Bump pip from 24.3.1 to 25.0.1 in /.github/workflows

[dependabot]

Bumps pip from 24.3.1 to 25.0.1.

Changelog

Sourced from pip's changelog.

25.0.1 (2025-02-09)

Bug Fixes

• Fix an unsupported type annotation on Python 3.10 and earlier. ([#13181](https://github.com/pypa/pip/issues/13181) <https://github.com/pypa/pip/issues/13181>_)
• Fix a regression where truststore would never be used while installing build dependencies. ([#13186](https://github.com/pypa/pip/issues/13186) <https://github.com/pypa/pip/issues/13186>_)

25.0 (2025-01-26)

Deprecations and Removals

• Deprecate the no-python-version-warning flag as it has long done nothing since Python 2 support was removed in pip 21.0. ([#13154](https://github.com/pypa/pip/issues/13154) <https://github.com/pypa/pip/issues/13154>_)

Features

• Prefer to display :pep:639 License-Expression in pip show if metadata version is at least 2.4. ([#13112](https://github.com/pypa/pip/issues/13112) <https://github.com/pypa/pip/issues/13112>_)
• Support :pep:639 License-Expression and License-File metadata fields in JSON output. pip inspect and pip install --report now emit license_expression and license_file fields in the metadata object, if the corresponding fields are present in the installed METADATA file. ([#13134](https://github.com/pypa/pip/issues/13134) <https://github.com/pypa/pip/issues/13134>_)
• Files in the network cache will inherit the read/write permissions of pip's cache directory (in addition to the current user retaining read/write access). This enables a single cache to be shared among multiple users. ([#11012](https://github.com/pypa/pip/issues/11012) <https://github.com/pypa/pip/issues/11012>_)
• Return the size, along with the number, of files cleared on pip cache purge and pip cache remove ([#12176](https://github.com/pypa/pip/issues/12176) <https://github.com/pypa/pip/issues/12176>_)
• Cache python-requires checks while filtering potential installation candidates. ([#13128](https://github.com/pypa/pip/issues/13128) <https://github.com/pypa/pip/issues/13128>_)
• Optimize package collection by avoiding unnecessary URL parsing and other processing. ([#13132](https://github.com/pypa/pip/issues/13132) <https://github.com/pypa/pip/issues/13132>_)

Bug Fixes

• Reorder the encoding detection when decoding a requirements file, relying on UTF-8 over the locale encoding by default, matching the documented behaviour. ([#12771](https://github.com/pypa/pip/issues/12771) <https://github.com/pypa/pip/issues/12771>_)
• The pip version self check is disabled on EXTERNALLY-MANAGED environments. ([#11820](https://github.com/pypa/pip/issues/11820) <https://github.com/pypa/pip/issues/11820>_)
• Fix a security bug allowing a specially crafted wheel to execute code during installation. ([#13079](https://github.com/pypa/pip/issues/13079) <https://github.com/pypa/pip/issues/13079>_)
• The inclusion of packaging 24.2 changes how pre-release specifiers with < and > behave. Including a pre-release version with these specifiers now implies accepting pre-releases (e.g., <2.0dev can include 1.0rc1). To avoid implying pre-releases, avoid specifying them (e.g., use <2.0). The exception is !=, which never implies pre-releases. ([#13163](https://github.com/pypa/pip/issues/13163) <https://github.com/pypa/pip/issues/13163>_)
• The --cert and --client-cert command-line options are now respected while installing build dependencies. Consequently, the private _PIP_STANDALONE_CERT environment variable is no longer used. ([#5502](https://github.com/pypa/pip/issues/5502) <https://github.com/pypa/pip/issues/5502>_)

... (truncated)

Commits

• bc7c88c Bump for release
• ebd0a52 Don't pass --cert to build subprocesses unless also given on CLI
• aea8629 Fix locate_file() type hints for older Pythons
• e612988 Add build-project.py compatibility note
• 202344e Update the release process docs
• dc696c2 Patch out EXTERNALLY-MANAGED for self-check tests (#13179)
• f47b587 Bump for release
• 74a7f33 Update AUTHORS.txt
• a008888 Merge pull request #13171 from pypa/dependabot/github_actions/github-actions-...
• d265fb7 Merge pull request #13174 from ichard26/changelog
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)