Skip to content

Please make a new release before 2026-09-18 - due date for CVE-2025-47273 #80

Description

@jacekon

Request

Please make a new release before 2026-09-18. The packages/gen/pyproject.toml has no setuptools runtime dependency, so the new uv build pipeline should produce a clean wheel without any code changes needed.


Background

The published sap-ai-sdk-gen==7.2.0 wheel on PyPI includes setuptools==50.3.1 as a runtime dependency (Requires-Dist: setuptools==50.3.1). This exact pin forces setuptools 50.3.1 into any downstream project, making it impossible to upgrade setuptools without a resolver conflict, and exposing:

  • CVE-2025-47273 — path traversal in PackageIndex allowing arbitrary file writes; fixed in setuptools 78.1.1 — remediation due 2026-09-18
  • CVE-2026-59890 — Unicode normalization bypass in FileList; fixed in setuptools 83.0.0 — remediation due 2026-11-13

The current main at packages/gen/pyproject.toml correctly has no setuptools runtime dependency. The uv build-based publish pipeline (.github/workflows/publish.yml) would produce a clean wheel — but it has not been triggered yet (no GitHub releases have been created from this repository).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions