fix(deps): uncap setuptools and lock 84.0.0 to remediate CVE-2026-59890

[devin-ai-integration]

Summary

The CDK constrains setuptools to ^80.9.0 (>=80.9.0,<81.0.0), so no lockfile that depends on airbyte-cdk can resolve setuptools>=83.0.0, the first release that fixes CVE-2026-59890 / GHSA-h35f-9h28-mq5c. The CDK itself never imports setuptools or pkg_resources. The dependency only exists for connectors that use setuptools without declaring it (source-shopify).

Changes:

• pyproject.toml: setuptools = "^80.9.0" >> setuptools = ">=80.9.0" (upper bound removed, floor unchanged).
• poetry.lock: setuptools 80.9.0 >> 84.0.0. Nothing else in the lock moves apart from the content hash. The SDM and manifest-server images install from this lock, so both images now ship the fixed version.

Why >=80.9.0 and not a >=83.0.0 floor

setuptools 82.0.0 removed pkg_resources. A >=83.0.0 floor would force every consumer onto a setuptools without pkg_resources and remove the escape hatch of pinning setuptools<82. At least one monorepo connector needs that escape hatch: destination-milvus pins pymilvus==2.3.0, whose pymilvus/client/__init__.py runs from pkg_resources import ... at import time, so import pymilvus fails on setuptools>=82. Dropping only the upper bound lets consumers take 83+ (issue #1118), while new locks, including the CDK's own, still resolve the latest fixed version.

Verification

• No setuptools, pkg_resources or distutils imports under airbyte_cdk/, unit_tests/ or bin/ (only a docstring in airbyte_cdk/sources/utils/transform.py).
• setuptools 83/84 require Python >=3.10, which matches the CDK's >=3.10,<3.14.
• The CDK core and all extras (file-based, vector-db-based, sql, manifest-server) import cleanly with setuptools 84.0.0 installed and pkg_resources absent. The pkg_resources references in CDK dependencies (pytz, wrapt, werkzeug, ddtrace, openai, pytest) are all guarded or lazy.
• SDM image build log: Updating setuptools (78.1.1 -> 84.0.0). The wheel metadata carries Requires-Dist: setuptools (>=80.9.0).
• source-shopify's from setuptools.command.alias import alias still resolves on 84.0.0.
• Full CI (pytest matrix 3.10-3.13, deptry, both Docker builds, connector checks) is green on this head. Check: destination-motherduck fails the same way on unrelated recently merged PRs.

Downstream impact

• The SDM and manifest-server images move to setuptools 84.0.0, which has no pkg_resources. Custom components that import pkg_resources must switch to importlib.metadata / importlib.resources, or run on a connector image that pins setuptools<82.
• Python connectors pick up setuptools>=82 on their next lock refresh. Connectors with a dependency that imports pkg_resources at load time should pin setuptools<82 first. Known case: destination-milvus (follow-up PR in the monorepo: fix(destination-milvus): pin setuptools below 82 for pymilvus 2.3.0 airbyte#87038).

Fixes #1118
Related: https://github.com/airbytehq/oncall/issues/13315

Link to Devin session: https://app.devin.ai/sessions/6a924111e09f48dba70eef51ae481d37

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

💡 Show Tips and Tricks

Testing This CDK Version

You can test this version of the CDK using the following:

# Run the CLI from this branch:
uvx 'git+https://github.com/airbytehq/airbyte-python-cdk.git@devin/1786897778-setuptools-cve-2026-59890#egg=airbyte-python-cdk[dev]' --help

# Update a connector to use the CDK from this branch ref:
cd airbyte-integrations/connectors/source-example
poe use-cdk-branch devin/1786897778-setuptools-cve-2026-59890

PR Slash Commands

Airbyte Maintainers can execute the following slash commands on your PR:

• /autofix - Fixes most formatting and linting issues
• /poetry-lock - Updates poetry.lock file
• /test - Runs connector tests with the updated CDK
• /prerelease - Triggers a prerelease publish with default arguments
• /poe build - Regenerate git-committed build artifacts, such as the pydantic models which are generated from the manifest JSON schema in YAML.
• /poe <command> - Runs any poe command in the CDK environment

📚 Show Repo Guidance

Helpful Resources

• CDK API Reference

📝 Edit this welcome message.

[Copilot]

Pull request overview

Updates the Airbyte Python CDK’s dependency constraints to unblock downstream resolvers from selecting a non-vulnerable setuptools version (>= 83.0.0) that remediates CVE-2026-59890, without requiring any CDK code changes.

Changes:

• Raises the setuptools constraint from ^80.9.0 to >=83.0.0 to ensure vulnerable versions cannot be resolved through the CDK dependency graph.
• Refreshes poetry.lock to reflect resolution to setuptools 84.0.0 and associated metadata updates.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
pyproject.toml	Updates setuptools dependency constraint to >=83.0.0 to permit/ensure remediation of CVE-2026-59890 downstream.
poetry.lock	Lockfile refresh reflecting setuptools upgrade (to 84.0.0) and updated lock metadata hash.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

PyTest Results (Fast)

4 688 tests  +14   4 676 ✅ +14   10m 1s ⏱️ +9s
    1 suites ± 0      12 💤 ± 0 
    1 files   ± 0       0 ❌ ± 0 

Results for commit 7fcd943. ± Comparison against base commit d8d8e6f.

♻️ This comment has been updated with latest results.

[github-actions]

PyTest Results (Full)

4 691 tests  +14   4 679 ✅ +14   11m 55s ⏱️ - 1m 59s
    1 suites ± 0      12 💤 ± 0 
    1 files   ± 0       0 ❌ ± 0 

Results for commit 7fcd943. ± Comparison against base commit d8d8e6f.

♻️ This comment has been updated with latest results.

[Baz (bazarnov)]

Approved. I changed the floor from >=83.0.0 to >=80.9.0: setuptools 82 removed pkg_resources, and a >=83 floor would take away the setuptools<82 pin that destination-milvus needs (pymilvus 2.3.0 imports pkg_resources at load time, see airbytehq/airbyte#87038). The lock stays on 84.0.0, so the SDM and manifest-server images ship the fixed version. I merged main, and all required checks are green on this head. Check: destination-motherduck fails the same way on recently merged PRs (#1149, #1152, #1154), and Check: source-shopify is still running and not required.

[devin-ai-integration]

❌ Cannot revive Devin session - the session is too old. Please start a new session instead.

View session