build(deps): update dependency setuptools to v70 [security] (main) - autoclosed
Metadata
Current evaluation
Renovate PR #4986 proposed setuptools 70 for CVE-2024-6345 but was autoclosed unmerged after inactivity; later PR #6386 merged setuptools 84.
Resolution: closed stale
Reason: PR #4986 was autoclosed unmerged after prolonged inactivity, with no review or resolving commit. The later merged PR #6386, commit afde69391, advanced setuptools to v84 and superseded the abandoned proposal.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [setuptools](https://togithub.com/pypa/setuptools) ([changelog](https://setuptools.pypa.io/en/stable/history.html)) | `==65.5.1` -> `==70.0.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-6345](https://nvd.nist.gov/vuln/detail/CVE-2024-6345)
A vulnerability in the `package_index` module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.
---
### Release Notes
<details>
<summary>pypa/setuptools (setuptools)</summary>
### [`v70.0.0`](https://togithub.com/pypa/setuptools/compare/v69.5.1...v70.0.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.5.1...v70.0.0)
### [`v69.5.1`](https://togithub.com/pypa/setuptools/compare/v69.5.0...v69.5.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.5.0...v69.5.1)
### [`v69.5.0`](https://togithub.com/pypa/setuptools/compare/v69.4.2...v69.5.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.4.2...v69.5.0)
### [`v69.4.2`](https://togithub.com/pypa/setuptools/compare/v69.4.1...v69.4.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.4.1...v69.4.2)
### [`v69.4.1`](https://togithub.com/pypa/setuptools/compare/v69.4.0...v69.4.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.4.0...v69.4.1)
### [`v69.4.0`](https://togithub.com/pypa/setuptools/compare/v69.3.1...v69.4.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.3.1...v69.4.0)
### [`v69.3.1`](https://togithub.com/pypa/setuptools/compare/v69.3.0...v69.3.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.3.0...v69.3.1)
### [`v69.3.0`](https://togithub.com/pypa/setuptools/compare/v69.2.0...v69.3.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.2.0...v69.3.0)
### [`v69.2.0`](https://togithub.com/pypa/setuptools/compare/v69.1.1...v69.2.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.1.1...v69.2.0)
### [`v69.1.1`](https://togithub.com/pypa/setuptools/compare/v69.1.0...v69.1.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.1.0...v69.1.1)
### [`v69.1.0`](https://togithub.com/pypa/setuptools/compare/v69.0.3...v69.1.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.0.3...v69.1.0)
### [`v69.0.3`](https://togithub.com/pypa/setuptools/compare/v69.0.2...v69.0.3)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.0.2...v69.0.3)
### [`v69.0.2`](https://togithub.com/pypa/setuptools/compare/v69.0.1...v69.0.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.0.1...v69.0.2)
### [`v69.0.1`](https://togithub.com/pypa/setuptools/compare/v69.0.0...v69.0.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.0.0...v69.0.1)
### [`v69.0.0`](https://togithub.com/pypa/setuptools/compare/v68.2.2...v69.0.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v68.2.2...v69.0.0)
### [`v68.2.2`](https://togithub.com/pypa/setuptools/compare/v68.2.1...v68.2.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v68.2.1...v68.2.2)
### [`v68.2.1`](https://togithub.com/pypa/setuptools/compare/v68.2.0...v68.2.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v68.2.0...v68.2.1)
### [`v68.2.0`](https://togithub.com/pypa/setuptools/compare/v68.1.2...v68.2.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v68.1.2...v68.2.0)
### [`v68.1.2`](https://togithub.com/pypa/setuptools/compare/v68.1.0...v68.1.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v68.1.0...v68.1.2)
### [`v68.1.0`](https://togithub.com/pypa/setuptools/compare/v68.0.0...v68.1.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v68.0.0...v68.1.0)
### [`v68.0.0`](https://togithub.com/pypa/setuptools/compare/v67.8.0...v68.0.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.8.0...v68.0.0)
### [`v67.8.0`](https://togithub.com/pypa/setuptools/compare/v67.7.2...v67.8.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.7.2...v67.8.0)
### [`v67.7.2`](https://togithub.com/pypa/setuptools/compare/v67.7.1...v67.7.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.7.1...v67.7.2)
### [`v67.7.1`](https://togithub.com/pypa/setuptools/compare/v67.7.0...v67.7.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.7.0...v67.7.1)
### [`v67.7.0`](https://togithub.com/pypa/setuptools/compare/v67.6.1...v67.7.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.6.1...v67.7.0)
### [`v67.6.1`](https://togithub.com/pypa/setuptools/compare/v67.6.0...v67.6.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.6.0...v67.6.1)
### [`v67.6.0`](https://togithub.com/pypa/setuptools/compare/v67.5.1...v67.6.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.5.1...v67.6.0)
### [`v67.5.1`](https://togithub.com/pypa/setuptools/compare/v67.5.0...v67.5.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.5.0...v67.5.1)
### [`v67.5.0`](https://togithub.com/pypa/setuptools/compare/v67.4.0...v67.5.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.4.0...v67.5.0)
### [`v67.4.0`](https://togithub.com/pypa/setuptools/compare/v67.3.3...v67.4.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.3.3...v67.4.0)
### [`v67.3.3`](https://togithub.com/pypa/setuptools/compare/v67.3.2...v67.3.3)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.3.2...v67.3.3)
### [`v67.3.2`](https://togithub.com/pypa/setuptools/compare/v67.3.1...v67.3.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.3.1...v67.3.2)
### [`v67.3.1`](https://togithub.com/pypa/setuptools/compare/v67.2.0...v67.3.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.2.0...v67.3.1)
### [`v67.2.0`](https://togithub.com/pypa/setuptools/compare/v67.1.0...v67.2.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.1.0...v67.2.0)
### [`v67.1.0`](https://togithub.com/pypa/setuptools/compare/v67.0.0...v67.1.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.0.0...v67.1.0)
### [`v67.0.0`](https://togithub.com/pypa/setuptools/compare/v66.1.1...v67.0.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v66.1.1...v67.0.0)
### [`v66.1.1`](https://togithub.com/pypa/setuptools/compare/v66.1.0...v66.1.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v66.1.0...v66.1.1)
### [`v66.1.0`](https://togithub.com/pypa/setuptools/compare/v66.0.0...v66.1.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v66.0.0...v66.1.0)
### [`v66.0.0`](https://togithub.com/pypa/setuptools/compare/v65.7.0...v66.0.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v65.7.0...v66.0.0)
### [`v65.7.0`](https://togithub.com/pypa/setuptools/compare/v65.6.3...v65.7.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v65.6.3...v65.7.0)
### [`v65.6.3`](https://togithub.com/pypa/setuptools/compare/v65.6.2...v65.6.3)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v65.6.2...v65.6.3)
### [`v65.6.2`](https://togithub.com/pypa/setuptools/compare/v65.6.1...v65.6.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v65.6.1...v65.6.2)
### [`v65.6.1`](https://togithub.com/pypa/setuptools/compare/v65.6.0...v65.6.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v65.6.0...v65.6.1)
### [`v65.6.0`](https://togithub.com/pypa/setuptools/compare/v65.5.1...v65.6.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v65.5.1...v65.6.0)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/snapcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC4yNi4xIiwidXBkYXRlZEluVmVyIjoiMzguMjYuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | Renovate PR #4986 proposed setuptools 70 for CVE-2024-6345 but was autoclosed unmerged after inactivity; later PR #6386 merged setuptools 84. | |
| stealth/space-bunny-alpha | — | closed stale | Autoclosed unmerged after inactivity; the setuptools upgrade later landed via snapcraft#6386 (afde69391), advancing to v84. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate’s setuptools v70 security update for main was autoclosed unmerged after inactivity, with no review or resolving commit; setuptools was later updated to v84 in #6386. | |
| qwen/qwen3.6-35b-a3b | — | — | Dependency update to setuptools v70.0.0 for CVE-2024-6345 was autoclosed without merging. Renovate automatically closed the branch, likely superseded by another update or applied separately. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Automated pull request to update setuptools to v70.0.0 for CVE-2024-6345 was autoclosed without merging. The security update was abandoned or superseded by a newer Renovate-generated PR. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/snapcraft#6386
(confidence 96%)
Merged PR #6386 later updated setuptools to v84, replacing the obsolete v70 proposal.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4987 build(deps): update dependency setuptools to v70 [security] (hotfix/8.3) - autoclosed | snapcraft | closed | Renovate’s setuptools 70 security hotfix for hotfix/8.3 was auto-closed unmerged after prolonged inactivity; no review, CI, or resolving commit landed. | |
| #4920 build(deps): update dependency setuptools to v70 [security] (hotfix/8.3) - autoclosed | snapcraft | closed | Setuptools 70 hotfix for hotfix/8.3 was closed unmerged and abandoned after inactivity; no v70 commit landed. | |
| #2291 build(deps): update dependency setuptools to v78 [security] (main) - autoclosed | charmcraft | closed | Renovate's setuptools 78.1.1 security update was autoclosed unmerged; no corresponding version bump or resolving commit was found. | |
| #1097 build(deps): update dependency setuptools to v78 [security] (hotfix/2.4) - autoclosed | craft-parts | closed | Renovate PR #1097 was autoclosed unmerged after 493 days, leaving setuptools 75.7.0 in hotfix/2.4; Ubuntu 20.04 tests and linters were failing. | |
| #1098 build(deps): update dependency setuptools to v78 [security] (hotfix/2.7) - autoclosed | craft-parts | closed | Autoclosed unmerged after 493 days; the setuptools 78.1.1 security update was merged separately via #1096 at commit 0681571f. | |
| #2293 build(deps): update dependency setuptools to v78 [security] (hotfix/3.4) - autoclosed | charmcraft | closed | Renovate's setuptools 78.1.1 security update for hotfix/3.4 was autoclosed unmerged after 483 days; no resolving commit landed. | |
| #2292 build(deps): update dependency setuptools to v78 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Renovate's setuptools 78.1.1 security update for hotfix/2.7 was autoclosed unmerged after prolonged inactivity; numerous CI jobs failed and no resolving commit was recorded. | |
| #1096 build(deps): update dependency setuptools to v78 [security] (main) | craft-parts | merged | Merged in #1096 via commit 0681571f, upgrading setuptools from 75.7.0 to 78.1.1 to remediate CVE-2025-47273. | |
| #1283 build(deps): update dependency setuptools to v82 (main) - autoclosed | rockcraft | closed | Renovate's setuptools ~80.10.2 to ~82.0.1 bump was autoclosed unmerged after no reviews or comments; lint/ files and source-spread-tests CI failed and the update never landed. | |
| #298 build(deps): update dependency setuptools to v82 (main) - autoclosed | imagecraft | closed | Renovate's setuptools<82.1 PR was closed unmerged after a maintainer proposed removing obsolete sphinxcontrib-details-directive and loosening the setuptools cap. |