Skip to content

v82.0.1.post1 (Python 3.9 security release)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@icanhasmath icanhasmath released this 29 Sep 14:29
· 283 commits to main since this release
v82.0.1.post1
838d0d2

ActiveState security release of setuptools for Python 3.9. Upstream 83.0.0 and later require Python >= 3.10. This release is 82.0.1 plus the upstream security fix.

Security

  • CVE-2026-59890 / GHSA-h35f-9h28-mq5c (medium): MANIFEST.in matching now ignores Unicode normalization form (NFC vs NFD). Before this fix, an exclude, global-exclude, recursive-exclude or prune rule could fail to drop a non-ASCII-named file stored NFD on disk (as on macOS APFS/HFS+), so the excluded file was published in the sdist. Backport of pypa/setuptools@dd9f436a3 (released in v83.0.0).

requires-python >= 3.9. PR: #5

Assets 2
Loading