Pyinstaller

Latest version: v6.11.1

Safety actively analyzes 685670 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 6 of 8

5.2

Not secure
-----------------

Features
~~~~~~~~

* Detect if an icon file (``.ico`` or ``.icns``) is of another image type but
has been mislabelled as a native icon type via its file suffix then either
normalise to a genuinely native image type if ``pillow`` is installed or raise
an error. (:issue:`6870`)
* Exit gracefully with an explanatory :class:`SystemExit` if the user moves or
deletes the application whilst it's still running. Note that this is only
detected on trying to load a module which has not already been loaded.
(:issue:`6856`)
* Implement new standard hook variable, called
``warn_on_missing_hiddenimports``. This optional boolean flag allows a hook to
opt out from warnings generated by missing hidden imports originating from
that hook. (:issue:`6914`)


Bugfix
~~~~~~

* (Linux) Fix potential mismatch between the collected Python shared library
name and the name expected by the bootloader when using Anaconda environment.
The mismatch would occur on some attempts to freeze a program that uses an
extension that is also linked against the python shared library.
(:issue:`6831`)
* (Linux) Fix the missing ``gi.repository`` error in an application frozen on
RHEL/Fedora linux with GObject introspection installed from the distribution's
RPM package. (:issue:`6780`)
* (macOS) The ``QtWebEngine`` hook now makes ``QtOpenGL`` and ``QtDBus``
available to the renderer process with framework installs of Qt 6.
(:issue:`6892`)
* (Windows) Optimize EXE PE headers fix-up process in an attempt to reduce the
processing time and the memory footprint with large onefile builds.
(:issue:`6874`)
* Add a try/except guard around :func:`ctypes.util.find_library` to protect
against `CPython bug 93094 <https://github.com/python/cpython/issues/93094>`_
which leads to a :class:`FileNotFoundError`. (:issue:`6864`)
* Fix regression in PyInstaller v5 where an import of a non-existent GObject
introspection (`gi`) module (for example, an optional dependency) in the
program causes a build-time error and aborts the build process.
(:issue:`6897`)
* If passed a name of an importable module instead of a package, the
:func:`PyInstaller.utils.hooks.collect_submodules` function now returns
a list containing the module's name, same as it would for a package without
submodules. (:issue:`6850`)
* Prevent :func:`PyInstaller.utils.hooks.collect_submodules` from recursing into
sub-packages that are excluded by the function passed via the ``filter``
argument. (:issue:`6846`)
* The :func:`PyInstaller.utils.hooks.collect_submodules` function now excludes
un-importable subpackages from the returned modules list. (:issue:`6850`)


Hooks
~~~~~

* (macOS) Disable ``QtWebEngine`` sandboxing for Qt6 in the corresponding
``PySide6`` and ``PyQt6`` run-time hooks as a work-around for the
``QtWebEngineProcess`` helper process crashing. This is required as of Qt
6.3.1 due to the way PyInstaller collects Qt libraries, but is applied
regardless of the used Qt6 version. If you are using an older version of Qt6
and would like to keep the sandboxing, reset the
``QTWEBENGINE_DISABLE_SANDBOX`` environment variable at the start of your
program, before importing Qt packages. (:issue:`6903`)
* Add support for GTK4 by adding dependencies and updating ``gi.repository.Gtk``
and ``gi.repository.Gdk`` to work with ``module-versions`` in hooksconfig for
``gi``. (:issue:`6834`)
* Refactor the GObject introspection (``gi``) hooks so that the processing is
performed only in hook loading stage or in the ``hook()`` function, but not in
the mixture of two. (:issue:`6901`)
* Update the GObject introspection (``gi``) hooks to use newly-introduced
``GiModuleInfo`` object to:

- Check for module availability.
- Perform typelib data collection; equivalent of old ``get_gi_typelibs``
function call.
- Obtain associated shared library path, equivalent of old ``get_gi_libdir``
function call.

The ``get_gi_typelibs`` and ``get_gi_libdir`` functions now internally
use ``GiModuleInfo`` to provide backwards-compatibility for external
users. (:issue:`6901`)

5.1

Not secure
-----------------

Bugfix
~~~~~~

* (Windows) Fix the regression causing the (relative) spec path ending up
prepended to relative icon path twice, resulting in icon not being found.
(:issue:`6788`)
* Prevent collection of an entire Python site when using
:func:`~PyInstaller.utils.hooks.collect_data_files` or
:func:`~PyInstaller.utils.hooks.collect_dynamic_libs` for single-file modules
(:issue:`6789`)
* Prevent the hook utility functions, such as
:func:`~PyInstaller.utils.hooks.collect_submodules`,
:func:`~PyInstaller.utils.hooks.collect_data_files`, and
:func:`~PyInstaller.utils.hooks.collect_dynamic_libs`, from failing to
identify a package when its PEP451-compliant loader does not implement
the optional ``is_package`` method. (:issue:`6790`)
* The :func:`~PyInstaller.utils.hooks.get_package_paths` function now
supports PEP420 namespace packages - although for backwards-compatibility
reasons, it returns only the first path when multiple paths are
present. (:issue:`6790`)
* The hook utility functions
:func:`~PyInstaller.utils.hooks.collect_submodules`,
:func:`~PyInstaller.utils.hooks.collect_data_files`, and
:func:`~PyInstaller.utils.hooks.collect_dynamic_libs`) now support
collection from PEP420 namespace packages. (:issue:`6790`)
* The user-provided spec file path and paths provided via :option:`--workpath`
and :option:`--distpath` are now resolved to absolute full paths before being
passed to PyInstaller's internals. (:issue:`6788`)


Hooks
~~~~~

* Exclude ``doctest`` in the ``pickle`` hook. Update ``PySide2``, ``PySide6``,
``PyQt5``, and ``PyQt6`` hooks with hidden imports that were previously
pulled in by ``doctest`` (that was in turn pulled in by ``pickle``).
(:issue:`6797`)


Bootloader
~~~~~~~~~~

* (Windows) Update the bundled ``zlib`` sources to v1.2.12. (:issue:`6804`)


Bootloader build
~~~~~~~~~~~~~~~~

* Building on Windows with MSVC no longer falls to bits if the PyInstaller repo
is
stored in a directory with a long path. (:issue:`6806`)

5.0.1

Not secure
------------------

Bugfix
~~~~~~

* (Linux) Have ``glib`` runtime hook prepend the frozen application's data
dir to the ``XDG_DATA_DIRS`` environment variable instead of completely
overwriting it. This should fix the case when ``xdg-open`` is used to
launch a system-installed application (for example, opening an URL in a
web browser via the ``webbrowser`` module) and no registered applications
being found. (:issue:`3668`)
* Prevent unactionable errors raised by UPX from terminating the build.
(:issue:`6757`)
* Restore the pre PyInstaller 5.0 behavior of resolving relative paths to icons
as
relative to the spec file rather than the current working directory.
(:issue:`6759`)
* (Windows) Update system DLL inclusion list to allow collection of DLLs from
Visual Studio 2012 (VC11) runtime and Visual Studio 2013 (VC12) runtime,
as well as the latest version of Visual Studio 2015/2017/2019/2022 (VC14)
runtime (14.3). (:issue:`6778`)


Hooks
~~~~~

* Refactor ``QtWebEngine`` hooks to support both pure Widget-based and
pure QML/Quick-based applications. (:issue:`6753`)
* Update PySide6 and PyQt6 hooks for compatibility with Qt 6.3. ``QtWebEngine``
on Windows and Linux does not provide the ``qt.conf`` file for the helper
executable anymore, so we generate our own version of the file in order for
``QtWebengine`` -based frozen applications to work. (:issue:`6769`)

5.0

Not secure
----------------

Features
~~~~~~~~

* (macOS) App bundles built in ``onedir`` mode can now opt-in for :ref:`argv
emulation <macos event forwarding and argv emulation>` so that file paths
passed from the UI (`Open with...`) are reflected in :data:`sys.argv`.
(:issue:`5908`)
* (macOS) App bundles built in ``onedir`` mode can now opt-in for :ref:`argv
emulation <macos event forwarding and argv emulation>` so that file paths
received in initial drag & drop event are reflected in :data:`sys.argv`.
(:issue:`5436`)
* (macOS) The :ref:`argv emulation <macos event forwarding and argv emulation>`
functionality is now available as an optional feature for app bundles
built in either ``onefile`` or ``onedir`` mode. (:issue:`6089`)
* (Windows) Embed the manifest into generated ``onedir`` executables by
default, in order to avoid potential issues when user renames the executable
(e.g., the manifest not being found anymore due to activation context
caching when user renames the executable and attempts to run it before
also renaming the manifest file). The old behavior of generating the
external manifest file in ``onedir`` mode can be re-enabled using the
``--no-embed-manifest`` command-line switch, or via the
``embed_manifest=False`` argument to ``EXE()`` in the .spec file.
(:issue:`6223`)
* (Wine) Prevent collection of Wine built-in DLLs (in either PE-converted or
fake/placeholder form) when building a Windows frozen application under
Wine. Display a warning for each excluded Wine built-in DLL. (:issue:`6149`)
* Add a :mod:`PyInstaller.isolated` submodule as a safer replacement to
:func:`PyInstaller.utils.hooks.exec_statement`. (:issue:`6052`)
* Improve matching of UPX exclude patterns to include OS-default case
sensitivity,
the wildcard operator (``*``), and support for parent directories in the
pattern.
Enables use of patterns like ``"Qt*.dll"`` and ``"PySide2*.pyd"``.
(:issue:`6161`)
* Make the error handing of :func:`~PyInstaller.utils.hooks.collect_submodules`
configurable. (:issue:`6052`)


Bugfix
~~~~~~

* (macOS) Fix potential loss of Apple Events during ``onefile`` app bundle
start-up, when the child process is not yet ready to receive events
forwarded by the parent process. (:issue:`6089`)
* (Windows) Remove the attempt to load the manifest of a ``onefile``
frozen executable via the activation context, which fails with *An
attempt to set the process default activation context failed because
the process default activation context was already set.* message that
can be observed in debug builds. This approach has been invalid ever
since :issue:`3746` implemented direct manifest embedding into the
``onefile`` executable. (:issue:`6203`)
* Fix an import leak when
:func:`PyInstaller.utils.hooks.get_module_file_attribute`
is called with a sub-module or a sub-package name. (:issue:`6169`)
* Fix an import leak when :func:`PyInstaller.utils.hooks.is_package`
is called with a sub-module or a sub-package name. (:issue:`6169`)
* Fix import errors when calling ``get_gi_libdir()`` during packaging of GTK
apps.
Enable CI tests of GTK by adding PyGObject dependencies for the Ubuntu
builds. (:issue:`6300`)
* Issue an error report if a `.spec` file will not be generated, but
command-line options specific to that functionality are given.
(:issue:`6660`)
* Prevent ``onefile`` cleanup from recursing into symlinked directories and
just remove the link instead. (:issue:`6074`)


Incompatible Changes
~~~~~~~~~~~~~~~~~~~~

* (macOS) App bundles built in ``onefile`` mode do not perform
:ref:`argv emulation <macos event forwarding and argv emulation>` by
default anymore. The functionality of converting initial open document/URL
events into ``sys.argv`` entries must now be explicitly opted-in,
via ``argv_emulation=True`` argument to ``EXE()`` in the .spec file
or via :option:`--argv-emulation` command-line flag. (:issue:`6089`)
* (Windows) By default, manifest is now embedded into the executable in
``onedir`` mode. The old behavior of generating the external manifest
file can be re-enabled using the ``--no-embed-manifest``
command-line switch, or via the ``embed_manifest=False`` argument to
``EXE()`` in the .spec file. (:issue:`6223`)
* Issue an error report if a `.spec` file will not be generated, but
command-line options specific to that functionality are given.
(:issue:`6660`)
* The :func:`PyInstaller.utils.hooks.get_module_attribute` function now
returns the actual attribute value instead of its string representation.
The external users (e.g., 3rd party hooks) of this function must adjust
their handling of the return value accordingly. (:issue:`6169`)
* The ``matplotlib.backends`` hook no longer collects all available
``matplotlib`` backends, but rather tries to auto-detect the used
backend(s) by default. The old behavior can be re-enabled via the
:ref:`hook configuration option <matplotlib hook options>`. (:issue:`6024`)


Hooks
~~~~~

* Rework the ``matplotlib.backends`` hook to attempt performing
auto-detection of the used backend(s) instead of collecting all
available backends. Implement :ref:`hook configuration option
<matplotlib hook options>` that allows users to switch between
this new behavior and the old behavior of collecting all backends,
or to manually specify the backend(s) to be collected. (:issue:`6024`)


Bootloader
~~~~~~~~~~

* Change the behaviour of the ``--no-universal2`` flag so that it now assumes
the
target architecture of the compiler (which may be overridden via the ``CC``
environment variable to facilitate cross compiling). (:issue:`6096`)
* Refactor Apple Events handling code and move it into a separate source file.
(:issue:`6089`)


Documentation
~~~~~~~~~~~~~

* Add a :ref:`new section <macos event forwarding and argv emulation>`
describing Apple Event forwarding behavior on macOS and the optional
`argv emulation` for macOS app bundles, along with its caveats.
(:issue:`6089`)
* Update documentation on using ``UPX``. (:issue:`6161`)


PyInstaller Core
~~~~~~~~~~~~~~~~

* Drop support for Python 3.6. (:issue:`6475`)


Bootloader build
~~~~~~~~~~~~~~~~

* (Windows) Enable `Control Flow Guard
<https://docs.microsoft.com/en-us/windows/win32/secbp/control-flow-guard>`_
for the Windows bootloader. (:issue:`6136`)

4.10

Not secure
-----------------

Features
~~~~~~~~

* (Wine) Prevent collection of Wine built-in DLLs (in either PE-converted or
fake/placeholder form) when building a Windows frozen application under
Wine. Display a warning for each excluded Wine built-in DLL. (:issue:`6622`)


Bugfix
~~~~~~

* (Linux) Remove the timeout on ``objcopy`` operations to prevent wrongful
abortions when processing large executables on slow disks. (:issue:`6647`)
* (macOS) Limit the strict architecture validation for collected binaries to
extension modules only. Fixes architecture validation errors when a
``universal2`` package has its multi-arch extension modules' arch slices
linked against distinct single-arch thin shared libraries, as is the
case with ``scipy`` 1.8.0 macOS ``universal2`` wheel. (:issue:`6587`)
* (macOS) Remove the 60 seconds timeout for each ``codesign`` and ``lipo``
operation which caused build abortion when
processing huge binaries. (:issue:`6644`)
* (Windows) Use a made up (not ``.exe``) suffix for intermediate executable
files during the build process to prevent
antiviruses from attempting to scan the file whilst PyInstaller is still
working on it leading to a
:class:`PermissionError` at build time. (:issue:`6467`)
* Fix an attempt to collect a non-existent ``.pyc`` file when the corresponding
source ``.py`` file has ``st_mtime`` set to zero. (:issue:`6625`)


Hooks
~~~~~

* Add ``IPython`` to the list of excluded packages in the ``PIL`` hook in
order to prevent automatic collection of ``IPython`` when it is not
imported anywhere else. This in turn prevents whole ``matplotlib`` being
automatically pulled in when using ``PIL.Image``. (:issue:`6605`)


Bootloader
~~~~~~~~~~

* Fix detection of 32-bit ``arm`` platform when Thumb instruction set is
enabled in the compiler. In this case, the ``ctx.env.DEST_CPU`` in
``waf`` build script is set to ``thumb`` instead of ``arm``. (:issue:`6532`)

4.9

Not secure
----------------

Bugfix
~~~~~~

* Add support for external paths when running ``pkgutil.iter_modules``.
Add support for multiple search paths to ``pkgutil.iter_modules``.
Correctly handle ``pkgutil.iter_modules`` with an empty list.
(:issue:`6529`)
* Fix finding ``libpython3x.so`` when Python is installed with pyenv and the
python executable is not linked against ``libpython3x.so``. (:issue:`6542`)
* Fix handling of symbolic links in the path matching part of the
PyInstaller's ``pkgutil.iter_modules`` replacement/override. (:issue:`6537`)


Hooks
~~~~~

* Add hooks for ``PySide6.QtMultimedia`` and ``PyQt6.QtMultimedia``.
(:issue:`6489`)
* Add hooks for ``QtMultimediaWidgets`` of all four supported Qt bindings
(``PySide2``, ``PySide6``, ``PyQt5``, and ``PySide6``). (:issue:`6489`)
* Add support for ``setuptools 60.7.1`` and its vendoring of ``jaraco.text``
in ``pkg_resources``. Exit with an error message if ``setuptools 60.7.0``
is encountered due to incompatibility with PyInstaller's loader logic.
(:issue:`6564`)
* Collect the ``QtWaylandClient``-related plugins to enable Wayland support in
the
frozen applications using any of the four supported Qt bindings (``PySide2``,
``PyQt5``, ``PySide6``, and ``PyQt6``). (:issue:`6483`)
* Fix the issue with missing ``QtMultimediaWidgets`` module when using
``PySide2.QtMultimedia`` or ``PySide6.QtMultimedia`` in combination
with PySide's ``true_property`` `feature
<https://doc.qt.io/qtforpython/feature-why.html#the-true-property-feature>`_.
(:issue:`6489`)

Page 6 of 8

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.