fix(deps, pyamber): update dependency setuptools to v83 [security] by renovate-bot · Pull Request #6911 · apache/texera

renovate-bot · 2026-07-26T20:34:34Z

This PR contains the following updates:

Package	Change	Age	Confidence
setuptools (changelog)	`==80.10.2` → `==83.0.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

BIT-setuptools-2026-59890 / CVE-2026-59890 / GHSA-h35f-9h28-mq5c / PYSEC-2026-3447

More information

Details

Summary

When building a source distribution (python -m build --sdist / setup.py sdist), setuptools' FileList applies MANIFEST.in directives (exclude, global-exclude, recursive-exclude, prune) by matching a compiled glob against on-disk file names byte-for-byte, with no Unicode normalization. On normalization-preserving filesystems (notably macOS APFS and HFS+), a file written in NFD and a MANIFEST.in rule written in NFC refer to the same file but are byte-distinct, so the exclusion silently fails to match. A file the maintainer intended to exclude is then packed into the .tar.gz and, if published, uploaded to the public, immutable PyPI index.

Details

File names in FileList.files come from os.walk (setuptools/_distutils/filelist.py, _find_all_simple), so on APFS a file written NFD is offered to the matcher in NFD, while the MANIFEST.in pattern carries the author's editor form (typically NFC). The matching path performs no canonicalization:

##### setuptools/command/egg_info.py  (FileList.global_exclude)
def global_exclude(self, pattern):
    match = translate_pattern(os.path.join('**', pattern))   # fnmatch.translate -> regex, no NFC/NFD
    return self._remove_files(match.match)                   # byte-level regex over raw os.walk names

A rule written NFC (café = 63 61 66 c3 a9) does not match an on-disk name written NFD (café = 63 61 66 65 cc 81), even though the filesystem treats the two as one file.

A unicodedata.normalize('NFD', ...) helper exists in setuptools/unicode_utils.py (decompose()), but it is never called in the manifest matching path, so neither the pattern nor the walked path is normalized before matching. The only normalization in this area, EggInfoCommand._manifest_normalize, uses filesys_decode (bytes→str decode only, no NFC/NFD) and runs when writing SOURCES.txt, after matching has already occurred.

Impact

MANIFEST.in exclusions are the documented mechanism maintainers use to keep secrets, local configs, and private fixtures out of the published sdist. A non-ASCII excluded file may be published to the public, immutable PyPI index despite the rule — an irreversible disclosure with no visual cue (NFC and NFD forms render identically). Exposure is filesystem-dependent and most relevant on macOS APFS/HFS+, where many maintainers build and publish. Pure-ASCII rules are unaffected.

Proof of concept

With a project containing MANIFEST.in:

global-include *.txt *.json
global-exclude secret_café.txt    # rule saved NFC

and an on-disk file secret_café.txt written in NFD, python -m build --sdist packs the secret file into the resulting .tar.gz, while an ASCII control file excluded by the same directive is correctly dropped — isolating the bypass to the NFC-pattern vs. NFD-name mismatch. Reproduced on macOS APFS with setuptools 82.0.1.

Remediation

Normalize both the walked path and each MANIFEST.in pattern to a single canonical form before matching, in both setuptools/command/egg_info.py (FileList) and the vendored setuptools/_distutils/filelist.py. For an exclusion list, err toward excluding more, and document that MANIFEST.in matching is normalization-insensitive on macOS.

Credit

Reported by Tomas Illuminati. Coordinated via CERT/CC VINCE VU#604762.

Severity

CVSS Score: 6.1 / 10 (Medium)
Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

BIT-setuptools-2026-59890 / CVE-2026-59890 / GHSA-h35f-9h28-mq5c / PYSEC-2026-3447

More information

Details

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.

Severity

CVSS Score: 6.1 / 10 (Medium)
Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

Release Notes

pypa/setuptools (setuptools)

Configuration

📅 Schedule: (in timezone Etc/UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-07-26T20:34:43Z

👋 Thanks for opening this pull request, @renovate-bot!

It looks like the pull request description doesn't quite follow our template yet:

The What changes were proposed in this PR? section is missing; please keep the template's headings.
The How was this PR tested? section is missing; please keep the template's headings.
The Was this PR authored or co-authored using generative AI tooling? section is missing; please keep the template's headings.

Filling out the template helps reviewers understand and triage your contribution faster. Please edit the description to complete it. This message will disappear automatically once the template is followed.

You can find the template prompts by editing the description, or see CONTRIBUTING.md for the full contribution flow.

github-actions · 2026-07-26T20:34:50Z

Automated Reviewer Suggestions

Based on the git blame history of the changed files, we recommend the following reviewers:

No candidates found from git blame history.

aglinxinyuan · 2026-07-27T05:14:09Z

Plan to remove setuptools: issue #6917

Yicong-Huang · 2026-07-27T16:48:42Z

@aicam @carloea2 can you take a look?

aicam · 2026-07-27T17:40:15Z

Since its a required library by another one, I suggest we remove it. @renovate-bot can you check which other library is using it and if possible just remove it so the other library can install the version it needs? this way we avoid conflict

codecov-commenter · 2026-07-27T18:17:49Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.70%. Comparing base (f521750) to head (2e7050a).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##               main    #6911   +/-   ##
=========================================
  Coverage     78.70%   78.70%           
  Complexity     3740     3740           
=========================================
  Files          1161     1161           
  Lines         46084    46084           
  Branches       5110     5110           
=========================================
  Hits          36269    36269           
  Misses         8206     8206           
  Partials       1609     1609

Flag	Coverage Δ	*Carryforward flag
access-control-service	`70.00% <ø> (ø)`	Carriedforward from f521750
agent-service	`76.76% <ø> (ø)`	Carriedforward from f521750
amber	`71.52% <ø> (ø)`	Carriedforward from f521750
computing-unit-managing-service	`20.49% <ø> (ø)`	Carriedforward from f521750
config-service	`66.66% <ø> (ø)`	Carriedforward from f521750
file-service	`67.21% <ø> (ø)`	Carriedforward from f521750
frontend	`82.91% <ø> (ø)`	Carriedforward from f521750
notebook-migration-service	`78.94% <ø> (ø)`	Carriedforward from f521750
pyamber	`95.38% <ø> (ø)`
workflow-compiling-service	`55.14% <ø> (ø)`	Carriedforward from f521750

*This pull request uses carry forward flags. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-07-27T18:43:54Z

⚠️ Benchmark changes need a look

🟢 0 better · 🔴 3 worse · ⚪ 12 noise (<±5%) · 0 without baseline

Compared against main f521750 benchmarked on this same runner, so the delta is largely free of cross-runner hardware noise. The "7d avg" column still reflects the gh-pages dashboard. Treat <±5% as noise unless repeated.

Dashboard · Run

	config	throughput	MB/s	latency	max Δ latest / 7d
🔴	bs=10 sw=10 sl=64	366	0.224	26,586/35,502/35,502 us	🔴 +12.3% / 🔴 +118.7%
🔴	bs=100 sw=10 sl=64	766	0.467	127,849/168,800/168,800 us	🔴 +21.9% / 🔴 +55.4%
⚪	bs=1000 sw=10 sl=64	896	0.547	1,115,622/1,161,408/1,161,408 us	⚪ within ±5% / 🔴 +11.6%

Baseline details

Latest main f521750 from same runner

config	metric	PR	latest main	7d avg	Δ latest	Δ 7d
bs=10 sw=10 sl=64	throughput	366 tuples/sec	383 tuples/sec	767.9 tuples/sec	-4.4%	-52.3%
bs=10 sw=10 sl=64	MB/s	0.224 MB/s	0.234 MB/s	0.469 MB/s	-4.3%	-52.2%
bs=10 sw=10 sl=64	p50	26,586 us	23,672 us	12,502 us	+12.3%	+112.7%
bs=10 sw=10 sl=64	p95	35,502 us	36,845 us	16,234 us	-3.6%	+118.7%
bs=10 sw=10 sl=64	p99	35,502 us	36,845 us	18,919 us	-3.6%	+87.7%
bs=100 sw=10 sl=64	throughput	766 tuples/sec	803 tuples/sec	974.8 tuples/sec	-4.6%	-21.4%
bs=100 sw=10 sl=64	MB/s	0.467 MB/s	0.49 MB/s	0.595 MB/s	-4.7%	-21.5%
bs=100 sw=10 sl=64	p50	127,849 us	122,702 us	102,449 us	+4.2%	+24.8%
bs=100 sw=10 sl=64	p95	168,800 us	138,429 us	108,652 us	+21.9%	+55.4%
bs=100 sw=10 sl=64	p99	168,800 us	138,429 us	116,310 us	+21.9%	+45.1%
bs=1000 sw=10 sl=64	throughput	896 tuples/sec	901 tuples/sec	1,004 tuples/sec	-0.6%	-10.8%
bs=1000 sw=10 sl=64	MB/s	0.547 MB/s	0.55 MB/s	0.613 MB/s	-0.5%	-10.7%
bs=1000 sw=10 sl=64	p50	1,115,622 us	1,109,081 us	999,606 us	+0.6%	+11.6%
bs=1000 sw=10 sl=64	p95	1,161,408 us	1,182,818 us	1,046,770 us	-1.8%	+11.0%
bs=1000 sw=10 sl=64	p99	1,161,408 us	1,182,818 us	1,076,937 us	-1.8%	+7.8%

Raw CSV

config_idx,batch_size,schema_width,string_len,num_batches,total_ms,total_tuples,total_bytes,tuples_per_sec,mb_per_sec,lat_p50_us,lat_p95_us,lat_p99_us
0,10,10,64,20,545.98,200,128000,366,0.224,26585.57,35501.86,35501.86
1,100,10,64,20,2611.41,2000,1280000,766,0.467,127848.60,168800.45,168800.45
2,1000,10,64,20,22332.84,20000,12800000,896,0.547,1115621.53,1161408.22,1161408.22

fix(deps, pyamber): update dependency setuptools to v83 [security]

2e7050a

forking-renovate Bot added dependencies Pull requests that update a dependency file release/v1.2 back porting to release/v1.2 security labels Jul 26, 2026

renovate-bot added dependencies Pull requests that update a dependency file release/v1.2 back porting to release/v1.2 security labels Jul 26, 2026

github-actions Bot assigned renovate-bot Jul 26, 2026

github-actions Bot added the pyamber label Jul 26, 2026

Yicong-Huang mentioned this pull request Jul 27, 2026

fix(dependencies): fix the version of setuptools package #4199

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps, pyamber): update dependency setuptools to v83 [security] - #6911

fix(deps, pyamber): update dependency setuptools to v83 [security]#6911
renovate-bot wants to merge 1 commit into
apache:mainfrom
renovate-bot:renovate/pypi-setuptools-vulnerability

renovate-bot commented Jul 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 26, 2026

Uh oh!

github-actions Bot commented Jul 26, 2026

Uh oh!

aglinxinyuan commented Jul 27, 2026 •

edited

Loading

Uh oh!

Yicong-Huang commented Jul 27, 2026

Uh oh!

aicam commented Jul 27, 2026

Uh oh!

codecov-commenter commented Jul 27, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

renovate-bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Details

Summary

Details

Impact

Proof of concept

Remediation

Credit

Severity

References

BIT-setuptools-2026-59890 / CVE-2026-59890 / GHSA-h35f-9h28-mq5c / PYSEC-2026-3447

Details

Severity

References

Release Notes

v83.0.0

v82.0.1

v82.0.0

v81.0.0

Configuration

Uh oh!

github-actions Bot commented Jul 26, 2026

Uh oh!

github-actions Bot commented Jul 26, 2026

Automated Reviewer Suggestions

Uh oh!

aglinxinyuan commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Yicong-Huang commented Jul 27, 2026

Uh oh!

aicam commented Jul 27, 2026

Uh oh!

codecov-commenter commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Jul 27, 2026

⚠️ Benchmark changes need a look

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

renovate-bot commented Jul 26, 2026 •

edited

Loading

`v83.0.0`

`v82.0.1`

`v82.0.0`

`v81.0.0`

aglinxinyuan commented Jul 27, 2026 •

edited

Loading

codecov-commenter commented Jul 27, 2026 •

edited

Loading