I imagine this is affecting far more people than just us, so might as well hang tight until it is resolved

I opened an issue here: pypa/pip#10848

Is it possible to add pip itself to requirements.txt and let Dependabot do the versioning?

I'm somewhat hesitant to do so... having a bit of trouble articulating why, but:

The only scenario I see us needing to specify pip's version (besides this (hopefully) fluke bug on our CI runner) would be to handle installing another package. In that situation, the upstream package should handle the pip version (and we should be questioning why we're using anything that doesn't support a recent version of pip). Otherwise, because PyVista in noarch, IMO we really should make sure PyVista itself is compatible with most recent versions of pip.

If we added this to the requirements for dependabot to handle, it'd have to be its own requirements_pip.txt file. That's because we'd need to make sure it is actually installed before using pip for any other dependency that might need that version. This wouldn't be bad, and would be a good way to handle this situation but overall it all feels a bit weird to me.

🤷🏼‍♂️ to answer your question: yes, we certainly could do this and it'd handle any scenario where our CI's break because of a pip release moving forward. And because of that, I'm inclined to do so (but still have some hesitancy)

We actually do require a very recent version of pip in our CI because we use pip cache dir

I think this is a Windows permissions thing and not a CI thing. See #2137