v68.0.0.post3 (Python 3.7 security release)

ActiveState security release on the Python 3.7 setuptools 68.0.0 line, bundled by CPython 3.7.17.8. Fixes merged in #7; version set in #8.

CVE	Advisory	Status
CVE-2026-59890	GHSA-h35f-9h28-mq5c	Patched: MANIFEST.in exclusion bypass in sdist via Unicode normalization (upstream 83.0.0)
—	GHSA-xmj3-9gf7-h52w	Patched: path escape via namespace_packages.txt during legacy wheel installation (upstream 84.1.0)

Earlier releases on this line already fixed CVE-2024-6345 (v68.0.0.1) and CVE-2025-47273 (v68.0.0.2).

What changed:

• CVE-2026-59890: MANIFEST.in patterns and file names are both normalized to NFC before matching. A file with a decomposed (NFD) name is now dropped by an exclude, global-exclude, recursive-exclude or prune rule written in composed form.
• GHSA-xmj3-9gf7-h52w: entries in a wheel's namespace_packages.txt must be dotted module names that resolve inside the egg directory. Absolute, drive-qualified and UNC entries are rejected. This is reachable only through the deprecated setup_requires mechanism.
• Versioning: the line now uses the X.Y.Z.postN scheme of the other ActiveState security releases.

Validated in python:3.7-slim, on test_manifest, test_wheel, test_egg_info and test_sdist:

• With the fixes: 196 tests pass. The one failure needs a C compiler, which the image lacks, and it fails the same way on the base.
• Before the fixes: all nine new tests fail there.

Wheel diff from 68.0.0.2: only setuptools/command/egg_info.py, setuptools/unicode_utils.py, setuptools/wheel.py, METADATA and RECORD differ.

sha256

• setuptools-68.0.0.post3.tar.gz: cabc6b52da7aa17b1d0418f9c2838ee8677ee500f2d5219d61f38e434a1b3927
• setuptools-68.0.0.post3-py3-none-any.whl: 95bb21258fbcb75b5d7d3740ce296991641e8c78a0de9590747ba2d11aa81c43