Python 3.15.1, 3.14.9 and 3.13.17 are out

Core Development
1

Here are expedited security releases of Python 3.15 and 3.14, and a special security release of 3.13.

They all upgrade the bundled pip to version 26.2.2, which includes certifi 2026.10.19 to address the eMudhra / emSign CA certificate security incident.

We don’t normally update pip for security releases like Python 3.13 because of backward compatibility concerns, but since 3.13 only just entered security-only mode, doing a special release with installers seemed prudent.

See the Discourse announcement for more information.

For all existing virtual environments on your system, please upgrade pip and uv to the latest versions.

To upgrade pip securely within a virtualenv:

python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"

If you cannot immediately upgrade to this release, you can upgrade certificates for a Python 3.15 macOS installation and pip itself via:

/Library/Frameworks/Python.framework/Versions/3.15/bin/python3.15 -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
/Library/Frameworks/Python.framework/Versions/3.15/bin/python3.15 -m pip install --upgrade certifi
/Library/Frameworks/PythonT.framework/Versions/3.15/bin/python3.15t -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"

For 3.14:

/Library/Frameworks/Python.framework/Versions/3.14/bin/python3.14 -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
/Library/Frameworks/Python.framework/Versions/3.14/bin/python3.14 -m pip install --upgrade certifi
/Library/Frameworks/PythonT.framework/Versions/3.14/bin/python3.14t -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"

For 3.13:

/Library/Frameworks/Python.framework/Versions/3.13/bin/python3.13 -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
/Library/Frameworks/Python.framework/Versions/3.13/bin/python3.13 -m pip install --upgrade certifi
/Library/Frameworks/PythonT.framework/Versions/3.13/bin/python3.13t -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"

macOS 27.0 IDLE and tkinter

Additionally, the macOS installer for this release is built with a pre-release of Tk, fixing a possible hang on macOS 27.0 in applications using tkinter, like IDLE, in older releases.

Enjoy the new release

Thanks to all of the many volunteers who help make Python development and these releases possible! Please consider supporting our efforts by volunteering yourself or through organisation contributions to the Python Software Foundation.

Your certified release team,
Hugo van Kemenade
Thomas Wouters
Ned Deily
Steve Dower

22 Likes
Information for Python users regarding eMudhra / emSign CA certificate security incident
Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 are out
Announcement: Hatch 1.18.2 and hatchling 1.33.0
2
1 Like
3

3.11 and 3.12 are still in Security support, will updated versions for them be released also?

4

They are source-only releases, and there is no pip release that doesn’t include new features as well as the security fix.

If you are building 3.11 or 3.12 from source, and you want to upgrade the bundled pip, all you need to do is replace the pip wheel and change the pip version in ensurepip\__init__.py. Then when you build, your binary will have a fixed pip included.

2 Likes
5

FWIW, this sort of thing is one of the reasons I built pactivate to create virtual environments: while it uses any arbitrary Python interpreter, it always downloads the latest version of pip for that interpreter and the latest version of the virtualenv package, and uses those to bootstrap a virtual environment with those same versions of pip and virtualenv.

The original motivation was to transparently deal with systems that had Python itself but not pip and/or virtualenv installed (e.g., a Debian-based system with python3 installed but not python3-pip), but I guess it also helps handle security issues like this where someone’s not upgraded their Python version to one that has security fixes to bundled tools.