RHAIENG-5847: chore: pin setuptools<81 to suppress pkg_resources deprecation warning

[jira-autofix]

Description

setuptools>=81 emits a UserWarning whenever pkg_resources is imported. Google namespace packages (google/__init__.py) still import pkg_resources, triggering the warning on every workbench startup. The workbench startup log checker (test_image_entrypoint_starts) treats any line containing "Warning" or "warning" as a test violation, failing CI.

This PR pins setuptools<81 in all 16 image pyproject.toml files as a direct dependency constraint, preventing the deprecation warning until upstream google packages drop their pkg_resources usage.

Files changed

• All */ubi9-python-3.12/pyproject.toml files under codeserver/, jupyter/, and runtimes/ (16 files total)

How Has This Been Tested?

• Verified all 16 pyproject.toml files consistently pin setuptools<81
• Verified no un-pinned setuptools references remain in any pyproject.toml
• Lock files need to be regenerated with make refresh-lock-files before merge

Self checklist:

• Ensure that you have run make test (gmake on macOS) before asking for review
• Changes to everything except Dockerfile.konflux files should be done in odh/notebooks and automatically synced to rhds/notebooks. For Konflux-specific changes, modify Dockerfile.konflux files directly in rhds/notebooks as these require special attention in the downstream repository and flow to the upcoming RHOAI release.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign atheo89 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @jira-autofix[bot]. Thanks for your PR.

I'm waiting for a red-hat-data-services member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[jiridanek]

@coderabbitai is this pr needed, or is there a different fix already in place through opendatahub-io/notebooks upstream?

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Current PR details =="
gh pr view 2407 --repo red-hat-data-services/notebooks --json number,title,state,baseRefName,headRefName,body,url,author,mergeStateStatus

echo
echo "== Search current repo PRs/issues for RHAIENG-5847 or setuptools<81 =="
gh search prs --repo red-hat-data-services/notebooks 'RHAIENG-5847 OR "setuptools<81"' --json number,title,state,url,repository
gh search issues --repo red-hat-data-services/notebooks 'RHAIENG-5847 OR "setuptools<81"' --json number,title,state,url,repository

echo
echo "== Search upstream repo PRs/issues for RHAIENG-5847 or setuptools<81 =="
gh search prs --repo opendatahub-io/notebooks 'RHAIENG-5847 OR "setuptools<81"' --json number,title,state,url,repository
gh search issues --repo opendatahub-io/notebooks 'RHAIENG-5847 OR "setuptools<81"' --json number,title,state,url,repository

echo
echo "== Search code in this repo for setuptools<81 and RHAIENG-5847 =="
rg -n -C2 'setuptools<81|RHAIENG-5847' .

echo
echo "== Search code in upstream default branch for the exact file contents =="
tmpdir=$(mktemp -d)
trap 'rm -rf "$tmpdir"' EXIT
git clone --depth 1 https://github.com/opendatahub-io/notebooks.git "$tmpdir/upstream" >/dev/null 2>&1 || {
  echo "Failed to clone upstream repo"
  exit 1
}
rg -n -C2 'setuptools<81|RHAIENG-5847' "$tmpdir/upstream"

echo
echo "== Upstream file if present =="
if [ -f "$tmpdir/upstream/codeserver/ubi9-python-3.12/pyproject.toml" ]; then
  sed -n '1,120p' "$tmpdir/upstream/codeserver/ubi9-python-3.12/pyproject.toml"
else
  echo "File not found in upstream repo"
fi

echo
echo "== Local git history for target file =="
git log --oneline --decorate -- codeserver/ubi9-python-3.12/pyproject.toml | head -n 20

Length of output: 17838

---

---

@jiridanek I checked both repos: I don’t see this fix already in place upstream.

Specifically:

• In opendatahub-io/notebooks, codeserver/ubi9-python-3.12/pyproject.toml still has plain "setuptools", not "setuptools<81".
• I also didn’t find an upstream PR/issue matching RHAIENG-5847 or setuptools<81.
• In this downstream repo, the setuptools<81 occurrences are coming from the current branch for #2407.

So from a content perspective, yes, the fix still appears needed.

The only caveat is process: the PR body itself says changes like this should be made in odh/notebooks first and then synced down automatically. So my read is:

• not already fixed upstream
• still needed
• but it may be better to land it upstream first rather than only in red-hat-data-services/notebooks

---

🧠 Learnings used

Learnt from: jiridanek
Repo: red-hat-data-services/notebooks PR: 2333
File: jupyter/rocm/pytorch/ubi9-python-3.12/uv.lock.d/pylock.rocm.toml:0-0
Timestamp: 2026-06-05T19:50:12.249Z
Learning: When generating pylock.toml files using `uv pip compile`, do not expect `[tool.uv].override-dependencies` from the image’s `pyproject.toml` to take effect. `uv pip compile` automatically reads only `[tool.uv].constraint-dependencies` from `pyproject.toml`.
- To apply dependency version overrides at `uv pip compile` time, pass an explicit `--override overrides.txt` argument.
- To enforce a CVE version floor during lock generation, add the floor constraints to `dependencies/cve-constraints.txt` (the repo’s constraint file already used via `--constraints`).
Note: `[tool.uv].override-dependencies` is honored only by `uv lock`, `uv sync`, and `uv run`, not by `uv pip compile`.