Skip to content

[Snyk] Security upgrade setuptools from 40.5.0 to 78.1.1 #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mitchelllisle merged 3 commits into from
Dec 26, 2025
Merged

[Snyk] Security upgrade setuptools from 40.5.0 to 78.1.1 #14

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8718a32
fix: requirements/dev.txt to reduce vulnerabilities
snyk-bot May 7, 2025
898da32
Merge branch 'main' into snyk-fix-57c3938b2669118ca8d9790d0e508630
mitchelllisle Dec 26, 2025
4aca998
Merge branch 'main' into snyk-fix-57c3938b2669118ca8d9790d0e508630
mitchelllisle Dec 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion requirements/dev.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ mypy

pre-commit
setuptools>=78.1.1 # not directly required, pinned by Snyk to avoid a vulnerability
certifi>=2024.7.4 # not directly required, pinned by Snyk to avoid a vulnerability
certifi>=2023.7.22 # not directly required, pinned by Snyk to avoid a vulnerability

Copilot AI Dec 26, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The certifi package is being downgraded from >=2024.7.4 to >=2023.7.22. This downgrade may reintroduce security vulnerabilities that were previously fixed. The PR description mentions this is a security upgrade for setuptools, but this change appears to weaken the security posture by allowing older versions of certifi. Please verify this change is intentional and does not introduce known vulnerabilities.

Suggested change
certifi>=2023.7.22 # not directly required, pinned by Snyk to avoid a vulnerability
certifi>=2024.7.4 # not directly required, pinned by Snyk to avoid a vulnerability

Copilot uses AI. Check for mistakes.
pygments>=2.15.0 # not directly required, pinned by Snyk to avoid a vulnerability
requests>=2.32.4 # not directly required, pinned by Snyk to avoid a vulnerability
zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability
Expand Down