Bump setuptools and patch version

contentctl/enrichments/cve_enrichment.py

@@ -1,8 +1,27 @@
 from __future__ import annotations
 
+import sys
+import types
 from decimal import Decimal
 from typing import TYPE_CHECKING, Annotated, Union
 
+try:
+    import pkg_resources  # noqa: F401
+except ModuleNotFoundError:
+    # setuptools >= 82 no longer ships pkg_resources. pycvesearch (unmaintained,
+    # no newer release available) still does `import pkg_resources` just to read
+    # its own version for a User-Agent header. Stub out the single attribute it
+    # needs so the import succeeds, rather than pinning setuptools to a version
+    # with a known vulnerability.
+    def _get_distribution(name: str) -> types.SimpleNamespace:
+        from importlib.metadata import version
+
+        return types.SimpleNamespace(version=version(name))
+
+    _pkg_resources_shim = types.ModuleType("pkg_resources")
+    _pkg_resources_shim.get_distribution = _get_distribution  # type: ignore[attr-defined]
+    sys.modules["pkg_resources"] = _pkg_resources_shim
+
 from pycvesearch import CVESearch
 from pydantic import BaseModel, ConfigDict, Field, computed_field
 

pyproject.toml

@@ -1,7 +1,7 @@
 [tool.poetry]
 name = "contentctl"
 
-version = "5.6.1"
+version = "5.6.2"
 
 description = "Splunk Content Control Tool"
 authors = ["STRT <research@splunk.com>"]
@@ -36,7 +36,7 @@ tqdm = "^4.70.1"
 pygit2 = "^1.20.1"
 tyro = "^1.0.16"
 gitpython = "^3.1.62"
-setuptools = ">=80.10.2,<81"
+setuptools = ">=83.0.0,<84"
 rich = "^15.0.0"
 
 [tool.poetry.group.dev.dependencies]