Setuptools < 83 has a security vulnerability

[Daverball]

The currently released version of more.transaction depends on pkg_resources, which in turn limits setuptools to v82, which now has a disclosed vulnerability.

This was already fixed via #16, but there hasn't been a new release yet, partially because #17 is blocked behind morepath releasing a new version. But since that might take another while, it might be better to cut a new minor release on a branch based on the commit before #17 was merged. So we have a version that doesn't depend on setuptools at all.

@jugmac00 or @faassen could you add @henri-hulski as a collaborator for more.transaction on PyPI? He seems to be the most active maintainer currently, but he isn't a collaborator on that PyPI project yet, so he can't push a new release. Although if either of you has the time to push a new release to PyPI, that would be fine as well.

I can handle more.webassets, more.content_security and more.itsdangerous myself, since those projects are still owned by us on PyPI, although I've invited henri as a collaborator on those projects, so he can release new versions without our help if necessary.

[henri-hulski]

@Daverball I think I have some time now, so we can strart the Morepath 1.0.0 release process.
What would be the correct road map?

I think we should first release dectate, importscan and reg and after morepath following the more.* extensions.
Before release we should make sure that the packages are fully typed, use the pyproject.toml project setup, use the PEP-420 style namespace package and support Python 3.10 - 3.14 if the dependencies of the package allow it.

Do you think the core packages are ready or is there still something to do?
At least I will take a look if the documentation is up to date.

[Daverball]

Everything is ready as far as I'm concerned, I prepared a draft PR against the upstream state of the dependencies a while ago: OneGov/onegov-cloud#2532

[Daverball]

The main thing to remember will be pinning the downstream dependencies to >= 1.0 after each step, before releasing the new versions, so morepath should pin dectate, importscan and reg and the more.* extensions should pin morepath.

[jugmac00]

Hey folks, I sent @henri-hulski an invite for more.transaction on PyPI - please let me know which other access you need.

I do not use morepath any more in any regards, and I have a very busy job + other responsibilities. I cannot keep up with morepath and I would like to gracefully handover things. Please ping me on the relevant trackers or by email (first.lastname@googlemail.com) if you need anything.

Thanks for keeping this project going!

[henri-hulski]

@jugmac00 Hey! Thanks for your invitation. Could you also send invitations for:

• more.jinja2
• more.chameleon
• more.forwarded
• more.static

These are the extensions I have on my computer which I cannot release yet. At least more.jinja2 I'm using in a project, but maybe the others also make sense to update if possible (not sure about more.static).

[jugmac00]

@henri-hulski I only had the owner role in for more.jinja2, so I cannot invite you do m.chameleon, m.forwarded, and m.static.

Let's give @faassen a bit of time. If this does not work out, you could claim the package for yourself, see https://github.com/pypi/support/issues, but that can take months.

[henri-hulski]

@jugmac00 more.jinja2 is the most important, so this is fine for now.