Fix incompatibilities with pip v26.1

[sirosen]

Minimally, pip==26.1 makes tests fail under tox. Some of the issues may be active user-facing problems, and some may be internal or niche things caught by the unit tests.

Here's what I saw in my first check on python 3.14:

1. AttributeError: 'DirectUrl' object has no attribute 'info' hit when pip-sync runs with URL reqs
2. tests/test_cli_sync.py::test_python_executable_option does not call mocked run func

Steps to replicate

Update the supported version of pip in tox.ini and run tests.

[ffernand]

Some of the issues may be active user-facing problems

We're on pip 26.1 + pip-tools 7.5.3, Python 3.10, and pip-sync crashes against any venv that has a locally-installed package (i.e. anything pulled in via a file: requirement or through other means).

The only reason we found out was to deal with the CVE-2026-6357 for pip<26.1 and tried to update pip-tools for compatibility with pip 26.x

Reproduction if it's useful to anyone...

$ python -m venv /tmp/repro && /tmp/repro/bin/pip install 'pip==26.1' 'pip-tools==7.5.3'

$ mkdir -p /tmp/pkg && cat > /tmp/pkg/pyproject.toml <<'EOF'
[project]
name = "demo"
version = "0.0.1"
EOF

$ echo "file:/tmp/pkg" > /tmp/requirements.txt
$ /tmp/repro/bin/pip install -r /tmp/requirements.txt
$ /tmp/repro/bin/pip-sync /tmp/requirements.txt   # crashes

Traceback (most recent call last):
  File "/tmp/repro/bin/pip-sync", line 8, in <module>
    sys.exit(cli())
  File "/tmp/repro/lib/python3.10/site-packages/click/core.py", line 1514, in __call__
    return self.main(*args, **kwargs)
  File "/tmp/repro/lib/python3.10/site-packages/click/core.py", line 1435, in main
    rv = self.invoke(ctx)
  File "/tmp/repro/lib/python3.10/site-packages/click/core.py", line 1298, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/tmp/repro/lib/python3.10/site-packages/click/core.py", line 853, in invoke
    return callback(*args, **kwargs)
  File "/tmp/repro/lib/python3.10/site-packages/piptools/scripts/sync.py", line 132, in cli
    to_install, to_uninstall = sync.diff(merged_requirements, installed_dists)
  File "/tmp/repro/lib/python3.10/site-packages/piptools/sync.py", line 176, in diff
    key = diff_key_from_req(dist)
  File "/tmp/repro/lib/python3.10/site-packages/piptools/sync.py", line 151, in diff_key_from_req
    and isinstance(req.direct_url.info, ArchiveInfo)
AttributeError: 'DirectUrl' object has no attribute 'info'

[digitalnumeric]

Will the fix "Tolerate pip 26.1 DirectUrl ..." be released in 7.5.4 or 7.6.0 and approximately when is the release expected to occur?

[sirosen]

It will be released in v7.6.0 . We have very limited reviewer time right now, so it's been taking a long time to get the last few items merged and to decide on what makes the cut.

I can't promise a timeline, but as soon as our last 7.6.0 PR merges, I'll be preparing a release.