← Back to issue list

chore(deps): update dependency setuptools to v65 [security] - autoclosed

View original Github issue

Metadata

Project
snapcraft
Number
#4774
Type
pull request
State
closed
Author
renovate[bot]
Labels
—
Created
Updated
Closed

Current evaluation

Renovate's setuptools 65.5.1 security update was autoclosed without merge after inactivity. Dependabot merged the same docs dependency bump in #4775 via d83f1ddb8.

Resolution: closed stale

Reason: PR #4774 received no review, CI results, or comments before Renovate autoclosed it after prolonged inactivity. A separate Dependabot PR, #4775, merged the same setuptools 59.6.0-to-65.5.1 docs update in commit d83f1ddb8.

Evaluated by: mr-cal-bot

No scores available.

Issue body

[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [setuptools](https://togithub.com/pypa/setuptools) ([changelog](https://setuptools.pypa.io/en/stable/history.html)) | `==59.6.0` -> `==65.5.1` | [![age](https://developer.mend.io/api/mc/badges/age/pypi/setuptools/65.5.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/pypi/setuptools/65.5.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/pypi/setuptools/59.6.0/65.5.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/setuptools/59.6.0/65.5.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2022-40897](https://nvd.nist.gov/vuln/detail/CVE-2022-40897) Python Packaging Authority (PyPA)'s setuptools is a library designed to facilitate packaging Python projects. Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in `package_index`. This has been patched in version 65.5.1. --- ### Release Notes <details> <summary>pypa/setuptools (setuptools)</summary> ### [`v65.5.1`](https://togithub.com/pypa/setuptools/compare/v65.5.0...v65.5.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.5.0...v65.5.1) ### [`v65.5.0`](https://togithub.com/pypa/setuptools/compare/v65.4.1...v65.5.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.4.1...v65.5.0) ### [`v65.4.1`](https://togithub.com/pypa/setuptools/compare/v65.4.0...v65.4.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.4.0...v65.4.1) ### [`v65.4.0`](https://togithub.com/pypa/setuptools/compare/v65.3.0...v65.4.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.3.0...v65.4.0) ### [`v65.3.0`](https://togithub.com/pypa/setuptools/compare/v65.2.0...v65.3.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.2.0...v65.3.0) ### [`v65.2.0`](https://togithub.com/pypa/setuptools/compare/v65.1.1...v65.2.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.1.1...v65.2.0) ### [`v65.1.1`](https://togithub.com/pypa/setuptools/compare/v65.1.0...v65.1.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.1.0...v65.1.1) ### [`v65.1.0`](https://togithub.com/pypa/setuptools/compare/v65.0.2...v65.1.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.0.2...v65.1.0) ### [`v65.0.2`](https://togithub.com/pypa/setuptools/compare/v65.0.1...v65.0.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.0.1...v65.0.2) ### [`v65.0.1`](https://togithub.com/pypa/setuptools/compare/v65.0.0...v65.0.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.0.0...v65.0.1) ### [`v65.0.0`](https://togithub.com/pypa/setuptools/compare/v64.0.3...v65.0.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v64.0.3...v65.0.0) ### [`v64.0.3`](https://togithub.com/pypa/setuptools/compare/v64.0.2...v64.0.3) [Compare Source](https://togithub.com/pypa/setuptools/compare/v64.0.2...v64.0.3) ### [`v64.0.2`](https://togithub.com/pypa/setuptools/compare/v64.0.1...v64.0.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v64.0.1...v64.0.2) ### [`v64.0.1`](https://togithub.com/pypa/setuptools/compare/v64.0.0...v64.0.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v64.0.0...v64.0.1) ### [`v64.0.0`](https://togithub.com/pypa/setuptools/compare/v63.4.3...v64.0.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v63.4.3...v64.0.0) ### [`v63.4.3`](https://togithub.com/pypa/setuptools/compare/v63.4.2...v63.4.3) [Compare Source](https://togithub.com/pypa/setuptools/compare/v63.4.2...v63.4.3) ### [`v63.4.2`](https://togithub.com/pypa/setuptools/compare/v63.4.1...v63.4.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v63.4.1...v63.4.2) ### [`v63.4.1`](https://togithub.com/pypa/setuptools/compare/v63.4.0...v63.4.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v63.4.0...v63.4.1) ### [`v63.4.0`](https://togithub.com/pypa/setuptools/compare/v63.3.0...v63.4.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v63.3.0...v63.4.0) ### [`v63.3.0`](https://togithub.com/pypa/setuptools/compare/v63.2.0...v63.3.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v63.2.0...v63.3.0) ### [`v63.2.0`](https://togithub.com/pypa/setuptools/compare/v63.1.0...v63.2.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v63.1.0...v63.2.0) ### [`v63.1.0`](https://togithub.com/pypa/setuptools/compare/v63.0.0...v63.1.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v63.0.0...v63.1.0) ### [`v63.0.0`](https://togithub.com/pypa/setuptools/compare/v62.6.0...v63.0.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.6.0...v63.0.0) ### [`v62.6.0`](https://togithub.com/pypa/setuptools/compare/v62.5.0...v62.6.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.5.0...v62.6.0) ### [`v62.5.0`](https://togithub.com/pypa/setuptools/compare/v62.4.0...v62.5.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.4.0...v62.5.0) ### [`v62.4.0`](https://togithub.com/pypa/setuptools/compare/v62.3.4...v62.4.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.3.4...v62.4.0) ### [`v62.3.4`](https://togithub.com/pypa/setuptools/compare/v62.3.3...v62.3.4) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.3.3...v62.3.4) ### [`v62.3.3`](https://togithub.com/pypa/setuptools/compare/v62.3.2...v62.3.3) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.3.2...v62.3.3) ### [`v62.3.2`](https://togithub.com/pypa/setuptools/compare/v62.3.1...v62.3.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.3.1...v62.3.2) ### [`v62.3.1`](https://togithub.com/pypa/setuptools/compare/v62.3.0...v62.3.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.3.0...v62.3.1) ### [`v62.3.0`](https://togithub.com/pypa/setuptools/compare/v62.2.0...v62.3.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.2.0...v62.3.0) ### [`v62.2.0`](https://togithub.com/pypa/setuptools/compare/v62.1.0...v62.2.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.1.0...v62.2.0) ### [`v62.1.0`](https://togithub.com/pypa/setuptools/compare/v62.0.0...v62.1.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.0.0...v62.1.0) ### [`v62.0.0`](https://togithub.com/pypa/setuptools/compare/v61.3.1...v62.0.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v61.3.1...v62.0.0) ### [`v61.3.1`](https://togithub.com/pypa/setuptools/compare/v61.3.0...v61.3.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v61.3.0...v61.3.1) ### [`v61.3.0`](https://togithub.com/pypa/setuptools/compare/v61.2.0...v61.3.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v61.2.0...v61.3.0) ### [`v61.2.0`](https://togithub.com/pypa/setuptools/compare/v61.1.1...v61.2.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v61.1.1...v61.2.0) ### [`v61.1.1`](https://togithub.com/pypa/setuptools/compare/v61.1.0...v61.1.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v61.1.0...v61.1.1) ### [`v61.1.0`](https://togithub.com/pypa/setuptools/compare/v61.0.0...v61.1.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v61.0.0...v61.1.0) ### [`v61.0.0`](https://togithub.com/pypa/setuptools/compare/v60.10.0...v61.0.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.10.0...v61.0.0) ### [`v60.10.0`](https://togithub.com/pypa/setuptools/compare/v60.9.3...v60.10.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.9.3...v60.10.0) ### [`v60.9.3`](https://togithub.com/pypa/setuptools/compare/v60.9.2...v60.9.3) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.9.2...v60.9.3) ### [`v60.9.2`](https://togithub.com/pypa/setuptools/compare/v60.9.1...v60.9.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.9.1...v60.9.2) ### [`v60.9.1`](https://togithub.com/pypa/setuptools/compare/v60.9.0...v60.9.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.9.0...v60.9.1) ### [`v60.9.0`](https://togithub.com/pypa/setuptools/compare/v60.8.2...v60.9.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.8.2...v60.9.0) ### [`v60.8.2`](https://togithub.com/pypa/setuptools/compare/v60.8.1...v60.8.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.8.1...v60.8.2) ### [`v60.8.1`](https://togithub.com/pypa/setuptools/compare/v60.8.0...v60.8.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.8.0...v60.8.1) ### [`v60.8.0`](https://togithub.com/pypa/setuptools/compare/v60.7.1...v60.8.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.7.1...v60.8.0) ### [`v60.7.1`](https://togithub.com/pypa/setuptools/compare/v60.7.0...v60.7.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.7.0...v60.7.1) ### [`v60.7.0`](https://togithub.com/pypa/setuptools/compare/v60.6.0...v60.7.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.6.0...v60.7.0) ### [`v60.6.0`](https://togithub.com/pypa/setuptools/compare/v60.5.0...v60.6.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.5.0...v60.6.0) ### [`v60.5.0`](https://togithub.com/pypa/setuptools/compare/v60.4.0...v60.5.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.4.0...v60.5.0) ### [`v60.4.0`](https://togithub.com/pypa/setuptools/compare/v60.3.1...v60.4.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.3.1...v60.4.0) ### [`v60.3.1`](https://togithub.com/pypa/setuptools/compare/v60.3.0...v60.3.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.3.0...v60.3.1) ### [`v60.3.0`](https://togithub.com/pypa/setuptools/compare/v60.2.0...v60.3.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.2.0...v60.3.0) ### [`v60.2.0`](https://togithub.com/pypa/setuptools/compare/v60.1.1...v60.2.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.1.1...v60.2.0) ### [`v60.1.1`](https://togithub.com/pypa/setuptools/compare/v60.1.0...v60.1.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.1.0...v60.1.1) ### [`v60.1.0`](https://togithub.com/pypa/setuptools/compare/v60.0.5...v60.1.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.0.5...v60.1.0) ### [`v60.0.5`](https://togithub.com/pypa/setuptools/compare/v60.0.4...v60.0.5) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.0.4...v60.0.5) ### [`v60.0.4`](https://togithub.com/pypa/setuptools/compare/v60.0.3...v60.0.4) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.0.3...v60.0.4) ### [`v60.0.3`](https://togithub.com/pypa/setuptools/compare/v60.0.2...v60.0.3) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.0.2...v60.0.3) ### [`v60.0.2`](https://togithub.com/pypa/setuptools/compare/v60.0.1...v60.0.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.0.1...v60.0.2) ### [`v60.0.1`](https://togithub.com/pypa/setuptools/compare/v60.0.0...v60.0.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.0.0...v60.0.1) ### [`v60.0.0`](https://togithub.com/pypa/setuptools/compare/v59.8.0...v60.0.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v59.8.0...v60.0.0) ### [`v59.8.0`](https://togithub.com/pypa/setuptools/compare/v59.7.0...v59.8.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v59.7.0...v59.8.0) ### [`v59.7.0`](https://togithub.com/pypa/setuptools/compare/v59.6.0...v59.7.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v59.6.0...v59.7.0) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "every weekend" in timezone Etc/UTC. 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/snapcraft). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zMjEuMiIsInVwZGF0ZWRJblZlciI6IjM3LjMyMS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed stale Renovate's setuptools 65.5.1 security update was autoclosed without merge after inactivity. Dependabot merged the same docs dependency bump in #4775 via d83f1ddb8.
stealth/space-bunny-alpha — closed superseded Autoclosed unmerged; the same setuptools 59.6.0→65.5.1 docs bump was merged via #4775 in commit d83f1ddb8.
stealth/space-bunny-alpha — closed superseded Renovate PR #4774 was autoclosed unmerged; Dependabot PR #4775 made the same setuptools update and merged as d83f1ddb8.
stealth/space-bunny-alpha — closed stale Renovate PR #4774 was autoclosed unmerged after inactivity. PR #4775 separately merged commit d83f1ddb8, updating setuptools 59.6.0 to 65.5.1 for docs.
stealth/space-bunny-alpha — closed stale Renovate PR #4774 was autoclosed without merge after inactivity; it proposed setuptools 65.5.1 to address CVE-2022-40897.
stealth/space-bunny-alpha — closed superseded Autoclosed after Dependabot PR #4775 applied the same setuptools 65.5.1 docs dependency update and merged as commit d83f1ddb8.
stealth/space-bunny-alpha — closed stale Renovate PR #4774 proposed setuptools 65.5.1 to address CVE-2022-40897, but was autoclosed after inactivity without review or merge.
qwen/qwen3.6-35b-a3b — — Automatically closed by Renovate due to inactivity. The update to setuptools v65.5.1 to address CVE-2022-40897 was abandoned without review or merge.
qwen3.6-35b-a3b-mtp-q6 — — Renovate bot PR updating setuptools to v65.5.1 for CVE-2022-40897 was autoclosed due to staleness. The dependency update was abandoned and never merged.

Update history

No update history recorded yet.

Related work

  • Related To: canonical/snapcraft#4775 (confidence 90%)

    Merged the same setuptools security upgrade for the docs dependency as commit d83f1ddb8.

Related issues

Issue Project State Summary Similarity
#153 chore(deps): update dependency setuptools to v67.8.0 - autoclosed craft-store closed Renovate PR #153 (setuptools 67.7.2 -> 67.8.0) was autoclosed unmerged; the same pin was instead bumped to 69.0.3 by merged PR #154 (commit 30d525f).
86%
#192 chore(deps): update dependency setuptools to v71 - autoclosed craft-store closed Renovate PR bumping setuptools 70.3.0 -> 71.1.0 was auto-closed unmerged; the pin was later updated to 75.1.0 by merged PR #225 (commit d90785a).
85%
#496 chore(deps): update dependency setuptools to v69 craft-providers merged Renovate's setuptools 67.8.0 -> 69.1.1 dev-dependency bump was merged to main via commit 1d7eaf8 after review (2024-01); coverage stayed at 98.99%.
84%
#23 chore(deps): update dependency setuptools to v67.2.0 craft-archives merged Renovate's setuptools 67.1.0->67.2.0 bump was approved and merged via #23 (commit 2d083ec), a one-line pin update; later builds moved setuptools to pyproject.toml.
84%
#26 chore(deps): update dependency setuptools to v67 starbase merged Renovate PR #26 was merged, updating setuptools from 66.1.1 to 67.1.0 in commit 8abb221.
84%
#559 chore(deps): update dependency setuptools to v69.5.1 craft-providers merged Renovate PR #559 was merged, updating setuptools from 69.5.0 to 69.5.1 in commit 623c34e.
84%
#538 chore(deps): update dependency setuptools to v69.2.0 craft-providers merged Renovate update merged via #538, raising setuptools from 69.1.1 to 69.2.0; landed as commit 105bff8.
83%
#173 chore(deps): update dependency setuptools to v69.5.1 craft-store closed Renovate PR #173 (setuptools ==69.2.0 -> ==69.5.1) was closed unmerged on 2024-05-26, superseded by #182, which merged as commit 7cf37e7 bumping setuptools straight to ==70.0.0.
83%
#267 chore(deps): update dependency setuptools to v69.1.1 craft-application merged Merged Renovate PR #267 updated setuptools from 69.1.0 to 69.1.1 in commit 54812365.
83%
#1726 chore(deps): update dependency setuptools to v70 [security] charmcraft merged Merged PR #1726 upgraded setuptools from 69.5.1 to 70.0.0 in commit 1ef1b2a6, addressing CVE-2024-6345.
82%