Update the bundled version of pip to 23.3.1

[schribl]

Feature or enhancement

Proposal:

Update the bundled pip in ensurepip to the latest version of pip (23.3.1).

This ensures that users who install newest release of Python get the newest version of pip. Also the latest pip version includes a couple of security improvements, fix of CVE-2023-5752 and updated urllib3.

Has this already been discussed elsewhere?

This is a minor feature, which does not need previous discussion elsewhere

Links to previous discussion of this feature:

No response

Linked PRs

• gh-112516: Update bundled pip version to 23.3.1 #112517
• [3.12] gh-112516: Update bundled pip version to 23.3.1 (gh-112517) #112718
• [3.11] gh-112516: Update bundled pip version to 23.3.1 (gh-112517) #112719

[schribl]

@pfmoore Sorry to ping you on this closed issue, but as mentioned here and in #112710 the update of pip is also fixing at least one security issue in the urllib3 vendored by pip. So is this something that should be considered to also be backported to the Python versions in security maintenance mode?

[pfmoore]

When 23.3.2 is released it will be included in ensurepip and backported according to the normal rules. We don't backport to distributions in security maintenance (source distribution only) mode, though.