alt-python36-setuptools (38.5.2-11) stable; urgency=medium

  * SECURITY UPDATE: MANIFEST.in exclusion bypass via Unicode normalization
    - debian/patches/CVE-2026-59890.patch: normalize pattern and path to NFC
      before matching in FileList (translate_pattern / unicode_utils)
    - CVE-2026-59890

 -- Viktor Borzov <vborzov@cloudlinux.com>  Tue, 21 Jul 2026 14:15:00 +0100

alt-python36-setuptools (38.5.2-10) stable; urgency=medium

  * SECURITY UPDATE: regex denial of service via crafted HTML
    - debian/patches/CVE-2022-40897.patch: limit whitespace matching in REL regex
    - CVE-2022-40897
  * SECURITY UPDATE: remote code execution via command injection in VCS downloads
    - debian/patches/CVE-2024-6345.patch: replace os.system with subprocess.check_call
    - CVE-2024-6345
  * SECURITY UPDATE: path traversal in download filename resolution
    - debian/patches/CVE-2025-47273.patch: validate download filename stays within tmpdir
    - CVE-2025-47273

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 08 Apr 2026 12:00:00 +0100

alt-python36-setuptools (38.5.2-9) stable; urgency=medium

  * ALTPYTH-586: Initial build for arm64

 -- Levon Matshkalyan <lmatshkalyan@corp.cloudlinux.com>  Thu, 26 Feb 2026 17:00:00 +0400

alt-python36-setuptools (38.5.2-8) stable; urgency=medium

  * ALTPYTH-560: Initial build.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 23 Jul 2025 13:20:00 +0300
