[dependabot]

Bumps setuptools from 84.0.0 to 84.1.0.

Changelog

Sourced from setuptools's changelog.

v84.1.0

Features

• setuptools.archive_util now raises the new UnsafeMember exception when an archive member would be extracted outside of the extraction directory, where previously such a member was silently skipped. Aborting makes a malicious or malformed archive visible to the caller instead of yielding a quietly incomplete extraction, and matches the behavior of the standard library's tarfile extraction filters.

Bugfixes

• Wheel.install_as_egg no longer creates namespace package directories outside of the destination egg directory. Entries in a wheel's namespace_packages.txt were split on . and passed straight to os.path.join, so an entry that was absolute, drive-qualified, or UNC discarded the destination and placed an __init__.py at a path chosen by the wheel. Namespace entries are now validated as dotted module names on every platform -- see GHSA-xmj3-9gf7-h52w.

  This code path is reached only by the deprecated setup_requires mechanism when setup() is invoked outside a PEP 517 frontend; the setuptools build backend never reaches it.

• setuptools.archive_util no longer extracts archive members outside of the requested extraction directory. Both the tar and zip formats specify / as the only path separator, but the guard against .. components split member names on / alone, so a name such as ..\escaped.txt was treated as a single component and then resolved as a traversal by the filesystem on Windows. Member names containing a backslash, a drive letter, or a UNC prefix are now rejected on every platform, as are members whose resolved destination falls outside the extraction directory -- see GHSA-grgh-hr87-3jpw.

Commits

• 77b7ace Bump version: 84.0.0 → 84.1.0
• e66004c Merge pull request #5329 from pypa/fix/wheel-namespace-path-escape
• 54b5dca Cover the containment check with a symlink escape test
• 6d07b8d Validate namespace package names during legacy wheel installation
• 8419f00 Merge pull request #5356 from pypa/skeleton-ruff-0.16
• 6dadc86 Remove DTZ011 suppressions that Ruff 0.17 reports as unused.
• 715ec38 Merge https://github.com/jaraco/skeleton
• 9695460jaraco/skeleton#219
• 9e08129jaraco/skeleton#216
• 4e612f9 Ignore PyPy's deprecated check_home warning in tests
• Additional commits viewable in compare view

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

PR Performance Report

Performance could not be assessed.

No matching performance run appeared within the 220-minute wait for aa3d661da06cc116cf275d0f27479fe1c65ac05e. No result is available.

[Copilot]

🟡 Changes recommended

The locks remove setuptools instead of upgrading it, leaving direct wheel builds dependent on preinstalled tooling.

1 open issue

• Locks remove setuptools instead of upgrading to 84.1.0 · New

What changed in this PR

This PR targets a setuptools 84.1.0 update for mssql-python’s build and test environments. The actual changes regenerate five dependency locks rather than applying a version-only bump.

Changes:

• Remove pip, setuptools, and several conditional dependencies.
• Change dependency markers and extras in the Linux test and macOS locks.
• Replace Windows-specific ODBC tooling dependencies with Linux-oriented dependencies and simplify provenance comments.

File	Description
eng/​requirements-test-linux.txt	Regenerates Linux test dependencies, removing build tools and conditional entries.
eng/​requirements-build-windows.txt	Removes build tools and platform/version-specific dependencies.
eng/​requirements-build-odbc.txt	Changes the tooling dependency graph and removes build-tool pins.
eng/​requirements-build-macos.txt	Changes extras and markers while removing build tools and conditional entries.
eng/​requirements-build-linux.txt	Removes build-tool pins and older-Python dependencies.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain for the dependency lock-file updates.

1 open issue

• Locks remove setuptools instead of upgrading to 84.1.0

_{Review effort: Balanced}