Setuptools

Latest version: v75.8.0

Safety actively analyzes 696928 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 23 of 114

60.4.0

Not secure
=======


Changes
-------
* 2839: Removed ``requires`` sorting when installing wheels as an egg dir.
* 2953: Fixed a bug that easy install incorrectly parsed Python 3.10 version string.
* 3006: Fixed startup performance issue of Python interpreter due to imports of
costly modules in ``_distutils_hack`` -- by :user:`tiran`

Documentation changes
---------------------
* 2674: Added link to additional resources on packaging in Quickstart guide
* 3008: "In-tree" Sphinx extension for "favicons" replaced with ``sphinx-favicon``.
* 3008: SVG images (logo, banners, ...) optimised with the help of the ``scour``
package.

Misc
----
* 2862: Added integration tests that focus on building and installing some packages in
the Python ecosystem via ``pip`` -- by :user:`abravalheri`
* 2952: Modified "vendoring" logic to keep license files.
* 2968: Improved isolation for some tests that where inadvertently using the project
root for builds, and therefore creating directories (e.g. ``build``, ``dist``,
``*.egg-info``) that could interfere with the outcome of other tests
-- by :user:`abravalheri`.
* 2968: Introduced new test fixtures ``venv``, ``venv_without_setuptools``,
``bare_venv`` that rely on the ``jaraco.envs`` package.
These new test fixtures were also used to remove the (currently problematic)
dependency on the ``pytest_virtualenv`` plugin.
* 2968: Removed ``tmp_src`` test fixture. Previously this fixture was copying all the
files and folders under the project root, including the ``.git`` directory,
which is error prone and increases testing time.

Since ``tmp_src`` was used to populate virtual environments (installing the
version of ``setuptools`` under test via the source tree), it was replaced by
the new ``setuptools_sdist`` and ``setuptools_wheel`` fixtures (that are build
only once per session testing and can be shared between all the workers for
read-only usage).

60.3.1

Not secure
=======


Misc
----
* 3002: Suppress AttributeError when detecting get-pip.

60.3.0

Not secure
=======


Changes
-------
* 2993: In _distutils_hack, bypass the distutils exception for pip when get-pip is being invoked, because it imports setuptools.

Misc
----
* 2989: Merge with pypa/distutils788cc159. Includes fix for config vars missing from sysconfig.

60.2.0

Not secure
=======


Changes
-------
* 2974: Setuptools now relies on the Python logging infrastructure to log messages. Instead of using ``distutils.log.*``, use ``logging.getLogger(name).*``.
* 2987: Sync with pypa/distutils2def21c5d74fdd2fe7996ee4030ac145a9d751bd, including fix for missing get_versions attribute (2969), more reliance on sysconfig from stdlib.

Misc
----
* 2962: Avoid attempting to use local distutils when the presiding version of Setuptools on the path doesn't have one.
* 2983: Restore 'add_shim' as the way to invoke the hook. Avoids compatibility issues between different versions of Setuptools with the distutils local implementation.

60.1.1

Not secure
=======


Misc
----
* 2980: Bypass distutils loader when setuptools module is no longer available on sys.path.

60.1.0

Not secure
=======


Changes
-------
* 2958: In distutils_hack, only add the metadata finder once. In ensure_local_distutils, rely on a context manager for reliable manipulation.
* 2963: Merge with pypa/distutilsa5af364910. Includes revisited fix for pypa/distutils15 and improved MinGW/Cygwin support from pypa/distutils77.

Page 23 of 114

Links

Releases

Has known vulnerabilities

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.