fix(deps): allow setuptools >=83 to remediate CVE-2026-59890

[devin-ai-integration]

Summary

The CDK's caret constraint on setuptools expands to >=80.9.0,<81.0.0, so no downstream lockfile that depends on airbyte-cdk can select a setuptools version with CVE-2026-59890 (GHSA-h35f-9h28-mq5c) fixed — the advisory's fixed version is 83.0.0. This is purely a resolver-level upper bound; the CDK does not import setuptools anywhere.

-setuptools = "^80.9.0"   # >=80.9.0,<81.0.0
+setuptools = ">=83.0.0"

Reproduction of the conflict on the released CDK:

$ pip install --dry-run "airbyte-cdk==7.25.1" "setuptools>=83"
ERROR: Cannot install airbyte-cdk==7.25.1 and setuptools>=83 because these package versions have conflicting dependencies.
    The user requested setuptools>=83
    airbyte-cdk 7.25.1 depends on setuptools<81.0.0 and >=80.9.0
ERROR: ResolutionImpossible

Does this guarantee remediation, or merely permit it? It guarantees it. Raising the floor to >=83.0.0 (rather than only widening the upper bound) means no consumer can resolve a vulnerable 80.x/82.x version through the CDK — widening the upper bound alone would still let existing lockfiles keep resolving a flagged version until each consumer explicitly bumped.

Why no upper bound? The CDK carries setuptools only because some connectors use it as an undeclared transitive dependency (e.g. source-shopify imports setuptools.command.alias). Since no CDK code imports it, an upper bound buys no protection for the CDK itself and recreates exactly this downstream resolver conflict the next time an advisory lands. poetry.lock resolves to 84.0.0 (current latest).

Compatibility risk verified

setuptools 82.0.0 removed pkg_resources and 81.0.0 removed setup.py --dry-run, so the widened floor was checked against both:

• No pkg_resources or distutils imports exist under airbyte_cdk/ or unit_tests/ on main.
• Among the CDK's locked dependencies (installed with --all-extras), only pytz, pytest and werkzeug reference pkg_resources, and all three do so from lazy/optional code paths rather than at import time. The full unit test suite passes against setuptools 84.0.0 (4230 passed, 2 skipped).
• from setuptools.command.alias import alias — the symbol source-shopify relies on — still resolves in 84.0.0.
• setuptools 83.0.0 requires Python >=3.10, which is already the CDK's floor (python = ">=3.10,<3.14"), so the constraint is satisfiable on every supported interpreter.

Note that a CDK release is required before downstream consumers can pick this up.

Test Coverage

No test was added: the change is a dependency constraint plus the resulting poetry.lock refresh, with no CDK code path to exercise. The relevant verification is that the existing suite still passes with setuptools 84.0.0 installed, plus the pkg_resources audit above.

Ran locally with Poetry 2.1.4 (matching the lock-version = "2.1" lockfile format used on main):

• poetry lock → only setuptools changes (20-line lockfile diff)
• poetry install --all-extras
• poetry run ruff check . — passed
• poetry run ruff format --check . — passed
• poetry run pytest unit_tests/ -x -q — 4230 passed, 2 skipped

Follow-up (not in this PR)

airbyte-integrations/connectors/source-shopify/source_shopify/shopify_graphql/bulk/query.py in airbytehq/airbyte has from setuptools.command.alias import alias, which appears to be unused (the other alias= occurrences in that file are graphql_query.Field keyword arguments). If that is the only consumer relying on the CDK's setuptools, removing it would let the CDK drop the dependency entirely. Worth a separate connector PR rather than bundling here.

Related to https://github.com/airbytehq/oncall/issues/13315:

• https://github.com/airbytehq/oncall/issues/13315

Reported upstream by Andrew (@foiseworth) in #1118.

Link to Devin session: https://app.devin.ai/sessions/6a924111e09f48dba70eef51ae481d37

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

💡 Show Tips and Tricks

Testing This CDK Version

You can test this version of the CDK using the following:

# Run the CLI from this branch:
uvx 'git+https://github.com/airbytehq/airbyte-python-cdk.git@devin/1786897778-setuptools-cve-2026-59890#egg=airbyte-python-cdk[dev]' --help

# Update a connector to use the CDK from this branch ref:
cd airbyte-integrations/connectors/source-example
poe use-cdk-branch devin/1786897778-setuptools-cve-2026-59890

PR Slash Commands

Airbyte Maintainers can execute the following slash commands on your PR:

• /autofix - Fixes most formatting and linting issues
• /poetry-lock - Updates poetry.lock file
• /test - Runs connector tests with the updated CDK
• /prerelease - Triggers a prerelease publish with default arguments
• /poe build - Regenerate git-committed build artifacts, such as the pydantic models which are generated from the manifest JSON schema in YAML.
• /poe <command> - Runs any poe command in the CDK environment

📚 Show Repo Guidance

Helpful Resources

• CDK API Reference

📝 Edit this welcome message.

[Copilot]

Pull request overview

Updates the Airbyte Python CDK’s dependency constraints to unblock downstream resolvers from selecting a non-vulnerable setuptools version (>= 83.0.0) that remediates CVE-2026-59890, without requiring any CDK code changes.

Changes:

• Raises the setuptools constraint from ^80.9.0 to >=83.0.0 to ensure vulnerable versions cannot be resolved through the CDK dependency graph.
• Refreshes poetry.lock to reflect resolution to setuptools 84.0.0 and associated metadata updates.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
pyproject.toml	Updates setuptools dependency constraint to >=83.0.0 to permit/ensure remediation of CVE-2026-59890 downstream.
poetry.lock	Lockfile refresh reflecting setuptools upgrade (to 84.0.0) and updated lock metadata hash.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

PyTest Results (Fast)

4 229 tests  ±0   4 217 ✅ ±0   8m 11s ⏱️ -13s
    1 suites ±0      12 💤 ±0 
    1 files   ±0       0 ❌ ±0 

Results for commit e433dea. ± Comparison against base commit 68bc294.

[github-actions]

PyTest Results (Full)

4 232 tests  ±0   4 220 ✅ ±0   12m 25s ⏱️ -22s
    1 suites ±0      12 💤 ±0 
    1 files   ±0       0 ❌ ±0 

Results for commit e433dea. ± Comparison against base commit 68bc294.