[rahultee]

Why

pip 26.2.2 rejects user installs when user site-packages are disabled. The module sets user=yes, but the Nix pip wrapper also sets PYTHONNOUSERSITE=true. This breaks requirements.txt installs that worked with pip 25.0.1.

What changed

• Set permitUserSite=true in the shared pip package so the wrapper no longer disables user site-packages.
• Keep pip 26.2.2 and its certifi 2026.10.19 bundle. Explicit user-site disabling and virtualenv restrictions still apply.
• Add offline regression tests to CI for legacy Python 3.10/3.11/3.12 and base Python 3.11/3.12/3.13 pip packages.

Test plan

• The regression test fails with the unmodified pip 26.2.2 wrapper and the exact user-site error; pip 25.0.1 installs successfully with the same config.
• nix build .#checks.x86_64-linux.pip-user-site --no-link passes all six package paths: empty requirements, local-wheel install/import into PYTHONUSERBASE, explicit disabled-user-site via environment/-s, and virtualenv install/user rejection.
• scripts/ci_check.sh passes, including formatting, development/deployment module evaluations, module registry, the pip regression matrix, development shell and synthetic OCI fixture checks. Shell syntax and diff checks also pass.
• Full shipped bundle build and live publishing are not run.

Rollout

Rebuild and distribute the affected Python modules. Existing bundles do not change until rebuilt and selected. No release or deployment is performed by this PR. Safe to revert, but reverting restores the install failure.

• This is fully backward and forward compatible

~ written by ⠕ Replit