Build: Bump setuptools to 83.0.0

[kevinjqliu]

This is for to address security alert: https://github.com/apache/iceberg-python/security/dependabot/137

Summary

• require setuptools 83.0.0 or newer in development and isolated build environments
• update the locked setuptools version from 82.0.1 to 83.0.0

Why

Setuptools versions before 83.0.0 compare MANIFEST.in patterns and on-disk filenames without Unicode normalization. On normalization-preserving macOS filesystems, this can cause exclusion rules to miss non-ASCII filenames and unintentionally include excluded files in a published source distribution.

The build-system requirement previously allowed setuptools 80 through 82, and the development dependency graph resolved 82.0.1 through moto and pytest-checkdocs.

Impact

This changes build and development tooling only. PyIceberg runtime dependencies and APIs are unchanged. Setuptools 83.0.0 requires Python 3.10 or newer, matching PyIceberg's supported Python range.

Validation

• uv lock --check --offline --default-index https://pypi.org/simple
• uv build --sdist
• git diff --check

[Copilot]

Pull request overview

Updates PyIceberg’s build and development tooling constraints to mitigate a setuptools security issue by requiring setuptools 83.0.0+ in both PEP 517 isolated builds and the default dev dependency group.

Changes:

• Raise [build-system].requires to setuptools>=83.0.0 in pyproject.toml.
• Add setuptools>=83.0.0 to the dev dependency group in pyproject.toml.
• Refresh uv.lock to include the dev-group requirement and lock setuptools to 83.0.0 (from 82.0.1).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
pyproject.toml	Tightens build-system and dev dependency constraints to require setuptools 83.0.0+
uv.lock	Locks setuptools to 83.0.0 and records the new dev-group requirement

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.