Repository navigation
fix(deps): bump setuptools 84.0.0 -> 84.1.0 for Dependabot alerts 8 and 9 - #4
Open
jaberjaber23 wants to merge 1 commit into
Open
jaberjaber23 wants to merge 1 commit into
jaberjaber23 wants to merge 1 commit into
Conversation
…nd 9 - alert 8: python/pyproject.toml build-system requires setuptools==84.0.0 -> setuptools==84.1.0 (development, build backend) - alert 9: tools/sdk/build-requirements.txt setuptools==84.0.0 -> 84.1.0, with the 84.1.0 wheel hash (build environment for CI and release) The same change goes to this repository's export sources in rightnow-api (pull request 187 there), so the next export keeps these lines.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the two low Dependabot alerts for setuptools (GHSA-xmj3-9gf7-h52w, fixed in 84.1.0). This is a minor bump of the exact pins, kept in each file's existing style.
Alerts closed
python/pyproject.toml(build-system requires)setuptools==84.0.0setuptools==84.1.0tools/sdk/build-requirements.txtsetuptools==84.0.0+ 84.0.0 wheel hashsetuptools==84.1.0+ 84.1.0 wheel hash5231689c...24c9The wheel hash was checked twice: against PyPI's published digest and by hashing the downloaded
setuptools-84.1.0-py3-none-any.whl. setuptools 84.1.0 requires Python >=3.10, matching the CI matrix and the package'srequires-python.Release date: setuptools 84.1.0 was published 2026-10-19 (10 days ago). This is short of the two-week soak, which it reaches on 2026-11-02. It is the first patched release.
This repository is exported from rightnow-api. The same change to its export sources is in RightNow-AI/rightnow-api#187, and
tools/sdk/build-requirements.txtis byte-identical to that template. No other file here references setuptools 84.0.0, and no test pins a hash of either file.Verification (local, Python 3.14.7, same commands as the Python CI job)
pip install --require-hashes --only-binary :all: -r tools/sdk/runtime-requirements.txt -r tools/sdk/build-requirements.txt -r tools/sdk/test-requirements.txt: OK. The 84.1.0 hash verifies.pip install --no-deps --no-build-isolation ./python: OK, built with setuptools 84.1.0.pytest python/tests integrations/function-tools -c python/pyproject.toml: 886 passed, 35 subtests passed.tools/sdk/smoke.py: OK.tests/workflow_policy.py,tests/release_artifacts.py,tools/sdk/scan_tree.py --root .andtests/content_rules.py: all OK.Deploys on merge
Nothing is published on merge.
sdk-release.ymlruns only on a manual dispatch or ansdk-v*tag push. Merging runsSDK CIonly.Related
Dependabot PR #3 bumps only
python/pyproject.toml. This PR covers it and alert 9.