SBOM contains misleading reference to setuptools

Description

The SBOM file in src/pip/_vendor/bom.cdx.json contains a reference to [email protected] although the directory does not contain the setuptools package at all. (All the other packages mentioned in the SBOM file can be found in the directory.) This confuses vulnerability scanners like e.g. Trivy (https://github.com/aquasecurity/trivy) which report vulnerabilities for [email protected] although one is using an entirely different version of setuptools.

Expected behavior

Could you please remove the reference to setuptools from the SBOM file?

pip version

26.2.1

Python version

3.12.14

OS

any

How to Reproduce

Compare directories in https://github.com/pypa/pip/tree/26.2.1/src/pip/_vendor with bom.cdx.json

Output

No response

Code of Conduct

• I agree to follow the PSF Code of Conduct.