fix: constrain transitive setuptools to the patched release

[Abhash-Chakraborty]

Summary

Closes the last actionable backend advisory: setuptools <83.0.0 (medium) against backend/uv.lock.

#373 bumped the build-system pin to setuptools>=83.0.0, but [build-system].requires only governs building this package — it does not constrain the resolved environment. setuptools also arrives transitively via torch and pip-audit with no lower bound, so uv.lock stayed on 82.0.1 and the alert stayed open.

Adding constraint-dependencies under [tool.uv] pins the transitive resolution forward without making setuptools a direct runtime dependency:

[tool.uv]
constraint-dependencies = ["setuptools>=83.0.0"]

uv lock then moves it: Updated setuptools v82.0.1 -> v83.0.0.

Type of change

• Bug fix

Release impact

• Critical/security fix (keep sensitive details private)

How to test

cd backend
uv sync --group dev --locked
uv run ruff check . && uv run ruff format --check .
uv run pytest tests/
uv run pip-audit
grep -A1 '^name = "setuptools"$' uv.lock   # 83.0.0

All green locally: 527 tests passing (5 skipped), pip-audit reports no known vulnerabilities.

Summary by CodeRabbit

• Chores
  • Updated dependency resolution to require a secure version of the package build tooling.
  • Prevented installation of a vulnerable transitive dependency version.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

PR Context Summary

• Linked issue(s): none
• Referenced but not closing: chore(deps-dev): bump setuptools from 82.0.1 to 83.0.0 in /backend #373
• PR author trusted by GitHub: yes
• Dependabot PR: no
• PR assignee synced from linked issue: no change
• Macroscope review status: Waiting for under-review or ready-to-merge before triggering Macroscope.

Suggested issue links

• feat: show version and a safe support summary in Settings #355 - feat: show version and a safe support summary in Settings
• security: audit InsightFace model licensing and benchmark a smaller face pack #342 - security: audit InsightFace model licensing and benchmark a smaller face pack
• feat: add a production CPU-only model runtime profile #339 - feat: add a production CPU-only model runtime profile

Use Fixes #123 or Closes #123 in the PR body when one of the suggestions is the intended issue.
Manual rerun: Actions > PR Context Triage > Run workflow > set pr_number and force_review=true.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 644836ad-c9c0-43fd-8b5a-5132876f378d

📥 Commits

Reviewing files that changed from the base of the PR and between 288a780 and 12a0a85.

⛔ Files ignored due to path filters (1)

• backend/uv.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• backend/pyproject.toml

---

📝 Walkthrough

Walkthrough

The backend project configuration adds a uv dependency constraint requiring setuptools>=83.0.0 for environment resolution.

Changes

Dependency Resolution

Layer / File(s)	Summary
Setuptools resolution constraint backend/pyproject.toml	Adds a uv constraint requiring setuptools>=83.0.0 and documents the transitive resolution issue it prevents.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Poem

I’m a rabbit with a package to mend,
Setuptools stays fresh from start to end.
No older burrow, no vulnerable flight,
Just a safer constraint hopping right. 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: constraining transitive setuptools to a patched version.
Description check	✅ Passed	The description covers Summary, Type of change, Release impact, and How to test, with only non-critical template sections missing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved 12a0a85

This is a straightforward security fix that constrains the transitive setuptools dependency to >=83.0.0 to address a known vulnerability (GHSA). The change only affects dependency resolution, not runtime behavior, and the author is the designated code owner of this file.

^{You can customize Macroscope's approvability policy. Learn more.}