build(deps): update dependency setuptools to v78 [security] (hotfix/2.4) - autoclosed
Metadata
Current evaluation
Renovate PR updating setuptools to v78.1.1 for CVE-2025-47273 was autoclosed without merging. Minor CI failures on older Ubuntu versions prevented progress. The security update was abandoned and never applied.
Suggested action: —
No scores available.
Issue body
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [setuptools](https://redirect.github.com/pypa/setuptools) ([changelog](https://setuptools.pypa.io/en/stable/history.html)) | `==75.7.0` -> `==78.1.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
---
> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
### GitHub Vulnerability Alerts
#### [CVE-2025-47273](https://redirect.github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf)
### Summary
A path traversal vulnerability in `PackageIndex` was fixed in setuptools version 78.1.1
### Details
```
def _download_url(self, url, tmpdir):
# Determine download filename
#
name, _fragment = egg_info_for_url(url)
if name:
while '..' in name:
name = name.replace('..', '.').replace('\\', '_')
else:
name = "__downloaded__" # default if URL has no path contents
if name.endswith('.[egg.zip](http://egg.zip/)'):
name = name[:-4] # strip the extra .zip before download
--> filename = os.path.join(tmpdir, name)
```
Here: https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88
`os.path.join()` discards the first argument `tmpdir` if the second begins with a slash or drive letter.
`name` is derived from a URL without sufficient sanitization. While there is some attempt to sanitize by replacing instances of '..' with '.', it is insufficient.
### Risk Assessment
As easy_install and package_index are deprecated, the exploitation surface is reduced.
However, it seems this could be exploited in a similar fashion like https://github.com/advisories/GHSA-r9hx-vwmv-q579, and as described by POC 4 in https://github.com/advisories/GHSA-cx63-2mw6-8hw5 report: via malicious URLs present on the pages of a package index.
### Impact
An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.
### References
https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
[https://github.com/pypa/setuptools/issues/4946](https://redirect.github.com/pypa/setuptools/issues/4946)
---
### Release Notes
<details>
<summary>pypa/setuptools (setuptools)</summary>
### [`v78.1.1`](https://redirect.github.com/pypa/setuptools/compare/v78.1.0...v78.1.1)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v78.1.0...v78.1.1)
### [`v78.1.0`](https://redirect.github.com/pypa/setuptools/compare/v78.0.2...v78.1.0)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v78.0.2...v78.1.0)
### [`v78.0.2`](https://redirect.github.com/pypa/setuptools/compare/v78.0.1...v78.0.2)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v78.0.1...v78.0.2)
### [`v78.0.1`](https://redirect.github.com/pypa/setuptools/compare/v77.0.3...v78.0.1)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v77.0.3...v78.0.1)
### [`v77.0.3`](https://redirect.github.com/pypa/setuptools/compare/v77.0.1...v77.0.3)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v77.0.1...v77.0.3)
### [`v77.0.1`](https://redirect.github.com/pypa/setuptools/compare/v76.1.0...v77.0.1)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v76.1.0...v77.0.1)
### [`v76.1.0`](https://redirect.github.com/pypa/setuptools/compare/v76.0.0...v76.1.0)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v76.0.0...v76.1.0)
### [`v76.0.0`](https://redirect.github.com/pypa/setuptools/compare/v75.9.1...v76.0.0)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.9.1...v76.0.0)
### [`v75.9.1`](https://redirect.github.com/pypa/setuptools/compare/v75.9.0...v75.9.1)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.9.0...v75.9.1)
### [`v75.9.0`](https://redirect.github.com/pypa/setuptools/compare/v75.8.2...v75.9.0)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.8.2...v75.9.0)
### [`v75.8.2`](https://redirect.github.com/pypa/setuptools/compare/v75.8.1...v75.8.2)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.8.1...v75.8.2)
### [`v75.8.1`](https://redirect.github.com/pypa/setuptools/compare/v75.8.0...v75.8.1)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.8.0...v75.8.1)
### [`v75.8.0`](https://redirect.github.com/pypa/setuptools/compare/v75.7.0...v75.8.0)
[Compare Source](https://redirect.github.com/pypa/setuptools/compare/v75.7.0...v75.8.0)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/craft-parts).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC4xNi4wIiwidXBkYXRlZEluVmVyIjoiNDAuMTYuMCIsInRhcmdldEJyYW5jaCI6ImhvdGZpeC8yLjQiLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Renovate PR updating setuptools to v78.1.1 for CVE-2025-47273 was autoclosed without merging. Minor CI failures on older Ubuntu versions prevented progress. The security update was abandoned and never applied. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | The setuptools update to v78.1.1 for CVE-2025-47273 was autoclosed without merging. The change was superseded or abandoned, likely due to branch deletion or inactivity on the hotfix/2.4 branch. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1098 build(deps): update dependency setuptools to v78 [security] (hotfix/2.7) - autoclosed | craft-parts | closed | Security update for setuptools to v78.1.1 addressing CVE-2025-47273 was autoclosed without merging. CI checks failed on Ubuntu 20.04 and linters. The bot-generated PR was abandoned due to inactivity and configuration constraints. | |
| #2292 build(deps): update dependency setuptools to v78 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Autoclosed and abandoned without merging. Renovate proposed updating setuptools to v78.1.1 to address CVE-2025-47273, but multiple CI checks failed and the branch was automatically closed. | |
| #2293 build(deps): update dependency setuptools to v78 [security] (hotfix/3.4) - autoclosed | charmcraft | closed | A security update to setuptools v78.1.1 addressing CVE-2025-47273 was autoclosed by the bot without merging. The dependency patch was abandoned and not applied. | |
| #2291 build(deps): update dependency setuptools to v78 [security] (main) - autoclosed | charmcraft | closed | Renovate bot PR updating setuptools to v78.1.1 to patch CVE-2025-47273 was autoclosed and abandoned. The security update was not merged. | |
| #4920 build(deps): update dependency setuptools to v70 [security] (hotfix/8.3) - autoclosed | snapcraft | closed | Closed without merging. Renovate proposed updating setuptools to v70.0.0 to fix CVE-2024-6345. The branch was manually modified, causing the bot to skip autoclosing. The update was ultimately abandoned. | |
| #4987 build(deps): update dependency setuptools to v70 [security] (hotfix/8.3) - autoclosed | snapcraft | closed | Automatically closed by Renovate due to inactivity. The setuptools update to v70 for CVE-2024-6345 was never reviewed or merged. | |
| #4986 build(deps): update dependency setuptools to v70 [security] (main) - autoclosed | snapcraft | closed | Dependency update to setuptools v70.0.0 for CVE-2024-6345 was autoclosed without merging. Renovate automatically closed the branch, likely superseded by another update or applied separately. | |
| #1096 build(deps): update dependency setuptools to v78 [security] (main) | craft-parts | merged | Merged automated update upgrading setuptools from 75.7.0 to 78.1.1 to patch CVE-2025-47273, a path traversal vulnerability in PackageIndex. The change passed CI checks and was merged to main. | |
| #298 build(deps): update dependency setuptools to v82 (main) - autoclosed | imagecraft | closed | The setuptools v82 dependency update was autoclosed without merging. A maintainer noted the requirement could be loosened based on related changes, making the strict update unnecessary. The PR was abandoned. | |
| #1283 build(deps): update dependency setuptools to v82 (main) - autoclosed | rockcraft | closed | The setuptools dependency update PR was autoclosed without merging. Renovate bot automatically closed the request after it received no reviews or comments. |