chore(deps): update dependency setuptools to v78.1.1 [security] (#16827)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [setuptools](https://redirect.github.com/pypa/setuptools)
([changelog](https://setuptools.pypa.io/en/stable/history.html)) |
`==78.1.0` → `==78.1.1` |
![age](https://developer.mend.io/api/mc/badges/age/pypi/setuptools/78.1.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/setuptools/78.1.0/78.1.1?slim=true)
|

---

### setuptools has a path traversal vulnerability in
PackageIndex.download that leads to Arbitrary File Write
[CVE-2025-47273](https://nvd.nist.gov/vuln/detail/CVE-2025-47273) /
[GHSA-5rjg-fvgr-3xxf](https://redirect.github.com/advisories/GHSA-5rjg-fvgr-3xxf)

<details>
<summary>More information</summary>

#### Details
##### Summary 
A path traversal vulnerability in `PackageIndex` was fixed in setuptools
version 78.1.1

##### Details
```
    def _download_url(self, url, tmpdir):
        # Determine download filename
        #
        name, _fragment = egg_info_for_url(url)
        if name:
            while '..' in name:
                name = name.replace('..', '.').replace('\\', '_')
        else:
            name = "__downloaded__"  # default if URL has no path contents

        if name.endswith('.[egg.zip](http://egg.zip/)'):
            name = name[:-4]  # strip the extra .zip before download

 -->       filename = os.path.join(tmpdir, name)
```

Here:
https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88

`os.path.join()` discards the first argument `tmpdir` if the second
begins with a slash or drive letter.
`name` is derived from a URL without sufficient sanitization. While
there is some attempt to sanitize by replacing instances of '..' with
'.', it is insufficient.

##### Risk Assessment
As easy_install and package_index are deprecated, the exploitation
surface is reduced.
However, it seems this could be exploited in a similar fashion like
GHSA-r9hx-vwmv-q579, and as described by
POC 4 in GHSA-cx63-2mw6-8hw5 report: via
malicious URLs present on the pages of a package index.

##### Impact
An attacker would be allowed to write files to arbitrary locations on
the filesystem with the permissions of the process running the Python
code, which could escalate to RCE depending on the context.

##### References
https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5

[https://github.com/pypa/setuptools/issues/4946](https://redirect.github.com/pypa/setuptools/issues/4946)

#### Severity
- CVSS Score: 7.7 / 10 (High)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P`

#### References
-
[https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf](https://redirect.github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf)
-
[https://nvd.nist.gov/vuln/detail/CVE-2025-47273](https://nvd.nist.gov/vuln/detail/CVE-2025-47273)
-
[https://github.com/pypa/setuptools/issues/4946](https://redirect.github.com/pypa/setuptools/issues/4946)
-
[https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b](https://redirect.github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b)
-
[https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88](https://redirect.github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88)
-
[https://lists.debian.org/debian-lts-announce/2025/05/msg00035.html](https://lists.debian.org/debian-lts-announce/2025/05/msg00035.html)
-
[https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2025-49.yaml](https://redirect.github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2025-49.yaml)
-
[https://github.com/advisories/GHSA-5rjg-fvgr-3xxf](https://redirect.github.com/advisories/GHSA-5rjg-fvgr-3xxf)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-5rjg-fvgr-3xxf)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>pypa/setuptools (setuptools)</summary>

###
[`v78.1.1`](https://redirect.github.com/pypa/setuptools/compare/v78.1.0...v78.1.1)

[Compare
Source](https://redirect.github.com/pypa/setuptools/compare/v78.1.0...v78.1.1)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - ""
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/googleapis/google-cloud-python).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuMyIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Author: renovate-bot

packages/google-crc32c/scripts/requirements.txt

@@ -35,7 +35,7 @@ pip==26.0 \
     --hash=sha256:3ce220a0a17915972fbf1ab451baae1521c4539e778b28127efa79b974aff0fa \
     --hash=sha256:98436feffb9e31bc9339cf369fd55d3331b1580b6a6f1173bacacddcf9c34754
     # via -r requirements.in
-setuptools==78.1.0 \
-    --hash=sha256:18fd474d4a82a5f83dac888df697af65afa82dec7323d09c3e37d1f14288da54 \
-    --hash=sha256:3e386e96793c8702ae83d17b853fb93d3e09ef82ec62722e61da5cd22376dcd8
+setuptools==78.1.1 \
+    --hash=sha256:c3a9c4211ff4c309edb8b8c4f1cbfa7ae324c4ba9f91ff254e3d305b9fd54561 \
+    --hash=sha256:fcc17fd9cd898242f6b4adfaca46137a9edef687f43e6f78469692a5e70d851d
     # via -r requirements.in