[jacalata]

Direct revert of #461's setuptools 81→83.0.0 bump. setuptools 82+ dropped the bundled pkg_resources shim; pyinstaller 5.13.1 still imports it directly, so package.yml's builds fail with ModuleNotFoundError: No module named 'pkg_resources' on every platform. Confirmed via workflow_dispatch run (all four legs green): https://github.com/tableau/tabcmd/actions/runs/38852580921

package.yml only runs on tag push or workflow_dispatch, so this went undetected by normal PR CI since #461 merged.

This is a stopgap, not a long-term fix — pkg_resources is slated for removal from pip entirely as early as 2025-11-30. The real fix is the pyinstaller 6.0 upgrade (#477), which needs matching changes for pyinstaller 6's macOS .app bundle restructuring before it's usable. Raising priority on that.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The targeted dependency rollback has no identified blocking issues, and the linked packaging workflow completed successfully.

0 open findings

What changed in this PR

Restores packaging compatibility with PyInstaller 5.13.1 while the PyInstaller 6 upgrade remains deferred.

Changes:

• Reverts the packaging extra’s setuptools pin from 83.0.0 to 81 to restore pkg_resources.

File	Description
pyproject.toml	Pins setuptools to 81 for packaging compatibility.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jacalata]

This setuptools-81 pin is a stopgap until #477 (bump pyinstaller 5.13.1 → 6.0.0) lands — once that merges, this revert should come back out since the packaging extra won't need the older pkg_resources behavior anymore.

Noting for the record: setuptools 81 reintroduces GHSA-h35f-9h28-mq5c (MANIFEST.in Unicode-exclusion bypass, fixed in 83.0.0). Not currently exploitable here — tabcmd has no MANIFEST.in file, so there's nothing for the bypass to act on.

[jacalata]

Superseded by #487 (PyInstaller 6.22.3).