← Back to issue list

build(deps): update dependency setuptools to v70 [security] (main) - autoclosed

View original Github issue

Metadata

Project
snapcraft
Number
#4986
Type
pull request
State
closed
Author
renovate[bot]
Labels
—
Created
Updated
Closed

Current evaluation

Dependency update to setuptools v70.0.0 for CVE-2024-6345 was autoclosed without merging. Renovate automatically closed the branch, likely superseded by another update or applied separately.

Suggested action: —

No scores available.

Issue body

[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [setuptools](https://togithub.com/pypa/setuptools) ([changelog](https://setuptools.pypa.io/en/stable/history.html)) | `==65.5.1` -> `==70.0.0` | [![age](https://developer.mend.io/api/mc/badges/age/pypi/setuptools/70.0.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/pypi/setuptools/70.0.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/pypi/setuptools/65.5.1/70.0.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/setuptools/65.5.1/70.0.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2024-6345](https://nvd.nist.gov/vuln/detail/CVE-2024-6345) A vulnerability in the `package_index` module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0. --- ### Release Notes <details> <summary>pypa/setuptools (setuptools)</summary> ### [`v70.0.0`](https://togithub.com/pypa/setuptools/compare/v69.5.1...v70.0.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v69.5.1...v70.0.0) ### [`v69.5.1`](https://togithub.com/pypa/setuptools/compare/v69.5.0...v69.5.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v69.5.0...v69.5.1) ### [`v69.5.0`](https://togithub.com/pypa/setuptools/compare/v69.4.2...v69.5.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v69.4.2...v69.5.0) ### [`v69.4.2`](https://togithub.com/pypa/setuptools/compare/v69.4.1...v69.4.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v69.4.1...v69.4.2) ### [`v69.4.1`](https://togithub.com/pypa/setuptools/compare/v69.4.0...v69.4.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v69.4.0...v69.4.1) ### [`v69.4.0`](https://togithub.com/pypa/setuptools/compare/v69.3.1...v69.4.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v69.3.1...v69.4.0) ### [`v69.3.1`](https://togithub.com/pypa/setuptools/compare/v69.3.0...v69.3.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v69.3.0...v69.3.1) ### [`v69.3.0`](https://togithub.com/pypa/setuptools/compare/v69.2.0...v69.3.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v69.2.0...v69.3.0) ### [`v69.2.0`](https://togithub.com/pypa/setuptools/compare/v69.1.1...v69.2.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v69.1.1...v69.2.0) ### [`v69.1.1`](https://togithub.com/pypa/setuptools/compare/v69.1.0...v69.1.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v69.1.0...v69.1.1) ### [`v69.1.0`](https://togithub.com/pypa/setuptools/compare/v69.0.3...v69.1.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v69.0.3...v69.1.0) ### [`v69.0.3`](https://togithub.com/pypa/setuptools/compare/v69.0.2...v69.0.3) [Compare Source](https://togithub.com/pypa/setuptools/compare/v69.0.2...v69.0.3) ### [`v69.0.2`](https://togithub.com/pypa/setuptools/compare/v69.0.1...v69.0.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v69.0.1...v69.0.2) ### [`v69.0.1`](https://togithub.com/pypa/setuptools/compare/v69.0.0...v69.0.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v69.0.0...v69.0.1) ### [`v69.0.0`](https://togithub.com/pypa/setuptools/compare/v68.2.2...v69.0.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v68.2.2...v69.0.0) ### [`v68.2.2`](https://togithub.com/pypa/setuptools/compare/v68.2.1...v68.2.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v68.2.1...v68.2.2) ### [`v68.2.1`](https://togithub.com/pypa/setuptools/compare/v68.2.0...v68.2.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v68.2.0...v68.2.1) ### [`v68.2.0`](https://togithub.com/pypa/setuptools/compare/v68.1.2...v68.2.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v68.1.2...v68.2.0) ### [`v68.1.2`](https://togithub.com/pypa/setuptools/compare/v68.1.0...v68.1.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v68.1.0...v68.1.2) ### [`v68.1.0`](https://togithub.com/pypa/setuptools/compare/v68.0.0...v68.1.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v68.0.0...v68.1.0) ### [`v68.0.0`](https://togithub.com/pypa/setuptools/compare/v67.8.0...v68.0.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v67.8.0...v68.0.0) ### [`v67.8.0`](https://togithub.com/pypa/setuptools/compare/v67.7.2...v67.8.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v67.7.2...v67.8.0) ### [`v67.7.2`](https://togithub.com/pypa/setuptools/compare/v67.7.1...v67.7.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v67.7.1...v67.7.2) ### [`v67.7.1`](https://togithub.com/pypa/setuptools/compare/v67.7.0...v67.7.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v67.7.0...v67.7.1) ### [`v67.7.0`](https://togithub.com/pypa/setuptools/compare/v67.6.1...v67.7.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v67.6.1...v67.7.0) ### [`v67.6.1`](https://togithub.com/pypa/setuptools/compare/v67.6.0...v67.6.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v67.6.0...v67.6.1) ### [`v67.6.0`](https://togithub.com/pypa/setuptools/compare/v67.5.1...v67.6.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v67.5.1...v67.6.0) ### [`v67.5.1`](https://togithub.com/pypa/setuptools/compare/v67.5.0...v67.5.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v67.5.0...v67.5.1) ### [`v67.5.0`](https://togithub.com/pypa/setuptools/compare/v67.4.0...v67.5.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v67.4.0...v67.5.0) ### [`v67.4.0`](https://togithub.com/pypa/setuptools/compare/v67.3.3...v67.4.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v67.3.3...v67.4.0) ### [`v67.3.3`](https://togithub.com/pypa/setuptools/compare/v67.3.2...v67.3.3) [Compare Source](https://togithub.com/pypa/setuptools/compare/v67.3.2...v67.3.3) ### [`v67.3.2`](https://togithub.com/pypa/setuptools/compare/v67.3.1...v67.3.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v67.3.1...v67.3.2) ### [`v67.3.1`](https://togithub.com/pypa/setuptools/compare/v67.2.0...v67.3.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v67.2.0...v67.3.1) ### [`v67.2.0`](https://togithub.com/pypa/setuptools/compare/v67.1.0...v67.2.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v67.1.0...v67.2.0) ### [`v67.1.0`](https://togithub.com/pypa/setuptools/compare/v67.0.0...v67.1.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v67.0.0...v67.1.0) ### [`v67.0.0`](https://togithub.com/pypa/setuptools/compare/v66.1.1...v67.0.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v66.1.1...v67.0.0) ### [`v66.1.1`](https://togithub.com/pypa/setuptools/compare/v66.1.0...v66.1.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v66.1.0...v66.1.1) ### [`v66.1.0`](https://togithub.com/pypa/setuptools/compare/v66.0.0...v66.1.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v66.0.0...v66.1.0) ### [`v66.0.0`](https://togithub.com/pypa/setuptools/compare/v65.7.0...v66.0.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.7.0...v66.0.0) ### [`v65.7.0`](https://togithub.com/pypa/setuptools/compare/v65.6.3...v65.7.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.6.3...v65.7.0) ### [`v65.6.3`](https://togithub.com/pypa/setuptools/compare/v65.6.2...v65.6.3) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.6.2...v65.6.3) ### [`v65.6.2`](https://togithub.com/pypa/setuptools/compare/v65.6.1...v65.6.2) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.6.1...v65.6.2) ### [`v65.6.1`](https://togithub.com/pypa/setuptools/compare/v65.6.0...v65.6.1) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.6.0...v65.6.1) ### [`v65.6.0`](https://togithub.com/pypa/setuptools/compare/v65.5.1...v65.6.0) [Compare Source](https://togithub.com/pypa/setuptools/compare/v65.5.1...v65.6.0) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/snapcraft). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC4yNi4xIiwidXBkYXRlZEluVmVyIjoiMzguMjYuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.6-35b-a3b — — Dependency update to setuptools v70.0.0 for CVE-2024-6345 was autoclosed without merging. Renovate automatically closed the branch, likely superseded by another update or applied separately.
qwen3.6-35b-a3b-mtp-q6 — — Automated pull request to update setuptools to v70.0.0 for CVE-2024-6345 was autoclosed without merging. The security update was abandoned or superseded by a newer Renovate-generated PR.
qwen3.6-35b-a3b-mtp-q6 — — Renovate dependency update to setuptools v70.0.0 for CVE-2024-6345 was autoclosed without merging. The branch was likely marked stale or superseded, leaving the security patch unapplied.

Update history

No update history recorded yet.

Related issues

Issue Project State Summary Similarity
#4920 build(deps): update dependency setuptools to v70 [security] (hotfix/8.3) - autoclosed snapcraft closed Closed without merging. Renovate proposed updating setuptools to v70.0.0 to fix CVE-2024-6345. The branch was manually modified, causing the bot to skip autoclosing. The update was ultimately abandoned.
93%
#4987 build(deps): update dependency setuptools to v70 [security] (hotfix/8.3) - autoclosed snapcraft closed Automatically closed by Renovate due to inactivity. The setuptools update to v70 for CVE-2024-6345 was never reviewed or merged.
91%
#2291 build(deps): update dependency setuptools to v78 [security] (main) - autoclosed charmcraft closed Renovate bot PR updating setuptools to v78.1.1 to patch CVE-2025-47273 was autoclosed and abandoned. The security update was not merged.
90%
#2292 build(deps): update dependency setuptools to v78 [security] (hotfix/2.7) - autoclosed charmcraft closed Autoclosed and abandoned without merging. Renovate proposed updating setuptools to v78.1.1 to address CVE-2025-47273, but multiple CI checks failed and the branch was automatically closed.
88%
#2293 build(deps): update dependency setuptools to v78 [security] (hotfix/3.4) - autoclosed charmcraft closed A security update to setuptools v78.1.1 addressing CVE-2025-47273 was autoclosed by the bot without merging. The dependency patch was abandoned and not applied.
86%
#1097 build(deps): update dependency setuptools to v78 [security] (hotfix/2.4) - autoclosed craft-parts closed Renovate PR updating setuptools to v78.1.1 for CVE-2025-47273 was autoclosed without merging. Minor CI failures on older Ubuntu versions prevented progress. The security update was abandoned and never applied.
86%
#1098 build(deps): update dependency setuptools to v78 [security] (hotfix/2.7) - autoclosed craft-parts closed Security update for setuptools to v78.1.1 addressing CVE-2025-47273 was autoclosed without merging. CI checks failed on Ubuntu 20.04 and linters. The bot-generated PR was abandoned due to inactivity and configuration constraints.
84%
#1283 build(deps): update dependency setuptools to v82 (main) - autoclosed rockcraft closed The setuptools dependency update PR was autoclosed without merging. Renovate bot automatically closed the request after it received no reviews or comments.
83%
#1096 build(deps): update dependency setuptools to v78 [security] (main) craft-parts merged Merged automated update upgrading setuptools from 75.7.0 to 78.1.1 to patch CVE-2025-47273, a path traversal vulnerability in PackageIndex. The change passed CI checks and was merged to main.
81%
#1117 build(deps): update dependency requests to v2.32.4 [security] (main) - autoclosed craft-parts closed Renovate autoclosed the pull request updating requests to v2.32.4 for CVE-2024-47081. The security update was automatically closed and unmerged, likely due to CI failures or being superseded.
81%