Update setuptools to address CVE-2026-59890

[foiseworth]

The latest released airbyte-cdk (7.25.1) and current main constrain setuptools to ^80.9.0, while CVE-2026-59890 is fixed in 83.0.0. Downstream connectors cannot override this because Poetry reports an unsatisfiable constraint.

Please widen/update the CDK constraint to include setuptools >=83.0.0 and publish a release so downstream lockfiles can remediate the vulnerability.

Trivy 0.74.0 reports this as MEDIUM with fixed version 83.0.0.

---

Internal Tracking: https://github.com/airbytehq/oncall/issues/13315

[octavia-bot]

AI Triage Starting...

Thank you for opening this issue! I'm an AI assistant that will do an initial review and may:

• Ask clarifying questions if needed
• Suggest relevant documentation or workarounds
• Flag this for internal visibility

Note: Community issues are reviewed on a best-effort basis and do not have a guaranteed response time. To help us act on a suspected bug, please include at least one of: a reproducing manifest or code snippet, the full stack trace or error message, or the CDK version where the behavior changed. More detail is always welcome.

For additional help:

• Join the Airbyte Community Slack to connect with other users and community members
• If you're an Airbyte Cloud customer, you can open a support ticket or contact your account representative, referencing this issue URL

View playbook

• 🔗 Session URL: https://app.devin.ai/sessions/8e91766618a441babb54f54215bdbad3

✅ Devin AI session created successfully!

[airbyte-support-bot]

Hi Andrew (@foiseworth), thank you for reporting this!

We're looking into the setuptools constraint in the CDK and have escalated it to our team for investigation, along with your note that Trivy reports a fixed version of 83.0.0.

For context, the current constraint in main is:

setuptools = "^80.9.0"

which resolves to >=80.9.0,<81.0.0. The team will evaluate whether the upper bound can safely be widened — the constraint exists because some connectors have historically relied on setuptools as an undeclared transitive dependency of the CDK, so any change needs to be checked against those consumers.

In the meantime, if a connector you maintain imports setuptools/pkg_resources directly, declaring setuptools explicitly in that connector's own pyproject.toml is the recommended long-term practice regardless of this issue.

We've escalated this to our team for investigation: airbytehq/oncall#13315

Please note that community issues are reviewed on a best-effort basis and we can't commit to a timeline for a fix or a release.

---

Need more help? Join Airbyte Community Slack for peer support, or if you're a Cloud customer, open a support ticket referencing this URL.