chore(deps): update dependency setuptools to v70 [security]
Metadata
Current evaluation
Merged PR #1726 upgraded setuptools from 69.5.1 to 70.0.0 in commit 1ef1b2a6, addressing CVE-2024-6345.
Resolution: closed resolved
Reason: The security dependency update was merged as commit 1ef1b2a6. Setuptools 70.0.0 contains the fix for CVE-2024-6345.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [setuptools](https://togithub.com/pypa/setuptools) ([changelog](https://setuptools.pypa.io/en/stable/history.html)) | `==69.5.1` -> `==70.0.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-6345](https://nvd.nist.gov/vuln/detail/CVE-2024-6345)
A vulnerability in the `package_index` module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.
---
### Release Notes
<details>
<summary>pypa/setuptools (setuptools)</summary>
### [`v70.0.0`](https://togithub.com/pypa/setuptools/compare/v69.5.1...v70.0.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.5.1...v70.0.0)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40MzEuNCIsInVwZGF0ZWRJblZlciI6IjM3LjQzMS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #1726 upgraded setuptools from 69.5.1 to 70.0.0 in commit 1ef1b2a6, addressing CVE-2024-6345. | |
| stealth/space-bunny-alpha | — | closed resolved | Renovate PR #1726 merged as commit 1ef1b2a6, bumping setuptools pin from 69.5.1 to 70.0.0 in charmcraft, fixing RCE CVE-2024-6345. | |
| stealth/space-bunny-alpha | — | closed resolved | Renovate PR #1726 was merged, upgrading setuptools from 69.5.1 to 70.0.0 for CVE-2024-6345; landed as commit 1ef1b2a6. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged automated dependency update upgrading setuptools from v69.5.1 to v70.0.0 to patch CVE-2024-6345, a remote code execution vulnerability. The change received reviewer approval and passed all CI checks. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged dependency update upgrading setuptools from 69.5.1 to 70.0.0 to patch CVE-2024-6345, a remote code execution vulnerability. Automated via Renovate bot. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #255 chore(deps): update dependency setuptools to v70 | craft-cli | merged | Merged PR #255, updating setuptools from 69.5.1 to 70.1.0; the change landed in commit 3d21998. | |
| #594 chore(deps): update dependency setuptools to v70.3.0 | craft-providers | merged | Merged PR #594 bumped setuptools from 70.2.0 to 70.3.0; commit 39852f7 records the merge. | |
| #592 chore(deps): update dependency setuptools to v70.2.0 | craft-providers | merged | Renovate PR #592 bumping setuptools 70.1.1 -> 70.2.0 was approved and merged (commit 36ff7c7), updating the pinned build dependency; followed by #594 (v70.3.0). | |
| #188 chore(deps): update dependency setuptools to v70.3.0 | craft-store | merged | Renovate dependency bump of setuptools 70.0.0 -> 70.3.0 merged into main via commit 0fb6749 (1-line change), reviewed and approved with no CI failures. | |
| #173 chore(deps): update dependency setuptools to v69.5.1 | craft-store | closed | Renovate PR #173 (setuptools ==69.2.0 -> ==69.5.1) was closed unmerged on 2024-05-26, superseded by #182, which merged as commit 7cf37e7 bumping setuptools straight to ==70.0.0. | |
| #171 chore(deps): update dependency setuptools to v69 | craft-application | merged | Merged PR #171 via commit 645e73b5, updating setuptools from 67.7.2 to 69.0.3. | |
| #203 chore(deps): update dependency setuptools to v69.1.0 | craft-application | merged | Merged PR #203 in commit 5c2aeb22, updating setuptools from 69.0.3 to 69.1.0. | |
| #182 chore(deps): update dependency setuptools to v70 | craft-store | merged | Renovate PR #182 merged into main as commit 7cf37e7, bumping the pinned setuptools build dependency from ==69.2.0 to ==70.0.0 (one line in pyproject.toml) after two approvals. | |
| #586 chore(deps): update dependency setuptools to v70.1.1 | craft-providers | merged | Renovate dependency bump of setuptools build requirement from ==70.0.0 to ==70.1.1 merged into main (commit ba20b6a, +1/-1 in pyproject.toml), later superseded by #592 (v70.2.0) and #594 (v70.3.0). | |
| #573 chore(deps): update dependency setuptools to v70 | craft-providers | merged | Renovate PR #573 bumped setuptools 69.5.1 → 70.0.0 in pyproject.toml; approved and merged as commit 11b3a73, superseded later by #586, #592, #594 and further upgrades. |