fix(deps): patch setuptools CVE-2026-59890

[seonghobae]

Summary

• update the hash-checked runtime lock from setuptools==82.0.1 to patched 83.0.0
• add a generic unittest that reports direct requirements.txt versus requirements-lock.txt pin drift
• preserve the existing platform-marker packages while keeping the security diff minimal

Security evidence

Dependabot alert #1 reports Medium GHSA-h35f-9h28-mq5c / CVE-2026-59890 for setuptools < 83.0.0 in requirements-lock.txt. The issue can bypass MANIFEST.in exclusions through NFC/NFD filename normalization differences on macOS, potentially publishing excluded files in an sdist.

The direct runtime and build declarations already required 83.0.0; the stale hash lock still installed 82.0.1. This PR aligns the actual CI/Docker installation input with the patched version and its PyPI hash.

Validation

• Python 3.10, 3.11, and 3.12 dependency-lock regression test: pass
• Python 3.12 pip install --require-hashes -r requirements-lock.txt: pass
• Python 3.12 no-index/no-deps/no-build-isolation editable build: pass
• pip check: pass; installed setuptools=83.0.0
• compile check matching CI: pass
• full unittest suite in the hash-installed environment: 463 passed, 4 skipped
• full current-worktree unittest suite after adding the guard: 464 passed, 74 skipped (optional integrations absent)
• OSV-Scanner 2.4.0 against requirements-lock.txt: 39 packages, no issues found
• Trivy 0.71.1 with freshly downloaded GHCR DB, Medium/High/Critical fixed findings against the repository: 0
• git diff --check: pass

pip-audit was also attempted, but its temporary macOS Python 3.12 venv aborted in ensurepip before auditing. That tool failure is not presented as security evidence; OSV and Trivy completed independently.

Summary by CodeRabbit

• 버그 수정

  • 안전하지 않은 setuptools 버전을 최신 버전으로 업데이트하고 관련 무결성 정보를 갱신했습니다.

• 테스트

  • 런타임 의존성의 버전 고정값이 잠금 파일과 일치하는지 자동으로 검증하는 테스트를 추가했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1749d430-0054-4329-ad53-72a3bd07c125

📥 Commits

Reviewing files that changed from the base of the PR and between 5a92586 and 4713b14.

📒 Files selected for processing (2)

• requirements-lock.txt
• tests/test_dependency_lock.py

---

📝 Walkthrough

Walkthrough

setuptools 잠금 버전과 SHA-256 해시를 갱신했습니다. 런타임 의존성 핀과 잠금 파일의 버전 일치를 검증하는 테스트를 추가했습니다.

Changes

의존성 잠금 검증

Layer / File(s)	Summary
의존성 핀 갱신 및 검증 requirements-lock.txt, tests/test_dependency_lock.py	setuptools 버전을 83.0.0으로 갱신하고 해시를 교체했습니다. exact_pins와 DependencyLockTests.test_direct_runtime_pins_match_lock을 추가해 직접 런타임 핀의 누락 및 버전 불일치를 검증합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• ContextualWisdomLab/codec-carver#318: 동일한 setuptools 버전 핀과 해시를 갱신합니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 setuptools를 패치 버전으로 업데이트하여 CVE-2026-59890을 해결하는 주요 변경 사항을 정확히 설명합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/setuptools-cve-2026-59890

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Additional live default-branch evidence:

• Dependabot security-update run https://github.com/ContextualWisdomLab/codec-carver/actions/runs/30144908112 failed with security_update_not_needed.
• The updater observed direct setuptools==83.0.0, concluded it was no longer vulnerable, and exited 1 without repairing the stale requirements-lock.txt pin at 82.0.1.
• That explains why the Medium alert remained open despite the source/build declarations already being patched. The new generic direct-pin/lock consistency test is intended to make this cross-manifest drift fail in normal CI with both versions printed.

Live governance was also rechecked: inherited ruleset 18156473 is active on the default branch with seven central required workflows, two approvals, stale-review dismissal, last-push approval, thread resolution, deletion protection, and non-fast-forward protection. Auto-merge is enabled for this exact head 4713b14581c1b57dba5045bcdfd135e3e719f3e2 using a head guard.

[seonghobae]

Current-head hosted evidence for 4713b14581c1b57dba5045bcdfd135e3e719f3e2: dependency-review reports setuptools@82.0.1 → 83.0.0 and no vulnerable packages at Moderate or higher; the head OSV SARIF analysis 1557861925 on refs/pull/331/head contains 0 results; the Trivy SARIF analysis 1557862057 on refs/pull/331/merge contains 0 results; and the branch/PR code-scanning query has no open dependency, OSV, Trivy, or Semgrep alerts. The OSV job also deliberately printed the vulnerable base-lock evidence for CVE-2026-59890 before checking out the PR head, then uploaded a comprehensive zero-result head SARIF, so the clean result is not a base-only false negative. Strix recorded “No scannable changed files in pull request” because the change is a dependency lock plus regression test; it did not claim a model scan. The only open Scorecard result is the pre-existing Low repository-level missing-license governance finding, now tracked separately in #332 rather than mixed with this Medium CVE patch.

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.