kuhyx/signal-bot
1
0
Fork 0
mirror of https://github.com/kuhyx/signal-bot.git synced 2026-11-11 13:57:32 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: pin setuptools to 84.0.0, closing the dependabot alert

Browse Source 
The build-system pin was setuptools==80.9.0, which GHSA flags for an sdist
MANIFEST.in exclusion bypass via Unicode NFC/NFD collision on macOS APFS/HFS+
(fixed in 83.0.0). Build-backend requirements are a real dependency surface
and the freshness sweep had not covered them.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013yaBT45KhHqxTKVCTA87iy
This commit is contained in:
Krzysztof Rudnicki 2026-08-29 13:08:02 +02:00
parent c9061b27a8
commit 7548a60cf1
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pyproject.toml
View File

@ -34,7 +34,7 @@ dev = [
signal-bot = "signal_bot.__main__:main"
[build-system]
requires = ["setuptools==80.9.0"]
requires = ["setuptools==84.0.0"]
build-backend = "setuptools.build_meta"
[tool.setuptools]