From dd282df60747c4620374989a110f789a3b4b3a94 Mon Sep 17 00:00:00 2001 From: aryasadeghi1 Date: Thu, 23 Jul 2026 14:42:44 +1000 Subject: [PATCH] build: drop setuptools upper bound, keep CVE floor (>=78.1.1) aaz-dev only renders setup.py templates for generated extensions and never executes them, so the setuptools<81 cap added in 4.6.1 is not load-bearing here. Replace it with the >=78.1.1 floor (CVE-2025-47273) so this repo no longer blocks the ecosystem-wide unpin. In shared dev environments the effective version is still bounded by azdev's own setuptools requirement until azdev lifts its cap. --- HISTORY.rst | 4 ++++ requirements.txt | 2 +- version.py | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/HISTORY.rst b/HISTORY.rst index 6ea0c46c..622dc345 100644 --- a/HISTORY.rst +++ b/HISTORY.rst @@ -3,6 +3,10 @@ Release History =============== +4.6.2 +++++++ +* Remove the ``setuptools<81`` upper bound; require ``setuptools>=78.1.1`` instead (includes the CVE-2025-47273 fix). aaz-dev only renders ``setup.py`` templates and never executes them, so newer setuptools does not affect it; in a shared dev environment the effective version is still bounded by ``azdev``'s own ``setuptools`` requirement. + 4.6.1 ++++++ * Unpinned ``setuptools`` (was ``==70.0.0``) to allow newer versions, capped at ``<81`` because setuptools 81+ drops ``setup.py``-based build support. diff --git a/requirements.txt b/requirements.txt index 0fa59c70..82d5bad7 100644 --- a/requirements.txt +++ b/requirements.txt @@ -11,7 +11,7 @@ Jinja2~=3.1.4 MarkupSafe>=2.1.5 jsonschema~=4.23.0 click~=8.1.2 -setuptools<81 +setuptools>=78.1.1 python-Levenshtein azure-mgmt-core azdev diff --git a/version.py b/version.py index a00c0d2d..a06ec27d 100644 --- a/version.py +++ b/version.py @@ -1,5 +1,5 @@ -_MAJOR, _MINOR, _PATCH, _SUFFIX = ("4", "6", "1", "") +_MAJOR, _MINOR, _PATCH, _SUFFIX = ("4", "6", "2", "") # _PATCH: On main and in a nightly release the patch should be one ahead of the last released build. # _SUFFIX: This is mainly for nightly builds which have the suffix ".dev$DATE". See