pip 25.1.1__py3-none-any.whl → 25.3__py3-none-any.whl

pip/_internal/utils/hashes.py

@@ -1,5 +1,8 @@
+from __future__ import annotations
+
 import hashlib
-from typing import TYPE_CHECKING, BinaryIO, Dict, Iterable, List, NoReturn, Optional
+from collections.abc import Iterable
+from typing import TYPE_CHECKING, BinaryIO, NoReturn
 
 from pip._internal.exceptions import HashMismatch, HashMissing, InstallationError
 from pip._internal.utils.misc import read_chunks
@@ -24,7 +27,7 @@ class Hashes:
 
     """
 
-    def __init__(self, hashes: Optional[Dict[str, List[str]]] = None) -> None:
+    def __init__(self, hashes: dict[str, list[str]] | None = None) -> None:
         """
         :param hashes: A dict of algorithm names pointing to lists of allowed
             hex digests
@@ -36,7 +39,7 @@ class Hashes:
                 allowed[alg] = [k.lower() for k in sorted(keys)]
         self._allowed = allowed
 
-    def __and__(self, other: "Hashes") -> "Hashes":
+    def __and__(self, other: Hashes) -> Hashes:
         if not isinstance(other, Hashes):
             return NotImplemented
 
@@ -86,7 +89,7 @@ class Hashes:
                 return
         self._raise(gots)
 
-    def _raise(self, gots: Dict[str, "_Hash"]) -> "NoReturn":
+    def _raise(self, gots: dict[str, _Hash]) -> NoReturn:
         raise HashMismatch(self._allowed, gots)
 
     def check_against_file(self, file: BinaryIO) -> None:
@@ -101,7 +104,7 @@ class Hashes:
         with open(path, "rb") as file:
             return self.check_against_file(file)
 
-    def has_one_of(self, hashes: Dict[str, str]) -> bool:
+    def has_one_of(self, hashes: dict[str, str]) -> bool:
         """Return whether any of the given hashes are allowed."""
         for hash_name, hex_digest in hashes.items():
             if self.is_hash_allowed(hash_name, hex_digest):
@@ -143,5 +146,5 @@ class MissingHashes(Hashes):
         # empty list, it will never match, so an error will always raise.
         super().__init__(hashes={FAVORITE_HASH: []})
 
-    def _raise(self, gots: Dict[str, "_Hash"]) -> "NoReturn":
+    def _raise(self, gots: dict[str, _Hash]) -> NoReturn:
         raise HashMissing(gots[FAVORITE_HASH].hexdigest())

pip/_internal/utils/logging.py

@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 import contextlib
 import errno
 import logging
@@ -5,10 +7,11 @@ import logging.handlers
 import os
 import sys
 import threading
+from collections.abc import Generator
 from dataclasses import dataclass
 from io import TextIOWrapper
 from logging import Filter
-from typing import Any, ClassVar, Generator, List, Optional, Type
+from typing import Any, ClassVar
 
 from pip._vendor.rich.console import (
     Console,
@@ -40,7 +43,7 @@ class BrokenStdoutLoggingError(Exception):
     """
 
 
-def _is_broken_pipe_error(exc_class: Type[BaseException], exc: BaseException) -> bool:
+def _is_broken_pipe_error(exc_class: type[BaseException], exc: BaseException) -> bool:
     if exc_class is BrokenPipeError:
         return True
 
@@ -156,7 +159,7 @@ def get_console(*, stderr: bool = False) -> Console:
 
 
 class RichPipStreamHandler(RichHandler):
-    KEYWORDS: ClassVar[Optional[List[str]]] = []
+    KEYWORDS: ClassVar[list[str] | None] = []
 
     def __init__(self, console: Console) -> None:
         super().__init__(
@@ -169,7 +172,7 @@ class RichPipStreamHandler(RichHandler):
 
     # Our custom override on Rich's logger, to make things work as we need them to.
     def emit(self, record: logging.LogRecord) -> None:
-        style: Optional[Style] = None
+        style: Style | None = None
 
         # If we are given a diagnostic error to present, present it with indentation.
         if getattr(record, "rich", False):
@@ -240,7 +243,7 @@ class ExcludeLoggerFilter(Filter):
         return not super().filter(record)
 
 
-def setup_logging(verbosity: int, no_color: bool, user_log_file: Optional[str]) -> int:
+def setup_logging(verbosity: int, no_color: bool, user_log_file: str | None) -> int:
     """Configures and sets up all of the logging
 
     Returns the requested logging level, as its integer value.

pip/_internal/utils/misc.py

@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 import errno
 import getpass
 import hashlib
@@ -9,6 +11,7 @@ import stat
 import sys
 import sysconfig
 import urllib.parse
+from collections.abc import Generator, Iterable, Iterator, Mapping, Sequence
 from dataclasses import dataclass
 from functools import partial
 from io import StringIO
@@ -19,18 +22,9 @@ from typing import (
     Any,
     BinaryIO,
     Callable,
-    Generator,
-    Iterable,
-    Iterator,
-    List,
-    Mapping,
     Optional,
-    Sequence,
     TextIO,
-    Tuple,
-    Type,
     TypeVar,
-    Union,
     cast,
 )
 
@@ -64,9 +58,9 @@ __all__ = [
 logger = logging.getLogger(__name__)
 
 T = TypeVar("T")
-ExcInfo = Tuple[Type[BaseException], BaseException, TracebackType]
-VersionInfo = Tuple[int, int, int]
-NetlocTuple = Tuple[str, Tuple[Optional[str], Optional[str]]]
+ExcInfo = tuple[type[BaseException], BaseException, TracebackType]
+VersionInfo = tuple[int, int, int]
+NetlocTuple = tuple[str, tuple[Optional[str], Optional[str]]]
 OnExc = Callable[[FunctionType, Path, BaseException], Any]
 OnErr = Callable[[FunctionType, Path, ExcInfo], Any]
 
@@ -80,7 +74,7 @@ def get_pip_version() -> str:
     return f"pip {__version__} from {pip_pkg_dir} (python {get_major_minor_version()})"
 
 
-def normalize_version_info(py_version_info: Tuple[int, ...]) -> Tuple[int, int, int]:
+def normalize_version_info(py_version_info: tuple[int, ...]) -> tuple[int, int, int]:
     """
     Convert a tuple of ints representing a Python version to one of length
     three.
@@ -123,9 +117,7 @@ def get_prog() -> str:
 
 # Retry every half second for up to 3 seconds
 @retry(stop_after_delay=3, wait=0.5)
-def rmtree(
-    dir: str, ignore_errors: bool = False, onexc: Optional[OnExc] = None
-) -> None:
+def rmtree(dir: str, ignore_errors: bool = False, onexc: OnExc | None = None) -> None:
     if ignore_errors:
         onexc = _onerror_ignore
     if onexc is None:
@@ -149,7 +141,7 @@ def _onerror_reraise(*_args: Any) -> None:
 def rmtree_errorhandler(
     func: FunctionType,
     path: Path,
-    exc_info: Union[ExcInfo, BaseException],
+    exc_info: ExcInfo | BaseException,
     *,
     onexc: OnExc = _onerror_reraise,
 ) -> None:
@@ -276,7 +268,7 @@ def format_size(bytes: float) -> str:
         return f"{int(bytes)} bytes"
 
 
-def tabulate(rows: Iterable[Iterable[Any]]) -> Tuple[List[str], List[int]]:
+def tabulate(rows: Iterable[Iterable[Any]]) -> tuple[list[str], list[int]]:
     """Return a list of formatted rows and a list of column sizes.
 
     For example::
@@ -331,7 +323,7 @@ def normalize_path(path: str, resolve_symlinks: bool = True) -> str:
     return os.path.normcase(path)
 
 
-def splitext(path: str) -> Tuple[str, str]:
+def splitext(path: str) -> tuple[str, str]:
     """Like os.path.splitext, but take off .tar too"""
     base, ext = posixpath.splitext(path)
     if base.lower().endswith(".tar"):
@@ -379,7 +371,7 @@ class StreamWrapper(StringIO):
     orig_stream: TextIO
 
     @classmethod
-    def from_stream(cls, orig_stream: TextIO) -> "StreamWrapper":
+    def from_stream(cls, orig_stream: TextIO) -> StreamWrapper:
         ret = cls()
         ret.orig_stream = orig_stream
         return ret
@@ -392,14 +384,14 @@ class StreamWrapper(StringIO):
 
 
 # Simulates an enum
-def enum(*sequential: Any, **named: Any) -> Type[Any]:
+def enum(*sequential: Any, **named: Any) -> type[Any]:
     enums = dict(zip(sequential, range(len(sequential))), **named)
     reverse = {value: key for key, value in enums.items()}
     enums["reverse_mapping"] = reverse
     return type("Enum", (), enums)
 
 
-def build_netloc(host: str, port: Optional[int]) -> str:
+def build_netloc(host: str, port: int | None) -> str:
     """
     Build a netloc from a host-port pair
     """
@@ -421,7 +413,7 @@ def build_url_from_netloc(netloc: str, scheme: str = "https") -> str:
     return f"{scheme}://{netloc}"
 
 
-def parse_netloc(netloc: str) -> Tuple[Optional[str], Optional[int]]:
+def parse_netloc(netloc: str) -> tuple[str | None, int | None]:
     """
     Return the host-port pair from a netloc.
     """
@@ -443,7 +435,7 @@ def split_auth_from_netloc(netloc: str) -> NetlocTuple:
     # behaves if more than one @ is present (which can be checked using
     # the password attribute of urlsplit()'s return value).
     auth, netloc = netloc.rsplit("@", 1)
-    pw: Optional[str] = None
+    pw: str | None = None
     if ":" in auth:
         # Split from the left because that's how urllib.parse.urlsplit()
         # behaves if more than one : is present (which again can be checked
@@ -480,8 +472,8 @@ def redact_netloc(netloc: str) -> str:
 
 
 def _transform_url(
-    url: str, transform_netloc: Callable[[str], Tuple[Any, ...]]
-) -> Tuple[str, NetlocTuple]:
+    url: str, transform_netloc: Callable[[str], tuple[Any, ...]]
+) -> tuple[str, NetlocTuple]:
     """Transform and replace netloc in a url.
 
     transform_netloc is a function taking the netloc and returning a
@@ -503,13 +495,13 @@ def _get_netloc(netloc: str) -> NetlocTuple:
     return split_auth_from_netloc(netloc)
 
 
-def _redact_netloc(netloc: str) -> Tuple[str]:
+def _redact_netloc(netloc: str) -> tuple[str]:
     return (redact_netloc(netloc),)
 
 
 def split_auth_netloc_from_url(
     url: str,
-) -> Tuple[str, str, Tuple[Optional[str], Optional[str]]]:
+) -> tuple[str, str, tuple[str | None, str | None]]:
     """
     Parse a url into separate netloc, auth, and url with no auth.
 
@@ -614,7 +606,7 @@ def is_console_interactive() -> bool:
     return sys.stdin is not None and sys.stdin.isatty()
 
 
-def hash_file(path: str, blocksize: int = 1 << 20) -> Tuple[Any, int]:
+def hash_file(path: str, blocksize: int = 1 << 20) -> tuple[Any, int]:
     """Return (hash, length) for path using hashlib.sha256()"""
 
     h = hashlib.sha256()
@@ -626,7 +618,7 @@ def hash_file(path: str, blocksize: int = 1 << 20) -> Tuple[Any, int]:
     return h, length
 
 
-def pairwise(iterable: Iterable[Any]) -> Iterator[Tuple[Any, Any]]:
+def pairwise(iterable: Iterable[Any]) -> Iterator[tuple[Any, Any]]:
     """
     Return paired elements.
 
@@ -639,7 +631,7 @@ def pairwise(iterable: Iterable[Any]) -> Iterator[Tuple[Any, Any]]:
 
 def partition(
     pred: Callable[[T], bool], iterable: Iterable[T]
-) -> Tuple[Iterable[T], Iterable[T]]:
+) -> tuple[Iterable[T], Iterable[T]]:
     """
     Use a predicate to partition entries into false entries and true entries,
     like
@@ -656,9 +648,9 @@ class ConfiguredBuildBackendHookCaller(BuildBackendHookCaller):
         config_holder: Any,
         source_dir: str,
         build_backend: str,
-        backend_path: Optional[str] = None,
-        runner: Optional[Callable[..., None]] = None,
-        python_executable: Optional[str] = None,
+        backend_path: str | None = None,
+        runner: Callable[..., None] | None = None,
+        python_executable: str | None = None,
     ):
         super().__init__(
             source_dir, build_backend, backend_path, runner, python_executable
@@ -668,8 +660,8 @@ class ConfiguredBuildBackendHookCaller(BuildBackendHookCaller):
     def build_wheel(
         self,
         wheel_directory: str,
-        config_settings: Optional[Mapping[str, Any]] = None,
-        metadata_directory: Optional[str] = None,
+        config_settings: Mapping[str, Any] | None = None,
+        metadata_directory: str | None = None,
     ) -> str:
         cs = self.config_holder.config_settings
         return super().build_wheel(
@@ -679,7 +671,7 @@ class ConfiguredBuildBackendHookCaller(BuildBackendHookCaller):
     def build_sdist(
         self,
         sdist_directory: str,
-        config_settings: Optional[Mapping[str, Any]] = None,
+        config_settings: Mapping[str, Any] | None = None,
     ) -> str:
         cs = self.config_holder.config_settings
         return super().build_sdist(sdist_directory, config_settings=cs)
@@ -687,8 +679,8 @@ class ConfiguredBuildBackendHookCaller(BuildBackendHookCaller):
     def build_editable(
         self,
         wheel_directory: str,
-        config_settings: Optional[Mapping[str, Any]] = None,
-        metadata_directory: Optional[str] = None,
+        config_settings: Mapping[str, Any] | None = None,
+        metadata_directory: str | None = None,
     ) -> str:
         cs = self.config_holder.config_settings
         return super().build_editable(
@@ -696,19 +688,19 @@ class ConfiguredBuildBackendHookCaller(BuildBackendHookCaller):
         )
 
     def get_requires_for_build_wheel(
-        self, config_settings: Optional[Mapping[str, Any]] = None
+        self, config_settings: Mapping[str, Any] | None = None
     ) -> Sequence[str]:
         cs = self.config_holder.config_settings
         return super().get_requires_for_build_wheel(config_settings=cs)
 
     def get_requires_for_build_sdist(
-        self, config_settings: Optional[Mapping[str, Any]] = None
+        self, config_settings: Mapping[str, Any] | None = None
     ) -> Sequence[str]:
         cs = self.config_holder.config_settings
         return super().get_requires_for_build_sdist(config_settings=cs)
 
     def get_requires_for_build_editable(
-        self, config_settings: Optional[Mapping[str, Any]] = None
+        self, config_settings: Mapping[str, Any] | None = None
     ) -> Sequence[str]:
         cs = self.config_holder.config_settings
         return super().get_requires_for_build_editable(config_settings=cs)
@@ -716,7 +708,7 @@ class ConfiguredBuildBackendHookCaller(BuildBackendHookCaller):
     def prepare_metadata_for_build_wheel(
         self,
         metadata_directory: str,
-        config_settings: Optional[Mapping[str, Any]] = None,
+        config_settings: Mapping[str, Any] | None = None,
         _allow_fallback: bool = True,
     ) -> str:
         cs = self.config_holder.config_settings
@@ -729,9 +721,9 @@ class ConfiguredBuildBackendHookCaller(BuildBackendHookCaller):
     def prepare_metadata_for_build_editable(
         self,
         metadata_directory: str,
-        config_settings: Optional[Mapping[str, Any]] = None,
+        config_settings: Mapping[str, Any] | None = None,
         _allow_fallback: bool = True,
-    ) -> Optional[str]:
+    ) -> str | None:
         cs = self.config_holder.config_settings
         return super().prepare_metadata_for_build_editable(
             metadata_directory=metadata_directory,

pip/_internal/utils/packaging.py

@@ -1,6 +1,7 @@
+from __future__ import annotations
+
 import functools
 import logging
-from typing import Optional, Tuple
 
 from pip._vendor.packaging import specifiers, version
 from pip._vendor.packaging.requirements import Requirement
@@ -10,7 +11,7 @@ logger = logging.getLogger(__name__)
 
 @functools.lru_cache(maxsize=32)
 def check_requires_python(
-    requires_python: Optional[str], version_info: Tuple[int, ...]
+    requires_python: str | None, version_info: tuple[int, ...]
 ) -> bool:
     """
     Check if the given Python version matches a "Requires-Python" specifier.

pip/_internal/utils/retry.py

@@ -1,11 +1,14 @@
+from __future__ import annotations
+
 import functools
 from time import perf_counter, sleep
-from typing import Callable, TypeVar
+from typing import TYPE_CHECKING, Callable, TypeVar
 
-from pip._vendor.typing_extensions import ParamSpec
+if TYPE_CHECKING:
+    from typing_extensions import ParamSpec
 
-T = TypeVar("T")
-P = ParamSpec("P")
+    T = TypeVar("T")
+    P = ParamSpec("P")
 
 
 def retry(

pip/_internal/utils/subprocess.py

@@ -1,8 +1,11 @@
+from __future__ import annotations
+
 import logging
 import os
 import shlex
 import subprocess
-from typing import Any, Callable, Iterable, List, Literal, Mapping, Optional, Union
+from collections.abc import Iterable, Mapping
+from typing import Any, Callable, Literal, Union
 
 from pip._vendor.rich.markup import escape
 
@@ -11,10 +14,10 @@ from pip._internal.exceptions import InstallationSubprocessError
 from pip._internal.utils.logging import VERBOSE, subprocess_logger
 from pip._internal.utils.misc import HiddenText
 
-CommandArgs = List[Union[str, HiddenText]]
+CommandArgs = list[Union[str, HiddenText]]
 
 
-def make_command(*args: Union[str, HiddenText, CommandArgs]) -> CommandArgs:
+def make_command(*args: str | HiddenText | CommandArgs) -> CommandArgs:
     """
     Create a CommandArgs object.
     """
@@ -31,7 +34,7 @@ def make_command(*args: Union[str, HiddenText, CommandArgs]) -> CommandArgs:
     return command_args
 
 
-def format_command_args(args: Union[List[str], CommandArgs]) -> str:
+def format_command_args(args: list[str] | CommandArgs) -> str:
     """
     Format command arguments for display.
     """
@@ -46,7 +49,7 @@ def format_command_args(args: Union[List[str], CommandArgs]) -> str:
     )
 
 
-def reveal_command_args(args: Union[List[str], CommandArgs]) -> List[str]:
+def reveal_command_args(args: list[str] | CommandArgs) -> list[str]:
     """
     Return the arguments in their raw, unredacted form.
     """
@@ -54,16 +57,16 @@ def reveal_command_args(args: Union[List[str], CommandArgs]) -> List[str]:
 
 
 def call_subprocess(
-    cmd: Union[List[str], CommandArgs],
+    cmd: list[str] | CommandArgs,
     show_stdout: bool = False,
-    cwd: Optional[str] = None,
-    on_returncode: 'Literal["raise", "warn", "ignore"]' = "raise",
-    extra_ok_returncodes: Optional[Iterable[int]] = None,
-    extra_environ: Optional[Mapping[str, Any]] = None,
-    unset_environ: Optional[Iterable[str]] = None,
-    spinner: Optional[SpinnerInterface] = None,
-    log_failed_cmd: Optional[bool] = True,
-    stdout_only: Optional[bool] = False,
+    cwd: str | None = None,
+    on_returncode: Literal["raise", "warn", "ignore"] = "raise",
+    extra_ok_returncodes: Iterable[int] | None = None,
+    extra_environ: Mapping[str, Any] | None = None,
+    unset_environ: Iterable[str] | None = None,
+    spinner: SpinnerInterface | None = None,
+    log_failed_cmd: bool | None = True,
+    stdout_only: bool | None = False,
     *,
     command_desc: str,
 ) -> str:
@@ -229,9 +232,9 @@ def runner_with_spinner_message(message: str) -> Callable[..., None]:
     """
 
     def runner(
-        cmd: List[str],
-        cwd: Optional[str] = None,
-        extra_environ: Optional[Mapping[str, Any]] = None,
+        cmd: list[str],
+        cwd: str | None = None,
+        extra_environ: Mapping[str, Any] | None = None,
     ) -> None:
         with open_spinner(message) as spinner:
             call_subprocess(

pip/_internal/utils/temp_dir.py

@@ -1,20 +1,18 @@
+from __future__ import annotations
+
 import errno
 import itertools
 import logging
 import os.path
 import tempfile
 import traceback
+from collections.abc import Generator
 from contextlib import ExitStack, contextmanager
 from pathlib import Path
 from typing import (
     Any,
     Callable,
-    Dict,
-    Generator,
-    List,
-    Optional,
     TypeVar,
-    Union,
 )
 
 from pip._internal.utils.misc import enum, rmtree
@@ -33,7 +31,7 @@ tempdir_kinds = enum(
 )
 
 
-_tempdir_manager: Optional[ExitStack] = None
+_tempdir_manager: ExitStack | None = None
 
 
 @contextmanager
@@ -51,7 +49,7 @@ class TempDirectoryTypeRegistry:
     """Manages temp directory behavior"""
 
     def __init__(self) -> None:
-        self._should_delete: Dict[str, bool] = {}
+        self._should_delete: dict[str, bool] = {}
 
     def set_delete(self, kind: str, value: bool) -> None:
         """Indicate whether a TempDirectory of the given kind should be
@@ -66,7 +64,7 @@ class TempDirectoryTypeRegistry:
         return self._should_delete.get(kind, True)
 
 
-_tempdir_registry: Optional[TempDirectoryTypeRegistry] = None
+_tempdir_registry: TempDirectoryTypeRegistry | None = None
 
 
 @contextmanager
@@ -113,8 +111,8 @@ class TempDirectory:
 
     def __init__(
         self,
-        path: Optional[str] = None,
-        delete: Union[bool, None, _Default] = _default,
+        path: str | None = None,
+        delete: bool | None | _Default = _default,
         kind: str = "temp",
         globally_managed: bool = False,
         ignore_cleanup_errors: bool = True,
@@ -184,7 +182,7 @@ class TempDirectory:
         if not os.path.exists(self._path):
             return
 
-        errors: List[BaseException] = []
+        errors: list[BaseException] = []
 
         def onerror(
             func: Callable[..., Any],
@@ -245,7 +243,7 @@ class AdjacentTempDirectory(TempDirectory):
     # with leading '-' and invalid metadata
     LEADING_CHARS = "-~.=%0123456789"
 
-    def __init__(self, original: str, delete: Optional[bool] = None) -> None:
+    def __init__(self, original: str, delete: bool | None = None) -> None:
         self.original = original.rstrip("/\\")
         super().__init__(delete=delete)
 

pip/_internal/utils/unpacking.py

@@ -1,5 +1,7 @@
 """Utilities related archives."""
 
+from __future__ import annotations
+
 import logging
 import os
 import shutil
@@ -7,7 +9,7 @@ import stat
 import sys
 import tarfile
 import zipfile
-from typing import Iterable, List, Optional
+from collections.abc import Iterable
 from zipfile import ZipInfo
 
 from pip._internal.exceptions import InstallationError
@@ -47,7 +49,7 @@ def current_umask() -> int:
     return mask
 
 
-def split_leading_dir(path: str) -> List[str]:
+def split_leading_dir(path: str) -> list[str]:
     path = path.lstrip("/").lstrip("\\")
     if "/" in path and (
         ("\\" in path and path.find("/") < path.find("\\")) or "\\" not in path
@@ -131,7 +133,7 @@ def unzip_file(filename: str, location: str, flatten: bool = True) -> None:
                     "outside target directory ({})"
                 )
                 raise InstallationError(message.format(filename, fn, location))
-            if fn.endswith("/") or fn.endswith("\\"):
+            if fn.endswith(("/", "\\")):
                 # A directory
                 ensure_dir(fn)
             else:
@@ -246,6 +248,20 @@ def untar_file(filename: str, location: str) -> None:
         tar.close()
 
 
+def is_symlink_target_in_tar(tar: tarfile.TarFile, tarinfo: tarfile.TarInfo) -> bool:
+    """Check if the file pointed to by the symbolic link is in the tar archive"""
+    linkname = os.path.join(os.path.dirname(tarinfo.name), tarinfo.linkname)
+
+    linkname = os.path.normpath(linkname)
+    linkname = linkname.replace("\\", "/")
+
+    try:
+        tar.getmember(linkname)
+        return True
+    except KeyError:
+        return False
+
+
 def _untar_without_filter(
     filename: str,
     location: str,
@@ -253,6 +269,9 @@ def _untar_without_filter(
     leading: bool,
 ) -> None:
     """Fallback for Python without tarfile.data_filter"""
+    # NOTE: This function can be removed once pip requires CPython ≥ 3.12.​
+    # PEP 706 added tarfile.data_filter, made tarfile extraction operations more secure.
+    # This feature is fully supported from CPython 3.12 onward.
     for member in tar.getmembers():
         fn = member.name
         if leading:
@@ -267,6 +286,14 @@ def _untar_without_filter(
         if member.isdir():
             ensure_dir(path)
         elif member.issym():
+            if not is_symlink_target_in_tar(tar, member):
+                message = (
+                    "The tar file ({}) has a file ({}) trying to install "
+                    "outside target directory ({})"
+                )
+                raise InstallationError(
+                    message.format(filename, member.name, member.linkname)
+                )
             try:
                 tar._extract_member(member, path)
             except Exception as exc:
@@ -307,7 +334,7 @@ def _untar_without_filter(
 def unpack_file(
     filename: str,
     location: str,
-    content_type: Optional[str] = None,
+    content_type: str | None = None,
 ) -> None:
     filename = os.path.realpath(filename)
     if (

pip/_internal/utils/urls.py

@@ -12,7 +12,7 @@ def path_to_url(path: str) -> str:
     quoted path parts.
     """
     path = os.path.normpath(os.path.abspath(path))
-    url = urllib.parse.urljoin("file:", urllib.request.pathname2url(path))
+    url = urllib.parse.urljoin("file://", urllib.request.pathname2url(path))
     return url