It appears that pip is still vulnerable in the latest official docker images.
For example:
docker run --rm python:3.15-slim-trixie python -m pip --version
pip 26.2.1 from /usr/local/lib/python3.15/site-packages/pip (python 3.15)
I opened These images ship vulnerable pip · Issue #1142 · docker-library/python · GitHub about this.
In the meantime, my team is using the trixie slim images and doing:
ENV PIP_CERT=/etc/ssl/certs/ca-certificates.crt