deps: update dependency setuptools to v83 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
setuptools (changelog)	>=78.1.1, <79.0.0 → >=83.0.0, <83.1.0

---

BIT-setuptools-2026-59890 / CVE-2026-59890 / GHSA-h35f-9h28-mq5c / PYSEC-2026-3447

More information

Details

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

• https://github.com/pypa/setuptools/releases/tag/v83.0.0
• https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f
• https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

Release Notes

pypa/setuptools (setuptools)

v83.0.0

Compare Source

v82.0.1

Compare Source

v82.0.0

Compare Source

v81.0.0

Compare Source

v80.10.2

Compare Source

v80.10.1

Compare Source

v80.9.0

Compare Source

v80.8.0

Compare Source

v80.7.1

Compare Source

v80.7.0

Compare Source

v80.6.0

Compare Source

v80.4.0

Compare Source

v80.3.1

Compare Source

v80.3.0

Compare Source

v80.2.0

Compare Source

v80.1.0

Compare Source

v80.0.1

Compare Source

v80.0.0

Compare Source

v79.0.1

Compare Source

v79.0.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ea6124bc-6695-49f8-9ad9-f211126c13fc

📥 Commits

Reviewing files that changed from the base of the PR and between 3eef218 and cabc9c0.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• pyproject.toml

---

📝 Walkthrough

Walkthrough

The development dependency group in pyproject.toml updates its setuptools constraint from >=78.1.1,<79.0.0 to >=83.0.0,<83.1.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.58%. Comparing base (45b08b4) to head (cabc9c0).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #251   +/-   ##
=======================================
  Coverage   97.58%   97.58%           
=======================================
  Files         109      109           
  Lines        4802     4802           
=======================================
  Hits         4686     4686           
  Misses        116      116           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.