Setuptools

Latest version: v69.5.1

Safety actively analyzes 630130 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 15 of 109

61.0.0

Not secure
=======


Deprecations
------------
* 3068: Deprecated ``setuptools.config.read_configuration``,
``setuptools.config.parse_configuration`` and other functions or classes
from ``setuptools.config``.

Users that still need to parse and process configuration from ``setup.cfg`` can
import a direct replacement from ``setuptools.config.setupcfg``, however this
module is transitional and might be removed in the future
(the ``setup.cfg`` configuration format itself is likely to be deprecated in the future).

Breaking Changes
----------------
* 2894: If you purposefully want to create an *"empty distribution"*, please be aware
that some Python files (or general folders) might be automatically detected and
included.

Projects that currently don't specify both ``packages`` and ``py_modules`` in their
configuration and contain extra folders or Python files (not meant for distribution),
might see these files being included in the wheel archive or even experience
the build to fail.

You can check details about the automatic discovery (and how to configure a
different behaviour) in :doc:`/userguide/package_discovery`.
* 3067: If the file ``pyproject.toml`` exists and it includes project
metadata/config (via ``[project]`` table or ``[tool.setuptools]``),
a series of new behaviors that are not backward compatible may take place:

- The default value of ``include_package_data`` will be considered to be ``True``.
- Setuptools will attempt to validate the ``pyproject.toml`` file according
to PEP 621 specification.
- The values specified in ``pyproject.toml`` will take precedence over those
specified in ``setup.cfg`` or ``setup.py``.

Changes
-------
* 2887: **[EXPERIMENTAL]** Added automatic discovery for ``py_modules`` and ``packages``
-- by :user:`abravalheri`.

Setuptools will try to find these values assuming that the package uses either
the *src-layout* (a ``src`` directory containing all the packages or modules),
the *flat-layout* (package directories directly under the project root),
or the *single-module* approach (an isolated Python file, directly under
the project root).

The automatic discovery will also respect layouts that are explicitly
configured using the ``package_dir`` option.

For backward-compatibility, this behavior will be observed **only if both**
``py_modules`` **and** ``packages`` **are not set**.
(**Note**: specifying ``ext_modules`` might also prevent auto-discover from
taking place)

If setuptools detects modules or packages that are not supposed to be in the
distribution, please manually set ``py_modules`` and ``packages`` in your
``setup.cfg`` or ``setup.py`` file.
If you are using a *flat-layout*, you can also consider switching to
*src-layout*.
* 2887: **[EXPERIMENTAL]** Added automatic configuration for the ``name`` metadata
-- by :user:`abravalheri`.

Setuptools will adopt the name of the top-level package (or module in the case
of single-module distributions), **only when** ``name`` **is not explicitly
provided**.

Please note that it is not possible to automatically derive a single name when
the distribution consists of multiple top-level packages or modules.
* 3066: Added vendored dependencies for :pypi:`tomli`, :pypi:`validate-pyproject`.

These dependencies are used to read ``pyproject.toml`` files and validate them.
* 3067: **[EXPERIMENTAL]** When using ``pyproject.toml`` metadata,
the default value of ``include_package_data`` is changed to ``True``.
* 3068: **[EXPERIMENTAL]** Add support for ``pyproject.toml`` configuration
(as introduced by :pep:`621`). Configuration parameters not covered by
standards are handled in the ``[tool.setuptools]`` sub-table.

In the future, existing ``setup.cfg`` configuration
may be automatically converted into the ``pyproject.toml`` equivalent before taking effect
(as proposed in 1688). Meanwhile users can use automated tools like
:pypi:`ini2toml` to help in the transition.

Please note that the legacy backend is not guaranteed to work with
``pyproject.toml`` configuration.

-- by :user:`abravalheri`
* 3125: Implicit namespaces (as introduced in :pep:`420`) are now considered by default
during :doc:`package discovery </userguide/package_discovery>`, when
``setuptools`` configuration and project metadata are added to the
``pyproject.toml`` file.

To disable this behaviour, use ``namespaces = False`` when explicitly setting
the ``[tool.setuptools.packages.find]`` section in ``pyproject.toml``.

This change is backwards compatible and does not affect the behaviour of
configuration done in ``setup.cfg`` or ``setup.py``.
* 3152: **[EXPERIMENTAL]** Added support for ``attr:`` and ``cmdclass`` configurations
in ``setup.cfg`` and ``pyproject.toml`` when ``package_dir`` is implicitly
found via auto-discovery.
* 3178: Postponed importing ``ctypes`` when hiding files on Windows.
This helps to prevent errors in systems that might not have ``libffi`` installed.
* 3179: Merge with pypa/distutils267dbd25ac

Documentation changes
---------------------
* 3172: Added initial documentation about configuring ``setuptools`` via ``pyproject.toml``
(using standard project metadata).

Misc
----
* 3065: Refactored ``setuptools.config`` by separating configuration parsing (specific
to the configuration file format, e.g. ``setup.cfg``) and post-processing
(which includes directives such as ``file:`` that can be used across different
configuration formats).

60.10.0

Not secure
========


Changes
-------
* 2971: Deprecated upload_docs command, to be removed in the future.
* 3137: Use samefile from stdlib, supported on Windows since Python 3.2.
* 3170: Adopt nspektr (vendored) to implement Distribution._install_dependencies.

Documentation changes
---------------------
* 3144: Added documentation on using console_scripts from setup.py, which was previously only shown in setup.cfg -- by :user:`xhlulu`
* 3148: Added clarifications about ``MANIFEST.in``, that include links to PyPUG docs
and more prominent mentions to using a revision control system plugin as an
alternative.
* 3148: Removed mention to ``pkg_resources`` as the recommended way of accessing data
files, in favour of importlib.resources.
Additionally more emphasis was put on the fact that *package data files* reside
**inside** the *package directory* (and therefore should be *read-only*).

Misc
----
* 3120: Added workaround for intermittent failures of backend tests on PyPy.
These tests now are marked with `XFAIL
<https://docs.pytest.org/en/stable/how-to/skipping.html>`_, instead of erroring
out directly.
* 3124: Improved configuration for :pypi:`rst-linker` (extension used to build the
changelog).
* 3133: Enhanced isolation of tests using virtual environments - PYTHONPATH is not leaking to spawned subprocesses -- by :user:`befeleme`
* 3147: Added options to provide a pre-built ``setuptools`` wheel or sdist for being
used during tests with virtual environments.
Paths for these pre-built distribution files can now be set via the environment
variables: ``PRE_BUILT_SETUPTOOLS_SDIST`` and ``PRE_BUILT_SETUPTOOLS_WHEEL``.

60.9.3

Not secure
=======


Misc
----
* 3093: Repaired automated release process.

60.9.2

Not secure
=======


Misc
----
* 3035: When loading distutils from the vendored copy, rewrite ``__name__`` to ensure consistent importing from inside and out.

60.9.1

Not secure
=======


Misc
----
* 3102: Prevent vendored importlib_metadata from loading distributions from older importlib_metadata.
* 3103: Fixed issue where string-based entry points would be omitted.
* 3107: Bump importlib_metadata to 4.11.1 addressing issue with parsing requirements in egg-info as found in PyPy.

60.9.0

Not secure
=======


Changes
-------
* 2876: In the build backend, allow single config settings to be supplied.
* 2993: Removed workaround in distutils hack for get-pip now that pypa/get-pip137 is closed.
* 3085: Setuptools no longer relies on ``pkg_resources`` for entry point handling.
* 3098: Bump vendored packaging to 21.3.
* Removed bootstrap script.

.. warning:: Users trying to install the unmaintained :pypi:`pathlib` backport
from PyPI/``sdist``/source code may find problems when using ``setuptools >= 60.9.0``.
This happens because during the installation, the unmaintained
implementation of ``pathlib`` is loaded and may cause compatibility problems
(it does not expose the same public API defined in the Python standard library).

Whenever possible users should avoid declaring ``pathlib`` as a dependency.
An alternative is to pre-build a wheel for ``pathlib`` using a separated
virtual environment with an older version of setuptools and install the
library directly from the pre-built wheel.

Page 15 of 109

Links

Releases

Has known vulnerabilities

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.