Repository navigation
chore(deps): bump setuptools from 80.9.0 to 83.0.0 in /tests/validation_runtime - #1231
Conversation
Bumps [setuptools](https://github.com/pypa/setuptools) from 80.9.0 to 83.0.0. - [Release notes](https://github.com/pypa/setuptools/releases) - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst) - [Commits](pypa/setuptools@v80.9.0...v83.0.0) --- updated-dependencies: - dependency-name: setuptools dependency-version: 83.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
burtenshaw
added
enhancement
Cursor
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 2c5ddd0. Configure here.
| "jsonschema==4.25.1", | ||
| "pip==25.2", | ||
| "setuptools==80.9.0", | ||
| "setuptools==83.0.0", |
There was a problem hiding this comment.
Stale setuptools toolchain pin
Low Severity
setuptools is now pinned to 83.0.0 in pyproject.toml and uv.lock, but toolchain.json still records 80.9.0. Validation evidence copies that file as the toolchain used, so run manifests will report the old version.
Reviewed by Cursor Bugbot for commit 2c5ddd0. Configure here.
There was a problem hiding this comment.
Alignment Review Report
Dependabot bump of setuptools 80.9.0 → 83.0.0 in tests/validation_runtime, touching pyproject.toml and uv.lock. The bump itself is internally consistent (the uv.lock [[package]] block and the runtime's requires-dist entry both move to 83.0.0 with matching sdist/wheel hashes). Two things to address below.
Automated Checks
- Lint: NOT RUN —
uvis unavailable in this review environment, so.claude/hooks/lint.sh(ruff/usort) couldn't execute. It's also N/A to the changed lines: this PR only editspyproject.tomlanduv.lock(no.pyfiles), which ruff/usort don't lint. - Debug code: CLEAN for this PR.
.claude/hooks/check-debug.shreportsprint/TODOhits, but they're all pre-existing undersrc/and unrelated to this change, which is confined totests/validation_runtime/.
Open RFCs Context
- RFC 008 – Environment Auto-Validation (In Review, @zkwentz) directly governs
tests/validation_runtime/. Its property #1 ("Scales on infra — builds reproducibly") is why this pinned-toolchain harness exists. No design conflict, but the findings below touch that reproducibility posture. - Other In-Review/Draft RFCs (000–005, 010–012) are unrelated to a test-toolchain dependency bump.
Tier 1: Fixes Required
-
tests/validation_runtime/toolchain.json:8—setuptoolsis still pinned to80.9.0whilepyproject.tomlanduv.lockare now83.0.0. Dependabot updated onlypyproject.toml+uv.lockand left the pinned-toolchain record stale.reproduce.pyembeds this file verbatim into evidence (manifest["toolchain"] = pins), sorun-manifest.jsonwould record an incorrect setuptools version. It won't fail a run — neitherreproduce.pynorverify_artifacts.pycross-checks thesetuptools/wheelpins — but the recorded provenance would be wrong. Fix: settoolchain.json→"setuptools": "83.0.0".
Tier 2: Alignment Discussion
Principle Conflicts
None identified. This is test infrastructure; no changes to the Gym-like API, MCP boundary, reward placement, or client/server separation.
RFC Conflicts
No direct design conflict. One provenance note relevant to RFC 008's reproducibility goal:
ALIGNMENT FLAG: uv.lock appears to have been regenerated with a non-pinned uv (marker drift on unrelated packages)
- Principle/RFC at stake: RFC 008 (Environment Auto-Validation) — reproducible builds;
tests/validation_runtimepinsuv == 0.9.3intoolchain.json. - The concern: A setuptools-only bump also stripped environment markers from unrelated locked packages —
httpcore2deps (h11,truststore) lostmarker = "sys_platform != 'emscripten'", andsecretstoragedeps (cryptography,jeepney) lostmarker = "sys_platform != 'emscripten' and sys_platform != 'win32'". A fixed package version's markers only change if a different resolver rewrote the lock, which implies Dependabot regenerated it with a uv other than the pinned0.9.3. It's functionally benign on the supported platforms (linux/amd64 + linux/arm64): those markers all evaluate True on Linux, andreproduce.py:select_linux_requirements()strips markers after evaluating them for Linux, so the installed set is unchanged. But it weakens the "regenerate identically under the pinned toolchain" guarantee this harness is built to demonstrate. Suggest regeneratinguv.lockwith the pinned uv0.9.3so the committed lock matches the pinned resolver's output. - Suggested reviewer: @burtenshaw (authored
tests/validation_runtimein feat: add docker validation lab), @zkwentz (RFC 008 author)
Summary
- 1 mechanical issue to fix —
toolchain.jsonsetuptools drift (80.9.0→83.0.0). - 1 alignment/reproducibility point for human review — lock marker drift; regenerate
uv.lockwith pinned uv0.9.3. - 0 RFC design conflicts.
Sent by Cursor Automation: Pre-review
| "jsonschema==4.25.1", | ||
| "pip==25.2", | ||
| "setuptools==80.9.0", | ||
| "setuptools==83.0.0", |
There was a problem hiding this comment.
Tier 1 — keep the pinned toolchain in sync. This bump to 83.0.0 isn't mirrored in tests/validation_runtime/toolchain.json, which still declares "setuptools": "80.9.0" (Dependabot didn't touch it). scripts/validation/reproduce.py copies toolchain.json verbatim into the evidence manifest (manifest["toolchain"] = pins), so run-manifest.json would record the wrong setuptools version. It won't fail a run — the setuptools/wheel pins aren't cross-checked against the lock — but please update toolchain.json → "setuptools": "83.0.0" so the provenance record stays accurate.
…on_runtime Pin the current release rather than landing an already-superseded 83.0.0. Keep toolchain.json in step with the pin, because reproduce.py copies that file verbatim into every retained evidence manifest. Relock with the lab's pinned uv 0.9.3 so the httpcore2/secretstorage platform markers are not stripped by a newer resolver. Co-authored-by: benjamin.burtenshaw <benjamin.burtenshaw@huggingface.co>
Co-authored-by: benjamin.burtenshaw <benjamin.burtenshaw@huggingface.co>
There was a problem hiding this comment.
Re-APPROVE exact tip 2ac06336 after merge-main onto #1230 (wheel 0.48.0).
Lab toolchain only (tests/validation_runtime/{pyproject.toml,toolchain.json,uv.lock}): setuptools 84.0.0 with synchronized evidence. Exact-head CI 12/12 green (incl. Runtime Linux Docker + Bugbot). Not package cargo — safe to merge independently of Thursday 0.6.0; title still says 83.0.0 but tip pins 84.0.0.
Sent by Cursor Automation: Release
…ptools) Lab toolchain only — package cargo unchanged. Keeps #1211 exact-main for Thursday. Co-authored-by: benjamin.burtenshaw <benjamin.burtenshaw@huggingface.co>
OpenEnv 0.6.0 Breaking change - `--llm-endpoint` / OpenAIClient now take a full base URL; the implicit port 8000 is gone. `http://localhost` means port 80; use `http://localhost:8000` or `--llm-port 8000` for the old behavior (#1189, landed via #1237). New - NovitaSandboxProvider: run an OpenEnv server in a Novita AI sandbox over wss://, from a registry image or a local Dockerfile; install with `pip install openenv[novita]` (#1191). - RFC 008 Level 2 validation building blocks: manifest-v2, report-v2 and runtime-plan schemas, the severity-v2 policy, and DockerValidationProvider (#1178, #1179). The `openenv validate` CLI is unchanged in this release. Fixes - A failed `new_session()` no longer leaves the provider's container or sandbox running (#1145). Repository and environment images (not in the wheel) - coding_env `additional_imports` now extends the default safe-import allowlist (#1147). - Environment lockfile security updates: anyio 4.14.2 and soupsieve 2.9.2 (#1196, #1197, #1201, #1202). - CI hardening: per-job GITHUB_TOKEN scopes and SHA-pinned actions (#1221, #1223, #1225, #1226, #1228, #1239, #1240); validation-lab toolchain pins (#1229, #1230, #1231); docs navigation and Miles integration docs (#1219, #1220). Known, accepted for this release: Novita provider debt (unbraced $ARG ordering in Dockerfile flattening, a tbench2 example readiness leak); fixes follow in #1235. Validated: exact-head CI 13/13 on 0034202; TestPyPI 0.6.0.dev141 (run 35854754769) byte-identical to the release wheel apart from Version; clean wheel/sdist install, CLI, and Echo reset/step smoke.
Bumps setuptools from 80.9.0 to 83.0.0.
Changelog
Sourced from setuptools's changelog.
... (truncated)
Commits
6519f72Bump version: 82.0.1 → 83.0.0d1151b1Merge pull request #5250 from pypa/feature/distutils-d7633fbeda2df31eCapture removal of dry_run parameter in changelog.00144dcMoved newsfragment to the release where it occurred.a4a5a2bAdd news fragment.77470c2Merge https://github.com/pypa/distutils into feature/distutils-d7633fbed3c43897Merge pull request #5247 from pypa/copilot/fix-pypy-version-issuebb6ea66Bump PyPy from 3.10 to 3.11 in CI workflowa2bc3acFix broken intersphinx reference to build's installation docs2d6a739Use stacked parametrize decorators instead of itertools.productDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Test-only toolchain pin with no runtime code changes; Python 3.12 already satisfies newer setuptools requirements.
Overview
Updates the pinned setuptools version from
80.9.0to84.0.0for thetests/validation_runtimeuv project.The bump is applied in
pyproject.tomland the matchingtoolchain.jsonentry so the documented test/fixture toolchain stays aligned.uv.lockis refreshed with the new setuptools sdist/wheel URLs and hashes.No application or production dependency changes—only the validation runtime test environment.
Reviewed by Cursor Bugbot for commit 2ac0633. Bugbot is set up for automated code reviews on this repo. Configure here.