fix(python): update setuptools to 83.0.0

[Copilot]

CVE-2026-59890 allows MANIFEST.in exclusions to be bypassed by Unicode normalization differences when building sdists on macOS normalization-preserving filesystems.

• Dependency remediation

  • Pin the Python generator’s setuptools dependency to 83.0.0.
  • Require setuptools>=83.0.0 in generated Python project build configurations.

• Generated output coverage

  • Update the generated packaging fixture.
  • Add a template test preventing regression to a vulnerable build-system constraint.

[build-system]
requires = ["setuptools>=83.0.0", "wheel"]
build-backend = "setuptools.build_meta"

Reachability Assessment

Reachable — high confidence. The Python generator builds sdists using setuptools and ships a MANIFEST.in; generated projects also use setuptools.build_meta. Both paths can invoke vulnerable manifest matching before this update.

Original prompt

---

This section details the Dependabot vulnerability alert you should resolve

<alert_title>setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+</alert_title>
<alert_description>## Summary

When building a source distribution (python -m build --sdist / setup.py sdist), setuptools' FileList applies MANIFEST.in directives (exclude, global-exclude, recursive-exclude, prune) by matching a compiled glob against on-disk file names byte-for-byte, with no Unicode normalization. On normalization-preserving filesystems (notably macOS APFS and HFS+), a file written in NFD and a MANIFEST.in rule written in NFC refer to the same file but are byte-distinct, so the exclusion silently fails to match. A file the maintainer intended to exclude is then packed into the .tar.gz and, if published, uploaded to the public, immutable PyPI index.

Details

File names in FileList.files come from os.walk (setuptools/_distutils/filelist.py, _find_all_simple), so on APFS a file written NFD is offered to the matcher in NFD, while the MANIFEST.in pattern carries the author's editor form (typically NFC). The matching path performs no canonicalization:

# setuptools/command/egg_info.py  (FileList.global_exclude)
def global_exclude(self, pattern):
    match = translate_pattern(os.path.join('**', pattern))   # fnmatch.translate -> regex, no NFC/NFD
    return self._remove_files(match.match)                   # byte-level regex over raw os.walk names

A rule written NFC (café = 63 61 66 c3 a9) does not match an on-disk name written NFD (café = 63 61 66 65 cc 81), even though the filesystem treats the two as one file.

A unicodedata.normalize('NFD', ...) helper exists in setuptools/unicode_utils.py (decompose()), but it is never called in the manifest matching path, so neither the pattern nor the walked path is normalized before matching. The only normalization in this area, EggInfoCommand._manifest_normalize, uses filesys_decode (bytes→str decode only, no NFC/NFD) and runs when writing SOURCES.txt, after matching has already occurred.

Impact

MANIFEST.in exclusions are the documented mechanism maintainers use to keep secrets, local configs, and private fixtures out of the published sdist. A non-ASCII excluded file may be published to the public, immutable PyPI index despite the rule — an irreversible disclosure with no visual cue (NFC and NFD forms render identically). Exposure is filesystem-dependent and most relevant on macOS APFS/HFS+, where many maintainers build and publish. Pure-ASCII rules are unaffected.

Proof of concept

With a project containing MANIFEST.in:

global-include *.txt *.json
global-exclude secret_café.txt    # rule saved NFC

and an on-disk file secret_café.txt written in NFD, python -m build --sdist packs the secret file into the resulting .tar.gz, while an ASCII control file excluded by the same directive is correctly dropped — isolating the bypass to the NFC-pattern vs. NFD-name mismatch. Reproduced on macOS APFS with setuptools 82.0.1.

Remediation

Normalize both the walked path and each MANIFEST.in pattern to a single canonical form before matching, in both setuptools/command/egg_info.py (FileList) and the vendored setuptools/_distutils/filelist.py. For an exclusion list, err toward excluding more, and document that MANIFEST.in matching is normalization-insensitive on macOS.

Credit

Reported by Tomas Illuminati. Coordinated via CERT/CC VINCE VU#604762.</alert_description>

moderate
GHSA-h35f-9h28-mq5c, CVE-2026-59890
setuptools
pip
<vulnerable_versions>= 75.3.2</vulnerable_versions>
<patched_version>83.0.0</patched_version>
<manifest_path>packages/http-client-python/generator/setup.py</manifest_path>

https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c https://nvd.nist.gov/vuln/detail/CVE-2026-59890 https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2026-3447.yaml https://github.com/pypa/setuptools/releases/tag/v83.0.0 https://github.com/advisories/GHSA-h35f-9h28-mq5c

<task_instructions>Resolve this alert by updating the affected package to a non-vulnerable version. Prefer the lowest non-vulnerable version (see the patched_version field above) over the latest to minimize breaking changes. Include a Reachability Assessment section in the PR description. Review the alert_description field to understand which APIs, features, or configurations are affected, then search the codebase for usage of those specific items. If the vulnerable code path is reachable, explain how (which files, APIs, or call sites use the affected functio...

• Resolves microsoft/typespec alert Default to post when body is present and no verb is specified #766

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@typespec/http-client-python@11569

commit: 38a2f66

[github-actions]

Python emitter diff

Baseline gh:0fba3feae35fe685fc6860b4a04cdf2ea4586c4b vs this PR.

Diff summary: 198 file(s), +198 / -198

Rendered diff: inline on the run summary, or the emitter-diff-html artifact.

Informational check (eng/emitter-diff); does not block the PR.

[Libba Lawrence (l0lawrence)]

Copilot add chronus add doc

[Copilot]

Copilot add chronus add doc

Added the Chronus dependency change document and verified it with pnpm chronus verify --since HEAD~1 in commit 9e62d65a.

[Yuchao Yan (msyyc)]

I will try if the latest 83.0.0 works in SDK generation pipeline.

[Yuchao Yan (msyyc)]

update: SDK Repo CI will report error if we upgrade setuptools to 83.0.0:
https://dev.azure.com/azure-sdk/public/_build/results?buildId=6665817&view=logs&j=1dca5ef1-3811-5712-152d-1052a5815ba2&t=b2c7405f-77c6-5d46-775b-341de5ad3a7a

Eng team shall upgrade https://github.com/Azure/azure-sdk-for-python/blob/dfea96e65f42d3d12d87382e05c9ab811930b38e/eng/ci_tools.txt#L2 at first so I create Azure/azure-sdk-for-python#48472 for eng team