From f31964d33e1e34cf9a518c761500971c9bd3fadf Mon Sep 17 00:00:00 2001 From: Mark Atwood Date: Thu, 9 Jul 2026 17:00:36 -0700 Subject: [PATCH] build: pin setuptools build backend version MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pyproject.toml declared setuptools as an unbounded PEP 517 build requirement, so an isolated build resolves whatever setuptools is latest on the index — a compromised index or an unexpected future backend release could then affect build execution and the produced artifacts. cffi was already pinned; setuptools was not. Bound it to setuptools>=64,<81: the floor keeps compatibility with the declared requires-python>=3.10, and the ceiling caps the exposure to an unvetted future major of the build backend. --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index e227c7a..dfb5e37 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -31,7 +31,7 @@ dependencies = [ Homepage = "https://github.com/wolfssl/wolfcrypt-py" [build-system] -requires = ["setuptools", "cffi>=1.17"] +requires = ["setuptools>=64,<81", "cffi>=1.17"] build-backend = "setuptools.build_meta:__legacy__" [dependency-groups]