Possible fix(deps): pip 25.0.1 → 26.1.2 (CVE-2026-8643) in uv.lock

[begininvoke]

This might be a false positive, but uv.lock around line 1 looked worth a second pair of eyes.

CVE-2026-8643 is a path traversal vulnerability in pip where console_scripts and gui_scripts are written without validating that the resolved absolute path remains within the intended installation directory. An attacker who can influence package metadata or source repositories can craft entry points using relative path sequences (e.g., ../../), causing executable scripts to be deposited in arbitrary filesystem locations. Impact includes arbitrary code execution, privilege escalation, or system persistence if these malicious scripts overwrite legitimate binaries and are later executed. Risk Level: MEDIUM.

Something like this might fix it:

# Update pip version constraint in your dependency manifest (e.g., pyproject.toml or requirements.txt)
--- a/requirements.txt
+++ b/requirements.txt
@@ -1 +1 @@
-pip==25.0.1
+pip==26.1.2

# Regenerate the lockfile to apply the fix
$ uv lock

For reference: rule CVE-2026-8643. Rated high.

If I have misread how this is used, sorry for the noise — feel free to close.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.