Threats tagged 'brew-gobject-introspection-cve-2026-59890'

A Unicode normalization mismatch in setuptools causes MANIFEST.in exclusion rules to fail on macOS APFS/HFS+ filesystems. When building source distributions, excluded files with non-ASCII names may be included if the on-disk filename uses NFD normalization but the MANIFEST.in pattern uses NFC, leading to unintended disclosure of files. This affects setuptools versions from 1.78.1 up to but not including 1.86.0_3. A fix is available in version 1.86.0_3.