Skip to content

Remove vulnerable Setuptools pin from generation dependencies - #83

Merged
bernalde merged 1 commit into
usra-riacs:mainfrom
bernalde:fix/dependabot-setuptools-4
Jul 29, 2026
Merged

Remove vulnerable Setuptools pin from generation dependencies#83
bernalde merged 1 commit into
usra-riacs:mainfrom
bernalde:fix/dependabot-setuptools-4

Conversation

@bernalde

Copy link
Copy Markdown
Collaborator

Summary

  • require Hyperopt 0.3.0, which replaced its pkg_resources usage with importlib.resources
  • remove Setuptools from the runtime/generation dependency surface
  • require patched Setuptools 83+ only in the isolated build backend
  • remove obsolete warning suppression and document/test the supported dependency policy

This resolves Dependabot alert 4. Dependabot could not generate a compatible update because the old Hyperopt workaround required setuptools<81, while the alert is only patched in Setuptools 83.0.0+.

Verification

  • python run_tests.py unit — 402 passed
  • isolated python -m build --sdist with setuptools>=83
  • Hyperopt 0.3.0 API smoke test using the Wishart workflow imports, with pkg_resources deliberately unavailable
  • notebook JSON validation and git diff --check

@codecov

codecov Bot commented Jul 29, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@bernalde
bernalde merged commit b35f31d into usra-riacs:main Jul 29, 2026
7 checks passed
@bernalde
bernalde deleted the fix/dependabot-setuptools-4 branch July 29, 2026 22:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant