Threats tagged 'brew-redex-cve-2026-59890'

A Unicode normalization mismatch in setuptools' MANIFEST.in exclusion handling on macOS APFS/HFS+ filesystems causes excluded files with non-ASCII names to be included in source distributions. This occurs because setuptools matches file names byte-for-byte without Unicode normalization, leading to exclusion bypasses when the on-disk filename is in NFD form but the exclusion pattern is in NFC form. This can result in unintended disclosure of files intended to be excluded from published source distributions.