(superset) branch master updated: chore(deps): bump setuptools to 84.0.0 and pip to 26.2.1 (#43413)

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/superset.git


The following commit(s) were added to refs/heads/master by this push:
     new c7cc22f4fee chore(deps): bump setuptools to 84.0.0 and pip to 26.2.1 (#43413)
c7cc22f4fee is described below

commit c7cc22f4fee2715688736433eb686475f896c8de
Author: dependabot[bot] <49...@users.noreply.github.com>
AuthorDate: Fri Aug 28 18:34:09 2026 -0700

    chore(deps): bump setuptools to 84.0.0 and pip to 26.2.1 (#43413)
    
    Signed-off-by: dependabot[bot] <su...@github.com>
    Co-authored-by: dependabot[bot] <49...@users.noreply.github.com>
    Co-authored-by: Evan Rusackas <ev...@rusackas.com>
    Co-authored-by: Superset Dev <de...@superset.apache.org>
---
 .github/workflows/dependency-review.yml | 21 +++++++++++++++++++++
 pyproject.toml                          |  2 +-
 requirements/base.in                    |  4 ++--
 requirements/base.txt                   |  2 +-
 requirements/development.txt            |  4 ++--
 5 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 5ebae85e7f9..9817d8cece4 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -66,6 +66,27 @@ jobs:
 
       - name: "Set up liccheck"
         run: |
+          # liccheck (as of 0.9.2) still does a bare `import pkg_resources`
+          # without declaring setuptools as a dependency, relying on it
+          # having historically been bundled. setuptools 81+ (installed
+          # above via requirements/base.txt) dropped the pkg_resources
+          # subpackage entirely, so liccheck's own import breaks outright.
+          #
+          # Reinstalling an older setuptools would restore pkg_resources but
+          # would also downgrade the *real* setuptools install, which then
+          # trips liccheck's own working_set.resolve() -- it cross-checks
+          # requirements/base.txt's declared `setuptools==84.0.0` against
+          # what's actually installed, and a downgrade makes those disagree.
+          #
+          # Instead, vendor just the pkg_resources/ package files from an
+          # old setuptools wheel into site-packages, leaving the real
+          # setuptools install (and its dist-info metadata) untouched. This
+          # gives liccheck an importable pkg_resources whose own working-set
+          # scan still correctly reports the real installed setuptools
+          # version, so no conflict is raised.
+          pip download "setuptools<81" --no-deps -d /tmp/old-setuptools
+          python -m zipfile -e /tmp/old-setuptools/setuptools-*.whl /tmp/old-setuptools-extracted/
+          cp -r /tmp/old-setuptools-extracted/pkg_resources "$(python -c 'import site; print(site.getsitepackages()[0])')/"
           uv pip install --system liccheck
       - name: "Run liccheck"
         run: |
diff --git a/pyproject.toml b/pyproject.toml
index d09c7738122..7e8be6dccbd 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -16,7 +16,7 @@
 # under the License.
 
 [build-system]
-requires = ["setuptools>=40.9.0", "wheel"]
+requires = ["setuptools>=84.0.0", "wheel"]
 build-backend = "setuptools.build_meta"
 
 [project]
diff --git a/requirements/base.in b/requirements/base.in
index 2c87ce3ce51..baaa17979e6 100644
--- a/requirements/base.in
+++ b/requirements/base.in
@@ -52,11 +52,11 @@ marshmallow-sqlalchemy>=1.5.0
 # needed for python 3.12 support
 openapi-schema-validator>=0.6.3
 
-# Pin setuptools <81 until all dependencies migrate from pkg_resources to importlib.metadata
+# Pin setuptools <85 until all dependencies migrate from pkg_resources to importlib.metadata
 # pkg_resources is deprecated and will be removed in setuptools 81+ (around 2025-11-30)
 # Known affected packages: Preset's 'clients' package
 # See docs/docs/contributing/pkg-resources-migration.md for details
-setuptools<81
+setuptools<85
 
 # google-auth 2.53+ dropped its transitive dependency on cachetools, which is
 # imported directly by superset.db_engine_specs.aws_iam. We declare cachetools
diff --git a/requirements/base.txt b/requirements/base.txt
index 9fc99ba7617..bd59001d1c8 100644
--- a/requirements/base.txt
+++ b/requirements/base.txt
@@ -366,7 +366,7 @@ rpds-py==0.25.0
     # via
     #   jsonschema
     #   referencing
-setuptools==80.9.0
+setuptools==84.0.0
     # via -r requirements/base.in
 shillelagh==1.4.5
     # via apache-superset (pyproject.toml)
diff --git a/requirements/development.txt b/requirements/development.txt
index 869f10a721f..b4e1714140f 100644
--- a/requirements/development.txt
+++ b/requirements/development.txt
@@ -663,7 +663,7 @@ pillow==12.3.0
     #   -c requirements/base-constraint.txt
     #   apache-superset
     #   matplotlib
-pip==25.1.1
+pip==26.2.1
     # via apache-superset
 platformdirs==4.3.8
     # via
@@ -920,7 +920,7 @@ secretstorage==3.5.0
     # via keyring
 semver==3.0.4
     # via apache-superset-extensions-cli
-setuptools==80.9.0
+setuptools==84.0.0
     # via
     #   -c requirements/base-constraint.txt
     #   nodeenv