Request
Please make a new release before 2026-09-18. The packages/gen/pyproject.toml has no setuptools runtime dependency, so the new uv build pipeline should produce a clean wheel without any code changes needed.
Background
The published sap-ai-sdk-gen==7.2.0 wheel on PyPI includes setuptools==50.3.1 as a runtime dependency (Requires-Dist: setuptools==50.3.1). This exact pin forces setuptools 50.3.1 into any downstream project, making it impossible to upgrade setuptools without a resolver conflict, and exposing:
- CVE-2025-47273 — path traversal in
PackageIndex allowing arbitrary file writes; fixed in setuptools 78.1.1 — remediation due 2026-09-18
- CVE-2026-59890 — Unicode normalization bypass in
FileList; fixed in setuptools 83.0.0 — remediation due 2026-11-13
The current main at packages/gen/pyproject.toml correctly has no setuptools runtime dependency. The uv build-based publish pipeline (.github/workflows/publish.yml) would produce a clean wheel — but it has not been triggered yet (no GitHub releases have been created from this repository).
Request
Please make a new release before 2026-09-18. The
packages/gen/pyproject.tomlhas nosetuptoolsruntime dependency, so the newuv buildpipeline should produce a clean wheel without any code changes needed.Background
The published
sap-ai-sdk-gen==7.2.0wheel on PyPI includessetuptools==50.3.1as a runtime dependency (Requires-Dist: setuptools==50.3.1). This exact pin forcessetuptools 50.3.1into any downstream project, making it impossible to upgrade setuptools without a resolver conflict, and exposing:PackageIndexallowing arbitrary file writes; fixed insetuptools 78.1.1— remediation due 2026-09-18FileList; fixed insetuptools 83.0.0— remediation due 2026-11-13The current
mainatpackages/gen/pyproject.tomlcorrectly has nosetuptoolsruntime dependency. Theuv build-based publish pipeline (.github/workflows/publish.yml) would produce a clean wheel — but it has not been triggered yet (no GitHub releases have been created from this repository).