CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

devel/py-setuptools63.1.0_3

Python packages installer

Maintainer
python@FreeBSD.org
Packages
py311-setuptools 63.1.0_3, py312-setuptools 63.1.0_3, py313-setuptools 63.1.0_3, py313t-setuptools 63.1.0_3, py314-setuptools 63.1.0_3, py314t-setuptools 63.1.0_3, py315-setuptools 63.1.0_3
Upstream
Higher version available: 84.2.1
CPE
python:setuptools from the port
WWW
https://github.com/pypa/setuptools
Links
cgit · VuXML

Unaddressed (2) · The CVE record lists this version as affected, no VuXML entry names the CVE

CVE-2025-472737.72025-05-17setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is presen…
CVE-2022-408975.92022-12-23Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page…

VuXML only (2) · listed, port not fixed yet

CVE-2025-472737.72025-05-17VuXML · setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is presen…

Fixed (0)

No VuXML entries for this package.

Commits (101)

Po-Chuan Hsieh (sunpoet) · 63.1.0_3
devel/py-setuptools: Remove outdated PYTHON_REL check after lang/python39 removal (05de8effa6b4a6fd9758a51d0c1acea91a36d3c6)
f07e5622d2
Charlie Li (vishwin) · 63.1.0_3
devel/py-setuptools@py39: add py39 compat layer to vendored importlib-metadata

...and partially revert a setuptools commit exposing another error.

Context: https://github.com/pypa/setuptools/issues/3452

Reported by: Niels Kobschätzki
PR: 285909
c4dd8f4017
Charlie Li (vishwin) · 63.1.0_3
devel/py-setuptools: account for removed pkgutil methods in Python 3.12

Reported by: jan, Tatsuki Makino
PR: 285957
8927fe8f67
Charlie Li (vishwin) · 63.1.0_3
devel/py-setuptools: convert to USE_PYTHON=pep517

The previous method of building/bootstrapping setuptools via the
built-in distutils module no longer works in Python 3.12+ as it has
been removed [0]. Since USE_PYTHON=pep517 has its own bootstrapping
process, use this method to build setuptools.

This allows newer Python distributions/interpreters to land in the
tree, for the purpose of having buildable packages.

While here, remove a slew of dead code and adjust WWW

[0] https://peps.python.org/pep-0632/

PR: 271673, 274671
8b5ae17d2f
Charlie Li (vishwin) · 63.1.0_2
python: bump all USE_PYTHON=distutils consumers after RUN_DEPENDS removal

Any missed ports, feel free to bump.

Any ports that need setuptools at runtime can have the devel/py-setuptools
manually added back to RUN_DEPENDS, but understand that this practice
is deprecated; see CHANGES for details.
06a08e69f3
Dan Langille (dvl) · 63.1.0_1
devel/py-setuptools: revert upgrade to 68.0.0

This reverts commit 121d8af16a7efd4f4ec25c5851f9976b396192c0.

PR:		270358
b1f7e31dea
Dan Langille (dvl) · 68.0.0
devel/py-setuptools: Update to 68.0.0

PR:		270358
121d8af16a
Rene Ladan (rene) · 63.1.0_1
all: remove explicit versions in USES=python for "3.x+"

The logic in USES=python will automatically convert this to 3.8+ by
itself.

Adjust two ports that only had Python 3.7 mentioned but build fine
on Python 3.8 too.

finance/quickfix: mark BROKEN with PYTHON

libtool: compile:  c++ -DHAVE_CONFIG_H -I. -I../.. -I -I. -I.. -I../.. -I../C++ -DLIBICONV_PLUG -DPYTHON_MAJOR_VERSION=3 -Wno-unused-variable -Wno-maybe-uninitialized -O2 -pipe -DLIBICONV_PLUG -fstack-protector-strong -fno-strict-aliasing -DLIBICONV_PLUG -Wall -ansi -Wno-unused-command-line-argument -Wpointer-arith -Wwrite-strings -Wno-overloaded-virtual -Wno-deprecated-declarations -Wno-deprecated -std=c++0x -MT _quickfix_la-QuickfixPython.lo -MD -MP -MF .deps/_quickfix_la-QuickfixPython.Tpo -c QuickfixPython.cpp  -fPIC -DPIC -o .libs/_quickfix_la-QuickfixPython.o
warning: unknown warning option '-Wno-maybe-uninitialized'; did you mean '-Wno-uninitialized'? [-Wunknown-warning-option]
QuickfixPython.cpp:175:11: fatal error: 'Python.h' file not found
          ^~~~~~~~~~
1 warning and 1 error generated.

Reviewed by:	portmgr, vishwin, yuri
Differential Revision:	<https://reviews.freebsd.org/D40568>
3d9a815d9c
Eugene Grosbein (eugen) · 63.1.0_1
devel/py-setuptools: fix CVE-2022-40897 backporting a patch

This commit integrates one-line upstream fix for the problem:
https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be.diff

Our port has not been fixed for several months making users unhappy.
It's upto the maintainer to update the port, this commit does not update it.

Bump PORTREVISION and adjust VuXML entry.
Due to the nature of the problem and fix there is no need in updating consumers.
3dda704910
Dmitry Marakasov (amdmi3) · 63.1.0
*/*: rename CHEESESHOP to PYPI in MASTER_SITES

PR:			267994
Differential revision:	D37518
Approved by:		bapt
77d68471ad
Stefan Eßer (se) · 63.1.0
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 63.1.0
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Po-Chuan Hsieh (sunpoet) · 63.1.0
devel/py-setuptools: Update to 63.1.0

Changes:	https://github.com/pypa/setuptools/blob/main/CHANGES.rst
PR:		265081
Exp-run by:	antoine
94c675d58d
Thierry Thomas (thierry) · 62.1.0_1
Mk/bsd.default-versions.mk: chase the switch to Python 3.9

Following the rules of
<https://wiki.freebsd.org/Python#Steps_to_switch_the_Python_default_version>

PR:		261703
ad2d6b8e48
Po-Chuan Hsieh (sunpoet) · 62.1.0
devel/py-setuptools: Update to 62.1.0

- Clean up comment

Changes:	https://github.com/pypa/setuptools/blob/main/CHANGES.rst
PR:		262250
Exp-run by:	antoine
eab9e31830
Bernhard Froehlich (decke) · 57.0.0
devel/py-setuptools: Add CPE information

Approved by:	portmgr (blanket)
7448b845fd
Dmitry Marakasov (amdmi3) · 57.0.0
devel/py-setuptools: update to 57.0.0 preserving old version

- Copy devel/py-setuptools to devel/py-setuptools44 (for Python 2.7 support)
- Update devel/py-setuptool to 57.0.0 (adding support for Python 3.10)
- Update Mk/Uses/python.mk to chose between py-setuptools and
  py-setuptools44 based on Python version

This allows us to have latest setuptools and working Python 3.10
without breaking packages requiring Python 2 support for remaining
reports that require it.

Exp-run showed 3 ports failing to build with latest setuptools and
they were fixed.

PR:			256173
Exp-run by:		antoine
Reviewed by:		koobs (python)
Approved by:		koobs (python)
Differential_Revision:	https://reviews.freebsd.org/D30473
7a4ce8f831
Dmitry Marakasov (amdmi3) · 44.0.0_1
Mk: switch PYTHON_REL to 5 digits to support python 3.10.x

PR:		255013
Differential Revision:	https://reviews.freebsd.org/D29418
Exp-run by:	antoine
Approved by:	wen@, no objection from python@ or portmgr@
0729af4255
Po-Chuan Hsieh (sunpoet) · 44.0.0_1
devel/py-setuptools: Remove outdated CONFLICTS_INSTALL

- Cosmetic change

py-distribute was removed 7.5 years ago.
4afa461bfc
Kai Knoblich (kai) · 44.0.0_1
*: Bump a few ports after the Python 3.7 to 3.8 switchover

Bump the PORTREVISION of the following ports as the concurrent symlinks
change with a new default version of Python:

* devel/py-setuptools
* lang/cython
* math/py-numpy

This is a follow-up to 6cd3db2d03cc544c5893e41dbbacd2000fcbd35a .

PR:		253815
Approved by:	kai (python, maintainer)
26d8faac23
Mathieu Arnold (mat) · 44.0.0
One more small cleanup, forgotten yesterday. Reported by:	lwhsu
cf118ccf87
Mathieu Arnold (mat) · 44.0.0
Remove # $FreeBSD$ from Makefiles.
305f148f48
Mathieu Arnold (mat) · 44.0.0
Those ports are allowed to build a 2.7 flavor, for now.
878fe05959
Antoine Brodin (antoine) · 44.0.0
Add a note that this port can't be updated without an exp-run

With hat:	portmgr
38c7fff02a
Sunpoet Po-Chuan Hsieh (sunpoet) · 44.0.0
Update to 44.0.0

Changes:	https://github.com/pypa/setuptools/blob/master/CHANGES.rst
PR:		243329
Exp-run by:	antoine
f3e1ecdf6d
Antoine Brodin (antoine) · 41.4.0_1
Bump PORTREVISION after r520219
7ce822bd88
Sunpoet Po-Chuan Hsieh (sunpoet) · 41.4.0
Update to 41.4.0

Changes:	https://github.com/pypa/setuptools/blob/master/CHANGES.rst
PR:		241377
Exp-run by:	antoine
7fa5bb2fad
Sunpoet Po-Chuan Hsieh (sunpoet) · 41.2.0
Update to 41.2.0

Changes:	https://github.com/pypa/setuptools/blob/master/CHANGES.rst
PR:		240045
Exp-run by:	antoine
b91d2127d2
Sunpoet Po-Chuan Hsieh (sunpoet) · 41.1.0
Update to 41.1.0

Changes:	https://github.com/pypa/setuptools/blob/master/CHANGES.rst
PR:		239862
Exp-run by:	antoine
9de828efb3
Mathieu Arnold (mat) · 41.0.1
Convert to UCL & cleanup pkg-message (categories d)
78d1aff1fc
Steve Wills (swills) · 41.0.1
devel/py-setuptools: Update to 41.0.1

PR:		238460
Approved by:	miwi
730a57ba41
Sunpoet Po-Chuan Hsieh (sunpoet) · 41.0.0
Update to 41.0.0

Changes:	https://github.com/pypa/setuptools/blob/master/CHANGES.rst
PR:		237123
Exp-run by:	antoine
691226a9f4
Antoine Brodin (antoine) · 40.8.0_1
Bump a few PORTREVISIONs after r498529

With hat:	portmgr
63f5eeef8a
Sunpoet Po-Chuan Hsieh (sunpoet) · 40.8.0
Update to 40.8.0

Changes:	https://github.com/pypa/setuptools/blob/master/CHANGES.rst
PR:		235474
Exp-run by:	antoine
d123fc8c0c
Martin Wilke (miwi) · 40.6.3
- Update to 40.6.3

https://github.com/pypa/setuptools/commit/1c1c9152abcb8b1b6a13f1cfb4744f8d73016876

Sponsored by:	iXsystems Inc.
418a4c7d31
Sunpoet Po-Chuan Hsieh (sunpoet) · 40.6.2
Update to 40.6.2

Changes:	https://github.com/pypa/setuptools/blob/master/CHANGES.rst
Differential Revision:	https://reviews.freebsd.org/D18030
PR:		233287
Exp-run by:	antoine
07671393b5
Sunpoet Po-Chuan Hsieh (sunpoet) · 40.4.3
Update to 40.4.3

Changes:	https://github.com/pypa/setuptools/blob/master/CHANGES.rst
PR:		231627
Exp-run by:	antoine
2ec4b91f92
Martin Wilke (miwi) · 40.0.0
- Update to 40.0.0

https://github.com/pypa/setuptools/compare/v40.0.0...master

PR:		229642
Submitted by:	miwi
Exp-run by:	antoine
Sponsored by:	iXsystems Inc.
Differential Revision:	https://reviews.freebsd.org/D16197
e9695119cd
Mathieu Arnold (mat) · 39.2.0
Use PY_FLAVOR for dependencies.

FLAVOR is the current port's flavor, it should not be used outside of
this scope.

Sponsored by:	Absolight
4376dbbb58
Martin Wilke (miwi) · 39.2.0
- Update to 39.2.0

PR:		228250
Submitted by:	myself
Sponsored by:	iXsystems Inc.
Differential Revision:	https://reviews.freebsd.org/D15426
8d632a45e5
Dmitry Marakasov (amdmi3) · 39.0.1
Switch all pypi.python.org WWWs to a new PyPi home pypi.org where they now redirect to anyway. All new urls checked to return 200, I've fixed a couple of them in the process.

Approved by:	portmgr blanket, mat
c637402081
Sunpoet Po-Chuan Hsieh (sunpoet) · 39.0.1
Update to 39.0.1

Changes:	https://github.com/pypa/setuptools/blob/master/CHANGES.rst
PR:		226733
Exp-run by:	antoine
d3223c334c
Martin Wilke (miwi) · 38.5.2
- Update to 38.5.2
f2b1cddf52
Sunpoet Po-Chuan Hsieh (sunpoet) · 38.5.1
Update to 38.5.1

Changes:	https://github.com/pypa/setuptools/blob/master/CHANGES.rst
PR:		225707
Exp-run by:	antoine
785e8e603b
Sunpoet Po-Chuan Hsieh (sunpoet) · 38.2.5
Fix LICENSE

- Add LICENSE_FILE
0e13e3b717
Mathieu Arnold (mat) · 38.2.5
Remove PYTHON*_DEFAULT_VERSION.
8cd72097ee
Sunpoet Po-Chuan Hsieh (sunpoet) · 38.2.5
Update to 38.2.5

Changes:	https://github.com/pypa/setuptools/blob/master/CHANGES.rst
PR:		224676
Exp-run by:	antoine
32e58a9d0f
Mathieu Arnold (mat) · 36.5.0
Convert Python ports to FLAVORS.

Ports using USE_PYTHON=distutils are now flavored.  They will
  automatically get flavors (py27, py34, py35, py36) depending on what
  versions they support.

  There is also a USE_PYTHON=flavors for ports that do not use distutils
  but need FLAVORS to be set.  A USE_PYTHON=noflavors can be set if
  using distutils but flavors are not wanted.

  A new USE_PYTHON=optsuffix that will add PYTHON_PKGNAMESUFFIX has been
  added to cope with Python ports that did not have the Python
  PKGNAMEPREFIX but are flavored.

  USES=python now also exports a PY_FLAVOR variable that contains the
  current python flavor.  It can be used in dependency lines when the
  port itself is not python flavored.  For example, deskutils/calibre.

  By default, all the flavors are generated.  To only generate flavors
  for the versions in PYTHON2_DEFAULT and PYTHON3_DEFAULT, define
  BUILD_DEFAULT_PYTHON_FLAVORS in your make.conf.

  In all the ports with Python dependencies, the *_DEPENDS entries MUST
  end with the flavor so that the framework knows which to build/use.
  This is done by appending '@${PY_FLAVOR}' after the origin (or
  @${FLAVOR} if in a Python module with Python flavors, as the content
  will be the same).  For example:

    RUN_DEPENDS= ${PYTHON_PKGNAMEPREFIX}six>0:devel/py-six@${PY_FLAVOR}

PR:		223071
Reviewed by:	portmgr, python
Sponsored by:	Absolight
Differential Revision:	https://reviews.freebsd.org/D12464
551be3c723
Antoine Brodin (antoine)
Rename python setuptools ports to better match other python ports

Reviewed by:	mat, sunpoet
With hat:	portmgr
Differential Revision:	https://reviews.freebsd.org/D9983
20b3a34a02
Wen Heping (wen) · 32.1.0
- Update to 32.1.0

PR:		215376
Submitted by:	wen@(myself)
Exp-run by:	antoine@
8f545fbb59