Updating setuptools to patch CVE-2025-47273 (#22094)

aaronmaxlevy · copybara-github · commit 508aba1b50e2 · 2025-07-08T13:58:42.000-07:00
Updating setuptools to patch CVE-2025-47273 Also updated Bazel to 7.4.0 due to bazelbuild/bazel#4327 Fixes #22165 Closes #22094 COPYBARA_INTEGRATE_REVIEW=#22094 from aaronmaxlevy:aaron_update_setuptools e1278ab PiperOrigin-RevId: 780701752
diff --git a/python/dist/BUILD.bazel b/python/dist/BUILD.bazel
@@ -299,24 +299,28 @@ pkg_tar(
     }),
 )
 
+sh_binary(
+    name = "setup_wrapper",
+    srcs = ["setup_wrapper.sh"],
+    data = [requirement("setuptools")],
+    visibility = ["//visibility:private"],
+)
+
 genrule(
     name = "source_wheel",
     srcs = [":source_tarball"],
     outs = ["protobuf-%s.tar.gz" % PROTOBUF_PYTHON_VERSION],
     cmd = """
-        export PYTHONPATH=$$PWD/external/protobuf_pip_deps_setuptools/site-packages
         set -eux
         tar -xzvf $(location :source_tarball)
-        cd protobuf/
-        python3 setup.py sdist
-        cd ..
+        $(location :setup_wrapper) sdist
         mv protobuf/dist/*.tar.gz $@
     """,
     target_compatible_with = select({
         "@system_python//:none": ["@platforms//:incompatible"],
         "//conditions:default": [],
     }),
-    tools = [requirement("setuptools")],
+    tools = [":setup_wrapper"],
 )
 
 py_wheel(
diff --git a/python/dist/setup_wrapper.sh b/python/dist/setup_wrapper.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+set -eux
+
+# Find the setuptools directory and add it to PYTHONPATH
+SETUPTOOLS_PATH=$(find $PWD -name "setuptools" -type d | grep site-packages | head -1)
+if [ -z "$SETUPTOOLS_PATH" ]; then
+  echo "Warning: Could not find setuptools directory"
+else
+  SITE_PACKAGES_DIR=$(dirname "$SETUPTOOLS_PATH")
+  echo "Using setuptools from: $SITE_PACKAGES_DIR"
+  export PYTHONPATH="$SITE_PACKAGES_DIR"
+fi
+
+# Run setup.py with the arguments passed to this script
+cd protobuf/
+python3 setup.py "$@"
diff --git a/python/requirements.txt b/python/requirements.txt
@@ -1,3 +1,3 @@
 numpy<=2.1.0
-setuptools<=70.3.0
+setuptools<=78.1.1
 absl-py==2.*
