Bump setuptools from 70.3.0 to 78.1.1

[dependabot]

Bumps setuptools from 70.3.0 to 78.1.1.

Changelog

Sourced from setuptools's changelog.

v78.1.1

Bugfixes

• More fully sanitized the filename in PackageIndex._download. (#4946)

v78.1.0

Features

• Restore access to _get_vc_env with a warning. (#4874)

v78.0.2

Bugfixes

• Postponed removals of deprecated dash-separated and uppercase fields in setup.cfg. All packages with deprecated configurations are advised to move before 2026. (#4911)

v78.0.1

Misc

• #4909

v78.0.0

Bugfixes

• Reverted distutils changes that broke the monkey patching of command classes. (#4902)

Deprecations and Removals

• Setuptools no longer accepts options containing uppercase or dash characters in setup.cfg.

... (truncated)

Commits

• 8e4868a Bump version: 78.1.0 → 78.1.1
• 100e9a6 Merge pull request #4951
• 8faf1d7 Add news fragment.
• 2ca4a9f Rely on re.sub to perform the decision in one expression.
• e409e80 Extract _sanitize method for sanitizing the filename.
• 250a6d1 Add a check to ensure the name resolves relative to the tmpdir.
• d8390fe Extract _resolve_download_filename with test.
• 4e1e893 Merge https://github.com/jaraco/skeleton
• 3a3144f Fix typo: pyproject.license -> project.license (#4931)
• d751068 Fix typo: pyproject.license -> project.license
• Additional commits viewable in compare view

[rtibblesbot]

Dependency Update Review

Package: setuptools 70.3.0 → 78.1.1
Semver risk: Multi-major (8 major versions)
Dependency type: Build-only (not in [project].dependencies)
CI status: Linting passing; DMG/EXE builds in progress at review time

Changelog Analysis

Sources consulted:

• PR body (setuptools NEWS.rst, truncated)

Breaking changes:

• v78.0.0: setup.cfg no longer accepts uppercase or dash-separated option names — not applicable: this repo uses pyproject.toml only, with lowercase/underscore names throughout
• v78.0.0: Reverted a prior distutils change that broke monkey-patching of command classes — net-neutral

Security fixes:

• v78.1.1: More fully sanitized the filename in PackageIndex._download (pypa/setuptools#4946) — filename sanitization fix in the package download path

Other notable changes:

• v78.1.0: Restored access to _get_vc_env with a deprecation warning
• v78.0.2: Postponed removal of deprecated setup.cfg fields (all packages advised to migrate before 2026)

Compatibility Assessment

• Project uses affected APIs (setup.cfg uppercase/dash options): no
• Peer dependency changes: none
• Code changes required: none
• Prior failed attempts: none noted

Recommendation

APPROVE — security fix for a build-only dependency; v78.0.0 breaking changes are not applicable to this project.

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

Reviewed the pull request diff checking for:

• Correctness: bugs, edge cases, undocumented behavior, resource leaks, hardcoded values
• Design: unnecessary complexity, naming, readability, comment accuracy, redundant state
• Architecture: duplicated concerns, minimal interfaces, composition over inheritance
• Testing: behavior-based assertions, mocks only at hard boundaries, accurate coverage
• Completeness: missing dependencies, unupdated usages, i18n, accessibility, security
• Principles: DRY (same reason to change), SRP, Rule of Three (no premature abstraction)
• Checked CI status and linked issue acceptance criteria
• For UI changes: inspected screenshots for layout, visual completeness, and consistency

[rtibblesbot]

praise: Pinning the lower bound to >=78.1.1 specifically ensures the security fix in pypa/setuptools#4946 is included, while <79 appropriately scopes to the 78.x series and avoids unknown future breaking changes from 79.x.

[rtibbles]

@dependabot recreate