From bd43eb22b6945b0bff5303f667e956849edcb3f5 Mon Sep 17 00:00:00 2001 From: "piyush.gupta" Date: Wed, 2 Sep 2026 08:19:08 +0530 Subject: [PATCH 1/2] =?UTF-8?q?APPSINTG-391:=20fix=20CVE-2026-59890=20?= =?UTF-8?q?=E2=80=94=20upgrade=20setuptools=20to=20>=3D83.0.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps setuptools from 82.0.1 to 84.0.0 to fix MANIFEST.in exclusion bypass via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+. Versions < 83.0.0 could silently include files the maintainer intended to exclude from a published sdist. Co-Authored-By: Claude Sonnet 4.6 --- CHANGELOG.md | 4 ++++ Pipfile | 2 +- Pipfile.lock | 10 +++++----- VERSION | 2 +- pyproject.toml | 2 +- 5 files changed, 12 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8b9ff03..3941ad4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,10 @@ # CHANGELOG for sumologic-python-sdk This project adheres to [Semantic Versioning](http://semver.org/). The CHANGELOG follows the format listed at [Keep A Changelog](http://keepachangelog.com/) +## [0.2.1] - 2026-09-02 +### Security +- Upgraded `setuptools` to `>=83.0.0` to fix MANIFEST.in exclusion bypass via Unicode normalization collision on macOS APFS/HFS+ (CVE-2026-59890, GHSA-h35f-9h28-mq5c) + ## [0.2.0] - 2026-05-18 ### Security - Upgraded `certifi` to `>=2026.4.22` to remove the revoked GLOBALTRUST root certificate diff --git a/Pipfile b/Pipfile index dd0181b..bb6f9c6 100644 --- a/Pipfile +++ b/Pipfile @@ -5,7 +5,7 @@ verify_ssl = true [dev-packages] virtualenv = ">=21.3.0" -setuptools = ">=78.1.1" +setuptools = ">=83.0.0" filelock = ">=3.29.0" zipp = ">=3.19.1" pygments = ">=2.20.0" diff --git a/Pipfile.lock b/Pipfile.lock index 9d62276..ac44f18 100644 --- a/Pipfile.lock +++ b/Pipfile.lock @@ -1,7 +1,7 @@ { "_meta": { "hash": { - "sha256": "e12ebebb0ad488d5a30a62478980effe58df189e4b8d0d93074e69dfe24fda1b" + "sha256": "5eb77a25c0c69c6614fb7a1c5a53ce9dcf20b1fe4c90e7590cbd7d0bdfd78854" }, "pipfile-spec": 6, "requires": { @@ -854,12 +854,12 @@ }, "setuptools": { "hashes": [ - "sha256:7d872682c5d01cfde07da7bccc7b65469d3dca203318515ada1de5eda35efbf9", - "sha256:a59e362652f08dcd477c78bb6e7bd9d80a7995bc73ce773050228a348ce2e5bb" + "sha256:51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670", + "sha256:f4695c21257f0d9b537ec2692c941d02ee143b7cc1276941349a546573b2ef73" ], "index": "pypi", - "markers": "python_version >= '3.9'", - "version": "==82.0.1" + "markers": "python_version >= '3.10'", + "version": "==84.0.0" }, "stevedore": { "hashes": [ diff --git a/VERSION b/VERSION index 0ea3a94..0c62199 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.2.0 +0.2.1 diff --git a/pyproject.toml b/pyproject.toml index 4766924..5dcf4fb 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -29,5 +29,5 @@ Issues = "https://github.com/SumoLogic/sumologic-python-sdk/issues" Changelog = "https://github.com/SumoLogic/sumologic-python-sdk/blob/master/CHANGELOG.md" [build-system] -requires = ["setuptools>=78.1.1"] +requires = ["setuptools>=83.0.0"] build-backend = "setuptools.build_meta" From 122c8354f6e32528f06e0c301f8232dc5e7b0956 Mon Sep 17 00:00:00 2001 From: "piyush.gupta" Date: Wed, 2 Sep 2026 08:23:38 +0530 Subject: [PATCH 2/2] fix: remove -n auto from pytest.ini to prevent parallel test failures The integration tests are ordered and stateful (test_02 creates a collector whose ID is used by test_03 and test_04), so running them in parallel workers via pytest-xdist breaks state sharing. Co-Authored-By: Claude Sonnet 4.6 --- pytest.ini | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pytest.ini b/pytest.ini index 7231733..7ca4016 100644 --- a/pytest.ini +++ b/pytest.ini @@ -1,5 +1,5 @@ [pytest] -addopts = -ra -n auto +addopts = -ra testpaths = tests ; Add vendor and patched in addition to the default list of ignored dirs ; Additionally, ignore tasks, news, test subdirectories and peeps directory