[shaanmajid]

Upgrade the embedded pip wheel from 26.2.1 to 26.2.2 (Python 3.10+).

pip 26.2.2 vendors certifi 2026.10.19, which removes emSign ECC Root CA - G3 after eight eMudhra intermediate CA keys were compromised (disclosure). pip loads its vendored certifi on top of the system store, so a venv seeded with 26.2.1 trusts certificates from those keys when installing from PyPI.

This bump is in advance of the scheduled workflow and 7-day cooldown given the severity of the issue. I would recommend merging and releasing ASAP to mitigate any impact for downstream virtualenv consumers.

See:

• GHSA-6q48-6c7w-9gw2 and Remove emsign certifi/python-certifi#437 for upstream certifi advisory and fix
• Upgrade certifi to 2026.10.19 pip#14373 for upstream pip bump of certifi to 2026.10.19

To verify the embedded wheel is identical to PyPI's:

curl -sL https://files.pythonhosted.org/packages/py3/p/pip/pip-26.2.2-py3-none-any.whl | cmp - src/virtualenv/seed/wheels/embed/pip-26.2.2-py3-none-any.whl

Python 3.9 stays on pip 26.0.1, since 26.2.x needs 3.10.

• ran the linter to address style issues (tox -e fix)
• wrote descriptive pull request text
• ensured there are test(s) validating the fix
• added news fragment in docs/changelog folder
• updated/extended the documentation
• for changes to activation scripts, pyvenv.cfg, wheel downloads, app-data or release workflows: explained in the PR text which outside input the change handles, such as a path, a prompt or a downloaded file, and how it stops that input from running as code. See the security scope.
• ran tests on Python 3.9 and 3.15 (tox run -e 3.9,3.15)
• linked upstream issues beside any temporary interpreter overrides
• kept the PR in draft until CI passes

[shaanmajid]

The workflows to get CI green here need to be explicitly ran by a maintainer. Not sure if I should keep in draft until then or not haha

[gaborbernat]

Hey, thanks for opening this pull request. We have automation for this, which I triggered, and this is superseded by that, as that provides a more complete solution. Thank you. #3452