chore(deps-dev): bump setuptools from 81.0.0 to 83.0.0 in /envs/kernrl

[dependabot]

Bumps setuptools from 81.0.0 to 83.0.0.

Changelog

Sourced from setuptools's changelog.

v83.0.0

Features

• Require Python 3.10 or later.

Bugfixes

• MANIFEST.in matching (via FileList) is now insensitive to Unicode normalization form. A pattern authored in one form (e.g. NFC, as typically saved by editors) now matches a file whose name is stored on disk in another (e.g. NFD, as produced by macOS APFS/HFS+). Previously an exclude, global-exclude, recursive-exclude, or prune rule could silently fail to drop a non-ASCII-named file from the source distribution, publishing it despite the exclusion -- see GHSA-h35f-9h28-mq5c.

Deprecations and Removals

• pypa/distutils#334

v82.0.1

Bugfixes

• Fix the loading of launcher manifest.xml file. (#5047)
• Replaced deprecated json.__version__ with fixture in tests. (#5186)

Improved Documentation

• Add advice about how to improve predictability when installing sdists. (#5168)

Misc

• #4941, #5157, #5169, #5175

v82.0.0

... (truncated)

Commits

• 6519f72 Bump version: 82.0.1 → 83.0.0
• d1151b1 Merge pull request #5250 from pypa/feature/distutils-d7633fbed
• a2df31e Capture removal of dry_run parameter in changelog.
• 00144dc Moved newsfragment to the release where it occurred.
• a4a5a2b Add news fragment.
• 77470c2 Merge https://github.com/pypa/distutils into feature/distutils-d7633fbed
• 3c43897 Merge pull request #5247 from pypa/copilot/fix-pypy-version-issue
• bb6ea66 Bump PyPy from 3.10 to 3.11 in CI workflow
• a2bc3ac Fix broken intersphinx reference to build's installation docs
• 2d6a739 Use stacked parametrize decorators instead of itertools.product
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Single-line build dependency constraint with no runtime or application logic changes.

Overview
Raises the build-system pin for setuptools in envs/kernrl/pyproject.toml from >=45 (Dependabot: 81.0.0 → 83.0.0) to >=83.0.0, so packaging that env uses a newer setuptools at sdist/wheel build time.

Runtime openenv-kernrl dependencies are unchanged; only the PEP 517 build backend requirement is updated. The package already declares requires-python = ">=3.10", which matches setuptools 83’s minimum Python version.

^{Reviewed by Cursor Bugbot for commit 2266c09. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Dependabot bumps the PEP 518 build-backend requirement setuptools>=45 → >=83.0.0 in envs/kernrl/pyproject.toml ([build-system].requires). Single-line change; uv.lock is untouched.

Automated Checks

• Lint: PASS (N/A for this PR). No .py changed (TOML isn't linted). .claude/hooks/lint.sh exits 1 only on the ~20 pre-existing unformatted envs/** files (agent_world_model_env, chat_env, coding_tools_env, jupyter_env, opencode_env×8, repl_env, terminus_env, textarena_env) — none is kernrl.
• Debug code: CLEAN. check-debug.sh hits are all pre-existing src/ (build.py prints, template doc-examples, serve/__main__ TODOs); none in the diff.

Open RFCs Context

7 RFCs (000–005, 010) + README — all In Review except 010 (Draft). None governs packaging / build-system requires / dependency management → no RFC surface.

Tier 1: Fixes Required

None.

• setuptools 83.0.0 verified on PyPI: not yanked, requires_python >=3.10 (satisfies kernrl requires-python = ">=3.10"), 0 known vulns.
• uv lock --check --project envs/kernrl passes at HEAD (146 pkgs) — build requires aren't tracked in uv.lock, so no lock update is needed/expected.
• uv build --wheel envs/kernrl succeeds — an isolated build env resolves setuptools>=83.0.0 and builds a valid openenv_kernrl-0.1.0-py3-none-any.whl with setuptools.build_meta + the existing [tool.setuptools] config.

Tier 2: Alignment Discussion

Principle Conflicts

None. No API / reward / client-server / MCP / container-isolation surface touched. Build-system/packaging config isn't governed by PRINCIPLES.md or INVARIANTS.md.

RFC Conflicts

None.

Notes (non-blocking)

1. Security-positive & correctly scoped. Fixes CVE-2026-59890 / GHSA-h35f-9h28-mq5c / PYSEC-2026-3447 (setuptools <83.0.0) — a build-time sdist flaw where FileList applies MANIFEST.in exclude/prune directives without Unicode normalization, so on macOS APFS/HFS+ an NFD filename can bypass an NFC exclusion and get packed into an sdist. It's a build-backend bug, so targeting [build-system].requires is the right fix. The runtime transitive setuptools 81.0.0 in uv.lock (via torch) is untouched — fine, since this CVE is build/packaging-only, not a runtime exposure. (The title's "from 81.0.0" refers to that locked transitive version, which this PR does not change.)
2. No lock side-effects. Unlike typical dependabot env-lock PRs, uv.lock is byte-identical → no index-source flip, no revision bump (kernrl stays revision = 2), no requires-dist re-sync.
3. Process: exclude-paths bypass (recurring, cc @burtenshaw). .github/dependabot.yml's uv updater declares directory: "/" + exclude-paths: ["envs/**"], yet this native dependabot/uv/envs/kernrl/… PR edits envs/kernrl/. Same known limitation seen on prior native env bumps (the uv ecosystem isn't honoring exclude-paths). Not a code bug — flagging for config/process awareness.
4. Fleet heterogeneity (cc @burtenshaw). kernrl is now the only env declaring setuptools>=83.0.0; all 34 other envs still declare setuptools>=45 in their [build-system].requires. If you want fleet-wide remediation of this build-time CVE, the others need the same bump — though urgency is low (all build on Linux; the CVE is macOS-APFS/HFS+-specific and build-only).

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review
• 0 RFC conflicts
• Non-blocking: security-positive, correctly-scoped build-requirement bump (verified by building the wheel); 1 recurring dependabot exclude-paths process note + 1 fleet-consistency FYI (@burtenshaw).

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

Security-positive and correctly targeted. This is a PEP 518 build-backend requirement, and setuptools <83.0.0 carries CVE-2026-59890 / GHSA-h35f-9h28-mq5c (fixed in 83.0.0): FileList applies MANIFEST.in exclude/global-exclude/recursive-exclude/prune directives without Unicode normalization, so on macOS APFS/HFS+ an NFD filename can bypass an NFC exclusion and get packed into an sdist. Bumping [build-system].requires (not a runtime dep) hits exactly the affected code path.

Verified:

• setuptools 83.0.0 on PyPI: not yanked, requires_python >=3.10 (satisfies kernrl requires-python = ">=3.10"), 0 known vulns.
• No uv.lock change is correct — PEP 518 build requires aren't tracked in uv.lock; uv lock --check --project envs/kernrl passes at HEAD.
• uv build --wheel envs/kernrl builds a valid wheel using an isolated build env satisfying >=83.0.0.

Minor: floor jumps >=45 → >=83.0.0 (dependabot's strategy). The runtime transitive setuptools 81.0.0 (via torch) in the lock is intentionally unchanged and not an exposure for this build-time CVE.

[burtenshaw]

Rolled into maintainer aggregate PR #921, so closing this single Dependabot PR.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.