[dependabot]

Bumps setuptools from 84.0.0 to 84.2.0.

Changelog

Sourced from setuptools's changelog.

v84.2.0

Features

• Added support for building abi3t extensions and abi3.abi3t wheels on Python 3.15 and newer. See :pep:803 and the Python 3.15 "What's New" entry <https://docs.python.org/3.15/whatsnew/3.15.html#pep-803-abi3t-stable-abi-for-free-threaded-builds>_ for more details. (#5193)
• Updated vendored packaging version to 26.3, which adds support for the abi3t tag from :pep:803. (#5361)

Bugfixes

• Use target sysconfig data for stable-ABI extension filenames. (#5351)

v84.1.0

Features

• setuptools.archive_util now raises the new UnsafeMember exception when an archive member would be extracted outside of the extraction directory, where previously such a member was silently skipped. Aborting makes a malicious or malformed archive visible to the caller instead of yielding a quietly incomplete extraction, and matches the behavior of the standard library's tarfile extraction filters.

Bugfixes

• Wheel.install_as_egg no longer creates namespace package directories outside of the destination egg directory. Entries in a wheel's namespace_packages.txt were split on . and passed straight to os.path.join, so an entry that was absolute, drive-qualified, or UNC discarded the destination and placed an __init__.py at a path chosen by the wheel. Namespace entries are now validated as dotted module names on every platform -- see GHSA-xmj3-9gf7-h52w.

  This code path is reached only by the deprecated setup_requires mechanism when setup() is invoked outside a PEP 517 frontend; the setuptools build backend never reaches it.

• setuptools.archive_util no longer extracts archive members outside of the requested extraction directory. Both the tar and zip formats specify / as

... (truncated)

Commits

• 301e27a Bump version: 84.1.0 → 84.2.0
• 39a7c2e Merge pull request #5193 from ngoldbaum/abi3.abi3t
• 7b5dea7 Merge branch 'main' into abi3.abi3t
• b3985b6 Merge pull request #5352 from jameshilliard/fix/abi3-target-platform
• 0c3f3c4 Merge pull request #5361 from pypa/feature/vendor-packaging-26.3
• 77b7ace Bump version: 84.0.0 → 84.1.0
• 97b75e6 Use target sysconfig for platform-qualified stable-ABI suffixes
• 4b02939 Add news fragment.
• 56bc40e Update vendored packaging version to 26.3
• e66004c Merge pull request #5329 from pypa/fix/wheel-namespace-path-escape
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)