alt-python313-setuptools (69.0.2-4) stable; urgency=medium

  * SECURITY UPDATE: MANIFEST.in exclusion bypass via Unicode normalization
    - debian/patches/CVE-2026-59890.patch: normalize both the MANIFEST.in
      pattern and the walked path to NFC before matching, via a new
      unicode_utils.normalize() helper and a _NormalizedMatcher wrapper in
      translate_pattern(), so an exclude/global-exclude/recursive-exclude/
      prune rule can no longer be bypassed by an NFC/NFD mismatch and leak
      the excluded file into the source distribution (CWE-176/CWE-697).
    - CVE-2026-59890

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 02 Sep 2026 12:00:00 +0000

alt-python313-setuptools (69.0.2-3) stable; urgency=medium

  * SECURITY UPDATE: command injection in PackageIndex VCS downloads
    - debian/patches/CVE-2024-6345.patch: pass argv lists to
      subprocess.check_call() instead of interpolating the URL and revision
      into an os.system() shell string (CWE-78).
    - CVE-2024-6345
  * SECURITY UPDATE: path traversal in the download filename
    - debian/patches/CVE-2025-47273.patch: sanitise the name derived from the
      URL so a percent-encoded absolute path cannot escape tmpdir (CWE-22).
    - CVE-2025-47273

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Thu, 27 Aug 2026 12:00:00 +0000

alt-python313-setuptools (69.0.2-2) stable; urgency=medium

  * ALTPYTH-595: Build alt-python packages for Debian 12 and 13 on ARM

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Fri, 27 Mar 2026 00:00:00 +0000

alt-python313-setuptools (69.0.2-1) stable; urgency=medium

  * ALTPYTH-533 Initial build.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Thu, 14 Nov 2024 13:20:00 +0300
