v44.1.1.post3 (Python 2.7 security release)

ActiveState security release of setuptools 44.1.1 for Python 2.7.

Security

• CVE-2026-59890 / GHSA-h35f-9h28-mq5c (medium): MANIFEST.in matching now ignores Unicode normalization form (NFC vs NFD). Before this fix, an exclude, global-exclude, recursive-exclude or prune rule could fail to drop a non-ASCII-named file stored NFD on disk (as on macOS APFS/HFS+), so the excluded file was published in the sdist. Backport of pypa/setuptools@dd9f436a3 (v83.0.0), adapted for Python 2: byte-string patterns and paths are normalized too, and a pattern and path of different string types still match.
• Also carries CVE-2024-6345 and CVE-2025-47273 (44.1.1+security.2) and CVE-2022-40897 (44.1.1.1).

Version ordering

This release uses the .postN scheme. Under PEP 440 44.1.1.post3 sorts below a build labelled 44.1.1.1; that build is not to be served alongside this one.

PR: #6

Wheel

setuptools-44.1.1.post3-py2.py3-none-any.whl, sha256 fc42d2f957b1172962a59fad9367200cb7385dd1ac8b3a7a36c0251779f046a5. Built from this tag (e2a1db3) under Python 2.7 with bootstrap.py and bdist_wheel (wheel 0.37.1). This is the same file bundled by ActiveState Python 2.7.18.15 ensurepip (ActiveState/cpython#91). Its contents match PyPI's setuptools 44.1.1 wheel except for the three fixed files: setuptools/command/egg_info.py, setuptools/package_index.py and setuptools/unicode_utils.py.