build(deps): update dependency setuptools to v70 [security] (hotfix/8.3) - autoclosed
Metadata
Current evaluation
Renovate’s setuptools 70 security hotfix for hotfix/8.3 was auto-closed unmerged after prolonged inactivity; no review, CI, or resolving commit landed.
Resolution: closed stale
Reason: PR #4987 remained unreviewed with no CI results and was auto-closed unmerged. The earlier identical hotfix PR #4920 was also closed unmerged, and no setuptools 70 resolving commit was found.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [setuptools](https://togithub.com/pypa/setuptools) ([changelog](https://setuptools.pypa.io/en/stable/history.html)) | `==65.5.1` -> `==70.0.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2024-6345](https://nvd.nist.gov/vuln/detail/CVE-2024-6345)
A vulnerability in the `package_index` module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.
---
### Release Notes
<details>
<summary>pypa/setuptools (setuptools)</summary>
### [`v70.0.0`](https://togithub.com/pypa/setuptools/compare/v69.5.1...v70.0.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.5.1...v70.0.0)
### [`v69.5.1`](https://togithub.com/pypa/setuptools/compare/v69.5.0...v69.5.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.5.0...v69.5.1)
### [`v69.5.0`](https://togithub.com/pypa/setuptools/compare/v69.4.2...v69.5.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.4.2...v69.5.0)
### [`v69.4.2`](https://togithub.com/pypa/setuptools/compare/v69.4.1...v69.4.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.4.1...v69.4.2)
### [`v69.4.1`](https://togithub.com/pypa/setuptools/compare/v69.4.0...v69.4.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.4.0...v69.4.1)
### [`v69.4.0`](https://togithub.com/pypa/setuptools/compare/v69.3.1...v69.4.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.3.1...v69.4.0)
### [`v69.3.1`](https://togithub.com/pypa/setuptools/compare/v69.3.0...v69.3.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.3.0...v69.3.1)
### [`v69.3.0`](https://togithub.com/pypa/setuptools/compare/v69.2.0...v69.3.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.2.0...v69.3.0)
### [`v69.2.0`](https://togithub.com/pypa/setuptools/compare/v69.1.1...v69.2.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.1.1...v69.2.0)
### [`v69.1.1`](https://togithub.com/pypa/setuptools/compare/v69.1.0...v69.1.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.1.0...v69.1.1)
### [`v69.1.0`](https://togithub.com/pypa/setuptools/compare/v69.0.3...v69.1.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.0.3...v69.1.0)
### [`v69.0.3`](https://togithub.com/pypa/setuptools/compare/v69.0.2...v69.0.3)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.0.2...v69.0.3)
### [`v69.0.2`](https://togithub.com/pypa/setuptools/compare/v69.0.1...v69.0.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.0.1...v69.0.2)
### [`v69.0.1`](https://togithub.com/pypa/setuptools/compare/v69.0.0...v69.0.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v69.0.0...v69.0.1)
### [`v69.0.0`](https://togithub.com/pypa/setuptools/compare/v68.2.2...v69.0.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v68.2.2...v69.0.0)
### [`v68.2.2`](https://togithub.com/pypa/setuptools/compare/v68.2.1...v68.2.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v68.2.1...v68.2.2)
### [`v68.2.1`](https://togithub.com/pypa/setuptools/compare/v68.2.0...v68.2.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v68.2.0...v68.2.1)
### [`v68.2.0`](https://togithub.com/pypa/setuptools/compare/v68.1.2...v68.2.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v68.1.2...v68.2.0)
### [`v68.1.2`](https://togithub.com/pypa/setuptools/compare/v68.1.0...v68.1.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v68.1.0...v68.1.2)
### [`v68.1.0`](https://togithub.com/pypa/setuptools/compare/v68.0.0...v68.1.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v68.0.0...v68.1.0)
### [`v68.0.0`](https://togithub.com/pypa/setuptools/compare/v67.8.0...v68.0.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.8.0...v68.0.0)
### [`v67.8.0`](https://togithub.com/pypa/setuptools/compare/v67.7.2...v67.8.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.7.2...v67.8.0)
### [`v67.7.2`](https://togithub.com/pypa/setuptools/compare/v67.7.1...v67.7.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.7.1...v67.7.2)
### [`v67.7.1`](https://togithub.com/pypa/setuptools/compare/v67.7.0...v67.7.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.7.0...v67.7.1)
### [`v67.7.0`](https://togithub.com/pypa/setuptools/compare/v67.6.1...v67.7.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.6.1...v67.7.0)
### [`v67.6.1`](https://togithub.com/pypa/setuptools/compare/v67.6.0...v67.6.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.6.0...v67.6.1)
### [`v67.6.0`](https://togithub.com/pypa/setuptools/compare/v67.5.1...v67.6.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.5.1...v67.6.0)
### [`v67.5.1`](https://togithub.com/pypa/setuptools/compare/v67.5.0...v67.5.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.5.0...v67.5.1)
### [`v67.5.0`](https://togithub.com/pypa/setuptools/compare/v67.4.0...v67.5.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.4.0...v67.5.0)
### [`v67.4.0`](https://togithub.com/pypa/setuptools/compare/v67.3.3...v67.4.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.3.3...v67.4.0)
### [`v67.3.3`](https://togithub.com/pypa/setuptools/compare/v67.3.2...v67.3.3)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.3.2...v67.3.3)
### [`v67.3.2`](https://togithub.com/pypa/setuptools/compare/v67.3.1...v67.3.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.3.1...v67.3.2)
### [`v67.3.1`](https://togithub.com/pypa/setuptools/compare/v67.2.0...v67.3.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.2.0...v67.3.1)
### [`v67.2.0`](https://togithub.com/pypa/setuptools/compare/v67.1.0...v67.2.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.1.0...v67.2.0)
### [`v67.1.0`](https://togithub.com/pypa/setuptools/compare/v67.0.0...v67.1.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v67.0.0...v67.1.0)
### [`v67.0.0`](https://togithub.com/pypa/setuptools/compare/v66.1.1...v67.0.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v66.1.1...v67.0.0)
### [`v66.1.1`](https://togithub.com/pypa/setuptools/compare/v66.1.0...v66.1.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v66.1.0...v66.1.1)
### [`v66.1.0`](https://togithub.com/pypa/setuptools/compare/v66.0.0...v66.1.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v66.0.0...v66.1.0)
### [`v66.0.0`](https://togithub.com/pypa/setuptools/compare/v65.7.0...v66.0.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v65.7.0...v66.0.0)
### [`v65.7.0`](https://togithub.com/pypa/setuptools/compare/v65.6.3...v65.7.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v65.6.3...v65.7.0)
### [`v65.6.3`](https://togithub.com/pypa/setuptools/compare/v65.6.2...v65.6.3)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v65.6.2...v65.6.3)
### [`v65.6.2`](https://togithub.com/pypa/setuptools/compare/v65.6.1...v65.6.2)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v65.6.1...v65.6.2)
### [`v65.6.1`](https://togithub.com/pypa/setuptools/compare/v65.6.0...v65.6.1)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v65.6.0...v65.6.1)
### [`v65.6.0`](https://togithub.com/pypa/setuptools/compare/v65.5.1...v65.6.0)
[Compare Source](https://togithub.com/pypa/setuptools/compare/v65.5.1...v65.6.0)
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View the [repository job log](https://developer.mend.io/github/canonical/snapcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC4yNi4xIiwidXBkYXRlZEluVmVyIjoiMzguMjYuMSIsInRhcmdldEJyYW5jaCI6ImhvdGZpeC84LjMiLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | Renovate’s setuptools 70 security hotfix for hotfix/8.3 was auto-closed unmerged after prolonged inactivity; no review, CI, or resolving commit landed. | |
| stealth/space-bunny-alpha | — | closed stale | Autoclosed unmerged after prolonged inactivity; setuptools 70 was not applied to hotfix/8.3. The parallel PR #4920 was also abandoned. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate proposed setuptools 70.0.0 for CVE-2024-6345 on hotfix/8.3, but #4920 was closed unmerged without reviews, CI results, or commits. | |
| stealth/space-bunny-alpha | — | closed stale | Renovate’s setuptools v70.0.0 security update for hotfix/8.3 was autoclosed unmerged. No #4920 or setuptools v70 commit was found; the parallel main PR #4986 was also abandoned. | |
| qwen/qwen3.6-35b-a3b | — | — | Automatically closed by Renovate due to inactivity. The setuptools update to v70 for CVE-2024-6345 was never reviewed or merged. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Automatically closed by Renovate without merging. The setuptools security update to v70.0.0 was abandoned, likely due to branch expiration or configuration overrides. |
Update history
No update history recorded yet.
Related work
-
Duplicate Of:
canonical/snapcraft#4920
(confidence 96%)
Proposed the same setuptools 65.5.1-to-70.0.0 security update for hotfix/8.3 and was also closed unmerged.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4920 build(deps): update dependency setuptools to v70 [security] (hotfix/8.3) - autoclosed | snapcraft | closed | Setuptools 70 hotfix for hotfix/8.3 was closed unmerged and abandoned after inactivity; no v70 commit landed. | |
| #2293 build(deps): update dependency setuptools to v78 [security] (hotfix/3.4) - autoclosed | charmcraft | closed | Renovate's setuptools 78.1.1 security update for hotfix/3.4 was autoclosed unmerged after 483 days; no resolving commit landed. | |
| #2292 build(deps): update dependency setuptools to v78 [security] (hotfix/2.7) - autoclosed | charmcraft | closed | Renovate's setuptools 78.1.1 security update for hotfix/2.7 was autoclosed unmerged after prolonged inactivity; numerous CI jobs failed and no resolving commit was recorded. | |
| #4986 build(deps): update dependency setuptools to v70 [security] (main) - autoclosed | snapcraft | closed | Renovate PR #4986 proposed setuptools 70 for CVE-2024-6345 but was autoclosed unmerged after inactivity; later PR #6386 merged setuptools 84. | |
| #1098 build(deps): update dependency setuptools to v78 [security] (hotfix/2.7) - autoclosed | craft-parts | closed | Autoclosed unmerged after 493 days; the setuptools 78.1.1 security update was merged separately via #1096 at commit 0681571f. | |
| #1097 build(deps): update dependency setuptools to v78 [security] (hotfix/2.4) - autoclosed | craft-parts | closed | Renovate PR #1097 was autoclosed unmerged after 493 days, leaving setuptools 75.7.0 in hotfix/2.4; Ubuntu 20.04 tests and linters were failing. | |
| #2291 build(deps): update dependency setuptools to v78 [security] (main) - autoclosed | charmcraft | closed | Renovate's setuptools 78.1.1 security update was autoclosed unmerged; no corresponding version bump or resolving commit was found. | |
| #1283 build(deps): update dependency setuptools to v82 (main) - autoclosed | rockcraft | closed | Renovate's setuptools ~80.10.2 to ~82.0.1 bump was autoclosed unmerged after no reviews or comments; lint/ files and source-spread-tests CI failed and the update never landed. | |
| #298 build(deps): update dependency setuptools to v82 (main) - autoclosed | imagecraft | closed | Renovate's setuptools<82.1 PR was closed unmerged after a maintainer proposed removing obsolete sphinxcontrib-details-directive and loosening the setuptools cap. | |
| #1096 build(deps): update dependency setuptools to v78 [security] (main) | craft-parts | merged | Merged in #1096 via commit 0681571f, upgrading setuptools from 75.7.0 to 78.1.1 to remediate CVE-2025-47273. |