diff --git a/Readme.md b/Readme.md
index 349adad2e9f4f46b8aad9f0e507fc9376e46f1f4..5de240dced554575110493649fa3f893374405de 100644
--- a/Readme.md
+++ b/Readme.md
@@ -17,7 +17,7 @@ Example usage:
     $ git push heroku master
     ...
     -----> Python app detected
-    -----> Installing runtime (python-2.7.8)
+    -----> Installing runtime (python-2.7.9)
     -----> Installing dependencies using pip
            Downloading/unpacking requests (from -r requirements.txt (line 1))
            Installing collected packages: requests
@@ -40,12 +40,12 @@ Specify a Runtime
 You can also provide arbitrary releases Python with a `runtime.txt` file.
 
     $ cat runtime.txt
-    python-3.4.2
+    python-3.4.3
 
 Runtime options include:
 
-- python-2.7.8
-- python-3.4.2
+- python-2.7.9
+- python-3.4.3
 - pypy-2.4.0 (unsupported, experimental)
 - pypy3-2.4.0 (unsupported, experimental)
 
diff --git a/bin/compile b/bin/compile
index ddb44286ff26bd5735839caf86e31d3928c4512c..ef458b2496f9c24bb6a950ca620276257e534662 100755
--- a/bin/compile
+++ b/bin/compile
@@ -29,7 +29,7 @@ WEBCONCURRENCY_PROFILE_PATH="$BUILD_DIR/.profile.d/python.webconcurrency.sh"
 DEFAULT_PYTHON_VERSION="python-2.7.9"
 DEFAULT_PYTHON_STACK="cedar"
 PYTHON_EXE="/app/.heroku/python/bin/python"
-PIP_VERSION="6.0.6"
+PIP_VERSION="6.0.8"
 SETUPTOOLS_VERSION="11.3.1"
 
 # Setup bpwatch
diff --git a/bin/utils b/bin/utils
index a57d54e747c54d25977af5dd969f77fec764665f..eff6bf0a9135fe1f50c4114d5b6c899e0921e368 100755
--- a/bin/utils
+++ b/bin/utils
@@ -68,7 +68,7 @@ deep-rm() {
   # subshell to avoid surprising caller with shopts.
   (
     shopt -s dotglob
-    rm -rf "$1"/!(tmp|.|..)
+    rm -rf "$1"/!(.curlrc|.netrc|tmp|.|..)
   )
 }
 
diff --git a/vendor/pip-6.0.6.tar.gz b/vendor/pip-6.0.6.tar.gz
deleted file mode 100644
index 2858bcf84ecafaec5c83c621159e9f1eb89980be..0000000000000000000000000000000000000000
Binary files a/vendor/pip-6.0.6.tar.gz and /dev/null differ
diff --git a/vendor/pip-6.0.8.tar.gz b/vendor/pip-6.0.8.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..d045cc4a5e38df32b1ea9eacd0a2fc7378a3118e
Binary files /dev/null and b/vendor/pip-6.0.8.tar.gz differ