From 7548a60cf14a2d3f983ae067fa45da45b647dca9 Mon Sep 17 00:00:00 2001 From: Krzysztof kuhy Rudnicki Date: Sat, 29 Aug 2026 13:08:02 +0200 Subject: [PATCH] fix: pin setuptools to 84.0.0, closing the dependabot alert The build-system pin was setuptools==80.9.0, which GHSA flags for an sdist MANIFEST.in exclusion bypass via Unicode NFC/NFD collision on macOS APFS/HFS+ (fixed in 83.0.0). Build-backend requirements are a real dependency surface and the freshness sweep had not covered them. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_013yaBT45KhHqxTKVCTA87iy --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 5503dd9..e7b6fc3 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -34,7 +34,7 @@ dev = [ signal-bot = "signal_bot.__main__:main" [build-system] -requires = ["setuptools==80.9.0"] +requires = ["setuptools==84.0.0"] build-backend = "setuptools.build_meta" [tool.setuptools]