build(deps): bump setuptools from 49.6.0 to 65.5.1
Metadata
Current evaluation
Closed unmerged after maintainer feedback: freeze-requirements.sh would overwrite the setuptools 65.5.1 bump, so the update was deferred until the tooling was updated.
Resolution: closed stale
Reason: Maintainer @lengau stated on 2023-01-14 that freeze-requirements.sh would overwrite the change and that merging before updating the script made no sense. No resolving commit for #4007 was merged; Dependabot subsequently stopped notifying for this release.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Bumps [setuptools](https://github.com/pypa/setuptools) from 49.6.0 to 65.5.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/pypa/setuptools/releases">setuptools's releases</a>.</em></p>
<blockquote>
<h2>v65.5.1</h2>
<p>No release notes provided.</p>
<h2>v65.5.0</h2>
<p>No release notes provided.</p>
<h2>v65.4.1</h2>
<p>No release notes provided.</p>
<h2>v65.4.0</h2>
<p>No release notes provided.</p>
<h2>v65.3.0</h2>
<p>No release notes provided.</p>
<h2>v65.2.0</h2>
<p>No release notes provided.</p>
<h2>v65.1.1</h2>
<p>No release notes provided.</p>
<h2>v65.1.0</h2>
<p>No release notes provided.</p>
<h2>v65.0.2</h2>
<p>No release notes provided.</p>
<h2>v65.0.1</h2>
<p>No release notes provided.</p>
<h2>v65.0.0</h2>
<p>No release notes provided.</p>
<h2>v64.0.3</h2>
<p>No release notes provided.</p>
<h2>v64.0.2</h2>
<p>No release notes provided.</p>
<h2>v64.0.1</h2>
<p>No release notes provided.</p>
<h2>v64.0.0</h2>
<p>No release notes provided.</p>
<h2>v63.4.3</h2>
<p>No release notes provided.</p>
<h2>v63.4.2</h2>
<p>No release notes provided.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/pypa/setuptools/blob/main/CHANGES.rst">setuptools's changelog</a>.</em></p>
<blockquote>
<h2>v65.5.1</h2>
<p>Misc
^^^^</p>
<ul>
<li><a href="https://github-redirect.dependabot.com/pypa/setuptools/issues/3638">#3638</a>: Drop a test dependency on the <code>mock</code> package, always use :external+python:py:mod:<code>unittest.mock</code> -- by :user:<code>hroncok</code></li>
<li><a href="https://github-redirect.dependabot.com/pypa/setuptools/issues/3659">#3659</a>: Fixed REDoS vector in package_index.</li>
</ul>
<h2>v65.5.0</h2>
<p>Changes
^^^^^^^</p>
<ul>
<li><a href="https://github-redirect.dependabot.com/pypa/setuptools/issues/3624">#3624</a>: Fixed editable install for multi-module/no-package <code>src</code>-layout projects.</li>
<li><a href="https://github-redirect.dependabot.com/pypa/setuptools/issues/3626">#3626</a>: Minor refactorings to support distutils using stdlib logging module.</li>
</ul>
<p>Documentation changes
^^^^^^^^^^^^^^^^^^^^^</p>
<ul>
<li><a href="https://github-redirect.dependabot.com/pypa/setuptools/issues/3419">#3419</a>: Updated the example version numbers to be compliant with PEP-440 on the "Specifying Your Project’s Version" page of the user guide.</li>
</ul>
<p>Misc
^^^^</p>
<ul>
<li><a href="https://github-redirect.dependabot.com/pypa/setuptools/issues/3569">#3569</a>: Improved information about conflicting entries in the current working directory
and editable install (in documentation and as an informational warning).</li>
<li><a href="https://github-redirect.dependabot.com/pypa/setuptools/issues/3576">#3576</a>: Updated version of <code>validate_pyproject</code>.</li>
</ul>
<h2>v65.4.1</h2>
<p>Misc
^^^^</p>
<ul>
<li><a href="https://github-redirect.dependabot.com/pypa/setuptools/issues/3613">#3613</a>: Fixed encoding errors in <code>expand.StaticModule</code> when system default encoding doesn't match expectations for source files.</li>
<li><a href="https://github-redirect.dependabot.com/pypa/setuptools/issues/3617">#3617</a>: Merge with pypa/distutils@6852b20 including fix for <a href="https://github-redirect.dependabot.com/pypa/distutils/issues/181">pypa/distutils#181</a>.</li>
</ul>
<h2>v65.4.0</h2>
<p>Changes
^^^^^^^</p>
<ul>
<li><a href="https://github-redirect.dependabot.com/pypa/setuptools/issues/3609">#3609</a>: Merge with pypa/distutils@d82d926 including support for DIST_EXTRA_CONFIG in <a href="https://github-redirect.dependabot.com/pypa/distutils/issues/177">pypa/distutils#177</a>.</li>
</ul>
<p>v65.3.0</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/pypa/setuptools/commit/a462cb5edb324dcc56f903524b742305e4087014"><code>a462cb5</code></a> Bump version: 65.5.0 → 65.5.1</li>
<li><a href="https://github.com/pypa/setuptools/commit/de35d8be997c9f8508b425e33a1b6e52431091fa"><code>de35d8b</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/pypa/setuptools/issues/3656">#3656</a> from bmorris3/typos</li>
<li><a href="https://github.com/pypa/setuptools/commit/58e23de0d4c2ce0f2502d072bb9a2ed1e2ab0ba6"><code>58e23de</code></a> Update changelog. Ref <a href="https://github-redirect.dependabot.com/pypa/setuptools/issues/3659">#3659</a>.</li>
<li><a href="https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be"><code>43a9c9b</code></a> Limit the amount of whitespace to search/backtrack. Fixes <a href="https://github-redirect.dependabot.com/pypa/setuptools/issues/3659">#3659</a>.</li>
<li><a href="https://github.com/pypa/setuptools/commit/579134321d4d9397c886a5cb50cc26d0e3fa4279"><code>5791343</code></a> Add test capturing failed expectation. Ref <a href="https://github-redirect.dependabot.com/pypa/setuptools/issues/3659">#3659</a>.</li>
<li><a href="https://github.com/pypa/setuptools/commit/1f97905bc40310ca454ff1ea3884f233b7dcc88c"><code>1f97905</code></a> ⚫ Fade to black.</li>
<li><a href="https://github.com/pypa/setuptools/commit/6254567c6ae323bb8ce19a6930ae3cc5f7fb25cc"><code>6254567</code></a> Remove workaround for emacs.</li>
<li><a href="https://github.com/pypa/setuptools/commit/729b180e926634930c21ccce5558780d42707763"><code>729b180</code></a> ⚫ Fade to black.</li>
<li><a href="https://github.com/pypa/setuptools/commit/c068081a7234a0c5c322a9312654e7d0f4aaa8d1"><code>c068081</code></a> Typo corrections</li>
<li><a href="https://github.com/pypa/setuptools/commit/f777a40ed9abf529906c2939f80a184a5ed035fa"><code>f777a40</code></a> Suppress deprecation warning in --rsyncdir. Workaround for <a href="https://github-redirect.dependabot.com/pypa/setuptools/issues/3655">#3655</a>.</li>
<li>Additional commits viewable in <a href="https://github.com/pypa/setuptools/compare/v49.6.0...v65.5.1">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/snapcore/snapcraft/network/alerts).
</details>
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | Closed unmerged after maintainer feedback: freeze-requirements.sh would overwrite the setuptools 65.5.1 bump, so the update was deferred until the tooling was updated. | |
| stealth/space-bunny-alpha | — | closed stale | Dependabot's setuptools 65.5.1 bump was closed unmerged because freeze-requirements.sh would overwrite it; the change was deferred pending tooling updates. | |
| stealth/space-bunny-alpha | — | closed stale | Setuptools 49.6.0-to-65.5.1 update was closed unmerged because freeze-requirements.sh would overwrite it; maintainers deferred it pending a script update. | |
| qwen/qwen3.6-35b-a3b | — | — | Dependabot's setuptools update was abandoned. Maintainers closed the PR because the freeze-requirements.sh script would overwrite it, opting to wait for a script update instead. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Dependabot's setuptools update was closed without merging. A maintainer noted that the freeze-requirements.sh script will overwrite the dependency, making the PR redundant until the script is updated. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/snapcraft#4031
(confidence 88%)
Merged follow-up 709e16c78 pinned setuptools<66 for compatibility, but did not land the requested 65.5.1 update.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4775 build(deps): bump setuptools from 59.6.0 to 65.5.1 in /docs | snapcraft | merged | Dependabot PR #4775 bumping setuptools 59.6.0 → 65.5.1 in /docs requirements was approved (2 reviewers) and merged as commit d83f1ddb8. | |
| #4919 build(deps): bump setuptools from 65.5.1 to 70.0.0 in /docs | snapcraft | closed | Dependabot PR #4919 to raise docs setuptools from 65.5.1 to 70.0.0 was closed unmerged as stale after prolonged inactivity and disabled automatic rebases. | |
| #2294 build(deps-dev): bump setuptools from 76.0.0 to 78.1.1 | charmcraft | closed | Setuptools 78.1.1 update closed unmerged as obsolete after the dependency was already up to date. | |
| #4985 build(deps): freeze requirements for docs | snapcraft | merged | Merged in #4985 via commit 37d2803aa, freezing documentation requirements and bumping setuptools to resolve #4919 and #4986. | |
| #225 build(deps): update dependency setuptools to v75 | craft-store | merged | Merged in #225 via commit d90785a, updating setuptools from 70.3.0 to 75.1.0. | |
| #683 build(deps): update dependency setuptools to v75 (main) | craft-providers | merged | Renovate PR merged: setuptools build dep bumped from 73.0.1 to 75.1.0 via commit 6ad8f95 in main; later superseded by #689 (75.2.0) and #897/#911 bumps. | |
| #6059 build(deps): update dependency setuptools to >=80.10,<81 (main) | snapcraft | closed | Closed unmerged because setuptools 80 broke Pyramid-based legacy tests; the change was deferred until tests/legacy was removed, then superseded by the setuptools v84 update in #6386. | |
| #281 build(deps): update dependency setuptools to v75 | craft-cli | merged | Merged PR #281 updated setuptools from 70.1.0 to 75.1.0; merged as commit ae19849. | |
| #4986 build(deps): update dependency setuptools to v70 [security] (main) - autoclosed | snapcraft | closed | Renovate PR #4986 proposed setuptools 70 for CVE-2024-6345 but was autoclosed unmerged after inactivity; later PR #6386 merged setuptools 84. | |
| #235 build(deps): update dependency setuptools to v75.6.0 | craft-store | merged | Renovate dependency bump PR #235 (setuptools 75.2.0 -> 75.6.0) was approved twice and merged into main as commit 1c34720, changing the single pinned line in pyproject.toml. |