chore(deps): update dependency setuptools to v70 [security]
Metadata
Current evaluation
Merged automated dependency update upgrading setuptools from v69.5.1 to v70.0.0 to patch CVE-2024-6345, a remote code execution vulnerability. The change received reviewer approval and passed all CI checks.
Suggested action: —
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [setuptools](https://togithub.com/pypa/setuptools) ([changelog](https://setuptools.pypa.io/en/stable/history.html)) | `==69.5.1` -> `==70.0.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-6345](https://nvd.nist.gov/vuln/detail/CVE-2024-6345)
A vulnerability in the `package_index` module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.
---
### Release Notes
<details>
<summary>pypa/setuptools (setuptools)</summary>
### [`v70.0.0`](https://togithub.com/pypa/setuptools/compare/v69.5.1...v70.0.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.5.1...v70.0.0)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40MzEuNCIsInVwZGF0ZWRJblZlciI6IjM3LjQzMS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged automated dependency update upgrading setuptools from v69.5.1 to v70.0.0 to patch CVE-2024-6345, a remote code execution vulnerability. The change received reviewer approval and passed all CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged dependency update upgrading setuptools from 69.5.1 to 70.0.0 to patch CVE-2024-6345, a remote code execution vulnerability. Automated via Renovate bot. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged automated dependency update upgrading setuptools from v69.5.1 to v70.0.0. The change resolves CVE-2024-6345, a remote code execution vulnerability, and was applied via Renovate bot. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #581 chore(deps): update dependency setuptools to v70 | rockcraft | merged | Merged automated dependency update upgrading setuptools from v69.5.1 to v70.0.0. The change passed CI checks, received approval from two reviewers, and was successfully merged into the main branch. | |
| #255 chore(deps): update dependency setuptools to v70 | craft-cli | merged | Merged automated dependency update upgrading setuptools from 69.5.1 to 70.1.0. The change passed CI checks and received approval from two reviewers before being integrated into the main branch. | |
| #358 chore(deps): update dependency setuptools to v70 | craft-application | merged | Merged automated dependency update for setuptools from v69.5.1 to v70.1.0. Approved by two reviewers, passed CI checks, and modified a single file with one line change. | |
| #182 chore(deps): update dependency setuptools to v70 | craft-store | merged | Merged automated dependency update upgrading setuptools from v69.2.0 to v70.0.0. Approved by two reviewers with passing CI checks. Single file change. | |
| #188 chore(deps): update dependency setuptools to v70.3.0 | craft-store | merged | Merged automated dependency update upgrading setuptools from v70.0.0 to v70.3.0. Approved by two reviewers, passed CI checks, and successfully merged into the main branch. | |
| #171 chore(deps): update dependency setuptools to v69 | craft-application | merged | Merged an automated dependency update that upgraded setuptools from v67.7.2 to v69.0.3. The change received reviewer approval, passed CI checks, and maintained 99.20% test coverage. | |
| #154 chore(deps): update dependency setuptools to v69 | craft-store | merged | Merged automated dependency update upgrading setuptools from v67.7.2 to v69.0.3. Passed CI checks and received approval from two reviewers before merging. | |
| #203 chore(deps): update dependency setuptools to v69.1.0 | craft-application | merged | Merged an automated dependency update that upgraded setuptools from v69.0.3 to v69.1.0. The change was approved by reviewers, passed CI checks, and successfully integrated into the codebase. | |
| #229 chore(deps): update dependency setuptools to v69 | craft-cli | merged | Merged automated dependency update upgrading setuptools from v67.8.0 to v69.0.3. Approved by two reviewers, passed CI checks, and maintained 94.81% test coverage. | |
| #168 chore(deps): update dependency setuptools to v69 | starbase | merged | Merged a dependency update upgrading setuptools from 67.8.0 to 69.0.3. The automated pull request was approved, passed CI checks, and maintained 100% code coverage. |