Skip to content

MINOR: pin setuptools<81#25763

Merged
chirag-madlani merged 2 commits intomainfrom
setuptools_fix
Feb 9, 2026
Merged

MINOR: pin setuptools<81#25763
chirag-madlani merged 2 commits intomainfrom
setuptools_fix

Conversation

@harshsoni2024
Copy link
Contributor

@harshsoni2024 harshsoni2024 commented Feb 9, 2026 •
edited by gitar-bot bot
Loading

Describe your changes:

Pin setuptools<81 as pkg_resources was removed in setuptools 81.0.0+

Type of change:

  • Bug fix
  • Improvement
  • New feature
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation

Checklist:

  • I have read the CONTRIBUTING document.
  • My PR title is Fixes <issue-number>: <short explanation>
  • I have commented on my code, particularly in hard-to-understand areas.
  • For JSON Schema changes: I updated the migration scripts or explained why it is not needed.

Summary by Gitar

  • Comprehensive setuptools fix:
    • Pin setuptools<81 across all Docker images (Dockerfile, Dockerfile.ci, operators/docker/Dockerfile, operators/docker/Dockerfile.ci) to prevent build failures from pkg_resources removal in setuptools 81+
    • Update ingestion/Makefile targets (install_all, install_test, install_dev_env) with setuptools pin for native Python environments
    • Broaden setup.py constraint from ~=78.1.1 to >=78.1.1,<81 with explanatory comment
  • Build isolation workaround:
    • Pre-install cx_Oracle with --no-build-isolation flag in all environments to use pinned setuptools version
    • Prevents pip from creating isolated build environment with latest setuptools 81+

This will update automatically on new commits.

@harshsoni2024 harshsoni2024 requested a review from a team as a code owner February 9, 2026 07:41
@github-actions github-actions bot added Ingestion safe to test Add this label to run secure Github workflows on PRs labels Feb 9, 2026
keshavmohta09
keshavmohta09 previously approved these changes Feb 9, 2026
View reviewed changes
@github-actions
Copy link
Contributor

github-actions bot commented Feb 9, 2026 •
edited
Loading

🛡️ TRIVY SCAN RESULT 🛡️

Target: openmetadata-ingestion:trivy (debian 12.12)

Vulnerabilities (4)

Package Vulnerability ID Severity Installed Version Fixed Version
libpam-modules CVE-2025-6020 🚨 HIGH 1.5.2-6+deb12u1 1.5.2-6+deb12u2
libpam-modules-bin CVE-2025-6020 🚨 HIGH 1.5.2-6+deb12u1 1.5.2-6+deb12u2
libpam-runtime CVE-2025-6020 🚨 HIGH 1.5.2-6+deb12u1 1.5.2-6+deb12u2
libpam0g CVE-2025-6020 🚨 HIGH 1.5.2-6+deb12u1 1.5.2-6+deb12u2

🛡️ TRIVY SCAN RESULT 🛡️

Target: Java

Vulnerabilities (33)

Package Vulnerability ID Severity Installed Version Fixed Version
com.fasterxml.jackson.core:jackson-core CVE-2025-52999 🚨 HIGH 2.12.7 2.15.0
com.fasterxml.jackson.core:jackson-core CVE-2025-52999 🚨 HIGH 2.13.4 2.15.0
com.fasterxml.jackson.core:jackson-databind CVE-2022-42003 🚨 HIGH 2.12.7 2.12.7.1, 2.13.4.2
com.fasterxml.jackson.core:jackson-databind CVE-2022-42004 🚨 HIGH 2.12.7 2.12.7.1, 2.13.4
com.google.code.gson:gson CVE-2022-25647 🚨 HIGH 2.2.4 2.8.9
com.google.protobuf:protobuf-java CVE-2021-22569 🚨 HIGH 3.3.0 3.16.1, 3.18.2, 3.19.2
com.google.protobuf:protobuf-java CVE-2022-3509 🚨 HIGH 3.3.0 3.16.3, 3.19.6, 3.20.3, 3.21.7
com.google.protobuf:protobuf-java CVE-2022-3510 🚨 HIGH 3.3.0 3.16.3, 3.19.6, 3.20.3, 3.21.7
com.google.protobuf:protobuf-java CVE-2024-7254 🚨 HIGH 3.3.0 3.25.5, 4.27.5, 4.28.2
com.google.protobuf:protobuf-java CVE-2021-22569 🚨 HIGH 3.7.1 3.16.1, 3.18.2, 3.19.2
com.google.protobuf:protobuf-java CVE-2022-3509 🚨 HIGH 3.7.1 3.16.3, 3.19.6, 3.20.3, 3.21.7
com.google.protobuf:protobuf-java CVE-2022-3510 🚨 HIGH 3.7.1 3.16.3, 3.19.6, 3.20.3, 3.21.7
com.google.protobuf:protobuf-java CVE-2024-7254 🚨 HIGH 3.7.1 3.25.5, 4.27.5, 4.28.2
com.nimbusds:nimbus-jose-jwt CVE-2023-52428 🚨 HIGH 9.8.1 9.37.2
com.squareup.okhttp3:okhttp CVE-2021-0341 🚨 HIGH 3.12.12 4.9.2
commons-beanutils:commons-beanutils CVE-2025-48734 🚨 HIGH 1.9.4 1.11.0
commons-io:commons-io CVE-2024-47554 🚨 HIGH 2.8.0 2.14.0
dnsjava:dnsjava CVE-2024-25638 🚨 HIGH 2.1.7 3.6.0
io.netty:netty-codec-http2 CVE-2025-55163 🚨 HIGH 4.1.96.Final 4.2.4.Final, 4.1.124.Final
io.netty:netty-codec-http2 GHSA-xpw8-rcwv-8f8p 🚨 HIGH 4.1.96.Final 4.1.100.Final
io.netty:netty-handler CVE-2025-24970 🚨 HIGH 4.1.96.Final 4.1.118.Final
net.minidev:json-smart CVE-2021-31684 🚨 HIGH 1.3.2 1.3.3, 2.4.4
net.minidev:json-smart CVE-2023-1370 🚨 HIGH 1.3.2 2.4.9
org.apache.avro:avro CVE-2024-47561 🔥 CRITICAL 1.7.7 1.11.4
org.apache.avro:avro CVE-2023-39410 🚨 HIGH 1.7.7 1.11.3
org.apache.derby:derby CVE-2022-46337 🔥 CRITICAL 10.14.2.0 10.14.3, 10.15.2.1, 10.16.1.2, 10.17.1.0
org.apache.ivy:ivy CVE-2022-46751 🚨 HIGH 2.5.1 2.5.2
org.apache.mesos:mesos CVE-2018-1330 🚨 HIGH 1.4.3 1.6.0
org.apache.thrift:libthrift CVE-2019-0205 🚨 HIGH 0.12.0 0.13.0
org.apache.thrift:libthrift CVE-2020-13949 🚨 HIGH 0.12.0 0.14.0
org.apache.zookeeper:zookeeper CVE-2023-44981 🔥 CRITICAL 3.6.3 3.7.2, 3.8.3, 3.9.1
org.eclipse.jetty:jetty-server CVE-2024-13009 🚨 HIGH 9.4.56.v20240826 9.4.57.v20241219
org.lz4:lz4-java CVE-2025-12183 🚨 HIGH 1.8.0 1.8.1

🛡️ TRIVY SCAN RESULT 🛡️

Target: Node.js

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: Python

Vulnerabilities (18)

Package Vulnerability ID Severity Installed Version Fixed Version
Werkzeug CVE-2024-34069 🚨 HIGH 2.2.3 3.0.3
aiohttp CVE-2025-69223 🚨 HIGH 3.12.12 3.13.3
aiohttp CVE-2025-69223 🚨 HIGH 3.13.2 3.13.3
apache-airflow CVE-2025-68438 🚨 HIGH 3.1.5 3.1.6
apache-airflow CVE-2025-68675 🚨 HIGH 3.1.5 3.1.6
azure-core CVE-2026-21226 🚨 HIGH 1.37.0 1.38.0
jaraco.context CVE-2026-23949 🚨 HIGH 5.3.0 6.1.0
jaraco.context CVE-2026-23949 🚨 HIGH 6.0.1 6.1.0
protobuf CVE-2026-0994 🚨 HIGH 4.25.8 6.33.5, 5.29.6
pyasn1 CVE-2026-23490 🚨 HIGH 0.6.1 0.6.2
python-multipart CVE-2026-24486 🚨 HIGH 0.0.20 0.0.22
ray CVE-2025-62593 🔥 CRITICAL 2.47.1 2.52.0
starlette CVE-2025-62727 🚨 HIGH 0.48.0 0.49.1
urllib3 CVE-2025-66418 🚨 HIGH 1.26.20 2.6.0
urllib3 CVE-2025-66471 🚨 HIGH 1.26.20 2.6.0
urllib3 CVE-2026-21441 🚨 HIGH 1.26.20 2.6.3
wheel CVE-2026-24049 🚨 HIGH 0.45.1 0.46.2
wheel CVE-2026-24049 🚨 HIGH 0.45.1 0.46.2

🛡️ TRIVY SCAN RESULT 🛡️

Target: /etc/ssl/private/ssl-cert-snakeoil.key

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: /home/airflow/openmetadata-airflow-apis/openmetadata_managed_apis.egg-info/PKG-INFO

No Vulnerabilities Found

gitar-bot[bot]
gitar-bot bot reviewed Feb 9, 2026
View reviewed changes
@gitar-bot
Copy link

gitar-bot bot commented Feb 9, 2026 •
edited
Loading

🔍 CI failure analysis for 40e2f9e: Build issue FIXED: cx_Oracle installs successfully, all tests pass. Two unrelated CI failures: (1) py-run-tests 3.11 segfault during cleanup (transient), (2) py-run-tests 3.10 Elasticsearch infrastructure issue (pre-existing).

CI Status Update for New Commit (40e2f9e)

✅ SUCCESS: Build Issue Resolved

The comprehensive setuptools fix has successfully resolved the primary blocker:

py-run-tests (3.11) - Build Issue FIXED ✅

Previous Status: Failed during setup with ModuleNotFoundError: No module named 'pkg_resources'

Current Status: ✅ Setup succeeded, cx_Oracle installed successfully

Test Results:

  • Unit tests: 3715 passed, 12 skipped, 6 xfailed, 2 xpassed
  • Integration tests: 537 passed, 21 skipped, 1 xfailed
  • Total: All 4,252 tests passed successfully

Failure Reason: Segmentation fault during test cleanup (post-test)

make[1]: *** [ingestion/Makefile:96: run_ometa_integration_tests] Segmentation fault (core dumped)

Analysis

This is NOT related to the PR changes:

  • The setuptools/cx_Oracle fix worked perfectly - no installation errors
  • All tests passed successfully
  • The segmentation fault occurred after all tests completed during cleanup
  • This is a known issue with Python test cleanup in CI environments (C extension cleanup issues)
  • The PR only modifies build configuration (setuptools pinning), not test code or runtime behavior

Segmentation faults during cleanup are often transient. Retrying may succeed.

py-run-tests (3.10) - Unrelated Infrastructure Issue ⚠️

Status: Test execution failures (7 errors) in Trino classifier tests

Error: Could not fetch database entity from Search Indexes. The search index may not be available or the entity has not been indexed yet.

Scope: 7 errors on tables: table, titanic, iris, userdata, empty, complex_and_simple, only_complex

Analysis

This is NOT related to the PR changes:

  • The PR only modifies build configuration (Docker, Makefile, setup.py)
  • This is an Elasticsearch/search index infrastructure issue
  • The same failure pattern occurred on the previous commit (8c22cbf) before any setuptools fixes
  • No impact on:
    • Integration test execution
    • Trino database connectivity
    • Build or installation processes

This is a persistent infrastructure/environment issue with the CI test setup.

Summary

✅ PR Objective Achieved

The PR successfully fixes the setuptools 81+ / pkg_resources incompatibility:

  • ✅ cx_Oracle installs without errors across all environments (Docker, Makefile, setup.py)
  • ✅ All unit and integration tests pass on py-run-tests (3.11)
  • ⚠️ Segmentation fault on 3.11 is transient cleanup issue (unrelated)
  • ⚠️ Elasticsearch errors on 3.10 are pre-existing infrastructure issues (unrelated)

Key Validation

The fix is proven to work:

  • No cx_Oracle installation errors
  • No pkg_resources errors
  • All 4,252 tests executed and passed
  • Both CI failures are unrelated infrastructure/environmental issues
Code Review ✅ Approved 1 resolved / 1 findings

Comprehensive setuptools<81 pin applied consistently across all Dockerfiles, Makefile targets, and setup.py. The previous finding about missing fixes in sibling Dockerfiles has been fully addressed.

✅ 1 resolved
✅ Bug: Same setuptools/cx_Oracle fix missing from ingestion/Dockerfile

📄 ingestion/Dockerfile:84 📄 ingestion/operators/docker/Dockerfile:84
The ingestion/Dockerfile (the production/release Dockerfile) has the same problem: it runs pip install --upgrade pip without pinning setuptools, and then installs openmetadata-ingestion[all] which includes the oracle extra (and therefore cx_Oracle>=8.3.0,<9). This means ingestion/Dockerfile will also fail to build when setuptools 81+ is resolved.

Similarly, ingestion/operators/docker/Dockerfile also runs pip install --upgrade pip without the setuptools pin and installs openmetadata-ingestion[all] which pulls in cx_Oracle.

Note that ingestion/operators/docker/Dockerfile.ci already has setuptools~=70.3.0, so it's unaffected.

Suggested fix: Apply the same setuptools pin and --no-build-isolation cx_Oracle pre-install to both ingestion/Dockerfile (line 84) and ingestion/operators/docker/Dockerfile (lines 84, 88).

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change:

Auto-apply Compact 
gitar auto-apply:on         

gitar display:verbose

Was this helpful? React with 👍 / 👎 | Gitar

@github-actions
Copy link
Contributor

github-actions bot commented Feb 9, 2026

🛡️ TRIVY SCAN RESULT 🛡️

Target: openmetadata-ingestion-base-slim:trivy (debian 12.13)

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: Java

Vulnerabilities (33)

Package Vulnerability ID Severity Installed Version Fixed Version
com.fasterxml.jackson.core:jackson-core CVE-2025-52999 🚨 HIGH 2.12.7 2.15.0
com.fasterxml.jackson.core:jackson-core CVE-2025-52999 🚨 HIGH 2.13.4 2.15.0
com.fasterxml.jackson.core:jackson-databind CVE-2022-42003 🚨 HIGH 2.12.7 2.12.7.1, 2.13.4.2
com.fasterxml.jackson.core:jackson-databind CVE-2022-42004 🚨 HIGH 2.12.7 2.12.7.1, 2.13.4
com.google.code.gson:gson CVE-2022-25647 🚨 HIGH 2.2.4 2.8.9
com.google.protobuf:protobuf-java CVE-2021-22569 🚨 HIGH 3.3.0 3.16.1, 3.18.2, 3.19.2
com.google.protobuf:protobuf-java CVE-2022-3509 🚨 HIGH 3.3.0 3.16.3, 3.19.6, 3.20.3, 3.21.7
com.google.protobuf:protobuf-java CVE-2022-3510 🚨 HIGH 3.3.0 3.16.3, 3.19.6, 3.20.3, 3.21.7
com.google.protobuf:protobuf-java CVE-2024-7254 🚨 HIGH 3.3.0 3.25.5, 4.27.5, 4.28.2
com.google.protobuf:protobuf-java CVE-2021-22569 🚨 HIGH 3.7.1 3.16.1, 3.18.2, 3.19.2
com.google.protobuf:protobuf-java CVE-2022-3509 🚨 HIGH 3.7.1 3.16.3, 3.19.6, 3.20.3, 3.21.7
com.google.protobuf:protobuf-java CVE-2022-3510 🚨 HIGH 3.7.1 3.16.3, 3.19.6, 3.20.3, 3.21.7
com.google.protobuf:protobuf-java CVE-2024-7254 🚨 HIGH 3.7.1 3.25.5, 4.27.5, 4.28.2
com.nimbusds:nimbus-jose-jwt CVE-2023-52428 🚨 HIGH 9.8.1 9.37.2
com.squareup.okhttp3:okhttp CVE-2021-0341 🚨 HIGH 3.12.12 4.9.2
commons-beanutils:commons-beanutils CVE-2025-48734 🚨 HIGH 1.9.4 1.11.0
commons-io:commons-io CVE-2024-47554 🚨 HIGH 2.8.0 2.14.0
dnsjava:dnsjava CVE-2024-25638 🚨 HIGH 2.1.7 3.6.0
io.netty:netty-codec-http2 CVE-2025-55163 🚨 HIGH 4.1.96.Final 4.2.4.Final, 4.1.124.Final
io.netty:netty-codec-http2 GHSA-xpw8-rcwv-8f8p 🚨 HIGH 4.1.96.Final 4.1.100.Final
io.netty:netty-handler CVE-2025-24970 🚨 HIGH 4.1.96.Final 4.1.118.Final
net.minidev:json-smart CVE-2021-31684 🚨 HIGH 1.3.2 1.3.3, 2.4.4
net.minidev:json-smart CVE-2023-1370 🚨 HIGH 1.3.2 2.4.9
org.apache.avro:avro CVE-2024-47561 🔥 CRITICAL 1.7.7 1.11.4
org.apache.avro:avro CVE-2023-39410 🚨 HIGH 1.7.7 1.11.3
org.apache.derby:derby CVE-2022-46337 🔥 CRITICAL 10.14.2.0 10.14.3, 10.15.2.1, 10.16.1.2, 10.17.1.0
org.apache.ivy:ivy CVE-2022-46751 🚨 HIGH 2.5.1 2.5.2
org.apache.mesos:mesos CVE-2018-1330 🚨 HIGH 1.4.3 1.6.0
org.apache.thrift:libthrift CVE-2019-0205 🚨 HIGH 0.12.0 0.13.0
org.apache.thrift:libthrift CVE-2020-13949 🚨 HIGH 0.12.0 0.14.0
org.apache.zookeeper:zookeeper CVE-2023-44981 🔥 CRITICAL 3.6.3 3.7.2, 3.8.3, 3.9.1
org.eclipse.jetty:jetty-server CVE-2024-13009 🚨 HIGH 9.4.56.v20240826 9.4.57.v20241219
org.lz4:lz4-java CVE-2025-12183 🚨 HIGH 1.8.0 1.8.1

🛡️ TRIVY SCAN RESULT 🛡️

Target: Node.js

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: Python

Vulnerabilities (8)

Package Vulnerability ID Severity Installed Version Fixed Version
apache-airflow CVE-2025-68438 🚨 HIGH 3.1.5 3.1.6
apache-airflow CVE-2025-68675 🚨 HIGH 3.1.5 3.1.6
jaraco.context CVE-2026-23949 🚨 HIGH 6.0.1 6.1.0
starlette CVE-2025-62727 🚨 HIGH 0.48.0 0.49.1
urllib3 CVE-2025-66418 🚨 HIGH 1.26.20 2.6.0
urllib3 CVE-2025-66471 🚨 HIGH 1.26.20 2.6.0
urllib3 CVE-2026-21441 🚨 HIGH 1.26.20 2.6.3
wheel CVE-2026-24049 🚨 HIGH 0.45.1 0.46.2

🛡️ TRIVY SCAN RESULT 🛡️

Target: /etc/ssl/private/ssl-cert-snakeoil.key

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: /ingestion/pipelines/extended_sample_data.yaml

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: /ingestion/pipelines/lineage.yaml

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: /ingestion/pipelines/sample_data.json

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: /ingestion/pipelines/sample_data.yaml

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: /ingestion/pipelines/sample_data_aut.yaml

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: /ingestion/pipelines/sample_usage.json

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: /ingestion/pipelines/sample_usage.yaml

No Vulnerabilities Found

🛡️ TRIVY SCAN RESULT 🛡️

Target: /ingestion/pipelines/sample_usage_aut.yaml

No Vulnerabilities Found

@chirag-madlani chirag-madlani merged commit 30f09df into main Feb 9, 2026
23 of 25 checks passed
@chirag-madlani chirag-madlani deleted the setuptools_fix branch February 9, 2026 13:59
harshsoni2024 added a commit that referenced this pull request Feb 9, 2026
@harshsoni2024
MINOR: pin setuptools<81 (#25763)
59b8d21
@gitar-bot gitar-bot bot mentioned this pull request Feb 9, 2026
Merged
9 tasks
ayush-shah pushed a commit that referenced this pull request Feb 10, 2026
@harshsoni2024 @ayush-shah
MINOR: pin setuptools<81 (#25763)
50b4ad2 
* pin setuptools<81

* env setup fix
ayush-shah pushed a commit that referenced this pull request Feb 10, 2026
@harshsoni2024 @ayush-shah
MINOR: pin setuptools<81 (#25763)
629532d 
* pin setuptools<81

* env setup fix
ulixius9 pushed a commit that referenced this pull request Feb 11, 2026
@harshsoni2024 @ulixius9
MINOR: pin setuptools<81 (#25763)
ee08d65 
* pin setuptools<81

* env setup fix
keshavmohta09 pushed a commit that referenced this pull request Feb 12, 2026
@harshsoni2024 @keshavmohta09
MINOR: pin setuptools<81 (#25763)
2f21b8c 
* pin setuptools<81

* env setup fix
harshsoni2024 added a commit that referenced this pull request Feb 12, 2026
@harshsoni2024
MINOR: pin setuptools<81 (#25763)
38a4bc2
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gitar-bot gitar-bot[bot] gitar-bot[bot] left review comments

@keshavmohta09 keshavmohta09 keshavmohta09 left review comments

Assignees

No one assigned

Labels

Ingestion safe to test Add this label to run secure Github workflows on PRs

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@harshsoni2024 @keshavmohta09 @chirag-madlani