And strictly speaking you cannot trust the pip upgrade of pip with the vulnerable cert in the trust store due to certifi, which you also cannot upgrade safely with pip for the same reason. All of these are at one out of two compromises from being MITM'd during the upgrade.

So strictly we have to burn everything python to the ground and reinstall entirely.

~~Recent versions of pip use `truststore` by default to access the system's certificates, only relying on the vendored `certifi` as a fallback or if explicitly directed.~~

The above is incorrect per the Python forum discussion (https://discuss.python.org/t/information-for-python-users-re...). Pip will trust certificates from both sources.

Users of uv who have already updated their system certificates can use:

  UV_SYSTEM_CERTS=true uv self update

Python certificate handling is a hot mess, even by Python standards.