Upgrading wheel 0.45 to 0.46
Breaking0.45.1 → 0.46.3Breaking2Security1Platform1Deprecated1Changed2Fixed4
SecurityHigh · CVSS 7.1Fixes wheel unpack potentially altering permissions of files outside the destination tree with maliciously crafted wheels.GHSA-8rrh-rw8j-w5fx · CVE-2026-24049 ↗
BreakingUpgrade verdict
2 breaking changes and a platform requirement change and a security fix.
In plain terms
- The built-in bdist_wheel command is gone; importing wheel.bdist_wheel now just points to setuptools' version and warns you.
- wheel.cli is now internal and no longer part of the public API.
- This version no longer works on Python 3.8; you need a newer Python.
- A malicious wheel file could previously change permissions on files outside the folder you unpacked it into. This is now fixed.
Must act 5 items need code or config changes
Python requirement changed in 0.46.0: >=3.8 → >=3.9.
Adds packaging >= 24.0.
Installs 1 package in all (was 0).
What you must change
Breaking2
Removes the bdist_wheel setuptools command implementation and entry point; wheel.bdist_wheel is now an alias to setuptools.command.bdist_wheel with a deprecation warning on import.
bdist_wheelwheel.bdist_wheelsetuptools.command.bdist_wheelMakes the wheel.cli package private without a deprecation warning.
wheel.cliSecurity1
Fixes wheel unpack potentially altering permissions of files outside the destination tree with maliciously crafted wheels.
wheel unpackHigh · CVSS 7.1Platform1
Drops support for Python 3.8.
Deprecations to plan for
Deprecated1
Makes the wheel.metadata module private, emitting a deprecation warning if it is imported.
wheel.metadataAPI changes
Generated by DepDelta from published Python source. Not mixed with prose notes.
- removed:
class WheelError(Exception) - removed:
function convert_f(args: argparse.Namespace) -> None - removed:
function main() - removed:
function pack_f(args: argparse.Namespace) -> None - removed:
function parse_build_tag(build_tag: str) -> str - removed:
function parser() - removed:
function tags_f(args: argparse.Namespace) -> None - removed:
function unpack_f(args: argparse.Namespace) -> None - removed:
function version_f(args: argparse.Namespace) -> None - removed:
variable TAGS_HELP
- removed:
class ConvertSource - removed:
class EggDirectorySource(EggFileSource) - removed:
class EggFileSource(ConvertSource) - removed:
class WininstFileSource(ConvertSource) - removed:
constructor EggFileSource(path: Path) - removed:
constructor WininstFileSource(path: Path) - removed:
field ConvertSource.abi: str - removed:
field ConvertSource.metadata: Message - removed:
field ConvertSource.name: str - removed:
field ConvertSource.platform: str - removed:
field ConvertSource.pyver: str - removed:
field ConvertSource.version: str - removed:
function convert(files: list[str], dest_dir: str, verbose: bool) -> None - removed:
function convert_pkg_info(pkginfo: str, metadata: Message) - removed:
function convert_requires(requires: str, metadata: Message) -> None - removed:
function normalize(name: str) -> str - removed:
method ConvertSource.generate_contents() -> Iterator[tuple[str, bytes]] - removed:
method EggDirectorySource.generate_contents() -> Iterator[tuple[str, bytes]] - removed:
method EggFileSource.generate_contents() -> Iterator[tuple[str, bytes]] - removed:
method WininstFileSource.generate_contents() -> Iterator[tuple[str, bytes]] - removed:
property ConvertSource.dist_info_dir -> str - removed:
variable GENERATOR - removed:
variable egg_filename_re - removed:
variable egg_info_re - removed:
variable pyd_re - removed:
variable serialization_policy - removed:
variable wininst_re
- removed:
function compute_tagline(tags: list[str]) -> str - removed:
function pack(directory: str, dest_dir: str, build_number: str | None) -> None - removed:
variable DIST_INFO_RE
- removed:
function tags(wheel: str, python_tags: str | None=…, abi_tags: str | None=…, platform_tags: str | None=…, build_tag: str | None=…, remove: bool=…) -> str
- removed:
function unpack(path: str, dest: str=…) -> None
- removed:
function convert_requirements(requirements: list[str]) -> Iterator[str] - removed:
function generate_requirements(extras_require: dict[str | None, list[str]]) -> Iterator[tuple[str, str]] - removed:
function pkginfo_to_metadata(egg_info_path: str, pkginfo_path: str) -> Message - removed:
function requires_to_requires_dist(requirement: Requirement) -> str - removed:
function safe_extra(extra: str) -> str - removed:
function safe_name(name: str) -> str - removed:
function split_sections(s: str | Iterator[str]) -> Generator[tuple[str | None, list[str]], None, None] - removed:
function yield_lines(iterable: Iterable[str]) -> Iterator[str]
- removed:
function urlsafe_b64decode(data: bytes) -> bytes - removed:
function urlsafe_b64encode(data: bytes) -> bytes - removed:
variable log
- removed:
class InvalidMarker(ValueError) - removed:
class Marker - removed:
class UndefinedComparison(ValueError) - removed:
class UndefinedEnvironmentName(ValueError) - removed:
constructor Marker(marker: str) -> None - removed:
function default_environment() -> Dict[str, str] - removed:
method Marker.evaluate(environment: Optional[Dict[str, str]]=…) -> bool
- removed:
class InvalidRequirement(ValueError) - removed:
class Requirement - removed:
constructor Requirement(requirement_string: str) -> None
- removed:
class BaseSpecifier - removed:
class InvalidSpecifier(ValueError) - removed:
class Specifier(BaseSpecifier) - removed:
class SpecifierSet(BaseSpecifier) - removed:
constructor Specifier(spec: str=…, prereleases: Optional[bool]=…) -> None - removed:
constructor SpecifierSet(specifiers: str=…, prereleases: Optional[bool]=…) -> None - removed:
method BaseSpecifier.contains(item: str, prereleases: Optional[bool]=…) -> bool - removed:
method BaseSpecifier.filter(iterable: Iterable[UnparsedVersionVar], prereleases: Optional[bool]=…) -> Iterator[UnparsedVersionVar] - removed:
method Specifier.contains(item: UnparsedVersion, prereleases: Optional[bool]=…) -> bool - removed:
method Specifier.filter(iterable: Iterable[UnparsedVersionVar], prereleases: Optional[bool]=…) -> Iterator[UnparsedVersionVar] - removed:
method SpecifierSet.contains(item: UnparsedVersion, prereleases: Optional[bool]=…, installed: Optional[bool]=…) -> bool - removed:
method SpecifierSet.filter(iterable: Iterable[UnparsedVersionVar], prereleases: Optional[bool]=…) -> Iterator[UnparsedVersionVar] - removed:
property BaseSpecifier.prereleases -> Optional[bool] - removed:
property Specifier.operator -> str - removed:
property Specifier.prereleases -> bool - removed:
property Specifier.version -> str - removed:
property SpecifierSet.prereleases -> Optional[bool] - removed:
variable CallableOperator - removed:
variable UnparsedVersion - removed:
variable UnparsedVersionVar
- removed:
class Tag - removed:
constructor Tag(interpreter: str, abi: str, platform: str) -> None - removed:
function compatible_tags(python_version: Optional[PythonVersion]=…, interpreter: Optional[str]=…, platforms: Optional[Iterable[str]]=…) -> Iterator[Tag] - removed:
function cpython_tags(python_version: Optional[PythonVersion]=…, abis: Optional[Iterable[str]]=…, platforms: Optional[Iterable[str]]=…, *, warn: bool=…) -> Iterator[Tag] - removed:
function generic_tags(interpreter: Optional[str]=…, abis: Optional[Iterable[str]]=…, platforms: Optional[Iterable[str]]=…, *, warn: bool=…) -> Iterator[Tag] - removed:
function interpreter_name() -> str - removed:
function interpreter_version(*, warn: bool=…) -> str - removed:
function mac_platforms(version: Optional[MacVersion]=…, arch: Optional[str]=…) -> Iterator[str] - removed:
function parse_tag(tag: str) -> FrozenSet[Tag] - removed:
function platform_tags() -> Iterator[str] - removed:
function sys_tags(*, warn: bool=…) -> Iterator[Tag] - removed:
property Tag.abi -> str - removed:
property Tag.interpreter -> str - removed:
property Tag.platform -> str - removed:
variable INTERPRETER_SHORT_NAMES: Dict[str, str] - removed:
variable MacVersion - removed:
variable PythonVersion - removed:
variable logger
- removed:
class InvalidName(ValueError) - removed:
class InvalidSdistFilename(ValueError) - removed:
class InvalidWheelFilename(ValueError) - removed:
function canonicalize_name(name: str, *, validate: bool=…) -> NormalizedName - removed:
function canonicalize_version(version: Union[Version, str], *, strip_trailing_zero: bool=…) -> str - removed:
function is_normalized_name(name: str) -> bool - removed:
function parse_sdist_filename(filename: str) -> Tuple[NormalizedName, Version] - removed:
function parse_wheel_filename(filename: str) -> Tuple[NormalizedName, Version, BuildTag, FrozenSet[Tag]] - removed:
variable BuildTag - removed:
variable NormalizedName
- removed:
class InvalidVersion(ValueError) - removed:
class Version(_BaseVersion) - removed:
constructor Version(version: str) -> None - removed:
function parse(version: str) -> Version - removed:
property Version.base_version -> str - removed:
property Version.dev -> Optional[int] - removed:
property Version.epoch -> int - removed:
property Version.is_devrelease -> bool - removed:
property Version.is_postrelease -> bool - removed:
property Version.is_prerelease -> bool - removed:
property Version.local -> Optional[str] - removed:
property Version.major -> int - removed:
property Version.micro -> int - removed:
property Version.minor -> int - removed:
property Version.post -> Optional[int] - removed:
property Version.pre -> Optional[Tuple[str, int]] - removed:
property Version.public -> str - removed:
property Version.release -> Tuple[int, ...] - removed:
variable VERSION_PATTERN
- removed:
class SizedBuffer(Sized, Buffer, Protocol) - removed:
function get_zipinfo_datetime(timestamp: float | None=…) - removed:
variable MINIMUM_TIMESTAMP - removed:
variable StrPath - changed:
method WheelFile.close() → method WheelFile.close() -> None - changed:
method WheelFile.write_files(base_dir: str) → method WheelFile.write_files(base_dir: str) -> None - changed:
method WheelFile.writestr(zinfo_or_arcname: str | ZipInfo, data: SizedBuffer | str, compress_type: int | None=…) → method WheelFile.writestr(zinfo_or_arcname: str | ZipInfo, data: SizedBuffer | str, compress_type: int | None=…) -> None - added:
class WheelError(Exception)