[dependabot]

Bumps the pip group with 1 update: pip.

Updates pip from 26.2.2 to 26.3

Changelog

Sourced from pip's changelog.

26.3 (2026-11-02)

Improved Documentation

• Clarify in the security policy that pip has never considered installing untrusted wheels safe. This is because Python's import system is dynamic, so pip cannot guarantee that installing a wheel will not execute third-party code. ([#14412](https://github.com/pypa/pip/issues/14412) <https://github.com/pypa/pip/issues/14412>_)

Deprecations and Removals

• Block unexpected imports during installation, warn about unsafe imports afterward, and improve recovery from interrupted installations. ([#13842](https://github.com/pypa/pip/issues/13842) <https://github.com/pypa/pip/issues/13842>_)

Features

• Show build backend warnings for local source directories and log them at debug level for other sources. ([#14372](https://github.com/pypa/pip/issues/14372) <https://github.com/pypa/pip/issues/14372>_)
• Add support for selecting extras in pylock.toml files with -r pylock.toml[extra1,extra2]. ([#14205](https://github.com/pypa/pip/issues/14205) <https://github.com/pypa/pip/issues/14205>_)
• Allow --group to select non-default groups from local pylock files, e.g. --group pylock.toml:docs. ([#14390](https://github.com/pypa/pip/issues/14390) <https://github.com/pypa/pip/issues/14390>_)
• Support --no-binary with -r pylock.toml. Before, pip would get the sdist from the index instead of the locked URL, or fail if no wheel were available in the lock file. ([#14187](https://github.com/pypa/pip/issues/14187) <https://github.com/pypa/pip/issues/14187>_)
• Speed up installing a wheel with console scripts by not resolving every PATH entry. ([#14235](https://github.com/pypa/pip/issues/14235) <https://github.com/pypa/pip/issues/14235>_)
• Clarify the warning for ~-prefixed leftover distribution directories. ([#11849](https://github.com/pypa/pip/issues/11849) <https://github.com/pypa/pip/issues/11849>_)

Bug Fixes

• Report build-backend import failures as pip errors instead of displaying an uncaught traceback. ([#12248](https://github.com/pypa/pip/issues/12248) <https://github.com/pypa/pip/issues/12248>_)
• No longer log the "pip is looking at multiple versions of a package" message until pip has looked at at least two versions of that package. ([#12928](https://github.com/pypa/pip/issues/12928) <https://github.com/pypa/pip/issues/12928>_)
• Fix pip's self version check reporting an outdated version from the environment instead of the running pip when run as a zipapp. ([#13084](https://github.com/pypa/pip/issues/13084) <https://github.com/pypa/pip/issues/13084>_)
• Fix a fatal error when using the PIP_CONFIG_FILE environment variable with pip config set. ([#13279](https://github.com/pypa/pip/issues/13279) <https://github.com/pypa/pip/issues/13279>_)
• Avoid misleading error messages that include extra markers such as ; extra == "..." when installing packages. ([#13618](https://github.com/pypa/pip/issues/13618) <https://github.com/pypa/pip/issues/13618>_)
• When installing to a custom --prefix, use the posix_prefix scheme when running from a Debian patched Python distribution to avoid a superfluous /local/ subdirectory. ([#13634](https://github.com/pypa/pip/issues/13634) <https://github.com/pypa/pip/issues/13634>_)
• Refuse to follow an HTTP redirect to a file: URL. ([#14171](https://github.com/pypa/pip/issues/14171) <https://github.com/pypa/pip/issues/14171>_)
• Prevent wheel cache origin mismatch warnings from exposing URL credentials. ([#14232](https://github.com/pypa/pip/issues/14232) <https://github.com/pypa/pip/issues/14232>_)
• Report the incomplete-download error on Windows, not a PermissionError. ([#14237](https://github.com/pypa/pip/issues/14237) <https://github.com/pypa/pip/issues/14237>_)
• Fix the global configuration location on macOS in virtual environments created from Homebrew Python. ([#14303](https://github.com/pypa/pip/issues/14303) <https://github.com/pypa/pip/issues/14303>_)
• Reject extra arguments to pip config edit instead of silently ignoring them. ([#14347](https://github.com/pypa/pip/issues/14347) <https://github.com/pypa/pip/issues/14347>_)
• Honor supplied hashes when using --no-require-hashes. ([#14355](https://github.com/pypa/pip/issues/14355) <https://github.com/pypa/pip/issues/14355>_)

... (truncated)

Commits

• 191854f Bump for release
• 063058b Update AUTHORS.txt
• d1a81c8 Merge pull request #14233 from carrerasdarren-cell/fix/cache-origin-redact-auth
• 942a415 Merge pull request #14423 from notatallshaw/fix/pkg-resources-deadline-20261102
• f424f1a Merge pull request #14424 from notatallshaw/vendor/msgpack-1.2.4-20261102
• 720a89a Merge branch 'main' into fix/cache-origin-redact-auth
• 8e3414c Merge pull request #14247 from notatallshaw/enforce-import-block
• 5156e03 Upgrade msgpack to 1.2.4
• 95e2e6b Merge branch 'main' into enforce-import-block
• 3859fd1 Defer pkg_resources metadata errors until pip 27.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions