Hello! Please, revert the change, which unbundled setuptools deps, so tons of packages are now needed only to use very few lines from e.g. jaraco-text. These new packages are updating, even though they're deadweight, and not used by setuptools or anything else in the system. Also, more and more deps are added with every release. All of this increases chances that supply chain attack will happen. I'm pretty sure that upstream of setuptools is vendoring packages for the same reason.
The code is there either way, though. It's not adding the risk of any sort of attack if the code is being used to begin with. If anything, it makes things safer as we can actually diff releases, which is impossible with massive setuptools diffs where new versions get imported with no commit history.
