[dependency] pkginfo2 seems to be abandoned

[frenzymadness]

I've realized that this project uses pkginfo2 as a dependency because it's the only package like that in Fedora Linux.

While pkginfo is still actively maintained with the last release in February 2025, pkginfo2 had only one release in 2022, and the project seems to be abandoned. Moreover, pkginfo2 is broken with the latest setutpools not yet ready for the latest metadata version, while pkginfo has this fixed already.

Would you accept PR switching from pkginfo2 to pkginfo?

[stefan6419846]

pkginfo2 has been forked for SCTK as there were security issues, see #2818:

replacing pkginfo with pkginfo2 at https://github.com/nexB/pkginfo2 : this removes problematic code that may import or eval arbitrary code

[AyanSinhaMahapatra]

Thanks @stefan6419846 that's correct 😄
@frenzymadness a better idea would be to merge new useful changes from pkginfo into pkginfo2 as applicable and fix any bugs/issues there. Help is much appreciated there. pkginfo2 is not abandoned, it did not have any major changes as there wasn't any need to do any, but it needs some love certainly.

[frenzymadness]

Thank you for the explanation.