From 5dabed1248bb89f038eb1837dc07bbb2f335cb48 Mon Sep 17 00:00:00 2001
From: Derrick Williams <derrickaw@google.com>
Date: Tue, 9 Jun 2026 11:57:29 +0000
Subject: [PATCH] Pin pip>=26.1 in Python container and verify ensurepip bundle

---
 sdks/python/container/Dockerfile | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/sdks/python/container/Dockerfile b/sdks/python/container/Dockerfile
index b0e0b94e7086..d212a108a630 100644
--- a/sdks/python/container/Dockerfile
+++ b/sdks/python/container/Dockerfile
@@ -48,7 +48,7 @@ RUN  \
        && \
     rm -rf /var/lib/apt/lists/* && \
 
-    pip install --upgrade pip setuptools wheel && \
+    pip install --upgrade "pip>=26.1" setuptools wheel && \
 
     # Install required packages for Beam Python SDK and common dependencies used by users.
     # use --no-deps to ensure the list includes all transitive dependencies.
@@ -101,7 +101,8 @@ RUN  \
     if [ "${py_version}" = "3.10" ] || [ "${py_version}" = "3.11" ]; then \
         pip uninstall upgrade_ensurepip -y; \
     fi; \
-    python3 -m ensurepip;
+    python3 -m ensurepip && \
+    python3 -c "import ensurepip; assert list(map(int, ensurepip._PIP_VERSION.split('.'))) >= [26, 1], f'Bundled pip version {ensurepip._PIP_VERSION} is older than 26.1';"
 
 ENTRYPOINT ["/opt/apache/beam/boot"]