cli: use importlib.metadata instead of pkg_resources

CHANGES.rst

@@ -35,6 +35,8 @@ Unreleased
     or ``AppContext.g`` instead. :issue:`3898`
 -   ``copy_current_request_context`` can decorate async functions.
     :pr:`4303`
+-   Replace the previously undocumented ``setuptools`` dependency in the CLI
+    with ``importlib.metadata``. :issue:`4419`
 
 
 Version 2.0.3

setup.py

@@ -8,6 +8,7 @@ setup(
         "Jinja2 >= 3.0",
         "itsdangerous >= 2.0",
         "click >= 8.0",
+        "importlib-metadata; python_version < '3.10'",
     ],
     extras_require={
         "async": ["asgiref >= 3.2"],

src/flask/cli.py

@@ -28,6 +28,16 @@ try:
 except ImportError:
     ssl = None  # type: ignore
 
+if sys.version_info >= (3, 10):
+    from importlib import metadata
+else:
+    # Use a backport on Python < 3.10.
+    #
+    # We technically have importlib.metadata on 3.8+,
+    # but the API changed in 3.10, so use the backport
+    # for consistency.
+    import importlib_metadata as metadata  # type: ignore
+
 
 class NoAppException(click.UsageError):
     """Raised if an application cannot be found or loaded."""
@@ -494,14 +504,10 @@ class FlaskGroup(AppGroup):
     def _load_plugin_commands(self):
         if self._loaded_plugin_commands:
             return
-        try:
-            import pkg_resources
-        except ImportError:
-            self._loaded_plugin_commands = True
-            return
 
-        for ep in pkg_resources.iter_entry_points("flask.commands"):
+        for ep in metadata.entry_points(group="flask.commands"):
             self.add_command(ep.load(), ep.name)
+
         self._loaded_plugin_commands = True
 
     def get_command(self, ctx, name):