build(deps): update dependency setuptools to v78 [security] (hotfix/2.7) - autoclosed
Metadata
Current evaluation
Renovate's setuptools 78.1.1 security update for hotfix/2.7 was autoclosed unmerged after prolonged inactivity; numerous CI jobs failed and no resolving commit was recorded.
Resolution: closed stale
Reason: PR #2292 received no reviews or comments, was last active 491 days ago, and was autoclosed without a resolving commit. Its failing test and build checks and pending review provide no evidence of a completed resolution.
Evaluated by: mr-cal-bot
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [setuptools](https://redirect.github.com/pypa/setuptools) ([changelog](https://setuptools.pypa.io/en/stable/history.html)) | `==75.3.0` -> `==78.1.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2025-47273](https://redirect.github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf)
### Summary
A path traversal vulnerability in `PackageIndex` was fixed in setuptools version 78.1.1
### Details
```
def _download_url(self, url, tmpdir):
# Determine download filename
#
name, _fragment = egg_info_for_url(url)
if name:
while '..' in name:
name = name.replace('..', '.').replace('\\', '_')
else:
name = "__downloaded__" # default if URL has no path contents
if name.endswith('.[egg.zip](http://egg.zip/)'):
name = name[:-4] # strip the extra .zip before download
--> filename = os.path.join(tmpdir, name)
```
Here: https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88
`os.path.join()` discards the first argument `tmpdir` if the second begins with a slash or drive letter.
`name` is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of '..' with '.', it is insufficient.
### Risk Assessment
As easy_install and package_index are deprecated, the exploitation surface is reduced.
However, it seems this could be exploited in a similar fashion like https://github.com/advisories/GHSA-r9hx-vwmv-q579, and as described by POC 4 in https://github.com/advisories/GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index.
### Impact
An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.
### References
https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
[https://github.com/pypa/setuptools/issues/4946](https://redirect.github.com/pypa/setuptools/issues/4946)
---
### Release Notes
<details>
<summary>pypa/setuptools (setuptools)</summary>
### [`v78.1.1`](https://redirect.github.com/pypa/setuptools/compare/v78.1.0...v78.1.1)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v78.1.0...v78.1.1)
### [`v78.1.0`](https://redirect.github.com/pypa/setuptools/compare/v78.0.2...v78.1.0)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v78.0.2...v78.1.0)
### [`v78.0.2`](https://redirect.github.com/pypa/setuptools/compare/v78.0.1...v78.0.2)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v78.0.1...v78.0.2)
### [`v78.0.1`](https://redirect.github.com/pypa/setuptools/compare/v77.0.3...v78.0.1)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v77.0.3...v78.0.1)
### [`v77.0.3`](https://redirect.github.com/pypa/setuptools/compare/v77.0.1...v77.0.3)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v77.0.1...v77.0.3)
### [`v77.0.1`](https://redirect.github.com/pypa/setuptools/compare/v76.1.0...v77.0.1)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v76.1.0...v77.0.1)
### [`v76.1.0`](https://redirect.github.com/pypa/setuptools/compare/v76.0.0...v76.1.0)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v76.0.0...v76.1.0)
### [`v76.0.0`](https://redirect.github.com/pypa/setuptools/compare/v75.9.1...v76.0.0)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.9.1...v76.0.0)
### [`v75.9.1`](https://redirect.github.com/pypa/setuptools/compare/v75.9.0...v75.9.1)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.9.0...v75.9.1)
### [`v75.9.0`](https://redirect.github.com/pypa/setuptools/compare/v75.8.2...v75.9.0)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.8.2...v75.9.0)
### [`v75.8.2`](https://redirect.github.com/pypa/setuptools/compare/v75.8.1...v75.8.2)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.8.1...v75.8.2)
### [`v75.8.1`](https://redirect.github.com/pypa/setuptools/compare/v75.8.0...v75.8.1)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.8.0...v75.8.1)
### [`v75.8.0`](https://redirect.github.com/pypa/setuptools/compare/v75.7.0...v75.8.0)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.7.0...v75.8.0)
### [`v75.7.0`](https://redirect.github.com/pypa/setuptools/compare/v75.6.0...v75.7.0)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.6.0...v75.7.0)
### [`v75.6.0`](https://redirect.github.com/pypa/setuptools/compare/v75.5.0...v75.6.0)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.5.0...v75.6.0)
### [`v75.5.0`](https://redirect.github.com/pypa/setuptools/compare/v75.4.0...v75.5.0)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.4.0...v75.5.0)
### [`v75.4.0`](https://redirect.github.com/pypa/setuptools/compare/v75.3.2...v75.4.0)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.3.2...v75.4.0)
### [`v75.3.2`](https://redirect.github.com/pypa/setuptools/compare/v75.3.1...v75.3.2)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.3.1...v75.3.2)
### [`v75.3.1`](https://redirect.github.com/pypa/setuptools/compare/v75.3.0...v75.3.1)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.3.0...v75.3.1)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/charmcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC4xNi4wIiwidXBkYXRlZEluVmVyIjoiNDAuMTYuMCIsInRhcmdldEJyYW5jaCI6ImhvdGZpeC8yLjciLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | Renovate's setuptools 78.1.1 security update for hotfix/2.7 was autoclosed unmerged after prolonged inactivity; numerous CI jobs failed and no resolving commit was recorded. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate’s setuptools 78.1.1 security update for hotfix/2.7 was autoclosed unmerged after failing CI, with no reviews and no resolving commit. | |
| qwen/qwen3.6-35b-a3b | — | — | Autoclosed and abandoned without merging. Renovate proposed updating setuptools to v78.1.1 to address CVE-2025-47273, but multiple CI checks failed and the branch was automatically closed. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Renovate bot PR to update setuptools to v78.1.1 for CVE-2025-47273 was autoclosed. The security fix was not merged, likely due to branch deletion or being superseded. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/charmcraft#2291
(confidence 90%)
Parallel Renovate PR proposing the same setuptools 78.1.1 update for main; it was also autoclosed unmerged.
-
Related To:
canonical/charmcraft#2293
(confidence 88%)
Parallel setuptools 78.1.1 update for hotfix/3.4 that was also autoclosed unmerged.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #2293 build(deps): update dependency setuptools to v78 [security] (hotfix/3.4) - autoclosed | charmcraft | closed | Renovate's setuptools 78.1.1 security update for hotfix/3.4 was autoclosed unmerged after 483 days; no resolving commit landed. | |
| #1098 build(deps): update dependency setuptools to v78 [security] (hotfix/2.7) - autoclosed | craft-parts | closed | Autoclosed unmerged after 493 days; the setuptools 78.1.1 security update was merged separately via #1096 at commit 0681571f. | |
| #2291 build(deps): update dependency setuptools to v78 [security] (main) - autoclosed | charmcraft | closed | Renovate's setuptools 78.1.1 security update was autoclosed unmerged; no corresponding version bump or resolving commit was found. | |
| #1097 build(deps): update dependency setuptools to v78 [security] (hotfix/2.4) - autoclosed | craft-parts | closed | Renovate PR #1097 was autoclosed unmerged after 493 days, leaving setuptools 75.7.0 in hotfix/2.4; Ubuntu 20.04 tests and linters were failing. | |
| #4987 build(deps): update dependency setuptools to v70 [security] (hotfix/8.3) - autoclosed | snapcraft | closed | Renovate’s setuptools 70 security hotfix for hotfix/8.3 was auto-closed unmerged after prolonged inactivity; no review, CI, or resolving commit landed. | |
| #4920 build(deps): update dependency setuptools to v70 [security] (hotfix/8.3) - autoclosed | snapcraft | closed | Setuptools 70 hotfix for hotfix/8.3 was closed unmerged and abandoned after inactivity; no v70 commit landed. | |
| #4986 build(deps): update dependency setuptools to v70 [security] (main) - autoclosed | snapcraft | closed | Renovate PR #4986 proposed setuptools 70 for CVE-2024-6345 but was autoclosed unmerged after inactivity; later PR #6386 merged setuptools 84. | |
| #1283 build(deps): update dependency setuptools to v82 (main) - autoclosed | rockcraft | closed | Renovate's setuptools ~80.10.2 to ~82.0.1 bump was autoclosed unmerged after no reviews or comments; lint/ files and source-spread-tests CI failed and the update never landed. | |
| #298 build(deps): update dependency setuptools to v82 (main) - autoclosed | imagecraft | closed | Renovate's setuptools<82.1 PR was closed unmerged after a maintainer proposed removing obsolete sphinxcontrib-details-directive and loosening the setuptools cap. | |
| #1096 build(deps): update dependency setuptools to v78 [security] (main) | craft-parts | merged | Merged in #1096 via commit 0681571f, upgrading setuptools from 75.7.0 to 78.1.1 to remediate CVE-2025-47273. |