Release 23.3

[pfmoore]

We're due to do 23.3 in October. Filing this issue to track that.

@pypa/pip-committers anyone up for being RM this time?

[sbidoul]

I can take it. I will probably do the release on the first or second weekend of October.

[sbidoul]

@pradyunsg since #12300 is on a good track, let me know if you would plan to cut a packaging release in the coming week or so.

[pradyunsg]

I'm hoping to do so today, if I end up having some time after I finish my household chores. :)

[pradyunsg]

@sbidoul are there any specific PRs in the milestone that you'd like help with / want someone else to pick up over the coming days?

I can make some time to work on pip this weekend, if there's anything I can do to help out with the release. :)

[sbidoul]

@pradyunsg thanks. The main topic for now is #12300 (comment) (@uranusjr has already mentioned he might look into it). You may also want to review #11159.

I'm usually not too keen to do vendoring upgrades late in the cycle ¹. I can do it just after release though.

Other than that I'm not aware of any urgent things to add to 23.3. If there are any, let me know.

Footnotes

1. the packaging upgrade being a notable exception ↩

[uranusjr]

We may want to upgrade urllib3 just in case. See #12337.

[sbidoul]

Does our vendoring action support upgrading to a specific version? Because we want to stay with urllib3 < 2 for now.

[pfmoore]

You could probably update vendor.txt and then run vendoring sync (i.e., just nox -s vendoring with no arguments).

In fact, I just did this. You need to manually add the news fragment and commit, but it seems to work. #12343.

[Orionx86]

Is this update including remediation for CVE-2023-37920 via an up to date certifi?.

[pfmoore]

This release has certifi 2023.7.22.

[sbidoul]

I plan to release tomorrow evening, if life permits.