Pass --disable-pip-version-check from pip.list and pip.freeze (#68214)#69431
Open
dwoz wants to merge 2 commits into
Open
Pass --disable-pip-version-check from pip.list and pip.freeze (#68214)#69431dwoz wants to merge 2 commits into
dwoz wants to merge 2 commits into
Conversation
added 2 commits
June 14, 2026 22:59
The pip CLI does an outbound HTTPS round-trip to PyPI on every invocation of `pip list` and `pip freeze` to check whether a newer pip release is available. On airgapped minions that lookup blocks until the socket timeout (~20s), which is exactly what the `pip.installed` state hits when it calls `pip.list` to see whether the package is already installed. Pass `--disable-pip-version-check` from both `pip.list` (the modern JSON-format path) and `pip.freeze` (the fallback `list_freeze_parse` path) so the listing call stays local and `pip.installed` re-checks return in milliseconds again. Fixes saltstack#68214
CI surfaced three additional argv assertions in tests/pytests/unit/modules/ test_pip.py that were not updated in the original commit: * test_is_installed_true / test_is_installed_false — these go through pip.is_installed → pip.freeze, so the expected ``freeze`` argv now needs ``--disable-pip-version-check``. * test_when_upgrade_is_called_and_there_are_available_upgrades_it_should_ call_correct_command — this one was relying on accidental list-mutation aliasing through ``_get_pip_bin``'s shared ``return_value`` list: pip. upgrade()'s ``cmd`` and the ``cmd`` constructed inside pip.list_() were the same Python list object, so ``cmd.extend(["list", "--format=json"])`` inside list_() mutated upgrade's local cmd, and the assertion ended up matching the contaminated argv by coincidence. The new ``--disable-pip-version-check`` extend lengthened the contaminated argv and broke the coincidence. Switch to ``side_effect=all_new_commands`` (same pattern already used by test_when_list_upgrades_is_provided_a_user_it_should_be_passed_to_the_ version_command on the very next test) so each _get_pip_bin call returns a fresh list, and assert against the real ``pip install -U <pkg>`` argv pip.upgrade actually constructs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Pass
--disable-pip-version-checkfrompip.listandpip.freezeso thepip CLI no longer does an outbound HTTPS round-trip to PyPI for its
"newer pip available?" self-check every time the
pip.installedstatequeries already-installed packages. On airgapped minions that self-check
blocks until the socket timeout (~20s per call), which the reporter
measured as a 21091 ms
pip.installedduration on a minion configuredwith
index_url/trusted_host/PIP_INDEX_URLenv vars.What issues does this PR fix or reference?
Fixes #68214
Previous Behavior
pip.installedre-checks took ~20s on every state run on airgappedminions because
salt.modules.pip.list_()invokedpip list --format=jsonwithout--disable-pip-version-check, and pip then blockedon its outbound version-check.
pip.freezehad the same issue along thelist_freeze_parsefallback path used on older pip versions.New Behavior
pip.listandpip.freezeboth append--disable-pip-version-checktothe underlying pip command, so the listing stays local and
pip.installedre-checks return in milliseconds again. The flag has beensupported since pip 6.0, well before the existing 8.0.3 floor in
pip.freeze, so it is safe to append unconditionally.Merge requirements satisfied?
call users never wanted from a
pip.listoperation)changelog/68214.fixed.md)assertions updated to include the new flag)
Commits signed with GPG?
No (matches recent base-branch commits — base branch is not requiring
signatures at this time)