← Back to issue list

chore(deps): update dependency setuptools to v65 [security] - autoclosed

View original Github issue

Metadata

Project
snapcraft
Number
#4774
Type
pull request
State
closed
Author
renovate[bot]
Labels
—
Created
Updated
Closed

Current evaluation

Automatically closed by Renovate due to inactivity. The update to setuptools v65.5.1 to address CVE-2022-40897 was abandoned without review or merge.

Suggested action: —

No scores available.

Issue body

[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [setuptools](https://togithub.com/pypa/setuptools) ([changelog](https://setuptools.pypa.io/en/stable/history.html)) | `==59.6.0` -> `==65.5.1` | [![age](https://developer.mend.io/api/mc/badges/age/pypi/setuptools/65.5.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/pypi/setuptools/65.5.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/pypi/setuptools/59.6.0/65.5.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/setuptools/59.6.0/65.5.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2022-40897](https://nvd.nist.gov/vuln/detail/CVE-2022-40897) Python Packaging Authority (PyPA)'s setuptools is a library designed to facilitate packaging Python projects. Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in `package_index`. This has been patched in version 65.5.1. --- ### Release Notes <details> <summary>pypa/setuptools (setuptools)</summary> ### [`v65.5.1`](https://togithub.com/pypa/setuptools/compare/v65.5.0...v65.5.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.5.0...v65.5.1) ### [`v65.5.0`](https://togithub.com/pypa/setuptools/compare/v65.4.1...v65.5.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.4.1...v65.5.0) ### [`v65.4.1`](https://togithub.com/pypa/setuptools/compare/v65.4.0...v65.4.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.4.0...v65.4.1) ### [`v65.4.0`](https://togithub.com/pypa/setuptools/compare/v65.3.0...v65.4.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.3.0...v65.4.0) ### [`v65.3.0`](https://togithub.com/pypa/setuptools/compare/v65.2.0...v65.3.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.2.0...v65.3.0) ### [`v65.2.0`](https://togithub.com/pypa/setuptools/compare/v65.1.1...v65.2.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.1.1...v65.2.0) ### [`v65.1.1`](https://togithub.com/pypa/setuptools/compare/v65.1.0...v65.1.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.1.0...v65.1.1) ### [`v65.1.0`](https://togithub.com/pypa/setuptools/compare/v65.0.2...v65.1.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.0.2...v65.1.0) ### [`v65.0.2`](https://togithub.com/pypa/setuptools/compare/v65.0.1...v65.0.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.0.1...v65.0.2) ### [`v65.0.1`](https://togithub.com/pypa/setuptools/compare/v65.0.0...v65.0.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.0.0...v65.0.1) ### [`v65.0.0`](https://togithub.com/pypa/setuptools/compare/v64.0.3...v65.0.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v64.0.3...v65.0.0) ### [`v64.0.3`](https://togithub.com/pypa/setuptools/compare/v64.0.2...v64.0.3) [Compare Source](https://togithub.com/pypa/setuptools/compare/v64.0.2...v64.0.3) ### [`v64.0.2`](https://togithub.com/pypa/setuptools/compare/v64.0.1...v64.0.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v64.0.1...v64.0.2) ### [`v64.0.1`](https://togithub.com/pypa/setuptools/compare/v64.0.0...v64.0.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v64.0.0...v64.0.1) ### [`v64.0.0`](https://togithub.com/pypa/setuptools/compare/v63.4.3...v64.0.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v63.4.3...v64.0.0) ### [`v63.4.3`](https://togithub.com/pypa/setuptools/compare/v63.4.2...v63.4.3) [Compare Source](https://togithub.com/pypa/setuptools/compare/v63.4.2...v63.4.3) ### [`v63.4.2`](https://togithub.com/pypa/setuptools/compare/v63.4.1...v63.4.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v63.4.1...v63.4.2) ### [`v63.4.1`](https://togithub.com/pypa/setuptools/compare/v63.4.0...v63.4.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v63.4.0...v63.4.1) ### [`v63.4.0`](https://togithub.com/pypa/setuptools/compare/v63.3.0...v63.4.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v63.3.0...v63.4.0) ### [`v63.3.0`](https://togithub.com/pypa/setuptools/compare/v63.2.0...v63.3.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v63.2.0...v63.3.0) ### [`v63.2.0`](https://togithub.com/pypa/setuptools/compare/v63.1.0...v63.2.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v63.1.0...v63.2.0) ### [`v63.1.0`](https://togithub.com/pypa/setuptools/compare/v63.0.0...v63.1.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v63.0.0...v63.1.0) ### [`v63.0.0`](https://togithub.com/pypa/setuptools/compare/v62.6.0...v63.0.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.6.0...v63.0.0) ### [`v62.6.0`](https://togithub.com/pypa/setuptools/compare/v62.5.0...v62.6.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.5.0...v62.6.0) ### [`v62.5.0`](https://togithub.com/pypa/setuptools/compare/v62.4.0...v62.5.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.4.0...v62.5.0) ### [`v62.4.0`](https://togithub.com/pypa/setuptools/compare/v62.3.4...v62.4.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.3.4...v62.4.0) ### [`v62.3.4`](https://togithub.com/pypa/setuptools/compare/v62.3.3...v62.3.4) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.3.3...v62.3.4) ### [`v62.3.3`](https://togithub.com/pypa/setuptools/compare/v62.3.2...v62.3.3) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.3.2...v62.3.3) ### [`v62.3.2`](https://togithub.com/pypa/setuptools/compare/v62.3.1...v62.3.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.3.1...v62.3.2) ### [`v62.3.1`](https://togithub.com/pypa/setuptools/compare/v62.3.0...v62.3.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.3.0...v62.3.1) ### [`v62.3.0`](https://togithub.com/pypa/setuptools/compare/v62.2.0...v62.3.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.2.0...v62.3.0) ### [`v62.2.0`](https://togithub.com/pypa/setuptools/compare/v62.1.0...v62.2.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.1.0...v62.2.0) ### [`v62.1.0`](https://togithub.com/pypa/setuptools/compare/v62.0.0...v62.1.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v62.0.0...v62.1.0) ### [`v62.0.0`](https://togithub.com/pypa/setuptools/compare/v61.3.1...v62.0.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v61.3.1...v62.0.0) ### [`v61.3.1`](https://togithub.com/pypa/setuptools/compare/v61.3.0...v61.3.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v61.3.0...v61.3.1) ### [`v61.3.0`](https://togithub.com/pypa/setuptools/compare/v61.2.0...v61.3.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v61.2.0...v61.3.0) ### [`v61.2.0`](https://togithub.com/pypa/setuptools/compare/v61.1.1...v61.2.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v61.1.1...v61.2.0) ### [`v61.1.1`](https://togithub.com/pypa/setuptools/compare/v61.1.0...v61.1.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v61.1.0...v61.1.1) ### [`v61.1.0`](https://togithub.com/pypa/setuptools/compare/v61.0.0...v61.1.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v61.0.0...v61.1.0) ### [`v61.0.0`](https://togithub.com/pypa/setuptools/compare/v60.10.0...v61.0.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.10.0...v61.0.0) ### [`v60.10.0`](https://togithub.com/pypa/setuptools/compare/v60.9.3...v60.10.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.9.3...v60.10.0) ### [`v60.9.3`](https://togithub.com/pypa/setuptools/compare/v60.9.2...v60.9.3) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.9.2...v60.9.3) ### [`v60.9.2`](https://togithub.com/pypa/setuptools/compare/v60.9.1...v60.9.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.9.1...v60.9.2) ### [`v60.9.1`](https://togithub.com/pypa/setuptools/compare/v60.9.0...v60.9.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.9.0...v60.9.1) ### [`v60.9.0`](https://togithub.com/pypa/setuptools/compare/v60.8.2...v60.9.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.8.2...v60.9.0) ### [`v60.8.2`](https://togithub.com/pypa/setuptools/compare/v60.8.1...v60.8.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.8.1...v60.8.2) ### [`v60.8.1`](https://togithub.com/pypa/setuptools/compare/v60.8.0...v60.8.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.8.0...v60.8.1) ### [`v60.8.0`](https://togithub.com/pypa/setuptools/compare/v60.7.1...v60.8.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.7.1...v60.8.0) ### [`v60.7.1`](https://togithub.com/pypa/setuptools/compare/v60.7.0...v60.7.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.7.0...v60.7.1) ### [`v60.7.0`](https://togithub.com/pypa/setuptools/compare/v60.6.0...v60.7.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.6.0...v60.7.0) ### [`v60.6.0`](https://togithub.com/pypa/setuptools/compare/v60.5.0...v60.6.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.5.0...v60.6.0) ### [`v60.5.0`](https://togithub.com/pypa/setuptools/compare/v60.4.0...v60.5.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.4.0...v60.5.0) ### [`v60.4.0`](https://togithub.com/pypa/setuptools/compare/v60.3.1...v60.4.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.3.1...v60.4.0) ### [`v60.3.1`](https://togithub.com/pypa/setuptools/compare/v60.3.0...v60.3.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.3.0...v60.3.1) ### [`v60.3.0`](https://togithub.com/pypa/setuptools/compare/v60.2.0...v60.3.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.2.0...v60.3.0) ### [`v60.2.0`](https://togithub.com/pypa/setuptools/compare/v60.1.1...v60.2.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.1.1...v60.2.0) ### [`v60.1.1`](https://togithub.com/pypa/setuptools/compare/v60.1.0...v60.1.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.1.0...v60.1.1) ### [`v60.1.0`](https://togithub.com/pypa/setuptools/compare/v60.0.5...v60.1.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.0.5...v60.1.0) ### [`v60.0.5`](https://togithub.com/pypa/setuptools/compare/v60.0.4...v60.0.5) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.0.4...v60.0.5) ### [`v60.0.4`](https://togithub.com/pypa/setuptools/compare/v60.0.3...v60.0.4) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.0.3...v60.0.4) ### [`v60.0.3`](https://togithub.com/pypa/setuptools/compare/v60.0.2...v60.0.3) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.0.2...v60.0.3) ### [`v60.0.2`](https://togithub.com/pypa/setuptools/compare/v60.0.1...v60.0.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.0.1...v60.0.2) ### [`v60.0.1`](https://togithub.com/pypa/setuptools/compare/v60.0.0...v60.0.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v60.0.0...v60.0.1) ### [`v60.0.0`](https://togithub.com/pypa/setuptools/compare/v59.8.0...v60.0.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v59.8.0...v60.0.0) ### [`v59.8.0`](https://togithub.com/pypa/setuptools/compare/v59.7.0...v59.8.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v59.7.0...v59.8.0) ### [`v59.7.0`](https://togithub.com/pypa/setuptools/compare/v59.6.0...v59.7.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v59.6.0...v59.7.0) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "every weekend" in timezone Etc/UTC. 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/canonical/snapcraft). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zMjEuMiIsInVwZGF0ZWRJblZlciI6IjM3LjMyMS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.6-35b-a3b — — Automatically closed by Renovate due to inactivity. The update to setuptools v65.5.1 to address CVE-2022-40897 was abandoned without review or merge.
qwen3.6-35b-a3b-mtp-q6 — — Renovate bot PR updating setuptools to v65.5.1 for CVE-2022-40897 was autoclosed due to staleness. The dependency update was abandoned and never merged.
qwen3.6-35b-a3b-mtp-q6 — — Pull request to update setuptools to v65.5.1 for CVE-2022-40897 was autoclosed without merging. Renovate automatically closed the branch due to inactivity or superseding updates.

Update history

No update history recorded yet.

Related issues

Issue Project State Summary Similarity
#153 chore(deps): update dependency setuptools to v67.8.0 - autoclosed craft-store closed Autoclosed by Renovate after approval. The setuptools dependency update to v67.8.0 was not merged and was automatically closed.
91%
#188 chore(deps): update dependency setuptools to v69.1.0 - autoclosed starbase closed Renovate bot dependency update for setuptools to v69.1.0 was autoclosed due to inactivity. No reviews or CI checks were performed, and the change was not merged.
89%
#192 chore(deps): update dependency setuptools to v71 - autoclosed craft-store closed Renovate-generated dependency update for setuptools to v71.1.0 was autoclosed due to inactivity. No reviews or CI checks occurred, and the change was abandoned without merging.
88%
#173 chore(deps): update dependency setuptools to v69.5.1 craft-store closed Dependency update to setuptools v69.5.1 was closed without merging and superseded by PR #182. Renovate will ignore this specific version.
88%
#43 chore(deps): update dependency setuptools to v67.4.0 starbase merged Merged automated dependency update for setuptools from v67.3.2 to v67.4.0. Generated by Renovate, the change passed CI checks, received reviewer approval, and was successfully merged.
86%
#30 chore(deps): update dependency setuptools to v67.2.0 starbase merged Merged automated dependency update for setuptools from v67.1.0 to v67.2.0. The Renovate-generated pull request passed CI checks, received approval, and was successfully merged.
85%
#23 chore(deps): update dependency setuptools to v67.2.0 craft-archives merged Merged automated dependency update for setuptools from v67.1.0 to v67.2.0 via Renovate. The change modified one file with a single line update, passed CI checks, received approval, and was successfully merged.
84%
#1726 chore(deps): update dependency setuptools to v70 [security] charmcraft merged Merged automated dependency update upgrading setuptools from v69.5.1 to v70.0.0 to patch CVE-2024-6345, a remote code execution vulnerability. The change received reviewer approval and passed all CI checks.
83%
#4773 chore(deps): update dependency pip to v23 [security] - autoclosed snapcraft closed Automatically closed without merging. The Renovate bot dependency update upgrading pip to v23.3 to address CVE-2023-5752 was abandoned, likely due to staleness or repository configuration.
83%
#4856 chore(deps): update dependency requests to v2.32.2 [security] - autoclosed snapcraft closed Renovate's dependency update PR for requests to v2.32.2 was autoclosed without merging. The bot automatically closed the stale pull request, leaving the CVE-2024-35195 security fix unapplied.
82%