Explicitly disable pip version checks when bootstrapping pip (#470)

These are currently implicitly disabled due to a pip implementation
detail, where it doesn't check for updates unless it finds that it is
installed in the current environment.

However, it's clearer if we disable them explicitly (and it also saves
pip from having to query the list of currently installed packages).

See:
https://pip.pypa.io/en/stable/cli/pip/#cmdoption-disable-pip-version-check

GUS-W-20289843.

Author: edmorley

CHANGELOG.md

@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Deprecated support for Python 3.10. ([#467](https://github.com/heroku/buildpacks-python/pull/467))
 - Updated uv from 0.9.9 to 0.9.11. ([#468](https://github.com/heroku/buildpacks-python/pull/468))
+- Explicitly disabled pip version checks when bootstrapping pip. ([#470](https://github.com/heroku/buildpacks-python/pull/470))
 - Unpinned Poetry's `dulwich` version, since the upstream incompatibility with older Python has been fixed. ([#464](https://github.com/heroku/buildpacks-python/pull/464))
 
 ## [2.7.4] - 2025-11-14

src/layers/pip.rs

@@ -94,6 +94,9 @@ pub(crate) fn install_pip(
                     .args([
                         &bundled_pip_module_path.to_string_lossy(),
                         "install",
+                        // We have to use CLI args to disable pip's version check here, since `--isolated` mode
+                        // means the `PIP_DISABLE_PIP_VERSION_CHECK` env var set previously will be ignored.
+                        "--disable-pip-version-check",
                         // Don't load any user-supplied pip configuration (pip.conf and `PIP_` env vars) given
                         // that this is an internal step for installing pip (rather than app dependencies), and
                         // so (a) doesn't need custom config, (b) we don't want the user to be able to break it.

src/layers/poetry.rs

@@ -90,7 +90,6 @@ pub(crate) fn install_poetry(
                     .args([
                         &bundled_pip_module_path.to_string_lossy(),
                         "install",
-                        // Setting this via CLI args since for Poetry we aren't setting `PIP_DISABLE_PIP_VERSION_CHECK`.
                         "--disable-pip-version-check",
                         // Don't load any user-supplied pip configuration (pip.conf and `PIP_` env vars) given
                         // that this is an internal step for installing Poetry (rather than app dependencies), and