably do the release on the first or second weekend of October.

[sbidoul]

@pradyunsg since #12300 is on a good track, let me know if you would plan to cut a packaging release in the coming week or so.

[pradyunsg]

I'm hoping to do so today, if I end up having some time after I finish my household chores. :)

[pradyunsg]

@sbidoul are there any specific PRs in the milestone that you'd like help with / want someone else to pick up over the coming days?

I can make some time to work on pip this weekend, if there's anything I can do to help out with the release. :)

[sbidoul]

@pradyunsg thanks. The main topic for now is #12300 (comment) (@uranusjr has already mentioned he might look into it). You may also want to review #11159.

I'm usually not too keen to do vendoring upgrades late in the cycle ¹. I can do it just after release though.

Other than that I'm not aware of any urgent things to add to 23.3. If there are any, let me know.

Footnotes

1. the packaging upgrade being a notable exception ↩

[uranusjr]

We may want to upgrade urllib3 just in case. See #12337.

[sbidoul]

Does our vendoring action support upgrading to a specific version? Because we want to stay with urllib3 < 2 for now.

[pfmoore]

You could probably update vendor.txt and then run vendoring sync (i.e., just nox -s vendoring with no arguments).

In fact, I just did this. You need to manually add the news fragment and commit, but it seems to work. #12343.

[Orionx86]

Is this update including remediation for CVE-2023-37920 via an up to date certifi?.

[pfmoore]

This release has certifi 2023.7.22.

[sbidoul]

I plan to release tomorrow evening, if life permits.

[sbidoul]

Release 23.3 in progress

• prepare: Release/23.3 #12353
• publish to PyPI
• update get-pip: Update to 23.3 get-pip#198
• release announcement: https://discuss.python.org/t/announcement-pip-23-3-release/36296
• CPython PR

[FlavioAmurrioCS]

Does this release include distlib 0.3.7? Been waiting on this one for a while 🥲

Context:
pypa/distlib#203
#12151
https://pypi.org/project/distlib/0.3.7/

[sbidoul]

@FlavioAmurrioCS no one had done the distlib vendoring upgrade on time before the release so that will be for 24.0 in January.

[sbidoul]

I plan to do a patch release this weekend.

[sbidoul]

Release 23.3.1 in progress

• prepare: Release/23.3.1 #12370
• publish to PyPI
• update get-pip: Update to 23.3.1 get-pip#199
• release announcement: https://discuss.python.org/t/announcement-pip-23-3-release/36296/2
• CPython PR

[edmorley]

There are a couple of possible regressions that would be good to fix in a 23.3.2 patch release:

• After uprade pip to version 23.3+ cant use hg+http with current branch #12371 (which has a fix: fix hg: parse error at 0: not a prefix: (use --rev instead -r=) #12373)
• Pip install local with extra fails dependency resolution #12372

[pradyunsg]

@sbidoul Do you plan on cutting more bugfix releases?

[sbidoul]

I do. I'm waiting on the analysis about the extras issue to conclude. I don't have enough experience with that part of the code base to be of any help in the little time I have available, unfortunately.

[notatallshaw]

Is #12392 going to get a release for 23.3 or is 23.3 done?

Funnily enough I just came across this at work today, happy to give it a test on my end and confirm on PR.

[sbidoul]

@notatallshaw I was planning to look at a last 23.3 patch release over the weekend. If you can test and confirm the fix that would be helpful.

[pfmoore]

@sbidoul Is there a reason there's no CPython PRs for the 23.3 releases?

[sbidoul]

There is a last bugfix to do, so I was waiting for that. Then life and work got in the way.
If #12392 is good to go I can do that end of this week.

[pfmoore]

What's in that release? Any security fixes? CPython 3.11.7 is being released, and there's a debate as to whether to release with pip 23.2.1 (what's there right now), 23.3.1 (contributed by a 3rd party) or wait for 23.3.2.

[pfmoore]

Looking at it, the Mercurial CVE fix had a bug in 23.3.1, which is fixed in 23.3.2. That's probably the key thing here.

[sbidoul]

I need to cherry-pick

• Fixed bug in extras handling for link requirements #12392 (if it is deemed good), to fix an issue with extras and direct urls
• fix hg: parse error at 0: not a prefix: (use --rev instead -r=) #12373 (mercurial support is broken in 23.3.1 so for that reason I would not recommend shiping it with CPython)

Sorry there is no way I can handle that before end of this week. So if urgent either someone else can do 23.3.2, or ship the latest 23.2 with CPython 3.11.7)

[pfmoore]

The CPython RM has decided to release 3.11.7 with 23.2.1. So we can simply continue with the 23.3.2 release as normal, and create a CPython PR when it's done.

[sbidoul]

Release 23.3.2 in progress

• prepare: Release/23.3.2 #12438
• publish to PyPI
• update get-pip: Update to 23.3.2 get-pip#201
• release announcement: https://discuss.python.org/t/announcement-pip-23-3-release/36296/3
• CPython PR: gh-113246: Updated bundled pip to 23.3.2 python/cpython#113249

[pradyunsg]

@sbidoul Do you plan to file a CPython PR? If not, I can create one tomorrow.

[sbidoul]

@pradyunsg I plan to do it early in the week. Just waiting a little bit to be sure nothing surprising shows up.

[hugovk]

Python 3.13.0a3 is planned for Tuesday, would be nice to have it in there, but I don't think it's essential:

https://peps.python.org/pep-0719/#schedule

The next 3.11 and 3.12 releases are in February.

[sbidoul]

The CPython PR is ready.

[sbidoul]

And with this, I'm closing the 23.3 release cycle.

[pradyunsg]

Thanks @sbidoul for doing this, and @pfmoore for landing the CPython PRs and backports!