From patchwork Tue Oct 20 07:13:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: auh@yoctoproject.org X-Patchwork-Id: 101349 Received: from a27-193.smtp-out.us-west-2.amazonses.com (a27-193.smtp-out.us-west-2.amazonses.com [54.240.27.193]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.1946.1792480406111515043 for ; Tue, 20 Oct 2026 00:13:26 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@yoctoproject.org header.s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky header.b=LfpvhCAa; dkim=pass header.i=@amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=DScWGTCf; spf=pass (domain: us-west-2.amazonses.com, ip: 54.240.27.193, mailfrom: 010101a15828664d-5c0a9e66-57de-4a96-966d-0e8164510216-000000@us-west-2.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky; d=yoctoproject.org; t=1792480405; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date; bh=A1Or6K88UPspMC7CnAVfyJtmcHiCJwZXfcr/BuK0Gt0=; b=LfpvhCAaTEV+LTS/6eqRRvhpow/Qyez6ywWaLFSmIz866fJwowQTSc1X55D/tPcM +WZRTkKYM0P4ANSN1c/y5gum0JelyIgNtju78ocfTQlRZikwSeck8uOm1TDfOovq8hH ZLJLDy/90T20zdHR97C6XyEQ9n/lcrU1LF+8LOpk= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=hsbnp7p3ensaochzwyq5wwmceodymuwv; d=amazonses.com; t=1792480405; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date:Feedback-ID; bh=A1Or6K88UPspMC7CnAVfyJtmcHiCJwZXfcr/BuK0Gt0=; b=DScWGTCfk8OsAXcLYAhACAS1bj+e1sH3A97AQoHny6o48h/0cVUfLsJYUOnUS/Xi DERddFsolgekAUHYcwiFAbcOodXcT9GsYD+E2tGLVf/ss/R1hkFiY4vZAMC2cte2pKM uHNiDxJrpik1jYrhBmcKzWyzm5+v+ll5X76OcagA= MIME-Version: 1.0 From: auh@yoctoproject.org To: Trevor Gamblin Cc: openembedded-core@lists.openembedded.org Subject: [AUH] python3-setuptools: upgrading to 84.2.0 SUCCEEDED Message-ID: <010101a15828664d-5c0a9e66-57de-4a96-966d-0e8164510216-000000@us-west-2.amazonses.com> Date: Tue, 20 Oct 2026 07:13:25 +0000 Feedback-ID: ::1.us-west-2.9np3MYPs3fEaOBysGKSlUD4KtcmPijcmS9Az2Hwf7iQ=:AmazonSES X-SES-Outgoing: 2026.10.20-54.240.27.193 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 20 Oct 2026 07:13:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/248232 Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *python3-setuptools* to *84.2.0* has Succeeded. Next steps: - apply the patch: git am 0001-python3-setuptools-upgrade-84.0.0-84.2.0.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From 536d8728d1a0b2a14b919825264cf424e0c75818 Mon Sep 17 00:00:00 2001 From: Upgrade Helper Date: Tue, 20 Oct 2026 06:44:44 +0000 Subject: [PATCH] python3-setuptools: upgrade 84.0.0 -> 84.2.0 v84.2.0 ======= Features -------- - Added support for building abi3t extensions and abi3.abi3t wheels on Python 3.15 and newer. See :pep:`803` and the `Python 3.15 "What's New" entry `_ for more details. - Updated vendored packaging version to 26.3, which adds support for the ``abi3t`` tag from :pep:`803`. Bugfixes -------- - Use target sysconfig data for stable-ABI extension filenames. v84.1.0 ======= Features -------- - ``setuptools.archive_util`` now raises the new ``UnsafeMember`` exception when an archive member would be extracted outside of the extraction directory, where previously such a member was silently skipped. Aborting makes a malicious or malformed archive visible to the caller instead of yielding a quietly incomplete extraction, and matches the behavior of the standard library's ``tarfile`` extraction filters. Bugfixes -------- - ``Wheel.install_as_egg`` no longer creates namespace package directories outside of the destination egg directory. Entries in a wheel's ``namespace_packages.txt`` were split on ``.`` and passed straight to ``os.path.join``, so an entry that was absolute, drive-qualified, or UNC discarded the destination and placed an ``__init__.py`` at a path chosen by the wheel. Namespace entries are now validated as dotted module names on every platform -- see GHSA-xmj3-9gf7-h52w. This code path is reached only by the deprecated ``setup_requires`` mechanism when ``setup()`` is invoked outside a PEP 517 frontend; the setuptools build backend never reaches it. - ``setuptools.archive_util`` no longer extracts archive members outside of the requested extraction directory. Both the tar and zip formats specify ``/`` as the only path separator, but the guard against ``..`` components split member names on ``/`` alone, so a name such as ``..\escaped.txt`` was treated as a single component and then resolved as a traversal by the filesystem on Windows. Member names containing a backslash, a drive letter, or a UNC prefix are now rejected on every platform, as are members whose resolved destination falls outside the extraction directory -- see GHSA-grgh-hr87-3jpw. for deprecated ``python_implementation`` marker. --- ...ils-sysconfig.py-make-it-possible-to-substite.patch | 10 +++++----- ...tuptools_84.0.0.bb => python3-setuptools_84.2.0.bb} | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) rename meta/recipes-devtools/python/{python3-setuptools_84.0.0.bb => python3-setuptools_84.2.0.bb} (94%) diff --git a/meta/recipes-devtools/python/python3-setuptools/0001-_distutils-sysconfig.py-make-it-possible-to-substite.patch b/meta/recipes-devtools/python/python3-setuptools/0001-_distutils-sysconfig.py-make-it-possible-to-substite.patch index f6313fb1a9..9971363689 100644 --- a/meta/recipes-devtools/python/python3-setuptools/0001-_distutils-sysconfig.py-make-it-possible-to-substite.patch +++ b/meta/recipes-devtools/python/python3-setuptools/0001-_distutils-sysconfig.py-make-it-possible-to-substite.patch @@ -1,4 +1,4 @@ -From fe651521b9d970a84432b37d2731932a4862deb2 Mon Sep 17 00:00:00 2001 +From 7406890471590644b9b3d76e9d255ae14b00be12 Mon Sep 17 00:00:00 2001 From: Alexander Kanavin Date: Wed, 11 May 2022 21:41:14 +0200 Subject: [PATCH] _distutils/sysconfig.py: make it possible to substite the @@ -20,10 +20,10 @@ Signed-off-by: Alexander Kanavin 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/setuptools/_distutils/sysconfig.py b/setuptools/_distutils/sysconfig.py -index 7ddc869..01a06af 100644 +index 4792b58..cf1fbc5 100644 --- a/setuptools/_distutils/sysconfig.py +++ b/setuptools/_distutils/sysconfig.py -@@ -134,6 +134,8 @@ def get_python_inc(plat_specific: bool = False, prefix: str | None = None) -> st +@@ -133,6 +133,8 @@ def get_python_inc(plat_specific: bool = False, prefix: str | None = None) -> st sys.base_exec_prefix -- i.e., ignore 'plat_specific'. """ default_prefix = BASE_EXEC_PREFIX if plat_specific else BASE_PREFIX @@ -32,7 +32,7 @@ index 7ddc869..01a06af 100644 resolved_prefix = prefix if prefix is not None else default_prefix # MinGW imitates posix like layout, but os.name != posix os_name = "posix" if is_mingw() else os.name -@@ -246,7 +248,13 @@ def get_python_lib( +@@ -245,7 +247,13 @@ def get_python_lib( early_prefix = prefix @@ -47,7 +47,7 @@ index 7ddc869..01a06af 100644 if standard_lib: prefix = plat_specific and BASE_EXEC_PREFIX or BASE_PREFIX else: -@@ -261,7 +269,7 @@ def get_python_lib( +@@ -260,7 +268,7 @@ def get_python_lib( # Pure Python libdir = "lib" implementation = 'pypy' if IS_PYPY else 'python' diff --git a/meta/recipes-devtools/python/python3-setuptools_84.0.0.bb b/meta/recipes-devtools/python/python3-setuptools_84.2.0.bb similarity index 94% rename from meta/recipes-devtools/python/python3-setuptools_84.0.0.bb rename to meta/recipes-devtools/python/python3-setuptools_84.2.0.bb index 648b084a27..9cd5739c44 100644 --- a/meta/recipes-devtools/python/python3-setuptools_84.0.0.bb +++ b/meta/recipes-devtools/python/python3-setuptools_84.2.0.bb @@ -11,7 +11,7 @@ CVE_PRODUCT = "python3-setuptools python:setuptools" SRC_URI += " \ file://0001-_distutils-sysconfig.py-make-it-possible-to-substite.patch" -SRC_URI[sha256sum] = "f4695c21257f0d9b537ec2692c941d02ee143b7cc1276941349a546573b2ef73" +SRC_URI[sha256sum] = "6f445ca2ce864605f81e223f262b4c94ffcb9a4a63473bae0ed7be5aab0291da" do_install:append() { # setuptools ships Windows launcher executables (cli*.exe, gui*.exe).