Skip to content

build(deps): bump setuptools from 80.10.1 to 83.0.0 - #347

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/setuptools-83.0.0
Closed

build(deps): bump setuptools from 80.10.1 to 83.0.0#347
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/setuptools-83.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 25, 2026

Copy link
Copy Markdown
Contributor

Bumps setuptools from 80.10.1 to 83.0.0.

Changelog

Sourced from setuptools's changelog.

v83.0.0

Features

  • Require Python 3.10 or later.

Bugfixes

  • MANIFEST.in matching (via FileList) is now insensitive to Unicode normalization form. A pattern authored in one form (e.g. NFC, as typically saved by editors) now matches a file whose name is stored on disk in another (e.g. NFD, as produced by macOS APFS/HFS+). Previously an exclude, global-exclude, recursive-exclude, or prune rule could silently fail to drop a non-ASCII-named file from the source distribution, publishing it despite the exclusion -- see GHSA-h35f-9h28-mq5c.

Deprecations and Removals

  • pypa/distutils#334

v82.0.1

Bugfixes

  • Fix the loading of launcher manifest.xml file. (#5047)
  • Replaced deprecated json.__version__ with fixture in tests. (#5186)

Improved Documentation

  • Add advice about how to improve predictability when installing sdists. (#5168)

Misc

v82.0.0

... (truncated)

Commits
  • 6519f72 Bump version: 82.0.1 → 83.0.0
  • d1151b1 Merge pull request #5250 from pypa/feature/distutils-d7633fbed
  • a2df31e Capture removal of dry_run parameter in changelog.
  • 00144dc Moved newsfragment to the release where it occurred.
  • a4a5a2b Add news fragment.
  • 77470c2 Merge https://github.com/pypa/distutils into feature/distutils-d7633fbed
  • 3c43897 Merge pull request #5247 from pypa/copilot/fix-pypy-version-issue
  • bb6ea66 Bump PyPy from 3.10 to 3.11 in CI workflow
  • a2bc3ac Fix broken intersphinx reference to build's installation docs
  • 2d6a739 Use stacked parametrize decorators instead of itertools.product
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [setuptools](https://github.com/pypa/setuptools) from 80.10.1 to 83.0.0.
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v80.10.1...v83.0.0)

---
updated-dependencies:
- dependency-name: setuptools
  dependency-version: 83.0.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 25, 2026
@semanticdiff-com

Copy link
Copy Markdown

Review changes with  SemanticDiff

F1uctus added a commit that referenced this pull request Jul 29, 2026
setuptools 82.0.0 removed the bundled `pkg_resources`, and coverage-badge
imports it at module scope, so the "Generate Coverage Badge" step dies
with ModuleNotFoundError as soon as setuptools is bumped past 81. That is
what fails dependabot's setuptools 83.0.0 PR (#347), which we want:
GHSA-h35f-9h28-mq5c is only fixed in 83.0.0, so there is no version of
setuptools that is both patched and compatible with coverage-badge.

coverage-badge cannot be waited on — its last release is 1.1.2 from
August 2024 and the upstream reports (dbrgn/coverage-badge#33, #35) are
open and untouched. genbadge reads the same coverage.xml, emits the same
shields-style SVG, and was last released in November 2025.

Verified locally with setuptools 83.0.0 installed: badge generation,
coverage-plot, `ty check ttc` and all 69 tests pass.
F1uctus added a commit that referenced this pull request Jul 29, 2026
* ci: generate the coverage badge with genbadge

setuptools 82.0.0 removed the bundled `pkg_resources`, and coverage-badge
imports it at module scope, so the "Generate Coverage Badge" step dies
with ModuleNotFoundError as soon as setuptools is bumped past 81. That is
what fails dependabot's setuptools 83.0.0 PR (#347), which we want:
GHSA-h35f-9h28-mq5c is only fixed in 83.0.0, so there is no version of
setuptools that is both patched and compatible with coverage-badge.

coverage-badge cannot be waited on — its last release is 1.1.2 from
August 2024 and the upstream reports (dbrgn/coverage-badge#33, #35) are
open and untouched. genbadge reads the same coverage.xml, emits the same
shields-style SVG, and was last released in November 2025.

Verified locally with setuptools 83.0.0 installed: badge generation,
coverage-plot, `ty check ttc` and all 69 tests pass.

* chore: update coverage assets
@F1uctus

F1uctus commented Jul 29, 2026

Copy link
Copy Markdown
Owner

Superseded by #358, which lands the same setuptools 80.10.1 → 83.0.0 bump in uv.lock together with the change that makes it viable.

This PR could not pass on its own: setuptools removed the bundled pkg_resources in 82.0.0, and coverage-badge imports it at module scope, so the "Generate Coverage Badge" step died with ModuleNotFoundError. #358 replaces coverage-badge with genbadge, which reads the same coverage.xml and is still maintained. GHSA-h35f-9h28-mq5c is now resolved on main.

@F1uctus F1uctus closed this Jul 29, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 29, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@F1uctus
F1uctus deleted the dependabot/uv/setuptools-83.0.0 branch July 29, 2026 16:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant