Deprecated project.license TOML table + License classifier under an uncapped setuptools build floor (CR-A16-039) #523

Wave 2 · theme D2-7: Next-release technology updates · highest severity Low · 2 finding(s) · effort trivial

Summary

After 2027-02-18 a setuptools release removes table support. The tag-driven publish build fails, or sdist installs fail, with no repository change.

Primary finding

CR-A16-039 — Deprecated project.license TOML table + License classifier under an uncapped setuptools build floor

severity Low · reachability default · intent intended-but-harmful · confidence likely · single reviewer · reproduced end to end · already tracked: KNOWN-OPEN OPS-11/12/14/17/18 (S13 packaging metadata; split not public) — docs/roadmap/phase-16-trust-surface-hardening.md:717-718

What happens. pyproject.toml:23 uses license = { text = 'Apache-2.0' } and :34 the 'License :: OSI Approved' classifier; setuptools 81-84 warn the table form is unsupported after 2027-02-18, and [build-system] requires setuptools>=83.0.0 with no cap (pyproject.toml:14), so publish.yml's python -m build will pick up the enforcing release with no repo change (both lines must change together).

Where.

• pyproject.toml:14
• pyproject.toml:23
• pyproject.toml:34
• .github/workflows/publish.yml:31

Evidence.

• pip wheel -v --no-build-isolation in a private copy with setuptools 81.0.0 (default venv) and 84.0.0 (latest venv) prints SetuptoolsDeprecationWarning 'project.license as a TOML table is deprecated' and 'License classifiers are deprecated', both with 'By 2027-Feb-18'. Both builds exit 0.
• fpy (setuptools 81.0.0) and fpy --venv lower (setuptools 84.0.0) running setuptools.config.pyprojecttoml.apply_configuration on the snapshot pyproject: both warnings reproduced, license_expression None. setuptools NEWS v82-v84 shows no removal yet.

Recommended fix. Use license = "Apache-2.0" plus license-files = ["LICENSE"] and drop the license classifier.

Other findings with the same root cause

These close with the same fix; update them in the same pull request.

TECH-T12-012 — Supply-chain tooling, network dependencies and vulnerability scanning: pyproject licence metadata: license = { text = ... } table and License classifier under setuptools>=83 (PEP 639 deprecation) (…

severity Next release · already tracked: KNOWN-OPEN OPS-11|OPS-12|OPS-14|OPS-17|OPS-18 docs/roadmap/phase-16-trust-surface-hardening.md:717-718

Item. pyproject licence metadata: license = { text = ... } table and License classifier under setuptools>=83 (PEP 639 deprecation) · verdict: deprecated-in-use · urgency: Next release

State in ForgeLM. pyproject.toml:23 license = { text = "Apache-2.0" }; pyproject.toml:34 classifier 'License :: OSI Approved :: Apache Software License'.

State of the ecosystem on 2026-10-01. Reproduced by the arbiter on 2026-10-01 with setuptools 84.0.0 (fpy --venv latest, setuptools.build_meta.prepare_metadata_for_build_wheel on a private copy of the snapshot): SetuptoolsDeprecationWarning 'project.license as a TOML table is deprecated ... By 2027-Feb-18, you need to update your project and remove deprecated calls or your builds will no longer be supported', plus 'License classifiers are deprecated'. The due date is hard-coded (setuptools/config/_apply_pyprojecttoml.py due_date=(2027, 2, 18)); in 84.0.0 a passed due date raises only when SETUPTOOLS_ENFORCE_DEPRECATION is set, otherwise it warns 'overdue', so the actual break arrives with a later setuptools release that removes the table form. setuptools v77.0.0 introduced both deprecations; PEP 639 (Final) deprecates the table subkeys and licence classifiers; the PyPA guide (updated 2026-09-22) calls the table format deprecated.

Impact. Builds succeed today with warnings. The build floor has no upper bound, so isolated builds always take the newest setuptools; a release after the removal would fail python -m build in publish.yml. Fix cost is two lines.

Recommendation. Use license = "Apache-2.0" plus license-files = ["LICENSE"] (setuptools >= 77, inside the >= 83 floor) and drop the License classifier; publish.yml already runs twine check.

Sources.

• setuptools NEWS (v77.0.0: project.license table and licence classifiers deprecated) (2026-08-08)
• PEP 639 (Final): deprecate license key table subkeys and license classifiers (2025-01-24 (last modified))
• PyPA guide: Writing your pyproject.toml (license table format deprecated) (2026-09-22 (last updated))
• PyPI setuptools (83.0.0 2026-07-04; 84.0.0 2026-08-08) (2026-08-08)

Acceptance criteria

• A regression test reproduces the failure scenario and asserts the corrected behaviour.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}