Currently, "pip3 install --upgrade pip" unconditionally installs a
"pip" alias even for Python 3.  If a user has an existing Python 3.x
installed from a python.org macOS installer and then subsequently
manually updates to a new version of pip, there may now be a stray
"pip" alias in the Python 3.x framework bin directory which can cause
confusion if the user has both a Python 2.7 and 3.x installed;
if the Python 3.x fw bin directory appears early on $PATH, "pip"
might invoke the pip3 for the Python 3.x rather than the pip for
Python 2.7.  To try to mitigate this, the macOS installer script
for the ensurepip option will unconditionally remove "pip" from
the 3.x framework bin directory being updated / installed.  (The
ambiguity can be avoided by using "pythonx.y -m pip".)

Build and link with private copy of Tcl/Tk 8.6 for the macOS 10.6+
installer. The 10.9+ installer variant already does this.  This means that
the Python 3.7 provided by the python.org macOS installers no longer need or
use any external versions of Tcl/Tk, either system-provided or user-
installed, such as ActiveTcl.