Merge branch 'main' into add-build-constraints

notatallshaw · web-flow · commit 11676b075fee · 2025-10-13T23:20:08.000-04:00
diff --git a/docs/html/cli/pip_freeze.rst b/docs/html/cli/pip_freeze.rst
@@ -23,6 +23,15 @@ Description
 
 .. pip-command-description:: freeze
 
+.. note::
+   By default, ``pip freeze`` omits bootstrap packaging tools so the output
+   focuses on your project’s dependencies. On Python **3.11 and earlier**
+   this excludes ``pip``, ``setuptools``, ``wheel`` and ``distribute``; on
+   Python **3.12 and later** only ``pip`` is excluded. Use ``--all`` to
+   include those packages when you need a complete environment snapshot.
+   ``pip freeze`` reports what is installed; it does **not** compute a
+   lockfile or a solver result.
+
 
 Options
 =======
diff --git a/docs/html/cli/pip_install.rst b/docs/html/cli/pip_install.rst
@@ -479,12 +479,11 @@ Examples
 
    .. warning::
 
-       Using this option to search for packages which are not in the main
-       repository (such as private packages) is unsafe, per a security
-       vulnerability called
-       `dependency confusion <https://azure.microsoft.com/en-us/resources/3-ways-to-mitigate-risk-using-private-package-feeds/>`_:
-       an attacker can claim the package on the public repository in a way that
-       will ensure it gets chosen over the private package.
+       Using the ``--extra-index-url`` option to search for packages which are
+       not in the main repository (for example, private packages) is unsafe.
+       This is a class of security issue known as `dependency confusion <https://azure.microsoft.com/en-us/resources/3-ways-to-mitigate-risk-using-private-package-feeds/>`_: an
+       attacker can publish a package with the same name to a public index,
+       which may then be chosen instead of your private package.
 
    .. tab:: Unix/macOS
 
diff --git a/news/certifi.vendor.rst b/news/certifi.vendor.rst
@@ -1 +1 @@
-Upgrade certifi to 2025.8.3
+Upgrade certifi to 2025.10.5
diff --git a/news/msgpack.vendor.rst b/news/msgpack.vendor.rst
@@ -0,0 +1 @@
+Upgrade msgpack to 1.1.2
diff --git a/news/platformdirs.vendor.rst b/news/platformdirs.vendor.rst
@@ -1 +1 @@
-Upgrade platformdirs to 4.4.0
+Upgrade platformdirs to 4.5.0
diff --git a/news/resolvelib.vendor.rst b/news/resolvelib.vendor.rst
@@ -0,0 +1 @@
+Upgrade resolvelib to 1.2.1
diff --git a/news/rich.vendor.rst b/news/rich.vendor.rst
@@ -0,0 +1 @@
+Upgrade rich to 14.2.0
diff --git a/news/tomli.vendor.rst b/news/tomli.vendor.rst
@@ -0,0 +1 @@
+Upgrade tomli to 2.3.0
diff --git a/src/pip/_vendor/certifi/__init__.py b/src/pip/_vendor/certifi/__init__.py
@@ -1,4 +1,4 @@
 from .core import contents, where
 
 __all__ = ["contents", "where"]
-__version__ = "2025.08.03"
+__version__ = "2025.10.05"
diff --git a/src/pip/_vendor/certifi/cacert.pem b/src/pip/_vendor/certifi/cacert.pem
@@ -4736,3 +4736,65 @@ Ao9QAwKxuDdollDruF/UKIqlIgyKhPBZLtU30WHlQnNYKoH3dtvi4k0NX/a3vgW0
 rk4N3hY9A4GzJl5LuEsAz/+MF7psYC0nhzck5npgL7XTgwSqT0N1osGDsieYK7EO
 gLrAhV5Cud+xYJHT6xh+cHiudoO+cVrQkOPKwRYlZ0rwtnu64ZzZ
 -----END CERTIFICATE-----
+
+# Issuer: CN=OISTE Server Root ECC G1 O=OISTE Foundation
+# Subject: CN=OISTE Server Root ECC G1 O=OISTE Foundation
+# Label: "OISTE Server Root ECC G1"
+# Serial: 47819833811561661340092227008453318557
+# MD5 Fingerprint: 42:a7:d2:35:ae:02:92:db:19:76:08:de:2f:05:b4:d4
+# SHA1 Fingerprint: 3b:f6:8b:09:ae:2a:92:7b:ba:e3:8d:3f:11:95:d9:e6:44:0c:45:e2
+# SHA256 Fingerprint: ee:c9:97:c0:c3:0f:21:6f:7e:3b:8b:30:7d:2b:ae:42:41:2d:75:3f:c8:21:9d:af:d1:52:0b:25:72:85:0f:49
+-----BEGIN CERTIFICATE-----
+MIICNTCCAbqgAwIBAgIQI/nD1jWvjyhLH/BU6n6XnTAKBggqhkjOPQQDAzBLMQsw
+CQYDVQQGEwJDSDEZMBcGA1UECgwQT0lTVEUgRm91bmRhdGlvbjEhMB8GA1UEAwwY
+T0lTVEUgU2VydmVyIFJvb3QgRUNDIEcxMB4XDTIzMDUzMTE0NDIyOFoXDTQ4MDUy
+NDE0NDIyN1owSzELMAkGA1UEBhMCQ0gxGTAXBgNVBAoMEE9JU1RFIEZvdW5kYXRp
+b24xITAfBgNVBAMMGE9JU1RFIFNlcnZlciBSb290IEVDQyBHMTB2MBAGByqGSM49
+AgEGBSuBBAAiA2IABBcv+hK8rBjzCvRE1nZCnrPoH7d5qVi2+GXROiFPqOujvqQy
+cvO2Ackr/XeFblPdreqqLiWStukhEaivtUwL85Zgmjvn6hp4LrQ95SjeHIC6XG4N
+2xml4z+cKrhAS93mT6NjMGEwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBQ3
+TYhlz/w9itWj8UnATgwQb0K0nDAdBgNVHQ4EFgQUN02IZc/8PYrVo/FJwE4MEG9C
+tJwwDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMDA2kAMGYCMQCpKjAd0MKfkFFR
+QD6VVCHNFmb3U2wIFjnQEnx/Yxvf4zgAOdktUyBFCxxgZzFDJe0CMQCSia7pXGKD
+YmH5LVerVrkR3SW+ak5KGoJr3M/TvEqzPNcum9v4KGm8ay3sMaE641c=
+-----END CERTIFICATE-----
+
+# Issuer: CN=OISTE Server Root RSA G1 O=OISTE Foundation
+# Subject: CN=OISTE Server Root RSA G1 O=OISTE Foundation
+# Label: " OISTE Server Root RSA G1"
+# Serial: 113845518112613905024960613408179309848
+# MD5 Fingerprint: 23:a7:9e:d4:70:b8:b9:14:57:41:8a:7e:44:59:e2:68
+# SHA1 Fingerprint: f7:00:34:25:94:88:68:31:e4:34:87:3f:70:fe:86:b3:86:9f:f0:6e
+# SHA256 Fingerprint: 9a:e3:62:32:a5:18:9f:fd:db:35:3d:fd:26:52:0c:01:53:95:d2:27:77:da:c5:9d:b5:7b:98:c0:89:a6:51:e6
+-----BEGIN CERTIFICATE-----
+MIIFgzCCA2ugAwIBAgIQVaXZZ5Qoxu0M+ifdWwFNGDANBgkqhkiG9w0BAQwFADBL
+MQswCQYDVQQGEwJDSDEZMBcGA1UECgwQT0lTVEUgRm91bmRhdGlvbjEhMB8GA1UE
+AwwYT0lTVEUgU2VydmVyIFJvb3QgUlNBIEcxMB4XDTIzMDUzMTE0MzcxNloXDTQ4
+MDUyNDE0MzcxNVowSzELMAkGA1UEBhMCQ0gxGTAXBgNVBAoMEE9JU1RFIEZvdW5k
+YXRpb24xITAfBgNVBAMMGE9JU1RFIFNlcnZlciBSb290IFJTQSBHMTCCAiIwDQYJ
+KoZIhvcNAQEBBQADggIPADCCAgoCggIBAKqu9KuCz/vlNwvn1ZatkOhLKdxVYOPM
+vLO8LZK55KN68YG0nnJyQ98/qwsmtO57Gmn7KNByXEptaZnwYx4M0rH/1ow00O7b
+rEi56rAUjtgHqSSY3ekJvqgiG1k50SeH3BzN+Puz6+mTeO0Pzjd8JnduodgsIUzk
+ik/HEzxux9UTl7Ko2yRpg1bTacuCErudG/L4NPKYKyqOBGf244ehHa1uzjZ0Dl4z
+O8vbUZeUapU8zhhabkvG/AePLhq5SvdkNCncpo1Q4Y2LS+VIG24ugBA/5J8bZT8R
+tOpXaZ+0AOuFJJkk9SGdl6r7NH8CaxWQrbueWhl/pIzY+m0o/DjH40ytas7ZTpOS
+jswMZ78LS5bOZmdTaMsXEY5Z96ycG7mOaES3GK/m5Q9l3JUJsJMStR8+lKXHiHUh
+sd4JJCpM4rzsTGdHwimIuQq6+cF0zowYJmXa92/GjHtoXAvuY8BeS/FOzJ8vD+Ho
+mnqT8eDI278n5mUpezbgMxVz8p1rhAhoKzYHKyfMeNhqhw5HdPSqoBNdZH702xSu
++zrkL8Fl47l6QGzwBrd7KJvX4V84c5Ss2XCTLdyEr0YconosP4EmQufU2MVshGYR
+i3drVByjtdgQ8K4p92cIiBdcuJd5z+orKu5YM+Vt6SmqZQENghPsJQtdLEByFSnT
+kCz3GkPVavBpAgMBAAGjYzBhMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAU
+8snBDw1jALvsRQ5KH7WxszbNDo0wHQYDVR0OBBYEFPLJwQ8NYwC77EUOSh+1sbM2
+zQ6NMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQwFAAOCAgEANGd5sjrG5T33
+I3K5Ce+SrScfoE4KsvXaFwyihdJ+klH9FWXXXGtkFu6KRcoMQzZENdl//nk6HOjG
+5D1rd9QhEOP28yBOqb6J8xycqd+8MDoX0TJD0KqKchxRKEzdNsjkLWd9kYccnbz8
+qyiWXmFcuCIzGEgWUOrKL+mlSdx/PKQZvDatkuK59EvV6wit53j+F8Bdh3foZ3dP
+AGav9LEDOr4SfEE15fSmG0eLy3n31r8Xbk5l8PjaV8GUgeV6Vg27Rn9vkf195hfk
+gSe7BYhW3SCl95gtkRlpMV+bMPKZrXJAlszYd2abtNUOshD+FKrDgHGdPY3ofRRs
+YWSGRqbXVMW215AWRqWFyp464+YTFrYVI8ypKVL9AMb2kI5Wj4kI3Zaq5tNqqYY1
+9tVFeEJKRvwDyF7YZvZFZSS0vod7VSCd9521Kvy5YhnLbDuv0204bKt7ph6N/Ome
+/msVuduCmsuY33OhkKCgxeDoAaijFJzIwZqsFVAzje18KotzlUBDJvyBpCpfOZC3
+J8tRd/iWkx7P8nd9H0aTolkelUTFLXVksNb54Dxp6gS1HAviRkRNQzuXSXERvSS2
+wq1yVAb+axj5d9spLFKebXd7Yv0PTY6YMjAwcRLWJTXjn/hvnLXrahut6hDTlhZy
+BiElxky8j3C7DOReIoMt0r7+hVu05L0=
+-----END CERTIFICATE-----
diff --git a/src/pip/_vendor/msgpack/__init__.py b/src/pip/_vendor/msgpack/__init__.py
@@ -4,8 +4,8 @@
 from .exceptions import *  # noqa: F403
 from .ext import ExtType, Timestamp
 
-version = (1, 1, 1)
-__version__ = "1.1.1"
+version = (1, 1, 2)
+__version__ = "1.1.2"
 
 
 if os.environ.get("MSGPACK_PUREPYTHON"):
diff --git a/src/pip/_vendor/platformdirs/version.py b/src/pip/_vendor/platformdirs/version.py
@@ -28,7 +28,7 @@
 commit_id: COMMIT_ID
 __commit_id__: COMMIT_ID
 
-__version__ = version = '4.4.0'
-__version_tuple__ = version_tuple = (4, 4, 0)
+__version__ = version = '4.5.0'
+__version_tuple__ = version_tuple = (4, 5, 0)
 
 __commit_id__ = commit_id = None
diff --git a/src/pip/_vendor/resolvelib/__init__.py b/src/pip/_vendor/resolvelib/__init__.py
@@ -11,7 +11,7 @@
     "__version__",
 ]
 
-__version__ = "1.2.0"
+__version__ = "1.2.1"
 
 
 from .providers import AbstractProvider
diff --git a/src/pip/_vendor/resolvelib/resolvers/abstract.py b/src/pip/_vendor/resolvelib/resolvers/abstract.py
@@ -1,7 +1,7 @@
 from __future__ import annotations
 
 import collections
-from typing import TYPE_CHECKING, Any, Generic, Iterable, Mapping, NamedTuple
+from typing import TYPE_CHECKING, Any, Generic, Iterable, NamedTuple
 
 from ..structs import CT, KT, RT, DirectedGraph
 
@@ -11,9 +11,9 @@
     from .criterion import Criterion
 
     class Result(NamedTuple, Generic[RT, CT, KT]):
-        mapping: Mapping[KT, CT]
+        mapping: dict[KT, CT]
         graph: DirectedGraph[KT | None]
-        criteria: Mapping[KT, Criterion[RT, CT]]
+        criteria: dict[KT, Criterion[RT, CT]]
 
 else:
     Result = collections.namedtuple("Result", ["mapping", "graph", "criteria"])
diff --git a/src/pip/_vendor/resolvelib/resolvers/resolution.py b/src/pip/_vendor/resolvelib/resolvers/resolution.py
@@ -384,6 +384,11 @@ def _backjump(self, causes: list[RequirementInformation[RT, CT]]) -> bool:
                 if not broken_state.mapping:
                     break
 
+                # Guard: We need at least two state to remain to both
+                # backtrack and push a new state
+                if len(self._states) <= 1:
+                    raise ResolutionImpossible(causes)
+
             incompatibilities_from_broken = [
                 (k, list(v.incompatibilities)) for k, v in broken_state.criteria.items()
             ]
diff --git a/src/pip/_vendor/rich/style.py b/src/pip/_vendor/rich/style.py
@@ -1,6 +1,7 @@
 import sys
 from functools import lru_cache
-from marshal import dumps, loads
+from operator import attrgetter
+from pickle import dumps, loads
 from random import randint
 from typing import Any, Dict, Iterable, List, Optional, Type, Union, cast
 
@@ -9,6 +10,10 @@
 from .repr import Result, rich_repr
 from .terminal_theme import DEFAULT_TERMINAL_THEME, TerminalTheme
 
+_hash_getter = attrgetter(
+    "_color", "_bgcolor", "_attributes", "_set_attributes", "_link", "_meta"
+)
+
 # Style instances and style definitions are often interchangeable
 StyleType = Union[str, "Style"]
 
@@ -432,16 +437,7 @@ def __ne__(self, other: Any) -> bool:
     def __hash__(self) -> int:
         if self._hash is not None:
             return self._hash
-        self._hash = hash(
-            (
-                self._color,
-                self._bgcolor,
-                self._attributes,
-                self._set_attributes,
-                self._link,
-                self._meta,
-            )
-        )
+        self._hash = hash(_hash_getter(self))
         return self._hash
 
     @property
diff --git a/src/pip/_vendor/tomli/LICENSE-HEADER b/src/pip/_vendor/tomli/LICENSE-HEADER
diff --git a/src/pip/_vendor/tomli/__init__.py b/src/pip/_vendor/tomli/__init__.py
@@ -3,6 +3,6 @@
 # Licensed to PSF under a Contributor Agreement.
 
 __all__ = ("loads", "load", "TOMLDecodeError")
-__version__ = "2.2.1"  # DO NOT EDIT THIS LINE MANUALLY. LET bump2version UTILITY DO IT
+__version__ = "2.3.0"  # DO NOT EDIT THIS LINE MANUALLY. LET bump2version UTILITY DO IT
 
 from ._parser import TOMLDecodeError, load, loads
diff --git a/src/pip/_vendor/tomli/_parser.py b/src/pip/_vendor/tomli/_parser.py
@@ -4,12 +4,8 @@
 
 from __future__ import annotations
 
-from collections.abc import Iterable
-import string
 import sys
 from types import MappingProxyType
-from typing import IO, Any, Final, NamedTuple
-import warnings
 
 from ._re import (
     RE_DATETIME,
@@ -19,7 +15,13 @@
     match_to_localtime,
     match_to_number,
 )
-from ._types import Key, ParseFloat, Pos
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from collections.abc import Iterable
+    from typing import IO, Any, Final
+
+    from ._types import Key, ParseFloat, Pos
 
 # Inline tables/arrays are implemented using recursion. Pathologically
 # nested documents cause pure Python to raise RecursionError (which is OK),
@@ -46,19 +48,21 @@
 
 TOML_WS: Final = frozenset(" \t")
 TOML_WS_AND_NEWLINE: Final = TOML_WS | frozenset("\n")
-BARE_KEY_CHARS: Final = frozenset(string.ascii_letters + string.digits + "-_")
+BARE_KEY_CHARS: Final = frozenset(
+    "abcdefghijklmnopqrstuvwxyz" "ABCDEFGHIJKLMNOPQRSTUVWXYZ" "0123456789" "-_"
+)
 KEY_INITIAL_CHARS: Final = BARE_KEY_CHARS | frozenset("\"'")
-HEXDIGIT_CHARS: Final = frozenset(string.hexdigits)
+HEXDIGIT_CHARS: Final = frozenset("abcdef" "ABCDEF" "0123456789")
 
 BASIC_STR_ESCAPE_REPLACEMENTS: Final = MappingProxyType(
     {
         "\\b": "\u0008",  # backspace
         "\\t": "\u0009",  # tab
-        "\\n": "\u000A",  # linefeed
-        "\\f": "\u000C",  # form feed
-        "\\r": "\u000D",  # carriage return
+        "\\n": "\u000a",  # linefeed
+        "\\f": "\u000c",  # form feed
+        "\\r": "\u000d",  # carriage return
         '\\"': "\u0022",  # quote
-        "\\\\": "\u005C",  # backslash
+        "\\\\": "\u005c",  # backslash
     }
 )
 
@@ -92,6 +96,8 @@ def __init__(
             or not isinstance(doc, str)
             or not isinstance(pos, int)
         ):
+            import warnings
+
             warnings.warn(
                 "Free-form arguments for TOMLDecodeError are deprecated. "
                 "Please set 'msg' (str), 'doc' (str) and 'pos' (int) arguments only.",
@@ -151,7 +157,7 @@ def loads(__s: str, *, parse_float: ParseFloat = float) -> dict[str, Any]:  # no
             f"Expected str object, not '{type(__s).__qualname__}'"
         ) from None
     pos = 0
-    out = Output(NestedDict(), Flags())
+    out = Output()
     header: Key = ()
     parse_float = make_safe_parse_float(parse_float)
 
@@ -220,7 +226,7 @@ class Flags:
     EXPLICIT_NEST: Final = 1
 
     def __init__(self) -> None:
-        self._flags: dict[str, dict] = {}
+        self._flags: dict[str, dict[Any, Any]] = {}
         self._pending_flags: set[tuple[Key, int]] = set()
 
     def add_pending(self, key: Key, flag: int) -> None:
@@ -278,7 +284,7 @@ def get_or_create_nest(
         key: Key,
         *,
         access_lists: bool = True,
-    ) -> dict:
+    ) -> dict[str, Any]:
         cont: Any = self.dict
         for k in key:
             if k not in cont:
@@ -288,7 +294,7 @@ def get_or_create_nest(
                 cont = cont[-1]
             if not isinstance(cont, dict):
                 raise KeyError("There is no nest behind this key")
-        return cont
+        return cont  # type: ignore[no-any-return]
 
     def append_nest_to_list(self, key: Key) -> None:
         cont = self.get_or_create_nest(key[:-1])
@@ -302,9 +308,10 @@ def append_nest_to_list(self, key: Key) -> None:
             cont[last_key] = [{}]
 
 
-class Output(NamedTuple):
-    data: NestedDict
-    flags: Flags
+class Output:
+    def __init__(self) -> None:
+        self.data = NestedDict()
+        self.flags = Flags()
 
 
 def skip_chars(src: str, pos: Pos, chars: Iterable[str]) -> Pos:
@@ -493,9 +500,9 @@ def parse_one_line_basic_str(src: str, pos: Pos) -> tuple[Pos, str]:
 
 def parse_array(
     src: str, pos: Pos, parse_float: ParseFloat, nest_lvl: int
-) -> tuple[Pos, list]:
+) -> tuple[Pos, list[Any]]:
     pos += 1
-    array: list = []
+    array: list[Any] = []
 
     pos = skip_comments_and_array_ws(src, pos)
     if src.startswith("]", pos):
@@ -519,7 +526,7 @@ def parse_array(
 
 def parse_inline_table(
     src: str, pos: Pos, parse_float: ParseFloat, nest_lvl: int
-) -> tuple[Pos, dict]:
+) -> tuple[Pos, dict[str, Any]]:
     pos += 1
     nested_dict = NestedDict()
     flags = Flags()
diff --git a/src/pip/_vendor/tomli/_re.py b/src/pip/_vendor/tomli/_re.py
diff --git a/src/pip/_vendor/vendor.txt b/src/pip/_vendor/vendor.txt

Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-Upgrade certifi to 2025.8.3`
	`1`	`+Upgrade certifi to 2025.10.5`
Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-Upgrade platformdirs to 4.4.0`
	`1`	`+Upgrade platformdirs to 4.5.0`