Repository navigation
Version 68.0.0.post3 - #8
Conversation
Release the 68.0.0.3 security fixes (#7) as 68.0.0.post3, following the X.Y.Z.postN scheme the ActiveState forks now use for security releases. Only the version strings change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ezequielp-activestate
left a comment
ezequielp-activestate
left a comment
There was a problem hiding this comment.
Requesting changes. Under PEP 440, 68.0.0.post3 sorts below the releases it is meant to replace.
68.0.0.postN is a post-release of 68.0.0, so it ranks above 68.0.0 and below 68.0.0.1. Sorted with packaging.version.Version:
['68.0.0', '68.0.0.post3', '68.0.0.1', '68.0.0.2', '68.0.0.2.post1', '68.0.0.3']
Both v68.0.0.1 and v68.0.0.2 are published releases on this repo, so with this name:
- An environment that already has 68.0.0.2 is never upgraded.
pip install --upgrade setuptoolsandensurepip --upgradeboth see 68.0.0.2 as newer, so an in-place CPython 3.7.17.8 upgrade keeps the vulnerable setuptools. - Anything that picks "the latest version" (a resolver, a feed, the inventory) picks 68.0.0.2 over this release.
- A requirement such as
setuptools>=68.0.0.2rejects it.
The X.Y.Z.postN scheme works for the pip and urllib3 forks because those lines never had an X.Y.Z.N release. This line has two.
Suggested fix: keep 68.0.0.3, as merged in #7, or use 68.0.0.2.post1 if it needs to read as a post-release. Either sorts above 68.0.0.2.
Same problem on the 2.7 line: v44.1.1.post3 (released 2026-10-22) sorts below the earlier v44.1.1.1 release, for the same reason.
|
No - we are moving to the new system everything new is post. |
ezequielp-activestate
left a comment
ezequielp-activestate
left a comment
There was a problem hiding this comment.
Approving. Going with the .postN scheme for new releases. The rename touches only the three version files, and a wheel built from this branch is setuptools-68.0.0.post3-py3-none-any.whl.
Renames the version merged in #7 from 68.0.0.3 to 68.0.0.post3 (the
X.Y.Z.postNscheme the ActiveState forks use for security releases), so the release can be taggedv68.0.0.post3. Onlysetup.cfg,.bumpversion.cfgand theCHANGES.rstheading change; the code is #7's (CVE-2026-59890, GHSA-xmj3-9gf7-h52w).