{"info": {"author": null, "author_email": "Python Packaging Authority <distutils-sig@python.org>", "bugtrack_url": null, "classifiers": ["Development Status :: 5 - Production/Stable", "Intended Audience :: Developers", "Programming Language :: Python :: 3", "Programming Language :: Python :: 3 :: Only", "Topic :: Software Development :: Libraries :: Python Modules", "Topic :: System :: Archiving :: Packaging", "Topic :: System :: Systems Administration", "Topic :: Utilities"], "description": ".. |pypi-version| image:: https://img.shields.io/pypi/v/setuptools.svg\n   :target: https://pypi.org/project/setuptools\n\n.. |py-version| image:: https://img.shields.io/pypi/pyversions/setuptools.svg\n\n.. |test-badge| image:: https://github.com/pypa/setuptools/actions/workflows/main.yml/badge.svg\n   :target: https://github.com/pypa/setuptools/actions?query=workflow%3A%22tests%22\n   :alt: tests\n\n.. |ruff-badge| image:: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets/badge/v2.json\n   :target: https://github.com/astral-sh/ruff\n   :alt: Ruff\n\n.. |docs-badge| image:: https://img.shields.io/readthedocs/setuptools/latest.svg\n   :target: https://setuptools.pypa.io\n\n.. |skeleton-badge| image:: https://img.shields.io/badge/skeleton-2025-informational\n   :target: https://blog.jaraco.com/skeleton\n\n.. |codecov-badge| image:: https://img.shields.io/codecov/c/github/pypa/setuptools/master.svg?logo=codecov&logoColor=white\n   :target: https://codecov.io/gh/pypa/setuptools\n\n.. |tidelift-badge| image:: https://tidelift.com/badges/github/pypa/setuptools?style=flat\n   :target: https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=readme\n\n.. |discord-badge| image:: https://img.shields.io/discord/803025117553754132\n   :target: https://discord.com/channels/803025117553754132/815945031150993468\n   :alt: Discord\n\n|pypi-version| |py-version| |test-badge| |ruff-badge| |docs-badge| |skeleton-badge| |codecov-badge| |discord-badge|\n\nSee the `Quickstart <https://setuptools.pypa.io/en/latest/userguide/quickstart.html>`_\nand the `User's Guide <https://setuptools.pypa.io/en/latest/userguide/>`_ for\ninstructions on how to use Setuptools.\n\nQuestions and comments should be directed to `GitHub Discussions\n<https://github.com/pypa/setuptools/discussions>`_.\nBug reports and especially tested patches may be\nsubmitted directly to the `bug tracker\n<https://github.com/pypa/setuptools/issues>`_.\n\n\nCode of Conduct\n===============\n\nEveryone interacting in the setuptools project's codebases, issue trackers,\nchat rooms, and fora is expected to follow the\n`PSF Code of Conduct <https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md>`_.\n\n\nFor Enterprise\n==============\n\nAvailable as part of the Tidelift Subscription.\n\nSetuptools and the maintainers of thousands of other packages are working with Tidelift to deliver one enterprise subscription that covers all of the open source you use.\n\n`Learn more <https://tidelift.com/subscription/pkg/pypi-setuptools?utm_source=pypi-setuptools&utm_medium=referral&utm_campaign=github>`_.\n", "description_content_type": "text/x-rst", "docs_url": null, "download_url": null, "downloads": {"last_day": -1, "last_month": -1, "last_week": -1}, "dynamic": ["License-File"], "home_page": null, "keywords": "CPAN PyPI distutils eggs package management", "license": null, "license_expression": "MIT", "license_files": ["LICENSE"], "maintainer": null, "maintainer_email": null, "name": "setuptools", "package_url": "https://pypi.org/project/setuptools/", "platform": null, "project_url": "https://pypi.org/project/setuptools/", "project_urls": {"Changelog": "https://setuptools.pypa.io/en/stable/history.html", "Documentation": "https://setuptools.pypa.io/", "Source": "https://github.com/pypa/setuptools"}, "provides_extra": ["test", "doc", "ssl", "certs", "core", "check", "cover", "enabler", "type"], "release_url": "https://pypi.org/project/setuptools/80.9.0/", "requires_dist": ["pytest!=8.1.*,>=6; extra == \"test\"", "virtualenv>=13.0.0; extra == \"test\"", "wheel>=0.44.0; extra == \"test\"", "pip>=19.1; extra == \"test\"", "packaging>=24.2; extra == \"test\"", "jaraco.envs>=2.2; extra == \"test\"", "pytest-xdist>=3; extra == \"test\"", "jaraco.path>=3.7.2; extra == \"test\"", "build[virtualenv]>=1.0.3; extra == \"test\"", "filelock>=3.4.0; extra == \"test\"", "ini2toml[lite]>=0.14; extra == \"test\"", "tomli-w>=1.0.0; extra == \"test\"", "pytest-timeout; extra == \"test\"", "pytest-perf; sys_platform != \"cygwin\" and extra == \"test\"", "jaraco.develop>=7.21; (python_version >= \"3.9\" and sys_platform != \"cygwin\") and extra == \"test\"", "pytest-home>=0.5; extra == \"test\"", "pytest-subprocess; extra == \"test\"", "pyproject-hooks!=1.1; extra == \"test\"", "jaraco.test>=5.5; extra == \"test\"", "sphinx>=3.5; extra == \"doc\"", "jaraco.packaging>=9.3; extra == \"doc\"", "rst.linker>=1.9; extra == \"doc\"", "furo; extra == \"doc\"", "sphinx-lint; extra == \"doc\"", "jaraco.tidelift>=1.4; extra == \"doc\"", "pygments-github-lexers==0.0.5; extra == \"doc\"", "sphinx-favicon; extra == \"doc\"", "sphinx-inline-tabs; extra == \"doc\"", "sphinx-reredirects; extra == \"doc\"", "sphinxcontrib-towncrier; extra == \"doc\"", "sphinx-notfound-page<2,>=1; extra == \"doc\"", "pyproject-hooks!=1.1; extra == \"doc\"", "towncrier<24.7; extra == \"doc\"", "packaging>=24.2; extra == \"core\"", "more_itertools>=8.8; extra == \"core\"", "jaraco.text>=3.7; extra == \"core\"", "importlib_metadata>=6; python_version < \"3.10\" and extra == \"core\"", "tomli>=2.0.1; python_version < \"3.11\" and extra == \"core\"", "wheel>=0.43.0; extra == \"core\"", "platformdirs>=4.2.2; extra == \"core\"", "jaraco.functools>=4; extra == \"core\"", "more_itertools; extra == \"core\"", "pytest-checkdocs>=2.4; extra == \"check\"", "pytest-ruff>=0.2.1; sys_platform != \"cygwin\" and extra == \"check\"", "ruff>=0.8.0; sys_platform != \"cygwin\" and extra == \"check\"", "pytest-cov; extra == \"cover\"", "pytest-enabler>=2.2; extra == \"enabler\"", "pytest-mypy; extra == \"type\"", "mypy==1.14.*; extra == \"type\"", "importlib_metadata>=7.0.2; python_version < \"3.10\" and extra == \"type\"", "jaraco.develop>=7.21; sys_platform != \"cygwin\" and extra == \"type\""], "requires_python": ">=3.9", "summary": "Easily download, build, install, upgrade, and uninstall Python packages", "version": "80.9.0", "yanked": false, "yanked_reason": null}, "last_serial": 39828918, "ownership": {"organization": null, "roles": [{"role": "Owner", "user": "jaraco"}, {"role": "Maintainer", "user": "abravalheri"}, {"role": "Maintainer", "user": "dstufft"}]}, "urls": [{"comment_text": null, "core-metadata": {"sha256": "7f890ca8dbc16b63b568c89312ed6a7f9f0a79d0b2b7f3c83bf796ac3d930615"}, "digests": {"blake2b_256": "a3dc17031897dae0efacfea57dfd3a82fdd2a2aeb58e0ff71b77b87e44edc772", "md5": "51e62d1ca39b0e1b44385c363a9cef55", "sha256": "062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922"}, "downloads": -1, "filename": "setuptools-80.9.0-py3-none-any.whl", "has_sig": false, "md5_digest": "51e62d1ca39b0e1b44385c363a9cef55", "packagetype": "bdist_wheel", "python_version": "py3", "requires_python": ">=3.9", "size": 1201486, "upload_time": "2025-05-27T00:56:49", "upload_time_iso_8601": "2025-05-27T00:56:49.664463Z", "url": "https://fixtures.pulpproject.org/python-pypi/packages/setuptools-80.9.0-py3-none-any.whl", "yanked": false, "yanked_reason": null}, {"comment_text": null, "core-metadata": false, "digests": {"blake2b_256": "185d3bf57dcd21979b887f014ea83c24ae194cfcd12b9e0fda66b957c69d1fca", "md5": "82e1d67883b713f9493659b50d13b436", "sha256": "f36b47402ecde768dbfafc46e8e4207b4360c654f1f3bb84475f0a28628fb19c"}, "downloads": -1, "filename": "setuptools-80.9.0.tar.gz", "has_sig": false, "md5_digest": "82e1d67883b713f9493659b50d13b436", "packagetype": "sdist", "python_version": "source", "requires_python": ">=3.9", "size": 1319958, "upload_time": "2025-05-27T00:56:51", "upload_time_iso_8601": "2025-05-27T00:56:51.443474Z", "url": "https://fixtures.pulpproject.org/python-pypi/packages/setuptools-80.9.0.tar.gz", "yanked": false, "yanked_reason": null}], "vulnerabilities": [{"aliases": ["CVE-2026-59890", "GHSA-h35f-9h28-mq5c"], "details": "setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.", "fixed_in": ["83.0.0"], "id": "PYSEC-2026-3447", "link": "https://osv.dev/vulnerability/PYSEC-2026-3447", "source": "osv", "summary": null, "withdrawn": null}, {"aliases": ["BIT-setuptools-2026-59890", "CVE-2026-59890", "PYSEC-2026-3447"], "details": "## Summary\n\nWhen building a source distribution (`python -m build --sdist` / `setup.py sdist`), setuptools' `FileList` applies `MANIFEST.in` directives (`exclude`, `global-exclude`, `recursive-exclude`, `prune`) by matching a compiled glob against on-disk file names **byte-for-byte, with no Unicode normalization**. On normalization-preserving filesystems (notably macOS APFS and HFS+), a file written in NFD and a `MANIFEST.in` rule written in NFC refer to the same file but are byte-distinct, so the exclusion silently fails to match. A file the maintainer intended to exclude is then packed into the `.tar.gz` and, if published, uploaded to the public, immutable PyPI index.\n\n## Details\n\nFile names in `FileList.files` come from `os.walk` (`setuptools/_distutils/filelist.py`, `_find_all_simple`), so on APFS a file written NFD is offered to the matcher in NFD, while the `MANIFEST.in` pattern carries the author's editor form (typically NFC). The matching path performs no canonicalization:\n\n```python\n# setuptools/command/egg_info.py  (FileList.global_exclude)\ndef global_exclude(self, pattern):\n    match = translate_pattern(os.path.join('**', pattern))   # fnmatch.translate -> regex, no NFC/NFD\n    return self._remove_files(match.match)                   # byte-level regex over raw os.walk names\n```\n\nA rule written NFC (`caf\u00e9` = `63 61 66 c3 a9`) does not match an on-disk name written NFD (`caf\u00e9` = `63 61 66 65 cc 81`), even though the filesystem treats the two as one file.\n\nA `unicodedata.normalize('NFD', ...)` helper exists in `setuptools/unicode_utils.py` (`decompose()`), but it is **never called in the manifest matching path**, so neither the pattern nor the walked path is normalized before matching. The only normalization in this area, `EggInfoCommand._manifest_normalize`, uses `filesys_decode` (bytes\u2192str decode only, no NFC/NFD) and runs when writing `SOURCES.txt`, after matching has already occurred.\n\n## Impact\n\n`MANIFEST.in` exclusions are the documented mechanism maintainers use to keep secrets, local configs, and private fixtures out of the published sdist. A non-ASCII excluded file may be published to the public, immutable PyPI index despite the rule \u2014 an irreversible disclosure with no visual cue (NFC and NFD forms render identically). Exposure is filesystem-dependent and most relevant on macOS APFS/HFS+, where many maintainers build and publish. Pure-ASCII rules are unaffected.\n\n## Proof of concept\n\nWith a project containing `MANIFEST.in`:\n\n```\nglobal-include *.txt *.json\nglobal-exclude secret_caf\u00e9.txt    # rule saved NFC\n```\n\nand an on-disk file `secret_caf\u00e9.txt` written in NFD, `python -m build --sdist` packs the secret file into the resulting `.tar.gz`, while an ASCII control file excluded by the same directive is correctly dropped \u2014 isolating the bypass to the NFC-pattern vs. NFD-name mismatch. Reproduced on macOS APFS with setuptools 82.0.1.\n\n## Remediation\n\nNormalize both the walked path and each `MANIFEST.in` pattern to a single canonical form before matching, in both `setuptools/command/egg_info.py` (`FileList`) and the vendored `setuptools/_distutils/filelist.py`. For an exclusion list, err toward excluding more, and document that `MANIFEST.in` matching is normalization-insensitive on macOS.\n\n## Credit\n\nReported by Tomas Illuminati. Coordinated via CERT/CC VINCE VU#604762.", "fixed_in": ["83.0.0"], "id": "GHSA-h35f-9h28-mq5c", "link": "https://osv.dev/vulnerability/GHSA-h35f-9h28-mq5c", "source": "osv", "summary": null, "withdrawn": null}], "releases": {"80.9.0": [{"comment_text": null, "core-metadata": {"sha256": "7f890ca8dbc16b63b568c89312ed6a7f9f0a79d0b2b7f3c83bf796ac3d930615"}, "digests": {"blake2b_256": "a3dc17031897dae0efacfea57dfd3a82fdd2a2aeb58e0ff71b77b87e44edc772", "md5": "51e62d1ca39b0e1b44385c363a9cef55", "sha256": "062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922"}, "downloads": -1, "filename": "setuptools-80.9.0-py3-none-any.whl", "has_sig": false, "md5_digest": "51e62d1ca39b0e1b44385c363a9cef55", "packagetype": "bdist_wheel", "python_version": "py3", "requires_python": ">=3.9", "size": 1201486, "upload_time": "2025-05-27T00:56:49", "upload_time_iso_8601": "2025-05-27T00:56:49.664463Z", "url": "https://fixtures.pulpproject.org/python-pypi/packages/setuptools-80.9.0-py3-none-any.whl", "yanked": false, "yanked_reason": null}, {"comment_text": null, "core-metadata": false, "digests": {"blake2b_256": "185d3bf57dcd21979b887f014ea83c24ae194cfcd12b9e0fda66b957c69d1fca", "md5": "82e1d67883b713f9493659b50d13b436", "sha256": "f36b47402ecde768dbfafc46e8e4207b4360c654f1f3bb84475f0a28628fb19c"}, "downloads": -1, "filename": "setuptools-80.9.0.tar.gz", "has_sig": false, "md5_digest": "82e1d67883b713f9493659b50d13b436", "packagetype": "sdist", "python_version": "source", "requires_python": ">=3.9", "size": 1319958, "upload_time": "2025-05-27T00:56:51", "upload_time_iso_8601": "2025-05-27T00:56:51.443474Z", "url": "https://fixtures.pulpproject.org/python-pypi/packages/setuptools-80.9.0.tar.gz", "yanked": false, "yanked_reason": null}]}}