You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Auto-generated by dependency-bump. Tracked in DLPX-99376.
🔧 A fix was applied. The post-change build initially failed; dependency-bump edited the consumer code to match a breaking upstream change (click 8.x) and the build now passes. See Fixes applied below — review it like any other code change in this PR.
⚠ This batch includes dependencies above LOW risk. They are still bundled into this single PR (per-dep breakdown below) rather than split out — review the flagged entries before approving.
TL;DR
Consolidates 2 open Dependabot PRs (#707, #708) into one batch, both in tools/pyproject.toml: click 7.1.2 → 8.5.0 and isort 8.0.1 → 9.0.2. Both cross a major version, which forces HIGH batch risk under this repo's latest-stable policy even though no CVEs were found for either. The click bump initially broke 6 tools tests (documented, intentional click 8.x behavior changes); dependency-bump fixed them in this same commit and the build is now green.
Batch risk tier: HIGH
⚠ Manual review required — see the per-dependency breakdown below for which entries are not LOW risk.
Dependencies in this batch (2)
Dependency
From → To
Risk
CVEs
Breaking changes
click
7.1.2 → 8.5.0
HIGH
0
3 (all fixed in this PR)
isort
8.0.1 → 9.0.2
HIGH
0
1 (not exploitable)
click: 7.1.2 → 8.5.0 — risk: HIGH
Why HIGH: crosses a major version (7 → 8) under the latest-stable policy — forced HIGH regardless of build/CVE results.
Manifests affected:
tools/pyproject.toml
CVE findings (0 in this version range):
No CVE-tagged commits between 7.1.2 and 8.5.0 (GHSA advisories query returned empty — no advisories_error).
Commit breakdown (1937 commits total between these tags; GitHub's compare API caps the returned list at 250, so the counts below are over that 250-commit sample, not the full 1937):
0 security/CVE fixes
57 bug fixes
45 features
14 breaking/removal-flavored commits (keyword-matched, not all individually reviewed given the truncated sample)
111 refactor / docs / tests / other
Breaking changes (need attention):
Given the compare API's 250-of-1937 truncation, breaking-change identification for this dependency relied on click's own documented 7→8 migration surface plus direct behavioral testing of the installed 7.1.2 vs 8.5.0 packages (not an exhaustive commit-by-commit review). Three confirmed behavioral differences actually affect this repo — all three broke tools tests and are fixed in this PR's diff:
Help-hint text now shows the long option form.click.exceptions.UsageError.show() now picks max(help_option_names, key=len) (i.e. --help) instead of the first-declared name (-h) when building "Try '<cmd> -h' for help." hints.
Your usage: 🔴 CALLED — tools/.../cli.py's CONTEXT_SETTINGS declares help_option_names=['-h', '--help']; 4 assertions in test_cli.py hardcoded the old -h wording. Fixed by updating those 4 assertions to --help.
Bare Group invocation now exits 2 instead of 0. Confirmed directly: a minimal @click.group() invoked with no subcommand returns exit_code=0 on click 7.1.2 and exit_code=2 on click 8.5.0 (click now treats "no subcommand given" as a usage error).
Your usage: 🔴 CALLED — test_cli.py::test_default_verbosity invoked cli.delphix_sdk bare and asserted exit_code == 0. Fixed by updating the assertion to exit_code == 2. Note for reviewers: this also means a bare dvp invocation (no args) from a script now returns a non-zero exit code where it used to return 0 — worth a mention in release notes if any external tooling depends on that.
Fixed by updating the assertion to exit_code == 2.
click.Path(resolve_path=True) no longer rejects an empty string. Confirmed directly: click.Path(exists=True, writable=True, resolve_path=True).convert('') raises BadParameter: Directory '' is not writable. on click 7.1.2, but on click 8.5.0 it resolves '' to os.path.realpath('') (the cwd) before running the writable/exists checks, so an empty value silently passes as "the current directory" instead of failing.
Your usage: 🔴 CALLED — dvp init -r '' (the -r/--root-dir option in cli.py) relied on this rejection; test_cli.py::test_empty_root_dir caught the regression (empty root-dir was silently accepted as cwd instead of erroring). Fixed by adding a NonEmptyPath wrapper (click_util.py) that explicitly rejects '' before delegating to click.Path.convert(), restoring the original validation behavior.
Changed: click.types.Path.convert
isort: 8.0.1 → 9.0.2 — risk: HIGH
Why HIGH: crosses a major version (8 → 9) under the latest-stable policy — forced HIGH regardless of build/CVE results.
Manifests affected:
tools/pyproject.toml (dev extra)
CVE findings (0 in this version range):
No CVE-tagged commits between 8.0.1 and 9.0.2 (GHSA advisories query returned empty — no advisories_error).
Commit breakdown (351 commits total between these tags; compare API returned 250 of them):
1 commit mentioning "security" (in quotes) — see below, not a real security fix
a53fecb — Remove references to defunct git_ignore config option (isort dropped a previously-deprecated config key)
Changed: isort's Config settings parsing
Your usage: ✅ NOT CALLED — this repo has no .isort.cfg and no [tool.isort] section anywhere (isort is only declared as a tools dev-extra, invoked via its default CLI behavior in lint tooling, never configured or imported programmatically), so the removed option was never in use.
4371472 — "Fix a "security" issue" — inspected the diff directly: it only adds a # nosec bandit-suppression comment next to an existing assert, no behavior change. Not a real vulnerability fix, not exploitable, not relevant to this repo either way.
Version note: source PR #708 proposed isort 9.0.1. dependency-bump resolved to 9.0.2 (policy: latest-stable) — bringing the repo to current rather than partially upgraded.
Source PRs consolidated (2)
dependency-bump does not close these. Once this PR merges and dep versions match the manifests, the bot that opened each one is responsible for auto-closing it on its own next scan.
Commands run (per .claude/dependency-bump.md), against all manifests touched by this batch (only tools affected):
sh bin/build_project.sh -b (pass 1, unscoped — builds all 5 modules)
sh bin/build_project.sh -ctf -m tools (pass 2, coverage-instrumented tests + flake8, scoped to tools)
Fix attempts
The post-change build initially failed (6 tools test failures). Isolated to: click (by code inspection — isort is only a dev/lint CLI tool with no import or config surface anywhere in this repo, so it cannot affect test_cli.py's CLI-parsing assertions; all 6 failures are explained by click 8.x's documented behavior changes above).
Attempt 1: Updated 4 test_cli.py assertions expecting click 7.x's -h help hint to expect click 8.x's --help; updated test_default_verbosity to expect exit code 2 for a bare dvp invocation (click 8.1+ treats a Group with no subcommand as a usage error); added a NonEmptyPath wrapper around click.Path in click_util.py (used by cli.py's -r/--root-dir option) to reject an empty string, restoring click 7.x's validation behavior that click 8.x's resolve_path=True silently dropped.
2 explicit + 1 transitive package version changes. (mypy_extensions is a new transitive dependency pulled in by this bump; it is not imported anywhere in this repo's source, so it's expected to be inert.)
Generated by dependency-bump · policy: latest-stable
This 2026 edit leaves the file header at Copyright (c) 2019. Repository convention requires modified source files to use the first and current years, so update line 2 to Copyright (c) 2019, 2026 by Delphix. All rights reserved.
This condition also matches invocations that contain global options but omit a subcommand. As the existing tests note, Click 7 rejected dvp -v and dvp -q unless help or a command was supplied; with invoke_without_command=True, both now print help and exit 0. Restrict the success path to a truly bare invocation (for example, fail when verbose or quiet is set) and add regression coverage for the option-only cases.
The reason will be displayed to describe this comment to others. Learn more.
Approving. Verified beyond the PR's own CI results:
Built tools from this branch in a clean 3.11 venv (click 8.5.0, isort 9.0.2 installed); bin/build_project.sh -ctf -m tools → 387 passed, 1 skipped, flake8 clean.
dvp init + dvp build --dev → produced a valid artifact.json with expected metadata.
Diffed CLI behavior against released dvp==5.2.0 (click 7.1.2) side-by-side: bare dvp, build -c <bad-file>, init -r '', download-logs -d '' — all preserve the original exit codes; only the
documented click 8.x help-hint wording (-h → --help) changed, as covered by the updated tests.
Confirmed click-configfile==0.2.3 still works against click 8.5.0 (used by ConfigFileProcessor).
One non-blocking note: making the group invoke_without_command=True means the Python-version check now runs even for a bare dvp invocation (previously short-circuited by click 7.x's no_args_is_help). Confirmed via monkeypatched sys.version_info that a bare invocation under a mismatched interpreter now raises instead of printing help+exit 0 — but requires-python blocks pip install on a mismatched interpreter in the first place, so this isn't reachable through the supported install/run path. No action needed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SumoSourabh
left a comment
TL;DR
Consolidates 2 open Dependabot PRs (#707, #708) into one batch, both in
tools/pyproject.toml:click7.1.2 → 8.5.0 andisort8.0.1 → 9.0.2. Both cross a major version, which forces HIGH batch risk under this repo'slatest-stablepolicy even though no CVEs were found for either. The click bump initially broke 6toolstests (documented, intentional click 8.x behavior changes); dependency-bump fixed them in this same commit and the build is now green.Batch risk tier: HIGH
⚠ Manual review required — see the per-dependency breakdown below for which entries are not LOW risk.
Dependencies in this batch (2)
click7.1.2→8.5.0isort8.0.1→9.0.2click:7.1.2→8.5.0— risk: HIGHWhy HIGH: crosses a major version (7 → 8) under the
latest-stablepolicy — forced HIGH regardless of build/CVE results.Manifests affected:
tools/pyproject.tomlCVE findings (0 in this version range):
No CVE-tagged commits between
7.1.2and8.5.0(GHSA advisories query returned empty — noadvisories_error).Commit breakdown (1937 commits total between these tags; GitHub's compare API caps the returned list at 250, so the counts below are over that 250-commit sample, not the full 1937):
Breaking changes (need attention):
Given the compare API's 250-of-1937 truncation, breaking-change identification for this dependency relied on click's own documented 7→8 migration surface plus direct behavioral testing of the installed 7.1.2 vs 8.5.0 packages (not an exhaustive commit-by-commit review). Three confirmed behavioral differences actually affect this repo — all three broke
toolstests and are fixed in this PR's diff:click.exceptions.UsageError.show()now picksmax(help_option_names, key=len)(i.e.--help) instead of the first-declared name (-h) when building "Try '<cmd> -h' for help." hints.tools/.../cli.py'sCONTEXT_SETTINGSdeclareshelp_option_names=['-h', '--help']; 4 assertions intest_cli.pyhardcoded the old-hwording. Fixed by updating those 4 assertions to--help.Groupinvocation now exits 2 instead of 0. Confirmed directly: a minimal@click.group()invoked with no subcommand returnsexit_code=0on click 7.1.2 andexit_code=2on click 8.5.0 (click now treats "no subcommand given" as a usage error).test_cli.py::test_default_verbosityinvokedcli.delphix_sdkbare and assertedexit_code == 0. Fixed by updating the assertion toexit_code == 2. Note for reviewers: this also means a baredvpinvocation (no args) from a script now returns a non-zero exit code where it used to return 0 — worth a mention in release notes if any external tooling depends on that.exit_code == 2.click.Group.parse_argsno-args-is-help handlingclick.Path(resolve_path=True)no longer rejects an empty string. Confirmed directly:click.Path(exists=True, writable=True, resolve_path=True).convert('')raisesBadParameter: Directory '' is not writable.on click 7.1.2, but on click 8.5.0 it resolves''toos.path.realpath('')(the cwd) before running the writable/exists checks, so an empty value silently passes as "the current directory" instead of failing.dvp init -r ''(the-r/--root-diroption incli.py) relied on this rejection;test_cli.py::test_empty_root_dircaught the regression (empty root-dir was silently accepted as cwd instead of erroring). Fixed by adding aNonEmptyPathwrapper (click_util.py) that explicitly rejects''before delegating toclick.Path.convert(), restoring the original validation behavior.click.types.Path.convertisort:8.0.1→9.0.2— risk: HIGHWhy HIGH: crosses a major version (8 → 9) under the
latest-stablepolicy — forced HIGH regardless of build/CVE results.Manifests affected:
tools/pyproject.toml(dev extra)CVE findings (0 in this version range):
No CVE-tagged commits between
8.0.1and9.0.2(GHSA advisories query returned empty — noadvisories_error).Commit breakdown (351 commits total between these tags; compare API returned 250 of them):
Breaking changes (need attention):
a53fecb— Remove references to defunctgit_ignoreconfig option (isort dropped a previously-deprecated config key)Configsettings parsing.isort.cfgand no[tool.isort]section anywhere (isortis only declared as atoolsdev-extra, invoked via its default CLI behavior in lint tooling, never configured or imported programmatically), so the removed option was never in use.4371472— "Fix a "security" issue" — inspected the diff directly: it only adds a# nosecbandit-suppression comment next to an existingassert, no behavior change. Not a real vulnerability fix, not exploitable, not relevant to this repo either way.Version note: source PR #708 proposed
isort 9.0.1. dependency-bump resolved to9.0.2(policy:latest-stable) — bringing the repo to current rather than partially upgraded.Source PRs consolidated (2)
dependency-bump does not close these. Once this PR merges and dep versions match the manifests, the bot that opened each one is responsible for auto-closing it on its own next scan.
Build verification
tools: 386 passed, 1 skipped; flake8 cleantools: 386 passed, 1 skipped; flake8 cleanCommands run (per
.claude/dependency-bump.md), against all manifests touched by this batch (onlytoolsaffected):sh bin/build_project.sh -b(pass 1, unscoped — builds all 5 modules)sh bin/build_project.sh -ctf -m tools(pass 2, coverage-instrumented tests + flake8, scoped totools)Fix attempts
The post-change build initially failed (6
toolstest failures). Isolated to:click(by code inspection —isortis only a dev/lint CLI tool with no import or config surface anywhere in this repo, so it cannot affecttest_cli.py's CLI-parsing assertions; all 6 failures are explained by click 8.x's documented behavior changes above).Attempt 1: Updated 4
test_cli.pyassertions expecting click 7.x's-hhelp hint to expect click 8.x's--help; updatedtest_default_verbosityto expect exit code2for a baredvpinvocation (click 8.1+ treats aGroupwith no subcommand as a usage error); added aNonEmptyPathwrapper aroundclick.Pathinclick_util.py(used bycli.py's-r/--root-diroption) to reject an empty string, restoring click 7.x's validation behavior that click 8.x'sresolve_path=Truesilently dropped.tools/src/test/python/dlpx/virtualization/_internal/test_cli.py,tools/src/main/python/dlpx/virtualization/_internal/click_util.py,tools/src/main/python/dlpx/virtualization/_internal/cli.pyFinal result: fix succeeded on attempt 1. The change above is included in this PR's diff — review it alongside the dependency bump itself.
Additional automations
Run against the pushed batch branch, after this PR was opened — see the PR's edit history if you're reading this before they've landed.
sh bin/build_project.sh -f -m tools— flake8 clean, no issuesdvp init --root-dir . && dvp build --dev, verifyartifact.json— ran in an isolated temp directory;artifact.jsonproduced (1,036,464 bytes), valid JSON with expected plugin metadata (pluginId,buildApi,engineApi,sourceCode)trigger_blackbox.sh ... virtualization_sdk APPDATA_SDK_UBUNTU20_STAGED_CENTOS73— re-triggered on reconcile (commit2b1bf4a), SUCCESS, not factored into risk tier→ https://selfservice-jenkins.eng-tools-prd.aws.delphixcloud.com/job/blackbox-self-service/232987/
trigger_blackbox.sh ... appdata_basic APPDATA_PYTHON_STAGED_RHEL93— re-triggered on reconcile (commit2b1bf4a), SUCCESS, not factored into risk tier→ https://selfservice-jenkins.eng-tools-prd.aws.delphixcloud.com/job/blackbox-self-service/232988/
Installed package changes (
pip freezediff)The diff below shows the full effect of this batch — including transitive deps that updated as a side effect.
2 explicit + 1 transitive package version changes. (
mypy_extensionsis a new transitive dependency pulled in by this bump; it is not imported anywhere in this repo's source, so it's expected to be inert.)Generated by dependency-bump · policy:
latest-stable🤖 Generated with Claude Code