Upgrading distlib 0.3 to 0.4
Breaking0.3.9 → 0.4.4Security7Platform1New3Changed5Fixed13Other1
Securityunarchive() now resolves member paths through earlier symlinks to prevent writes outside the destination on Pythons without extraction filters.Advisory ↗
BreakingUpgrade verdict
A platform requirement change and 7 security fixes.
In plain terms
- The package now works with the free-threaded build of Python 3.13.
- Extraction now follows symlinks seen earlier in the same archive, so chained links cannot be used to write files outside the target directory.
- Makes decompression safer when handling untrusted or malicious archives.
- Prevents resource paths from being built in a way that reaches outside the package.
Must act Top 4 of 8 that need code or config changes
What you must change
Security7
unarchive() now resolves member paths through earlier symlinks to prevent writes outside the destination on Pythons without extraction filters.
unarchive()Hardens decompression against malicious input.
Ensures constructed resource paths cannot escape the package.
Checks during unarchiving that the destination directory is not escaped via symlinks.
Adds checks that installed files do not escape the installation directory.
Adds checks when mounting extensions to ensure path containment.
Fixes a path traversal bug in entry point handling that allowed escaping the scripts directory.
Platform1
Adds support for the free-threading version of Python (3.13t).
API changes
Generated by DepDelta from published Python source. Not mixed with prose notes.
- changed:
function cache_from_source(path, debug_override=…) → function cache_from_source(path, debug_override=…, optimization=…)
- removed:
field SimpleScrapingLocator.decoders - added:
field SimpleScrapingLocator.decode_size_limit
- added:
property Metadata.urls
- added:
function is_in_directory(path, target)