Upgrade truststore to 0.10.4 (#13544)

Author: sethmlarson

news/truststore.vendor.rst

@@ -1 +1 @@
-Upgrade truststore to 0.10.3
+Upgrade truststore to 0.10.4

src/pip/_vendor/truststore/__init__.py

@@ -33,4 +33,4 @@
 del _api, _sys  # type: ignore[name-defined] # noqa: F821
 
 __all__ = ["SSLContext", "inject_into_ssl", "extract_from_ssl"]
-__version__ = "0.10.3"
+__version__ = "0.10.4"

src/pip/_vendor/truststore/_api.py

@@ -1,8 +1,10 @@
+import contextlib
 import os
 import platform
 import socket
 import ssl
 import sys
+import threading
 import typing
 
 import _ssl
@@ -84,6 +86,7 @@ def __class__(self) -> type:
 
     def __init__(self, protocol: int = None) -> None:  # type: ignore[assignment]
         self._ctx = _original_SSLContext(protocol)
+        self._ctx_lock = threading.Lock()
 
         class TruststoreSSLObject(ssl.SSLObject):
             # This object exists because wrap_bio() doesn't
@@ -106,10 +109,15 @@ def wrap_socket(
         server_hostname: str | None = None,
         session: ssl.SSLSession | None = None,
     ) -> ssl.SSLSocket:
-        # Use a context manager here because the
-        # inner SSLContext holds on to our state
-        # but also does the actual handshake.
-        with _configure_context(self._ctx):
+
+        # We need to lock around the .__enter__()
+        # but we don't need to lock within the
+        # context manager, so we need to expand the
+        # syntactic sugar of the `with` statement.
+        with contextlib.ExitStack() as stack:
+            with self._ctx_lock:
+                stack.enter_context(_configure_context(self._ctx))
+
             ssl_sock = self._ctx.wrap_socket(
                 sock,
                 server_side=server_side,

src/pip/_vendor/vendor.txt

@@ -15,5 +15,5 @@ resolvelib==1.2.0
 setuptools==70.3.0
 tomli==2.2.1
 tomli-w==1.2.0
-truststore==0.10.3
+truststore==0.10.4
 dependency-groups==1.3.1