[dependabot]

Updates the requirements on setuptools to permit the latest version.

Changelog

Sourced from setuptools's changelog.

v84.2.0

Features

• Added support for building abi3t extensions and abi3.abi3t wheels on Python 3.15 and newer. See :pep:803 and the Python 3.15 "What's New" entry <https://docs.python.org/3.15/whatsnew/3.15.html#pep-803-abi3t-stable-abi-for-free-threaded-builds>_ for more details. (#5193)
• Updated vendored packaging version to 26.3, which adds support for the abi3t tag from :pep:803. (#5361)

Bugfixes

• Use target sysconfig data for stable-ABI extension filenames. (#5351)

v84.1.0

Features

• setuptools.archive_util now raises the new UnsafeMember exception when an archive member would be extracted outside of the extraction directory, where previously such a member was silently skipped. Aborting makes a malicious or malformed archive visible to the caller instead of yielding a quietly incomplete extraction, and matches the behavior of the standard library's tarfile extraction filters.

Bugfixes

• Wheel.install_as_egg no longer creates namespace package directories outside of the destination egg directory. Entries in a wheel's namespace_packages.txt were split on . and passed straight to os.path.join, so an entry that was absolute, drive-qualified, or UNC discarded the destination and placed an __init__.py at a path chosen by the wheel. Namespace entries are now validated as dotted module names on every platform -- see GHSA-xmj3-9gf7-h52w.

  This code path is reached only by the deprecated setup_requires mechanism when setup() is invoked outside a PEP 517 frontend; the setuptools build backend never reaches it.

• setuptools.archive_util no longer extracts archive members outside of the requested extraction directory. Both the tar and zip formats specify / as

... (truncated)

Commits

• 301e27a Bump version: 84.1.0 → 84.2.0
• 39a7c2e Merge pull request #5193 from ngoldbaum/abi3.abi3t
• 7b5dea7 Merge branch 'main' into abi3.abi3t
• b3985b6 Merge pull request #5352 from jameshilliard/fix/abi3-target-platform
• 0c3f3c4 Merge pull request #5361 from pypa/feature/vendor-packaging-26.3
• 77b7ace Bump version: 84.0.0 → 84.1.0
• 97b75e6 Use target sysconfig for platform-qualified stable-ABI suffixes
• 4b02939 Add news fragment.
• 56bc40e Update vendored packaging version to 26.3
• e66004c Merge pull request #5329 from pypa/fix/wheel-namespace-path-escape
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[yliaog]

/lgtm
/approve

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dependabot[bot], yliaog

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [yliaog]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[yliaog]

/release-note-none