build(deps): update dependency setuptools to v78 [security] (main)
Metadata
Current evaluation
Merged automated update upgrading setuptools from 75.7.0 to 78.1.1 to patch CVE-2025-47273, a path traversal vulnerability in PackageIndex. The change passed CI checks and was merged to main.
Suggested action: —
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [setuptools](https://redirect.github.com/pypa/setuptools) ([changelog](https://setuptools.pypa.io/en/stable/history.html)) | `==75.7.0` -> `==78.1.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
### GitHub Vulnerability Alerts
#### [CVE-2025-47273](https://redirect.github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf)
### Summary
A path traversal vulnerability in `PackageIndex` was fixed in setuptools version 78.1.1
### Details
```
def _download_url(self, url, tmpdir):
# Determine download filename
#
name, _fragment = egg_info_for_url(url)
if name:
while '..' in name:
name = name.replace('..', '.').replace('\\', '_')
else:
name = "__downloaded__" # default if URL has no path contents
if name.endswith('.[egg.zip](http://egg.zip/)'):
name = name[:-4] # strip the extra .zip before download
--> filename = os.path.join(tmpdir, name)
```
Here: https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88
`os.path.join()` discards the first argument `tmpdir` if the second begins with a slash or drive letter.
`name` is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of '..' with '.', it is insufficient.
### Risk Assessment
As easy_install and package_index are deprecated, the exploitation surface is reduced.
However, it seems this could be exploited in a similar fashion like https://github.com/advisories/GHSA-r9hx-vwmv-q579, and as described by POC 4 in https://github.com/advisories/GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index.
### Impact
An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.
### References
https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
[https://github.com/pypa/setuptools/issues/4946](https://redirect.github.com/pypa/setuptools/issues/4946)
---
### Release Notes
<details>
<summary>pypa/setuptools (setuptools)</summary>
### [`v78.1.1`](https://redirect.github.com/pypa/setuptools/compare/v78.1.0...v78.1.1)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v78.1.0...v78.1.1)
### [`v78.1.0`](https://redirect.github.com/pypa/setuptools/compare/v78.0.2...v78.1.0)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v78.0.2...v78.1.0)
### [`v78.0.2`](https://redirect.github.com/pypa/setuptools/compare/v78.0.1...v78.0.2)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v78.0.1...v78.0.2)
### [`v78.0.1`](https://redirect.github.com/pypa/setuptools/compare/v77.0.3...v78.0.1)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v77.0.3...v78.0.1)
### [`v77.0.3`](https://redirect.github.com/pypa/setuptools/compare/v77.0.1...v77.0.3)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v77.0.1...v77.0.3)
### [`v77.0.1`](https://redirect.github.com/pypa/setuptools/compare/v76.1.0...v77.0.1)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v76.1.0...v77.0.1)
### [`v76.1.0`](https://redirect.github.com/pypa/setuptools/compare/v76.0.0...v76.1.0)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v76.0.0...v76.1.0)
### [`v76.0.0`](https://redirect.github.com/pypa/setuptools/compare/v75.9.1...v76.0.0)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.9.1...v76.0.0)
### [`v75.9.1`](https://redirect.github.com/pypa/setuptools/compare/v75.9.0...v75.9.1)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.9.0...v75.9.1)
### [`v75.9.0`](https://redirect.github.com/pypa/setuptools/compare/v75.8.2...v75.9.0)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.8.2...v75.9.0)
### [`v75.8.2`](https://redirect.github.com/pypa/setuptools/compare/v75.8.1...v75.8.2)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.8.1...v75.8.2)
### [`v75.8.1`](https://redirect.github.com/pypa/setuptools/compare/v75.8.0...v75.8.1)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.8.0...v75.8.1)
### [`v75.8.0`](https://redirect.github.com/pypa/setuptools/compare/v75.7.0...v75.8.0)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.7.0...v75.8.0)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/craft-parts).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC4xNi4wIiwidXBkYXRlZEluVmVyIjoiNDAuMTYuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged automated update upgrading setuptools from 75.7.0 to 78.1.1 to patch CVE-2025-47273, a path traversal vulnerability in PackageIndex. The change passed CI checks and was merged to main. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged automated update upgrading setuptools from 75.7.0 to 78.1.1 on main. The change resolves CVE-2025-47273, a path traversal vulnerability in PackageIndex. Applied via Renovate without conflicts. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #2291 build(deps): update dependency setuptools to v78 [security] (main) - autoclosed | charmcraft | closed | Renovate bot PR updating setuptools to v78.1.1 to patch CVE-2025-47273 was autoclosed and abandoned. The security update was not merged. | |
| #2293 build(deps): update dependency setuptools to v78 [security] (hotfix/3.4) - autoclosed | charmcraft | closed | A security update to setuptools v78.1.1 addressing CVE-2025-47273 was autoclosed by the bot without merging. The dependency patch was abandoned and not applied. | |
| #1097 build(deps): update dependency setuptools to v78 [security] (hotfix/2.4) - autoclosed | craft-parts | closed | Renovate PR updating setuptools to v78.1.1 for CVE-2025-47273 was autoclosed without merging. Minor CI failures on older Ubuntu versions prevented progress. The security update was abandoned and never applied. | |
| #302 build(deps): update dependency setuptools to v75.9.1 (main) | craft-store | merged | Successfully merged an automated dependency update for setuptools from v75.8.0 to v75.9.1. The change passed all CI checks, received approval from two reviewers, and was integrated into the main branch. | |
| #399 build(deps): update dependency setuptools to v80 (main) | craft-cli | merged | Merged automated dependency update upgrading setuptools from v75.9.1 to v80.9.0. The change passed all CI checks, received two approvals, and was merged into main. | |
| #2292 build(deps): update dependency setuptools to v78 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Autoclosed and abandoned without merging. Renovate proposed updating setuptools to v78.1.1 to address CVE-2025-47273, but multiple CI checks failed and the branch was automatically closed. | |
| #1098 build(deps): update dependency setuptools to v78 [security] (hotfix/2.7) - autoclosed | craft-parts | closed | Security update for setuptools to v78.1.1 addressing CVE-2025-47273 was autoclosed without merging. CI checks failed on Ubuntu 20.04 and linters. The bot-generated PR was abandoned due to inactivity and configuration constraints. | |
| #4986 build(deps): update dependency setuptools to v70 [security] (main) - autoclosed | snapcraft | closed | Dependency update to setuptools v70.0.0 for CVE-2024-6345 was autoclosed without merging. Renovate automatically closed the branch, likely superseded by another update or applied separately. | |
| #235 build(deps): update dependency setuptools to v75.6.0 | craft-store | merged | Merged automated dependency update upgrading setuptools from v75.2.0 to v75.6.0. The change passed CI checks, received two approvals, and was successfully integrated with a single line modification. | |
| #535 build(deps): update dependency setuptools to v75.2.0 | craft-application | merged | Merged an automated dependency update upgrading setuptools from v75.1.0 to v75.2.0. Approved by two reviewers and passing all CI checks, the change was successfully merged into the main branch. |