support newer `pip` ?

[vcunat]

It would be nice, as the current constraints result into failures like

  - pip<25.1,>=9 not satisfied by version 25.3

[snkris1]

Adding a critical security context to this issue.

The current dependency constraint of pip<25.1 also locks users into a version of pip with a known vulnerability. Here are the details:

Vulnerability found in pip version 25.0.1
   Vulnerability ID: 79883
   Affected spec: <25.2
   ADVISORY: Affected versions of the pip package are vulnerable to
   Arbitrary File Overwrite due to improper validation of symbolic link...
   CVE-2025-8869
   For more information about this vulnerability, visit
   https://data.safetycli.com/v/79883/97c

Thank you!

[KeeperFrancis]

To add to what @snkris1 said, this vulnerability has been present for about four months, according to GitHub Dependabot reports. We check weekly to see whether a new Chalice version changes these constraints so we can address the issue.