[alangou]

Summary

Update setuptools and the TypeScript SDK's Vitest dependencies to the patched releases for three published upstream advisories. Keep the two dependency updates in separate commits and preserve unrelated locked dependencies.

Related Issue

No separate tracking issue. This PR addresses dependency maintenance for the public upstream advisories linked below.

Changes

• ab97685df: update setuptools from 83.0.0 to 84.1.0 in uv.lock and raise the Python build backend minimum to >=84.1.0, addressing GHSA-xmj3-9gf7-h52w.
• 8fc15b5de: update Vitest, @vitest/coverage-v8, and the matching internal Vitest packages from 4.1.11 to 4.1.12, addressing GHSA-qxg6-89mg-rqv8 and GHSA-xp26-3454-mjgp. Both advisories share this dependency update.

Testing

Validated locally on Linux with Node 24.15.0 and Python 3.14.5:

• mise run sdk:ts:ci: protobuf generation/lint, Biome, type checking, build, and 197 tests passed; 93.23% line coverage.
• mise exec -- npm publish --dry-run from sdk/typescript: package validation passed.
• npm ci audit: 0 vulnerabilities; npm ls vitest @vitest/mocker @vitest/coverage-v8 confirms the patched 4.1.12 versions.
• mise run python:format:check ::: python:lint ::: python:typecheck ::: test:python ::: build:python:wheel: formatting, lint, type checking, 243 tests, and wheel verification passed. The build used SETUPTOOLS_SCM_PRETEND_VERSION_FOR_OPENSHELL=0.0.0 and a UV_BUILD_CONSTRAINT file containing setuptools==84.1.0 to exercise the new minimum version.
• mise exec -- uv lock --check and git diff --check passed.
• Unit/E2E test additions: not applicable to these dependency-only updates; existing SDK and packaging tests cover compatibility.

Checklist

• Follows Conventional Commits.
• Both commits are signed off (DCO).
• Architecture and published documentation updates: not applicable.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[alangou]

/ok to test 8fc15b5

[github-actions]

Label test:e2e applied for 8fc15b5. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.