Fix Django container startup: Add setuptools for pkg_resources dependency

[Copilot]

Requirements for Contributing a Bug Fix

• Fill out the template below. Any pull request that does not include enough information to be reviewed in a timely manner may be closed at the maintainers' discretion.
• The pull request must only fix an existing bug. To contribute other changes, you must use a different template. You can see all templates at https://github.com/atom/.github/tree/master/.github/PULL_REQUEST_TEMPLATE.
• The pull request must update the test suite to demonstrate the changed functionality.
• After you create the pull request, all status checks must be pass before a maintainer reviews your contribution. For more details, please see https://github.com/GhostManager/Ghostwriter/blob/master/CONTRIBUTING.md#submitting-a-pull-request.

Identify the Bug

Django container fails to start with ModuleNotFoundError: No module named 'pkg_resources' when importing from docxcompose.properties.

Description of the Change

Added setuptools>=78.1.1 to requirements/base.txt.

Root cause: docxcompose (transitive dependency via docxtpl) imports pkg_resources, which is provided by setuptools. While the Dockerfile upgrades setuptools during build, it was not persisted as a runtime dependency.

Import chain:

Django admin → reporting.admin → commandcenter.admin → commandcenter.forms 
→ modules.reportwriter.report.base → docxtpl → docxcompose.properties → pkg_resources

Version rationale: 78.1.1 patches a path traversal vulnerability (CVE) in earlier versions.

Alternate Designs

• Pin to exact version: Rejected. Using >=78.1.1 allows security updates.
• Add to local.txt only: Rejected. Production environments need this too.
• Install docxtpl with [subdoc] extra: Rejected. Already implicitly required by existing code imports.

Possible Drawbacks

None. setuptools is a standard packaging tool with minimal footprint. The version constraint only enforces security best practices.

Verification Process

• Security scan confirmed no vulnerabilities in setuptools ≥78.1.1
• Code review passed
• Existing test suite validates imports work correctly once container starts

Release Notes

Fixed Django container startup failure due to missing pkg_resources module

Original prompt

The Django container does not come up now because of ModuleNotFoundError: No module named 'pkg_resources'. Here is the full output. Examine this output and the requirements to determine what is not installing this dependency. django-1 | File "/usr/local/lib/python3.10/site-packages/django/core/management/__init__.py", line 416, in execute django-1 | django.setup() django-1 | File "/usr/local/lib/python3.10/site-packages/django/__init__.py", line 24, in setup django-1 | apps.populate(settings.INSTALLED_APPS) django-1 | File "/usr/local/lib/python3.10/site-packages/django/apps/registry.py", line 124, in populate django-1 | app_config.ready() django-1 | File "/usr/local/lib/python3.10/site-packages/django/contrib/admin/apps.py", line 27, in ready django-1 | self.module.autodiscover() django-1 | File "/usr/local/lib/python3.10/site-packages/django/contrib/admin/__init__.py", line 50, in autodiscover django-1 | autodiscover_modules("admin", register_to=site) django-1 | File "/usr/local/lib/python3.10/site-packages/django/utils/module_loading.py", line 58, in autodiscover_modules django-1 | import_module("%s.%s" % (app_config.name, module_to_search)) django-1 | File "/usr/local/lib/python3.10/importlib/__init__.py", line 126, in import_module django-1 | return _bootstrap._gcd_import(name[level:], package, level) django-1 | File "<frozen importlib._bootstrap>", line 1050, in _gcd_import django-1 | File "<frozen importlib._bootstrap>", line 1027, in _find_and_load django-1 | File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked django-1 | File "<frozen importlib._bootstrap>", line 688, in _load_unlocked django-1 | File "<frozen importlib._bootstrap_external>", line 883, in exec_module django-1 | File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed django-1 | File "/app/ghostwriter/reporting/admin.py", line 10, in <module> django-1 | from ghostwriter.commandcenter.admin import CollabAdminBase django-1 | File "/app/ghostwriter/commandcenter/admin.py", line 8, in <module> django-1 | from ghostwriter.commandcenter.forms import ReportConfigurationForm django-1 | File "/app/ghostwriter/commandcenter/forms.py", line 17, in <module> django-1 | from ghostwriter.modules.reportwriter.report.base import ExportReportBase django-1 | File "/app/ghostwriter/modules/reportwriter/report/base.py", line 5, in <module> django-1 | from docxtpl import RichText as DocxRichText django-1 | File "/usr/local/lib/python3.10/site-packages/docxtpl/__init__.py", line 13, in <module> django-1 | from .subdoc import Subdoc django-1 | File "/usr/local/lib/python3.10/site-packages/docxtpl/subdoc.py", line 11, in <module> django-1 | from docxcompose.properties import CustomProperties django-1 | File "/usr/local/lib/python3.10/site-packages/docxcompose/properties.py", line 18, in <module> django-1 | import pkg_resources django-1 | ModuleNotFoundError: No module named 'pkg_resources'

The user has attached the following file paths as relevant context:

• .github/copilot-instructions.md

Created from VS Code.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.