pkg_resources is deprecated as an API

[benfiedler]

After a recent pip install of salt-pepper==0.7.6 on a python3.10 system, running pepper provides this warning message -

venvs/salt-pepper/lib/python3.10/site-packages/pepper/__init__.py:4: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
import pkg_resources

I have pinned to Setuptools 80.9 but a long term solution would be ideal.

[vitotafuni]

with python 3.14 no more warning

[vitotafuni]

more precisely using setuptools<81 it works

[teason30]

This seems to work without pinning setuptools if you use the 0.7.7 version from the develop branch of this repository.

[b-a-t]

If you install salt-pepper into the saltstack one-dir installation(as there are some benefits to having the installed together), the newer version of setup-tools again breaks the run:

Traceback (most recent call last):
 File "/opt/saltstack/salt/extras-3.10/pepper/__init__.py", line 11, in <module>
  __version__ = pkg_resources.get_distribution('salt_pepper').version
AttributeError: module 'pkg_resources' has no attribute 'get_distribution'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
 File "/usr/bin/salt-pepper", line 7, in <module>
  import pepper.script
 File "/opt/saltstack/salt/extras-3.10/pepper/__init__.py", line 12, in <module>
  except pkg_resources.DistributionNotFound:
AttributeError: module 'pkg_resources' has no attribute 'DistributionNotFound'

Well, the fix is still the same:

salt-pip install  setuptools<81

But again, this should have been updated years ago... The code fix is straigtforward:

--- __init__.py.old     2024-12-05 12:10:18.461001018 +0000
+++ __init__.py 2026-04-07 20:27:39.139924828 +0000
@@ -1,14 +1,14 @@
 '''
 Pepper is a CLI front-end to salt-api
 '''
-import pkg_resources
+from importlib.metadata import PackageNotFoundError, version

 from pepper.libpepper import Pepper, PepperException

 __all__ = ('__version__', 'Pepper', 'PepperException')

 try:
-    __version__ = pkg_resources.get_distribution('salt_pepper').version
+    __version__ = version("salt_pepper")
 except PackageNotFoundError:
     # package is not installed
     __version__ = None

[b-a-t]

And, apparently, develop version was patched, so the real question is - when to expect a new release.

[hwirths]

Now that the vulnerability CVE-2026-59890 is reported for all versions <83.0.0 of setuptools and version 0.7.6 of salt-pepper cannot be used with version 83.0.0 of setuptools: Is there a chance of building and publishing release 0.7.7?