fix(setup): install setuptools>=83 in pip venvs

[NWarila]

Problem

Consumer runs 37935721195, 37940750631, and 37119136109 fail their Python security check because the pip-toolchain venv retains the interpreter-bundled setuptools 79.0.1. The exact audit output is:

Found 2 known vulnerabilities in 1 package
Name       Version ID              Fix Versions
---------- ------- --------------- ------------
setuptools 79.0.1  PYSEC-2026-3447 83.0.0
setuptools 79.0.1  PYSEC-2026-3447 83.0.0

Change

The PR diff changes exactly two files:

• scripts/setup.sh: +1 line, upgrading setuptools>=83.0.0 in the pip + venv branch.
• scripts/setup.ps1: +2 lines, adding the equivalent setuptools upgrade and failure check.

Acceptance

Section D with ambient Python 3.12.3 exited 0. Literal output:

BASE=24f4e01780b25af4c096dbe978268130d255132f
Project root: /github/nwarila/python-template-wt-setuptools/.tmp/tmp.NDmieGsqKK/proj

No uv.lock found — using pip + venv toolchain.

WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
Requirement already satisfied: pip in ./.venv/lib/python3.12/site-packages (24.0)
Collecting pip
  Downloading pip-26.2.1-py3-none-any.whl.metadata (4.6 kB)
Downloading pip-26.2.1-py3-none-any.whl (1.8 MB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1.8/1.8 MB 51.0 MB/s eta 0:00:00
Installing collected packages: pip
  Attempting uninstall: pip
    Found existing installation: pip 24.0
    Uninstalling pip-24.0:
      Successfully uninstalled pip-24.0
Successfully installed pip-26.2.1
WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
Collecting setuptools>=83.0.0
  Downloading setuptools-84.0.0-py3-none-any.whl.metadata (6.6 kB)
Downloading setuptools-84.0.0-py3-none-any.whl (818 kB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 818.2/818.2 kB 62.7 MB/s  0:00:00
Installing collected packages: setuptools
Successfully installed setuptools-84.0.0
Installing package (no dev extras detected)...
WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
Obtaining file:///github/nwarila/python-template-wt-setuptools/.tmp/tmp.NDmieGsqKK/proj
  Installing build dependencies: started
  Installing build dependencies: finished with status 'done'
  Checking if build backend supports build_editable: started
  Checking if build backend supports build_editable: finished with status 'done'
  Getting requirements to build editable: started
  Getting requirements to build editable: finished with status 'done'
  Preparing editable metadata (pyproject.toml): started
  Preparing editable metadata (pyproject.toml): finished with status 'done'
Building wheels for collected packages: pkg
  Building editable for pkg (pyproject.toml): started
  Building editable for pkg (pyproject.toml): finished with status 'done'
  Created wheel for pkg: filename=pkg-0.0.1-0.editable-py3-none-any.whl size=1142 sha256=97b40949815d8590fb2532e07fdef90cbc1605bed39d1ba45c13438aa88af231
  Stored in directory: /github/nwarila/python-template-wt-setuptools/.tmp/pip-ephem-wheel-cache-xxdf4udm/wheels/c8/fe/f2/58d8e30b1a607c472f09c69739dbb416c439b9975e83aecabf
Successfully built pkg
Installing collected packages: pkg
Successfully installed pkg-0.0.1

Setup complete (pip + venv).
  Activate: source .venv/bin/activate
84.0.0
WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
WARNING:pip_audit._cache:Failed to write to cache directory, performance may be degraded: [Errno 30] Read-only file system: '/home/hellbomb/.cache/pip-audit/7/7/3/5/9/tmp9mf0soh6'
No known vulnerabilities found
Name Skip Reason
---- -------------------------------
pkg  distribution marked as editable
Project root: /github/nwarila/python-template-wt-setuptools/.tmp/tmp.NDmieGsqKK/proj

No uv.lock found — using pip + venv toolchain.

WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
Requirement already satisfied: pip in ./.venv/lib/python3.12/site-packages (24.0)
Collecting pip
  Downloading pip-26.2.1-py3-none-any.whl.metadata (4.6 kB)
Downloading pip-26.2.1-py3-none-any.whl (1.8 MB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1.8/1.8 MB 48.8 MB/s eta 0:00:00
Installing collected packages: pip
  Attempting uninstall: pip
    Found existing installation: pip 24.0
    Uninstalling pip-24.0:
      Successfully uninstalled pip-24.0
Successfully installed pip-26.2.1
Installing package (no dev extras detected)...
WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
Obtaining file:///github/nwarila/python-template-wt-setuptools/.tmp/tmp.NDmieGsqKK/proj
  Installing build dependencies: started
  Installing build dependencies: finished with status 'done'
  Checking if build backend supports build_editable: started
  Checking if build backend supports build_editable: finished with status 'done'
  Getting requirements to build editable: started
  Getting requirements to build editable: finished with status 'done'
  Preparing editable metadata (pyproject.toml): started
  Preparing editable metadata (pyproject.toml): finished with status 'done'
Building wheels for collected packages: pkg
  Building editable for pkg (pyproject.toml): started
  Building editable for pkg (pyproject.toml): finished with status 'done'
  Created wheel for pkg: filename=pkg-0.0.1-0.editable-py3-none-any.whl size=1142 sha256=3cf9dc038bba12bc9424af13cf42bfeec50d25bd6c21a412b8046a8a80c150f1
  Stored in directory: /github/nwarila/python-template-wt-setuptools/.tmp/pip-ephem-wheel-cache-g4o8mviz/wheels/c8/fe/f2/58d8e30b1a607c472f09c69739dbb416c439b9975e83aecabf
Successfully built pkg
Installing collected packages: pkg
Successfully installed pkg-0.0.1

Setup complete (pip + venv).
  Activate: source .venv/bin/activate
fail-before: not reproducible on Python 3.12.3: setuptools absent
WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
........................................................................ [ 61%]
..............................................                           [100%]
================================ tests coverage ================================
_______________ coverage: platform linux, python 3.12.3-final-0 ________________

Name                           Stmts   Miss  Cover   Missing
------------------------------------------------------------
scripts/check_lint.py             42      1    98%   61
scripts/check_package.py          69      6    91%   31, 39, 84-85, 88, 97
scripts/check_security.py         24      3    88%   19, 27, 38
scripts/check_spelling.py         29      3    90%   19, 27, 44
scripts/check_tests.py            55      3    95%   20, 28, 86
scripts/check_types.py            36      3    92%   29, 37, 53
scripts/qa.py                    130     11    92%   49-50, 218, 231, 244, 250-251, 256-258, 273
scripts/sync.py                   51      5    90%   51, 90-94
src/sample_app/__init__.py         6      0   100%
src/sample_app/__main__.py         4      0   100%
src/sample_app/_contracts.py      23      0   100%
src/sample_app/config.py          17      0   100%
src/sample_app/exceptions.py      11      0   100%
src/sample_app/main.py            29      0   100%
src/sample_app/validators.py      10      0   100%
------------------------------------------------------------
TOTAL                            536     35    93%
Required test coverage of 90% reached. Total coverage: 93.47%
118 passed in 15.81s

Section D with python3 resolving through the PATH shim to Python 3.11.16 exited 0. Literal output:

BASE=24f4e01780b25af4c096dbe978268130d255132f
Project root: /github/nwarila/python-template-wt-setuptools/.tmp/tmp.HTf1gx28dw/proj

No uv.lock found — using pip + venv toolchain.

WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
Requirement already satisfied: pip in ./.venv/lib/python3.11/site-packages (24.0)
Collecting pip
  Downloading pip-26.2.1-py3-none-any.whl.metadata (4.6 kB)
Downloading pip-26.2.1-py3-none-any.whl (1.8 MB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1.8/1.8 MB 53.0 MB/s eta 0:00:00
Installing collected packages: pip
  Attempting uninstall: pip
    Found existing installation: pip 24.0
    Uninstalling pip-24.0:
      Successfully uninstalled pip-24.0
Successfully installed pip-26.2.1
WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
Collecting setuptools>=83.0.0
  Downloading setuptools-84.0.0-py3-none-any.whl.metadata (6.6 kB)
Downloading setuptools-84.0.0-py3-none-any.whl (818 kB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 818.2/818.2 kB 63.6 MB/s  0:00:00
Installing collected packages: setuptools
  Attempting uninstall: setuptools
    Found existing installation: setuptools 79.0.1
    Uninstalling setuptools-79.0.1:
      Successfully uninstalled setuptools-79.0.1
Successfully installed setuptools-84.0.0
Installing package (no dev extras detected)...
WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
Obtaining file:///github/nwarila/python-template-wt-setuptools/.tmp/tmp.HTf1gx28dw/proj
  Installing build dependencies: started
  Installing build dependencies: finished with status 'done'
  Checking if build backend supports build_editable: started
  Checking if build backend supports build_editable: finished with status 'done'
  Getting requirements to build editable: started
  Getting requirements to build editable: finished with status 'done'
  Preparing editable metadata (pyproject.toml): started
  Preparing editable metadata (pyproject.toml): finished with status 'done'
Building wheels for collected packages: pkg
  Building editable for pkg (pyproject.toml): started
  Building editable for pkg (pyproject.toml): finished with status 'done'
  Created wheel for pkg: filename=pkg-0.0.1-0.editable-py3-none-any.whl size=1143 sha256=02d15e53bbb03c50e6ee271d53c8a91ddabedbc8ab585e76cf638a526373d12b
  Stored in directory: /github/nwarila/python-template-wt-setuptools/.tmp/pip-ephem-wheel-cache-6mjt581f/wheels/99/0c/13/e2b80e118e4b750438c63370be09049131dcb8c69d27799de8
Successfully built pkg
Installing collected packages: pkg
Successfully installed pkg-0.0.1

Setup complete (pip + venv).
  Activate: source .venv/bin/activate
84.0.0
WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
WARNING:pip_audit._cache:Failed to write to cache directory, performance may be degraded: [Errno 30] Read-only file system: '/home/hellbomb/.cache/pip-audit/7/7/3/5/9/tmpw8kh1xx6'
No known vulnerabilities found
Name Skip Reason
---- -------------------------------
pkg  distribution marked as editable
Project root: /github/nwarila/python-template-wt-setuptools/.tmp/tmp.HTf1gx28dw/proj

No uv.lock found — using pip + venv toolchain.

WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
Requirement already satisfied: pip in ./.venv/lib/python3.11/site-packages (24.0)
Collecting pip
  Downloading pip-26.2.1-py3-none-any.whl.metadata (4.6 kB)
Downloading pip-26.2.1-py3-none-any.whl (1.8 MB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1.8/1.8 MB 54.8 MB/s eta 0:00:00
Installing collected packages: pip
  Attempting uninstall: pip
    Found existing installation: pip 24.0
    Uninstalling pip-24.0:
      Successfully uninstalled pip-24.0
Successfully installed pip-26.2.1
Installing package (no dev extras detected)...
WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
Obtaining file:///github/nwarila/python-template-wt-setuptools/.tmp/tmp.HTf1gx28dw/proj
  Installing build dependencies: started
  Installing build dependencies: finished with status 'done'
  Checking if build backend supports build_editable: started
  Checking if build backend supports build_editable: finished with status 'done'
  Getting requirements to build editable: started
  Getting requirements to build editable: finished with status 'done'
  Preparing editable metadata (pyproject.toml): started
  Preparing editable metadata (pyproject.toml): finished with status 'done'
Building wheels for collected packages: pkg
  Building editable for pkg (pyproject.toml): started
  Building editable for pkg (pyproject.toml): finished with status 'done'
  Created wheel for pkg: filename=pkg-0.0.1-0.editable-py3-none-any.whl size=1143 sha256=0cef43fc64a9b8982e00efd3786bb96dd6e43ef49d471a6f63e1f3a973112f44
  Stored in directory: /github/nwarila/python-template-wt-setuptools/.tmp/pip-ephem-wheel-cache-t6bcens1/wheels/99/0c/13/e2b80e118e4b750438c63370be09049131dcb8c69d27799de8
Successfully built pkg
Installing collected packages: pkg
Successfully installed pkg-0.0.1

Setup complete (pip + venv).
  Activate: source .venv/bin/activate
WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
WARNING:pip_audit._cache:Failed to write to cache directory, performance may be degraded: [Errno 30] Read-only file system: '/home/hellbomb/.cache/pip-audit/7/7/3/5/9/tmplimpvplg'
Found 2 known vulnerabilities in 1 package
Name       Version ID              Fix Versions
---------- ------- --------------- ------------
setuptools 79.0.1  PYSEC-2026-3447 83.0.0
setuptools 79.0.1  PYSEC-2026-3447 83.0.0

Name Skip Reason
---- -------------------------------
pkg  distribution marked as editable
WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
WARNING: The directory '/home/hellbomb/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
........................................................................ [ 61%]
..............................................                           [100%]
================================ tests coverage ================================
_______________ coverage: platform linux, python 3.11.16-final-0 _______________

Name                           Stmts   Miss  Cover   Missing
------------------------------------------------------------
scripts/check_lint.py             42      1    98%   61
scripts/check_package.py          69      6    91%   31, 39, 84-85, 88, 97
scripts/check_security.py         24      3    88%   19, 27, 38
scripts/check_spelling.py         29      3    90%   19, 27, 44
scripts/check_tests.py            55      3    95%   20, 28, 86
scripts/check_types.py            36      3    92%   29, 37, 53
scripts/qa.py                    130     11    92%   49-50, 218, 231, 244, 250-251, 256-258, 273
scripts/sync.py                   51      5    90%   51, 90-94
src/sample_app/__init__.py         6      0   100%
src/sample_app/__main__.py         4      0   100%
src/sample_app/_contracts.py      23      0   100%
src/sample_app/config.py          17      0   100%
src/sample_app/exceptions.py      11      0   100%
src/sample_app/main.py            29      0   100%
src/sample_app/validators.py      10      0   100%
------------------------------------------------------------
TOTAL                            536     35    93%
Required test coverage of 90% reached. Total coverage: 93.47%
118 passed in 14.51s

CI on this PR

Template CI run 38048152406 on head 5134a8b53c7b16d85a483f2043d33a1b98a9ccb9 completed with conclusion failure.

Job	Conclusion
lint	success
spelling	success
markdownlint	success
shellcheck	success
Governance gates	success
tests (ubuntu-latest)	success
tests (windows-latest)	success
security	failure
package	success
Org repo hygiene / repo-hygiene / verify	success
dependency-review	success
actionlint	success
Org CodeQL / CodeQL (actions)	success
types	success
Org OpenSSF Scorecard	skipped
ci-passed	failure

The security job (Python 3.11) and dependent ci-passed aggregate are red because the job runs the released .github/scripts/setup.sh, which this PR must not touch. The released copy is refreshed only by the post-v1.0.7 self-update PR. The security log contains exactly these two audit rows and no other vulnerability-ID rows:

setuptools 79.0.1  PYSEC-2026-3447 83.0.0
setuptools 79.0.1  PYSEC-2026-3447 83.0.0

All other executed jobs succeeded; the conditional Org OpenSSF Scorecard job was skipped.

Release state

v1 points to d12884de43b9f47b8f47721a6ea1977bdc2a4cbb (v1.0.6), the release drift check is green, and v1.0 remains absent until v1.0.7.

Merge path

The branch was updated from main by merge commit 5134a8b53c7b16d85a483f2043d33a1b98a9ccb9 before Section D and CI were rerun. Merging requires an explicit admin bypass of the required ci-passed check; the owner decides after P4.

Do not merge: P4 clean-room review pending