Merge branch 'main' into fix-extras

Author: sepehr-rs

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
           python-version: "3.x"
@@ -70,7 +70,7 @@ jobs:
         os: [ubuntu-22.04, windows-latest]
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
           python-version: "3.x"
@@ -94,7 +94,7 @@ jobs:
       github.event_name != 'pull_request'
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
           python-version: "3.x"
@@ -125,7 +125,7 @@ jobs:
           - "3.14"
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python }}
@@ -195,7 +195,7 @@ jobs:
           mkdir "D:\\Temp"
           echo "TEMP=D:\\Temp" >> $env:GITHUB_ENV
 
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python }}
@@ -236,7 +236,7 @@ jobs:
       github.event_name != 'pull_request'
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
           python-version: "3.10"

.github/workflows/release.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           persist-credentials: false
       - name: Build a binary wheel and a source tarball

.github/workflows/update-rtd-redirects.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: RTD Deploys
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
           python-version: "3.11"

docs/html/topics/https-certificates.md

@@ -17,6 +17,9 @@ allow users to specify a different certificate store/bundle for pip to use. It
 is also possible to use `REQUESTS_CA_BUNDLE` or `CURL_CA_BUNDLE` environment
 variables.
 
+If you need a specific certificate bundle, you can download the
+[Mozilla CA bundle provided by the curl project](https://curl.se/docs/caextract.html).
+
 ## Using system certificate stores
 
 ```{versionadded} 24.2

news/13660.feature.rst

@@ -0,0 +1,2 @@
+When using the ``importlib.metadata`` backend, pip skips redundant work
+converting version objects to strings and back to version objects.

src/pip/_internal/index/package_finder.py

@@ -18,7 +18,7 @@
 from pip._vendor.packaging import specifiers
 from pip._vendor.packaging.tags import Tag
 from pip._vendor.packaging.utils import NormalizedName, canonicalize_name
-from pip._vendor.packaging.version import InvalidVersion, _BaseVersion
+from pip._vendor.packaging.version import InvalidVersion, Version, _BaseVersion
 from pip._vendor.packaging.version import parse as parse_version
 
 from pip._internal.exceptions import (
@@ -28,6 +28,7 @@
     UnsupportedWheel,
 )
 from pip._internal.index.collector import LinkCollector, parse_links
+from pip._internal.metadata import select_backend
 from pip._internal.models.candidate import InstallationCandidate
 from pip._internal.models.format_control import FormatControl
 from pip._internal.models.link import Link
@@ -458,14 +459,19 @@ def get_applicable_candidates(
         allow_prereleases = self._allow_all_prereleases or None
         specifier = self._specifier
 
-        # We turn the version object into a str here because otherwise
-        # when we're debundled but setuptools isn't, Python will see
-        # packaging.version.Version and
+        # When using the pkg_resources backend we turn the version object into
+        # a str here because otherwise when we're debundled but setuptools isn't,
+        # Python will see packaging.version.Version and
         # pkg_resources._vendor.packaging.version.Version as different
         # types. This way we'll use a str as a common data interchange
         # format. If we stop using the pkg_resources provided specifier
         # and start using our own, we can drop the cast to str().
-        candidates_and_versions = [(c, str(c.version)) for c in candidates]
+        if select_backend().NAME == "pkg_resources":
+            candidates_and_versions: list[
+                tuple[InstallationCandidate, str | Version]
+            ] = [(c, str(c.version)) for c in candidates]
+        else:
+            candidates_and_versions = [(c, c.version) for c in candidates]
         versions = set(
             specifier.filter(
                 (v for _, v in candidates_and_versions),