In my opinion, yes, all 4 major releases each year, starting with whatever was released with python 3.11 on 2022-10-24, going to whatever was released with 3.13 on 2024-10-07. That’s a total of 8 new releases that would need to be cut, with the only required change being a version bump on certifi. You shouldn’t need to handle the ones in 2025 or 2026, as the newer python builds have had newer versions of pip bundled with them.
The standing reason, by the Python core dev team, for CPython to vendor pip at all has been to allow users to bootstrap in to the Python packaging ecosystem, not necessarily to provide an end solution. Builders and users can still securely bootstrap to latest pip. And perhaps if that’s too problematic then CPython should stop distributing pip for security releases and leave it up to the builders to choose which version of pip (if at all) they want to include?
I agree, perhaps CPython should either adopt pip as a first-party project or drop it entirely from the bundle.
The part that I find surprising and confusing is that there is a Python security release lifecycle document which does not actually cover critical security bugs in software shipped alongside Python. Perhaps that could just be called out more clearly, with language like “While a given Python branch is maintained for 5 years from its release date, the associated vendored version of pip is not subject to security releases, so users are encouraged to safely upgrade pip before attempting to use older Python releases”.
Take this with a grain of salt - I’ve been a professional Python programmer for more than a decade but I’ve never contributed to the project. I know many key core open source projects are strapped for time and money these days. I don’t mean to minimize the effort or work that goes into CPython and pip.
I just find it hard to handle the idea that I could use a release of Python that is within security support, downloaded from python.org, and get pwned by some skid running a proxy in front of pypi that they vibe coded in 15 minutes as soon as I ran pip install --upgrade pip.
Edit: To be fair, I think you only actually need to make a new version of pip 24.0 (used in Python 3.11) and pip 25.0 (used in Python 3.12). I see that ensurepip for Python 3.11.17 bundles 24.0 while ensurepip for Python 3.12.15 bundles 25.0.1. I’m not sure who is asking for other versions, but those are the ones that would affect my use case.