I don't know bazel, but presumably the simplest approach is to align the checked-in setuptools/pkg_resources with the version constraints of pex for the versions of pex allowed in the bazel rules