Upgrade setuptools to resolve CVE-2026-59890 (#581)

Author: cigamit

Makefile

@@ -46,7 +46,7 @@ RECEPTOR_IMAGE ?= quay.io/ansible/receptor:devel
 SRC_ONLY_PKGS ?= cffi,pycparser,psycopg,twilio
 # These should be upgraded in the AWX and Ansible venv before attempting
 # to install the actual requirements
-VENV_BOOTSTRAP ?= pip==26.1.2 setuptools==80.9.0 setuptools_scm[toml]==9.2.2 wheel==0.46.2
+VENV_BOOTSTRAP ?= pip==26.1.2 setuptools==83.0.0 setuptools_scm[toml]==9.2.2 wheel==0.46.2
 
 NAME ?= awx
 

requirements/requirements.in

@@ -68,7 +68,7 @@ uWSGI>=2.0.22 # CVE-2023-27522
 valkey[libvalkey]
 wheel>=0.46.2  # CVE-2026-24049
 pip==26.1.2  # see CVE-2026-8643
-setuptools==80.9.0  # CVE-2025-47273
+setuptools==83.0.0  # CVE-2026-59890
 setuptools-scm[toml]  # see UPGRADE BLOCKERs, xmlsec build dep
 setuptools-rust>=0.11.4  # cryptography build dep
 pkgconfig>=1.5.1  # xmlsec build dep - needed for offline build

requirements/requirements.txt

@@ -490,7 +490,7 @@ zope-interface==7.0.3
 # The following packages are considered to be unsafe in a requirements file:
 pip==26.1.2
     # via -r /awx_devel/requirements/requirements.in
-setuptools==80.9.0
+setuptools==83.0.0
     # via
     #   -r /awx_devel/requirements/requirements.in
     #   asciichartpy

requirements/updater.sh

@@ -23,7 +23,7 @@ generate_requirements() {
   source "${venv}/bin/activate"
 
   # pip / setuptools version must match the version used in AWX venv (see README.md UPGRADE BLOCKERs)
-  "${venv}/bin/python3" -m pip install -U 'pip==26.1.2' 'setuptools==80.9.0' pip-tools
+  "${venv}/bin/python3" -m pip install -U 'pip==26.1.2' 'setuptools==83.0.0' pip-tools
 
   ${pip_compile} ${input_reqs} --output-file requirements.txt
   # consider the git requirements for purposes of resolving deps