From ee9690c9a8ef88b96101c275aeba060b96412ec1 Mon Sep 17 00:00:00 2001 From: Eric Date: Fri, 9 Oct 2026 07:25:55 -0500 Subject: [PATCH 1/2] Bump setuptools and patch version --- pyproject.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index eb7fc37e..bc57f986 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,7 +1,7 @@ [tool.poetry] name = "contentctl" -version = "5.6.1" +version = "5.6.2" description = "Splunk Content Control Tool" authors = ["STRT "] @@ -36,7 +36,7 @@ tqdm = "^4.70.1" pygit2 = "^1.20.1" tyro = "^1.0.16" gitpython = "^3.1.62" -setuptools = ">=80.10.2,<81" +setuptools = ">=83.0.0,<84" rich = "^15.0.0" [tool.poetry.group.dev.dependencies] From f67457cba9e7d29a22b8c81906ee78b716aaadad Mon Sep 17 00:00:00 2001 From: Eric Date: Fri, 9 Oct 2026 08:08:42 -0500 Subject: [PATCH 2/2] Shim pkg_resources for pycvesearch under setuptools >= 82 setuptools >= 82 no longer ships pkg_resources, which breaks the unconditional pycvesearch import on module load (pycvesearch is unmaintained and has no release that drops the dependency). Stub out pkg_resources.get_distribution via importlib.metadata only when the real module is unavailable, so the setuptools bump for the vulnerability fix doesn't break contentctl. Co-Authored-By: Claude Code --- contentctl/enrichments/cve_enrichment.py | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/contentctl/enrichments/cve_enrichment.py b/contentctl/enrichments/cve_enrichment.py index 424fff06..c8b3425e 100644 --- a/contentctl/enrichments/cve_enrichment.py +++ b/contentctl/enrichments/cve_enrichment.py @@ -1,8 +1,27 @@ from __future__ import annotations +import sys +import types from decimal import Decimal from typing import TYPE_CHECKING, Annotated, Union +try: + import pkg_resources # noqa: F401 +except ModuleNotFoundError: + # setuptools >= 82 no longer ships pkg_resources. pycvesearch (unmaintained, + # no newer release available) still does `import pkg_resources` just to read + # its own version for a User-Agent header. Stub out the single attribute it + # needs so the import succeeds, rather than pinning setuptools to a version + # with a known vulnerability. + def _get_distribution(name: str) -> types.SimpleNamespace: + from importlib.metadata import version + + return types.SimpleNamespace(version=version(name)) + + _pkg_resources_shim = types.ModuleType("pkg_resources") + _pkg_resources_shim.get_distribution = _get_distribution # type: ignore[attr-defined] + sys.modules["pkg_resources"] = _pkg_resources_shim + from pycvesearch import CVESearch from pydantic import BaseModel, ConfigDict, Field, computed_field