Include setuptools in upgrade set (#454)

* _virtual_env: ensure setuptools is up-to-date Signed-off-by: William Woodruff <[email protected]> * _virtual_env: add TODO Signed-off-by: William Woodruff <[email protected]> * CHANGELOG: record changes Signed-off-by: William Woodruff <[email protected]> Signed-off-by: William Woodruff <[email protected]>
pypa · Dec 29, 2022 · 73855b1 · 73855b1
1 parent dddcf24
commit 73855b1
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -8,6 +8,12 @@ All versions prior to 0.0.9 are untracked.
 
 ## [Unreleased]
 
+### Fixed
+
+* Fixed `pip-audit`'s virtual environment creation and upgrade behavior,
+  preventing spurious vulnerability reports
+  ([#454](https://github.com/pypa/pip-audit/pull/454))
+
 ## [2.4.11]
 
 ### Fixed

diff --git a/pip_audit/_virtual_env.py b/pip_audit/_virtual_env.py
@@ -78,6 +78,8 @@ def post_setup(self, context: SimpleNamespace) -> None:
 
         # Firstly, upgrade our `pip` versions since `ensurepip` can leave us with an old version
         # and install `wheel` in case our package dependencies are offered as wheels
+        # TODO: This is probably replaceable with the `upgrade_deps` option on `EnvBuilder`
+        # itself, starting with Python 3.9.
         pip_upgrade_cmd = [
             context.env_exe,
             "-m",
@@ -86,6 +88,7 @@ def post_setup(self, context: SimpleNamespace) -> None:
             "--upgrade",
             "pip",
             "wheel",
+            "setuptools",
         ]
         try:
             run(pip_upgrade_cmd, state=self._state)