linux/poky.git/meta/recipes-devtools/python/python3-setuptools, branch walnascar-5.2.2

python3-setuptools: fix CVE-2025-47273

2025-07-04T14:50:16+00:00

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to remote code execution depending on the context. Version 78.1.1 fixes the issue. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-47273 Upstream-patch: https://github.com/pypa/setuptools/commit/d8390feaa99091d1ba9626bec0e4ba7072fc507a https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b (From OE-Core rev: cfb2d77f841ae21cae0ba7d6263dc3e1e0280400) Signed-off-by: Praveen Kumar Signed-off-by: Steve Sakoman

python3-setuptools: upgrade 75.8.2 -> 76.0.0

2025-03-17T22:38:32+00:00

(From OE-Core rev: cdaa24119650c41469cd1cea1955aa6fb0494398) Signed-off-by: Richard Purdie

python3-setuptools: upgrade 75.8.0 -> 75.8.2

2025-03-06T11:16:47+00:00

0001-conditionally-do-not-fetch-code-by-easy_install.patch refreshed for 75.8.2 (From OE-Core rev: 7afde38357bb214d3685e84e2db73c26074dd354) Signed-off-by: Wang Mingyu Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

python3-setuptools: upgrade 75.6.0 -> 75.8.0

2025-02-05T12:49:56+00:00

(From OE-Core rev: 2f30a782ae5500d9b7dcc37e2cfc43312a470605) Signed-off-by: Richard Purdie

python3-setuptools: upgrade 72.1.0 -> 75.6.0

2024-11-22T16:58:40+00:00

Changelog: https://github.com/pypa/setuptools/blob/main/NEWS.rst 0001-conditionally-do-not-fetch-code-by-easy_install.patch had to be adjusted to apply on top of 75.6.0. (From OE-Core rev: 6d7e621ef133d625e8405c74a9dba712b8692064) Signed-off-by: Trevor Gamblin Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

python3-setuptools: add more comments to a patch

2024-11-12T11:19:44+00:00

Add more explanatory comments, including when we can drop the patch. (From OE-Core rev: 15091ef668b544ceb881f8179c0c25c97afd3f5f) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

python3-setuptools: upgrade 69.5.1 -> 70.3.0

2024-07-18T16:21:39+00:00

Refactor 0001-_distutils-sysconfig.py-make-it-possible-to-substite.patch to apply on the latest codebase. Changelog: https://github.com/pypa/setuptools/blob/main/NEWS.rst (From OE-Core rev: 8af6ba2a0a10f8d8995aab322d9f4cfbf1880228) Signed-off-by: Trevor Gamblin Signed-off-by: Richard Purdie

python3-setuptools: upgrade 69.1.1 -> 69.2.0

2024-04-16T07:07:02+00:00

0001-conditionally-do-not-fetch-code-by-easy_install.patch refreshed for 69.2.0 Changelog: ========== -Explicitly use encoding="locale" for .pth files whenever possible, to reduce EncodingWarnings. This avoid errors with UTF-8 -Clarify some Package Discovery and Resource Access using pkg_resources methods return bytes, not str. Also return an empty bytes in EmptyProvider._get -Return an empty list by default in pkg_resources.ResourceManager.cleanup_resources -Made pkg_resoursces.NullProvider's has_metadata and metadata_isdir methods return actual booleans like all other Providers. (From OE-Core rev: 49d2c4cf43d4ccac6f3f6c090fc0e5b0365645b6) Signed-off-by: Wang Mingyu Signed-off-by: Richard Purdie

python3-setuptools: upgrade 69.0.3 -> 69.1.1

2024-03-07T17:25:02+00:00

(From OE-Core rev: a953d88346d4ee93b5669c079586ae27d71552dc) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie

python3-setuptools: upgrade 69.0.2 -> 69.0.3

2023-12-30T11:03:07+00:00

0001-_distutils-sysconfig.py-make-it-possible-to-substite.patch refreshed for 69.0.3 Changelog: Retain valid names with underscores in egg_info. (From OE-Core rev: 47507793764cef763e31bd888754cb8ba7361376) Signed-off-by: Wang Mingyu Signed-off-by: Richard Purdie