← Back to issue list

chore(deps): update dependency setuptools to v70 [security]

View original Github issue

Metadata

Project
charmcraft
Number
#1726
Type
pull request
State
merged
Author
renovate[bot]
Labels
Created
Updated
Closed

Current evaluation

Merged automated dependency update upgrading setuptools from v69.5.1 to v70.0.0 to patch CVE-2024-6345, a remote code execution vulnerability. The change received reviewer approval and passed all CI checks.

Suggested action:

No scores available.

Issue body

[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [setuptools](https://togithub.com/pypa/setuptools) ([changelog](https://setuptools.pypa.io/en/stable/history.html)) | `==69.5.1` -> `==70.0.0` | [![age](https://developer.mend.io/api/mc/badges/age/pypi/setuptools/70.0.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/pypi/setuptools/70.0.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/pypi/setuptools/69.5.1/70.0.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/setuptools/69.5.1/70.0.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2024-6345](https://nvd.nist.gov/vuln/detail/CVE-2024-6345) A vulnerability in the `package_index` module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0. --- ### Release Notes <details> <summary>pypa/setuptools (setuptools)</summary> ### [`v70.0.0`](https://togithub.com/pypa/setuptools/compare/v69.5.1...v70.0.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v69.5.1...v70.0.0) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/charmcraft). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40MzEuNCIsInVwZGF0ZWRJblZlciI6IjM3LjQzMS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.6-35b-a3b Merged automated dependency update upgrading setuptools from v69.5.1 to v70.0.0 to patch CVE-2024-6345, a remote code execution vulnerability. The change received reviewer approval and passed all CI checks.
qwen3.6-35b-a3b-mtp-q6 Merged dependency update upgrading setuptools from 69.5.1 to 70.0.0 to patch CVE-2024-6345, a remote code execution vulnerability. Automated via Renovate bot.
qwen3.6-35b-a3b-mtp-q6 Merged automated dependency update upgrading setuptools from v69.5.1 to v70.0.0. The change resolves CVE-2024-6345, a remote code execution vulnerability, and was applied via Renovate bot.

Update history

No update history recorded yet.

Related issues

Issue Project State Summary Similarity
#581 chore(deps): update dependency setuptools to v70 rockcraft merged Merged automated dependency update upgrading setuptools from v69.5.1 to v70.0.0. The change passed CI checks, received approval from two reviewers, and was successfully merged into the main branch.
94%
#255 chore(deps): update dependency setuptools to v70 craft-cli merged Merged automated dependency update upgrading setuptools from 69.5.1 to 70.1.0. The change passed CI checks and received approval from two reviewers before being integrated into the main branch.
94%
#358 chore(deps): update dependency setuptools to v70 craft-application merged Merged automated dependency update for setuptools from v69.5.1 to v70.1.0. Approved by two reviewers, passed CI checks, and modified a single file with one line change.
93%
#182 chore(deps): update dependency setuptools to v70 craft-store merged Merged automated dependency update upgrading setuptools from v69.2.0 to v70.0.0. Approved by two reviewers with passing CI checks. Single file change.
93%
#188 chore(deps): update dependency setuptools to v70.3.0 craft-store merged Merged automated dependency update upgrading setuptools from v70.0.0 to v70.3.0. Approved by two reviewers, passed CI checks, and successfully merged into the main branch.
93%
#171 chore(deps): update dependency setuptools to v69 craft-application merged Merged an automated dependency update that upgraded setuptools from v67.7.2 to v69.0.3. The change received reviewer approval, passed CI checks, and maintained 99.20% test coverage.
89%
#154 chore(deps): update dependency setuptools to v69 craft-store merged Merged automated dependency update upgrading setuptools from v67.7.2 to v69.0.3. Passed CI checks and received approval from two reviewers before merging.
89%
#203 chore(deps): update dependency setuptools to v69.1.0 craft-application merged Merged an automated dependency update that upgraded setuptools from v69.0.3 to v69.1.0. The change was approved by reviewers, passed CI checks, and successfully integrated into the codebase.
89%
#229 chore(deps): update dependency setuptools to v69 craft-cli merged Merged automated dependency update upgrading setuptools from v67.8.0 to v69.0.3. Approved by two reviewers, passed CI checks, and maintained 94.81% test coverage.
89%
#168 chore(deps): update dependency setuptools to v69 starbase merged Merged a dependency update upgrading setuptools from 67.8.0 to 69.0.3. The automated pull request was approved, passed CI checks, and maintained 100% code coverage.
89%