build(deps): update dependency setuptools to v70 [security] (hotfix/8.3) - autoclosed
Metadata
Current evaluation
Setuptools 70 hotfix for hotfix/8.3 was closed unmerged and abandoned after inactivity; no v70 commit landed.
Resolution: closed stale
Reason: Renovate's final comment says autoclosing was skipped because the branch had been modified, and the PR was ultimately closed unmerged. No review, CI, or setuptools 70 commit landed.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [setuptools](https://togithub.com/pypa/setuptools) ([changelog](https://setuptools.pypa.io/en/stable/history.html)) | `==65.5.1` -> `==70.0.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-6345](https://nvd.nist.gov/vuln/detail/CVE-2024-6345)
A vulnerability in the `package_index` module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.
---
### Release Notes
<details>
<summary>pypa/setuptools (setuptools)</summary>
### [`v70.0.0`](https://togithub.com/pypa/setuptools/compare/v69.5.1...v70.0.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.5.1...v70.0.0)
### [`v69.5.1`](https://togithub.com/pypa/setuptools/compare/v69.5.0...v69.5.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.5.0...v69.5.1)
### [`v69.5.0`](https://togithub.com/pypa/setuptools/compare/v69.4.2...v69.5.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.4.2...v69.5.0)
### [`v69.4.2`](https://togithub.com/pypa/setuptools/compare/v69.4.1...v69.4.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.4.1...v69.4.2)
### [`v69.4.1`](https://togithub.com/pypa/setuptools/compare/v69.4.0...v69.4.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.4.0...v69.4.1)
### [`v69.4.0`](https://togithub.com/pypa/setuptools/compare/v69.3.1...v69.4.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.3.1...v69.4.0)
### [`v69.3.1`](https://togithub.com/pypa/setuptools/compare/v69.3.0...v69.3.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.3.0...v69.3.1)
### [`v69.3.0`](https://togithub.com/pypa/setuptools/compare/v69.2.0...v69.3.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.2.0...v69.3.0)
### [`v69.2.0`](https://togithub.com/pypa/setuptools/compare/v69.1.1...v69.2.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.1.1...v69.2.0)
### [`v69.1.1`](https://togithub.com/pypa/setuptools/compare/v69.1.0...v69.1.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.1.0...v69.1.1)
### [`v69.1.0`](https://togithub.com/pypa/setuptools/compare/v69.0.3...v69.1.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.0.3...v69.1.0)
### [`v69.0.3`](https://togithub.com/pypa/setuptools/compare/v69.0.2...v69.0.3)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.0.2...v69.0.3)
### [`v69.0.2`](https://togithub.com/pypa/setuptools/compare/v69.0.1...v69.0.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.0.1...v69.0.2)
### [`v69.0.1`](https://togithub.com/pypa/setuptools/compare/v69.0.0...v69.0.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.0.0...v69.0.1)
### [`v69.0.0`](https://togithub.com/pypa/setuptools/compare/v68.2.2...v69.0.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v68.2.2...v69.0.0)
### [`v68.2.2`](https://togithub.com/pypa/setuptools/compare/v68.2.1...v68.2.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v68.2.1...v68.2.2)
### [`v68.2.1`](https://togithub.com/pypa/setuptools/compare/v68.2.0...v68.2.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v68.2.0...v68.2.1)
### [`v68.2.0`](https://togithub.com/pypa/setuptools/compare/v68.1.2...v68.2.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v68.1.2...v68.2.0)
### [`v68.1.2`](https://togithub.com/pypa/setuptools/compare/v68.1.0...v68.1.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v68.1.0...v68.1.2)
### [`v68.1.0`](https://togithub.com/pypa/setuptools/compare/v68.0.0...v68.1.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v68.0.0...v68.1.0)
### [`v68.0.0`](https://togithub.com/pypa/setuptools/compare/v67.8.0...v68.0.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.8.0...v68.0.0)
### [`v67.8.0`](https://togithub.com/pypa/setuptools/compare/v67.7.2...v67.8.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.7.2...v67.8.0)
### [`v67.7.2`](https://togithub.com/pypa/setuptools/compare/v67.7.1...v67.7.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.7.1...v67.7.2)
### [`v67.7.1`](https://togithub.com/pypa/setuptools/compare/v67.7.0...v67.7.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.7.0...v67.7.1)
### [`v67.7.0`](https://togithub.com/pypa/setuptools/compare/v67.6.1...v67.7.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.6.1...v67.7.0)
### [`v67.6.1`](https://togithub.com/pypa/setuptools/compare/v67.6.0...v67.6.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.6.0...v67.6.1)
### [`v67.6.0`](https://togithub.com/pypa/setuptools/compare/v67.5.1...v67.6.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.5.1...v67.6.0)
### [`v67.5.1`](https://togithub.com/pypa/setuptools/compare/v67.5.0...v67.5.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.5.0...v67.5.1)
### [`v67.5.0`](https://togithub.com/pypa/setuptools/compare/v67.4.0...v67.5.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.4.0...v67.5.0)
### [`v67.4.0`](https://togithub.com/pypa/setuptools/compare/v67.3.3...v67.4.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.3.3...v67.4.0)
### [`v67.3.3`](https://togithub.com/pypa/setuptools/compare/v67.3.2...v67.3.3)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.3.2...v67.3.3)
### [`v67.3.2`](https://togithub.com/pypa/setuptools/compare/v67.3.1...v67.3.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.3.1...v67.3.2)
### [`v67.3.1`](https://togithub.com/pypa/setuptools/compare/v67.2.0...v67.3.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.2.0...v67.3.1)
### [`v67.2.0`](https://togithub.com/pypa/setuptools/compare/v67.1.0...v67.2.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.1.0...v67.2.0)
### [`v67.1.0`](https://togithub.com/pypa/setuptools/compare/v67.0.0...v67.1.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.0.0...v67.1.0)
### [`v67.0.0`](https://togithub.com/pypa/setuptools/compare/v66.1.1...v67.0.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v66.1.1...v67.0.0)
### [`v66.1.1`](https://togithub.com/pypa/setuptools/compare/v66.1.0...v66.1.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v66.1.0...v66.1.1)
### [`v66.1.0`](https://togithub.com/pypa/setuptools/compare/v66.0.0...v66.1.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v66.0.0...v66.1.0)
### [`v66.0.0`](https://togithub.com/pypa/setuptools/compare/v65.7.0...v66.0.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v65.7.0...v66.0.0)
### [`v65.7.0`](https://togithub.com/pypa/setuptools/compare/v65.6.3...v65.7.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v65.6.3...v65.7.0)
### [`v65.6.3`](https://togithub.com/pypa/setuptools/compare/v65.6.2...v65.6.3)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v65.6.2...v65.6.3)
### [`v65.6.2`](https://togithub.com/pypa/setuptools/compare/v65.6.1...v65.6.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v65.6.1...v65.6.2)
### [`v65.6.1`](https://togithub.com/pypa/setuptools/compare/v65.6.0...v65.6.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v65.6.0...v65.6.1)
### [`v65.6.0`](https://togithub.com/pypa/setuptools/compare/v65.5.1...v65.6.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v65.5.1...v65.6.0)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/snapcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40MzEuNCIsInVwZGF0ZWRJblZlciI6IjM4LjI2LjEiLCJ0YXJnZXRCcmFuY2giOiJob3RmaXgvOC4zIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | Setuptools 70 hotfix for hotfix/8.3 was closed unmerged and abandoned after inactivity; no v70 commit landed. | |
| stealth/space-bunny-alpha | — | closed stale | Setuptools 70 security PR #4920 was closed unmerged after prolonged inactivity; no resolving hotfix/8.3 commit landed. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate PR #4920 proposed setuptools 70 for hotfix/8.3 but was closed unmerged after inactivity; no review, CI, or v70 resolving commit was recorded. | |
| stealth/space-bunny-alpha | — | closed stale | Setuptools 70 security update for hotfix/8.3 was closed unmerged and abandoned; no review, CI, or v70 resolving commit was recorded. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without merging. Renovate proposed updating setuptools to v70.0.0 to fix CVE-2024-6345. The branch was manually modified, causing the bot to skip autoclosing. The update was ultimately abandoned. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Renovate autoclosed this security update for setuptools v70.0.0 without merging. The bot skipped initial autoclosing due to branch modifications but ultimately closed the PR, leaving the dependency update unapplied. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4987 build(deps): update dependency setuptools to v70 [security] (hotfix/8.3) - autoclosed | snapcraft | closed | Renovate’s setuptools 70 security hotfix for hotfix/8.3 was auto-closed unmerged after prolonged inactivity; no review, CI, or resolving commit landed. | |
| #1098 build(deps): update dependency setuptools to v78 [security] (hotfix/2.7) - autoclosed | craft-parts | closed | Autoclosed unmerged after 493 days; the setuptools 78.1.1 security update was merged separately via #1096 at commit 0681571f. | |
| #4986 build(deps): update dependency setuptools to v70 [security] (main) - autoclosed | snapcraft | closed | Renovate PR #4986 proposed setuptools 70 for CVE-2024-6345 but was autoclosed unmerged after inactivity; later PR #6386 merged setuptools 84. | |
| #2292 build(deps): update dependency setuptools to v78 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Renovate's setuptools 78.1.1 security update for hotfix/2.7 was autoclosed unmerged after prolonged inactivity; numerous CI jobs failed and no resolving commit was recorded. | |
| #2293 build(deps): update dependency setuptools to v78 [security] (hotfix/3.4) - autoclosed | charmcraft | closed | Renovate's setuptools 78.1.1 security update for hotfix/3.4 was autoclosed unmerged after 483 days; no resolving commit landed. | |
| #1097 build(deps): update dependency setuptools to v78 [security] (hotfix/2.4) - autoclosed | craft-parts | closed | Renovate PR #1097 was autoclosed unmerged after 493 days, leaving setuptools 75.7.0 in hotfix/2.4; Ubuntu 20.04 tests and linters were failing. | |
| #2291 build(deps): update dependency setuptools to v78 [security] (main) - autoclosed | charmcraft | closed | Renovate's setuptools 78.1.1 security update was autoclosed unmerged; no corresponding version bump or resolving commit was found. | |
| #1096 build(deps): update dependency setuptools to v78 [security] (main) | craft-parts | merged | Merged in #1096 via commit 0681571f, upgrading setuptools from 75.7.0 to 78.1.1 to remediate CVE-2025-47273. | |
| #4919 build(deps): bump setuptools from 65.5.1 to 70.0.0 in /docs | snapcraft | closed | Dependabot PR #4919 to raise docs setuptools from 65.5.1 to 70.0.0 was closed unmerged as stale after prolonged inactivity and disabled automatic rebases. | |
| #225 build(deps): update dependency setuptools to v75 | craft-store | merged | Merged in #225 via commit d90785a, updating setuptools from 70.3.0 to 75.1.0. |