Skip to content

Upgrading setuptools 64 to 65

Breaking64.0.3 → 65.7.0Breaking3Security2Deprecated1Changed4Fixed15Other13

Full comparisonBack to setuptools
BreakingUpgrade verdict

3 breaking changes and 2 security fixes.

In plain terms
  • Setuptools no longer patches Python's MSVC 9 compiler module at import time.
  • Two old Windows compiler helper modules bundled with setuptools are gone, so code importing them will fail.
  • The commands for building Windows MSI installers and old-style Windows installers are removed. Projects that still need them must stay on an older setuptools release.
  • A crafted input could make a regular expression in the package index code run very slowly, tying up the process. This release fixes that.
Must act Top 5 of 6 that need code or config changes

What you must change

Breaking3
Removes monkeypatching of msvc9compiler.
msvc9compiler
65.1.0NEWS.rstSummarizedView source
Removes the 'msvccompiler' and 'msvc9compiler' modules from distutils.
msvccompilermsvc9compiler
65.0.0NEWS.rstSummarizedView source
Removes the bdist_msi and bdist_wininst commands, deprecated since Python 3.9; use older Setuptools if needed.
bdist_msibdist_wininst
65.0.0NEWS.rstSummarizedView source
Security2
Fixes a ReDoS (regular expression denial of service) vector in package_index.
package_index
65.5.1NEWS.rstSummarizedView source
Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
65.5.1GitHub AdvisoryOriginalView source

Deprecations to plan for

Deprecated1
Restores the distutils msvccompiler and msvc9compiler modules and marks them as deprecated.
distutils.msvccompilerdistutils.msvc9compiler
65.0.2NEWS.rstSummarizedView source