Mirror of git.yoctoproject.org/poky https://git.enea.com/cgit/linux/poky.git/atom?h=yocto-5.0.17 2026-03-25T17:34:13+00:00 2026-03-25T17:34:13+00:00 Krupal Ka Patel krkapate@cisco.com 2026-03-09T05:19:33+00:00 urn:sha1:8acfa6cc83191a62fef0f451aff493ac60e0ee34 setuptools installs Windows launcher executables (cli*.exe, gui*.exe) into site-packages. These binaries are only used on Windows platforms but are packaged for target, native, and nativesdk builds. Remove the Windows launcher executables when not building for a mingw (mingw32/mingw64) host to avoid shipping unused Windows binaries. (From OE-Core rev: a618c504ba69d20eec08944c577b15a48b1ac578) Signed-off-by: Krupal Ka Patel <krkapate@cisco.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit cf7c79f3962f2be99cfda47e8cc730091e6a18cb) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> 2025-06-11T15:17:34+00:00 Vijay Anusuri vanusuri@mvista.com 2025-06-05T07:14:10+00:00 urn:sha1:6ba8b8a487f61d511904dd7263a58a794d3d3bb5 Upstream-Status: Backport from https://github.com/pypa/setuptools/commit/d8390feaa99091d1ba9626bec0e4ba7072fc507a & https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b (From OE-Core rev: 9769cd99c32faf7d95a7cab07b8550b438ccaf0c) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2024-10-30T15:30:00+00:00 Shunsuke Tokumoto s-tokumoto@fujitsu.com 2024-09-26T11:01:03+00:00 urn:sha1:8dae11e0b5294a07b320ab8987eff6a598546374 Since there are vulnerabilities that cannot be detected by the existing CVE_PRODUCT, add "python:setuptools" to CVE_PRODUCT. https://nvd.nist.gov/vuln/detail/CVE-2013-1633 https://nvd.nist.gov/vuln/detail/CVE-2022-40897 (From OE-Core rev: 85b61bf9cefc024faefa083c37ce88ba9c7355e1) Signed-off-by: Shunsuke Tokumoto <s-tokumoto@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit aa1c8d97efc6640a1cffa2459d9b20ad1f7309b0) Signed-off-by: Steve Sakoman <steve@sakoman.com> 2024-09-09T13:08:10+00:00 Soumya Sambu soumya.sambu@windriver.com 2024-09-01T17:17:26+00:00 urn:sha1:67aa29393db111a67b64f3394a0c490c33946c02 A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0. References: https://nvd.nist.gov/vuln/detail/CVE-2024-6345 Upstream-patch: https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0 (From OE-Core rev: 468c5a4e12b9d38768b00151c55fd27b2b504f3b) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2024-07-09T13:02:55+00:00 Guðni Már Gilbert gudni.m.g@gmail.com 2024-07-02T22:31:29+00:00 urn:sha1:b0ab1c80fc5787d4eb43a443afe0979d56c930bc 2to3 module was dropped as a dependency in setuptools 58.0 (From OE-Core rev: 0d5cd1d867a826cf83fcaee3e8390b9defec47d1) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2024-03-07T17:25:02+00:00 Alexander Kanavin alex.kanavin@gmail.com 2024-03-06T15:42:22+00:00 urn:sha1:51460be41f5c9a047a6da3ebf1dcaa7d331352fe (From OE-Core rev: a953d88346d4ee93b5669c079586ae27d71552dc) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>