Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump setuptools from 66.1.1 to 70.0.0 #1575

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

Bump setuptools from 66.1.1 to 70.0.0 #1575

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Feb 17, 2025

Bumps setuptools from 66.1.1 to 70.0.0.

Changelog

Sourced from setuptools's changelog.

v70.0.0

Features

  • Emit a warning when [tools.setuptools] is present in pyproject.toml and will be ignored. -- by :user:SnoopJ (#4150)
  • Improved AttributeError error message if pkg_resources.EntryPoint.require is called without extras or distribution Gracefully "do nothing" when trying to activate a pkg_resources.Distribution with a None location, rather than raising a TypeError -- by :user:Avasam (#4262)
  • Typed the dynamically defined variables from pkg_resources -- by :user:Avasam (#4267)
  • Modernized and refactored VCS handling in package_index. (#4332)

Bugfixes

  • In install command, use super to call the superclass methods. Avoids race conditions when monkeypatching from _distutils_system_mod occurs late. (#4136)
  • Fix finder template for lenient editable installs of implicit nested namespaces constructed by using package_dir to reorganise directory structure. (#4278)
  • Fix an error with UnicodeDecodeError handling in pkg_resources when trying to read files in UTF-8 with a fallback -- by :user:Avasam (#4348)

Improved Documentation

  • Uses RST substitution to put badges in 1 line. (#4312)

Deprecations and Removals

  • Further adoption of UTF-8 in setuptools. This change regards mostly files produced and consumed during the build process (e.g. metadata files, script wrappers, automatically updated config files, etc..) Although precautions were taken to minimize disruptions, some edge cases might be subject to backwards incompatibility.

    Support for "locale" encoding is now deprecated. (#4309)

  • Remove setuptools.convert_path after long deprecation period. This function was never defined by setuptools itself, but rather a side-effect of an import for internal usage. (#4322)

  • Remove fallback for customisations of distutils' build.sub_command after long deprecated period. Users are advised to import build directly from setuptools.command.build. (#4322)

  • Removed typing_extensions from vendored dependencies -- by :user:Avasam (#4324)

  • Remove deprecated setuptools.dep_util. The provided alternative is setuptools.modified. (#4360)

... (truncated)

Commits
  • 5cbf12a Workaround for release error in v70
  • 9c1bcc3 Bump version: 69.5.1 → 70.0.0
  • 4dc0c31 Remove deprecated setuptools.dep_util (#4360)
  • 6c1ef57 Remove xfail now that test passes. Ref #4371.
  • d14fa01 Add all site-packages dirs when creating simulated environment for test_edita...
  • 6b7f7a1 Prevent bin folders to be taken as extern packages when vendoring (#4370)
  • 69141f6 Add doctest for vendorised bin folder
  • 2a53cc1 Prevent 'bin' folders to be taken as extern packages
  • 7208628 Replace call to deprecated validate_pyproject command (#4363)
  • 96d681a Remove call to deprecated validate_pyproject command
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump setuptools from 66.1.1 to 70.0.0
bcf9350 
Bumps [setuptools](https://github.com/pypa/setuptools) from 66.1.1 to 70.0.0.
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v66.1.1...v70.0.0)

---
updated-dependencies:
- dependency-name: setuptools
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot requested a review from a team as a code owner February 17, 2025 13:23
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Feb 17, 2025
github-advanced-security[bot]
github-advanced-security bot found potential problems Feb 17, 2025
View reviewed changes
poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 1.8.3 and should not be changed by hand.
# This file is automatically @generated by Poetry 1.8.5 and should not be changed by hand.

Check warning

Code scanning / Trivy

psf/black: ReDoS via the lines_with_leading_tabs_expanded() function in strings.py file Medium

Package: black
Installed Version: 23.12.1
Vulnerability CVE-2024-21503
Severity: MEDIUM
Fixed Version: 24.3.0
Link: CVE-2024-21503
poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 1.8.3 and should not be changed by hand.
# This file is automatically @generated by Poetry 1.8.5 and should not be changed by hand.

Check failure

Code scanning / Trivy

python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659 High

Package: cryptography
Installed Version: 41.0.7
Vulnerability CVE-2023-50782
Severity: HIGH
Fixed Version: 42.0.0
Link: CVE-2023-50782
poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 1.8.3 and should not be changed by hand.
# This file is automatically @generated by Poetry 1.8.5 and should not be changed by hand.

Check failure

Code scanning / Trivy

python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override High

Package: cryptography
Installed Version: 41.0.7
Vulnerability CVE-2024-26130
Severity: HIGH
Fixed Version: 42.0.4
Link: CVE-2024-26130
poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 1.8.3 and should not be changed by hand.
# This file is automatically @generated by Poetry 1.8.5 and should not be changed by hand.

Check warning

Code scanning / Trivy

openssl: denial of service via null dereference Medium

Package: cryptography
Installed Version: 41.0.7
Vulnerability CVE-2024-0727
Severity: MEDIUM
Fixed Version: 42.0.2
Link: CVE-2024-0727
poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 1.8.3 and should not be changed by hand.
# This file is automatically @generated by Poetry 1.8.5 and should not be changed by hand.

Check warning

Code scanning / Trivy

pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels Medium

Package: cryptography
Installed Version: 41.0.7
Vulnerability GHSA-h4gh-qq45-vh27
Severity: MEDIUM
Fixed Version: 43.0.1
Link: GHSA-h4gh-qq45-vh27
poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 1.8.3 and should not be changed by hand.
# This file is automatically @generated by Poetry 1.8.5 and should not be changed by hand.

Check failure

Code scanning / Trivy

A vulnerability in corydolphin/flask-cors version 4.0.1 allows the `Ac ... High

Package: flask-cors
Installed Version: 3.0.10
Vulnerability CVE-2024-6221
Severity: HIGH
Fixed Version: 4.0.2
Link: CVE-2024-6221
poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 1.8.3 and should not be changed by hand.
# This file is automatically @generated by Poetry 1.8.5 and should not be changed by hand.

Check warning

Code scanning / Trivy

corydolphin/flask-cors is vulnerable to log injection when the log lev ... Medium

Package: flask-cors
Installed Version: 3.0.10
Vulnerability CVE-2024-1681
Severity: MEDIUM
Fixed Version: 4.0.1
Link: CVE-2024-1681
poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 1.8.3 and should not be changed by hand.
# This file is automatically @generated by Poetry 1.8.5 and should not be changed by hand.

Check failure

Code scanning / Trivy

python-werkzeug: user may execute code on a developer&#39;s machine High

Package: werkzeug
Installed Version: 2.3.8
Vulnerability CVE-2024-34069
Severity: HIGH
Fixed Version: 3.0.3
Link: CVE-2024-34069
poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 1.8.3 and should not be changed by hand.
# This file is automatically @generated by Poetry 1.8.5 and should not be changed by hand.

Check warning

Code scanning / Trivy

werkzeug: python-werkzeug: Werkzeug safe_join not safe on Windows Medium

Package: werkzeug
Installed Version: 2.3.8
Vulnerability CVE-2024-49766
Severity: MEDIUM
Fixed Version: 3.0.6
Link: CVE-2024-49766
poetry.lock
@@ -1,4 +1,4 @@
# This file is automatically @generated by Poetry 1.8.3 and should not be changed by hand.
# This file is automatically @generated by Poetry 1.8.5 and should not be changed by hand.

Check failure

Code scanning / Trivy

werkzeug: python-werkzeug: Werkzeug possible resource exhaustion when parsing file data in forms High

Package: werkzeug
Installed Version: 2.3.8
Vulnerability CVE-2024-49767
Severity: MEDIUM
Fixed Version: 3.0.6
Link: CVE-2024-49767
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants