DLPX-99537 dependency-bump: batch update 6 dependencies (consolidates 10 PRs)

[delphix-devops-bot]

Auto-generated by dependency-bump. Tracked in DLPX-99537.

⚠ This batch includes dependencies above LOW risk. They are still bundled into this single PR (per-dep breakdown below) rather than split out — review the flagged entries before approving.

TL;DR

Consolidates 10 open Dependabot PRs into one batch covering 6 distinct dependencies (policy: latest-stable). Build passed clean on the first attempt (no fix-and-retry needed) across all 5 Python modules plus the docs mkdocs --strict build. Batch risk is HIGH because two dependencies crossed a major version under latest-stable: pyflakes (3→4), one of the 6 named dependencies, and pymdown-extensions (11→12.1), a transitive package swept into docs/Pipfile.lock by the urllib3 lock refresh with no source PR of its own — see its dedicated entry below. No exploitable CVEs were found in production code anywhere in the batch.

Edit 2026-10-07 (reconcile pass): added the pymdown-extensions entry below in response to automated review feedback flagging that this major-version crossing wasn't originally assessed — see PR discussion.

Edit 2026-10-07 (reconcile pass): pyflakes re-resolved from 4.0.2 to 4.0.3 — a newer latest-stable release was published on PyPI after this batch was first opened. Still within the same major version (4.x), so this does not change the batch's risk tier or the reason it's HIGH.

Batch risk tier: HIGH

⚠ Manual review required — see the per-dependency breakdown below for which entries are not LOW risk. Two independent major-version crossings drive this tier: pyflakes (3→4) and pymdown-extensions (11→12).

Dependencies in this batch (6)

Dependency	From → To	Risk	CVEs	Breaking changes
pyparsing	3.3.2 → 3.3.3	LOW	0	0
pyflakes	3.4.0 → 4.0.3	HIGH	0	0 called
pycodestyle	2.14.0 → 2.15.0	LOW	0	unknown (no source repo)
flake8	7.3.0 → 7.4.1	LOW	0	0
coverage	7.16.0 → 7.16.2	LOW	0	0
urllib3	2.7.0 → 2.8.0	LOW	3 (0 called)	0

pyparsing: 3.3.2 → 3.3.3 — risk: LOW

Manifests affected:

• common/pyproject.toml
• libs/pyproject.toml
• platform/pyproject.toml
• tools/pyproject.toml
• dvp/pyproject.toml

CVE findings (0 in this version range): No CVE-tagged commits between 3.3.2 and 3.3.3.

Commit breakdown (3 commits): 0 security, 0 bug fixes, 0 features, 0 breaking, 3 refactor/test/build (internal recursion rework, CI test additions, packaging metadata).

Transitive dev dependency (pulled in by packaging/pytest tooling) — not imported directly anywhere in this repo.

pyflakes: 3.4.0 → 4.0.3 — risk: HIGH

Manifests affected:

• tools/pyproject.toml

CVE findings (0 in this version range): No CVE-tagged commits between 3.4.0 and 4.0.3.

Commit breakdown (46 commits): 0 security, ~6 bug fixes, ~8 features (new lazy-import error classes, typing specializations), 1 breaking (dropped Python <3.9 fallback — not applicable, this repo targets 3.11 only), ~31 refactor/test/docs/release commits.

Your usage: not imported directly — invoked only as a flake8 plugin (see flake8 entry below, which this batch bumps in lockstep and whose upstream history shows explicit pyflakes-4.x compatibility fixes). ✅ NOT CALLED directly.

Version note: source PR (#712) proposed pyflakes 4.0.1. dependency-bump originally resolved to 4.0.2 (policy: latest-stable), then re-resolved to 4.0.3 on a reconcile pass once that newer release appeared on PyPI — bringing the repo to current rather than partially upgraded.

Why HIGH: this resolution crosses a major version (3→4), which forces HIGH under this repo's latest-stable policy regardless of the (clean) build and CVE results — flagged for human review of the major-version jump itself, not because of any known exploit.

pycodestyle: 2.14.0 → 2.15.0 — risk: LOW

Manifests affected:

• tools/pyproject.toml

CVE findings: unknown — this dependency's PyPI metadata has no project_urls/home_page GitHub link, so upstream commit history and CVE lookup could not be attempted. No CVE was found via the version-range check regardless.

Your usage: not imported directly — invoked only as a flake8 plugin. ✅ NOT CALLED directly.

flake8: 7.3.0 → 7.4.1 — risk: LOW

Note: this dependency has two affected lines in the same manifest — an exact dev-extra pin (== 7.3.0 → == 7.4.1) and a main-dependencies range ceiling (>= 7.3, < 7.4 → >= 7.3, < 7.5, matching the source PR's own proposed range, which already admits the resolved 7.4.1).

Manifests affected:

• tools/pyproject.toml

CVE findings (0 in this version range): No CVE-tagged commits between 7.3.0 and 7.4.1.

Commit breakdown (49 commits): 0 security, ~3 bug fixes (including explicit "fix pyflakes 4.x --builtins integration" and "update to latest pyflakes" — upstream's own adaptation to the pyflakes major bump in this same batch), ~2 features (py3.10+ support, F842 docs), 0 breaking, ~44 refactor/CI/pre-commit-bot maintenance commits.

Your usage: 🔴 CALLED — tools/src/main/python/dlpx/virtualization/_internal/plugin_validator.py:13 imports flake8.api.legacy and calls get_style_guide(select=["F821"]). This is the one dependency in the batch with a real call site; the post-change build's tools test suite (test_plugin_validator.py) exercises this exact code path and passed cleanly, which is empirical evidence this transition — including the coupled pyflakes major bump — doesn't break it.

coverage: 7.16.0 → 7.16.2 — risk: LOW

Manifests affected:

• tools/pyproject.toml

CVE findings (0 in this version range): No CVE-tagged commits between 7.16.0 and 7.16.2.

Commit breakdown (31 commits): 0 security, ~7 bug fixes, ~1 feature, 0 breaking, ~23 refactor/test/docs/release commits.

Your usage: not imported directly — invoked only via coverage run in the build pipeline. ✅ NOT CALLED directly.

urllib3: 2.7.0 → 2.8.0 — risk: LOW

Note: transitive-only dependency — no direct line in docs/Pipfile, pinned only in docs/Pipfile.lock. No manifest text edit was made; docs/Pipfile.lock was refreshed via pipenv lock per this repo's ## Lock files config, which also moved several other transitive doc-tooling packages as an expected side effect of the re-resolve (see the freeze/lock diff).

Manifests affected:

• docs/Pipfile.lock

CVE findings (3 in this version range):

• GHSA-gh4c-6fx4-qh6g / CVE-2026-97688 (medium) — Chunked Deflate streaming can enter an infinite loop. Fixed in 2.8.0. Your usage: ✅ NOT CALLED in this repo.
• GHSA-vxq7-64xx-v4gw / CVE-2026-97689 (high) — HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory. Fixed in 2.8.0. Your usage: ✅ NOT CALLED in this repo.
• GHSA-8988-9cw3-xx77 / CVE-2026-97687 (high) — HTTPS proxy TLS configuration may be ignored or overridden. Fixed in 2.8.0. Your usage: ✅ NOT CALLED in this repo.
• Reasoning: rg found zero import urllib3/urllib3. references anywhere under common/, libs/, platform/, tools/, dvp/. It's pulled in transitively by the docs-only mkdocs/pipenv toolchain — not reachable from any plugin-facing or CLI code path.

Commit breakdown (69 commits): 0 security commits isolated by name, but 3 CVE fixes landed in this version range per GHSA (see above); remainder: ~15 bug fixes, ~10 features, 0 breaking, ~41 refactor/CI/docs commits.

pymdown-extensions (swept transitive, no source PR): 11.0.2 → 12.1 — risk: HIGH

Manifests affected:

• docs/Pipfile.lock

Note: like urllib3 above, no direct line in docs/Pipfile — mkdocs-material's own (unchanged) pin allows this version, and pipenv lock's re-resolve picked up the current resolver output when the lock was refreshed for urllib3. Unlike urllib3, this one crosses a major version (11→12), which was not called out in the original version of this PR body — added here in response to review feedback.

CVE findings (0 in this version range): 5 historical GHSA advisories exist for this package (ReDoS in caret/tilde/betterem/magiclink, path traversal in b64 and snippets), but all are fixed in versions <= 11.0.1 — before this batch's starting version (11.0.2). 0 new CVEs apply to the 11.0.2 → 12.1 range.

Commit breakdown (60 commits): notable changes include a rewrite of the betterem/tilde/caret/mark inline processors and a new bracketspan extension. This repo's docs/mkdocs.yml only enables pymdownx.highlight, pymdownx.inlinehilite, pymdownx.snippets, pymdownx.superfences, pymdownx.details, and pymdownx.tabbed — none of which are among the rewritten/new extensions above.

Your usage: ✅ configured extensions unaffected by the rewritten code paths per the commit scan above; empirically confirmed by both the baseline and post-change mkdocs build --clean --strict passing clean (same build evidence already reported for the batch as a whole in "Build verification" below).

Why HIGH: same rule as pyflakes — an unreviewed major-version crossing is HIGH under this repo's latest-stable policy regardless of a clean build/CVE result, whether or not a source PR proposed it. This doesn't change the batch's already-HIGH tier, but corrects the original TL;DR, which cited pyflakes as the sole reason.

Source PRs consolidated (10)

dependency-bump does not close these. Once this PR merges and dep versions match the manifests, the bot that opened each one is responsible for auto-closing it on its own next scan.

• Bump pyparsing from 3.3.2 to 3.3.3 in /dvp #710 — Bump pyparsing from 3.3.2 to 3.3.3 in /dvp
• Bump pyparsing from 3.3.2 to 3.3.3 in /platform #711 — Bump pyparsing from 3.3.2 to 3.3.3 in /platform
• Bump pyflakes from 3.4.0 to 4.0.1 in /tools #712 — Bump pyflakes from 3.4.0 to 4.0.1 in /tools
• Bump pyparsing from 3.3.2 to 3.3.3 in /common #713 — Bump pyparsing from 3.3.2 to 3.3.3 in /common
• Bump pyparsing from 3.3.2 to 3.3.3 in /tools #714 — Bump pyparsing from 3.3.2 to 3.3.3 in /tools
• Bump pycodestyle from 2.14.0 to 2.15.0 in /tools #715 — Bump pycodestyle from 2.14.0 to 2.15.0 in /tools
• Bump flake8 from 7.3.0 to 7.4.1 in /tools #716 — Bump flake8 from 7.3.0 to 7.4.1 in /tools
• Bump coverage from 7.16.0 to 7.16.2 in /tools #717 — Bump coverage from 7.16.0 to 7.16.2 in /tools
• Bump pyparsing from 3.3.2 to 3.3.3 in /libs #718 — Bump pyparsing from 3.3.2 to 3.3.3 in /libs
• Bump urllib3 from 2.7.0 to 2.8.0 in /docs #720 — Bump urllib3 from 2.7.0 to 2.8.0 in /docs

Build verification

Phase	Result	Summary
Baseline (pre-change)	✅ PASS	All 5 modules built; 768 tests passed (0 failed) across common/libs/platform/tools/dvp; flake8 clean; docs mkdocs build --clean --strict clean
Post-change	✅ PASS	Same — all 5 modules built; 768 tests passed, 1 skipped (0 failed); flake8 clean; docs mkdocs build --clean --strict clean
Post-change (reconcile, pyflakes re-resolved to 4.0.3)	✅ PASS	Re-verified after the drift bump — all 5 modules built; 387 passed, 1 skipped per tools (768 total across modules, 0 failed); flake8 clean; docs mkdocs build --clean --strict clean

Commands run (per .claude/dependency-bump.md), against all manifests touched by this batch (all 5 modules affected, so pass 2 is unscoped):

• sh bin/build_project.sh -b
• sh bin/build_project.sh -ctf
• cd docs && pipenv sync && pipenv run mkdocs build --clean --strict

Additional automations

Re-run on the reconcile pass that bumped pyflakes to 4.0.3, against the current HEAD.

• ✅ [sync] sh bin/build_project.sh -f — PASSED, clean across all 5 modules
• ✅ [sync] dvp init --root-dir . && dvp build --dev (end-to-end plugin build smoke check, run from an isolated temp dir) — PASSED, artifact.json produced (1 MB, well-formed Plugin artifact)
• ✅ [async] trigger_blackbox.sh ... virtualization_sdk APPDATA_SDK_UBUNTU20_STAGED_CENTOS73 — triggered (not factored into risk tier)
  → Tracking URL: https://selfservice-jenkins.eng-tools-prd.aws.delphixcloud.com/job/blackbox-self-service/233476/
• ✅ [async] trigger_blackbox.sh ... appdata_basic APPDATA_PYTHON_STAGED_RHEL93 — triggered (not factored into risk tier)
  → Tracking URL: https://selfservice-jenkins.eng-tools-prd.aws.delphixcloud.com/job/blackbox-self-service/233477/

Installed package changes (pip freeze diff)

The diff below shows the full effect of this batch's pip-managed modules (common/libs/platform/tools/dvp venv) — no unexpected transitive drift, exactly the 5 explicit bumps pulled in via pip:

17c17
< coverage==7.16.0
---
> coverage==7.16.2
22c22
< flake8==7.3.0
---
> flake8==7.4.1
51,52c51,52
< pycodestyle==2.14.0
< pyflakes==3.4.0
---
> pycodestyle==2.15.0
> pyflakes==4.0.3
54c54
< pyparsing==3.3.2
---
> pyparsing==3.3.3

5 explicit + 0 unexpected transitive package version changes in the shared pip venv. urllib3's transition (2.7.0 → 2.8.0) is tracked separately via the docs/Pipfile.lock diff above, since it's pipenv-managed rather than part of the pip venv's own dependency graph; a handful of other docs-only transitive packages (charset-normalizer, idna, markdown, markupsafe, platformdirs, babel, ghp-import, jinja2, mergedeep, etc.) also moved as an expected side effect of the pipenv lock re-resolve. Of those, only pymdown-extensions (11.0.2 → 12.1) crossed a major version — see its dedicated entry above; the rest are patch/minor bumps.

---

Generated by dependency-bump · policy: latest-stable

[delphix-devops-bot]

@/tmp/new_status_comment.md

[Copilot]

Copilot review overview

🟡 Changes recommended

The lockfile includes an unassessed major pymdown-extensions upgrade that contradicts the stated dependency count and risk analysis.

Review effort: Balanced
Findings: None

What changed in this PR

Updates Python development, linting, and documentation dependencies across the SDK.

Changes:

• Updates pyparsing across all five Python modules.
• Updates Flake8, Pyflakes, Pycodestyle, and coverage tooling.
• Refreshes documentation dependencies, including urllib3 security fixes.

File	Description
common/​pyproject.toml	Updates pyparsing.
libs/​pyproject.toml	Updates pyparsing.
platform/​pyproject.toml	Updates pyparsing.
tools/​pyproject.toml	Updates linting, coverage, and parsing dependencies.
dvp/​pyproject.toml	Updates pyparsing.
docs/​Pipfile.lock	Refreshes documentation dependencies and hashes.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[delphix-devops-bot]

Addressing feedback from @copilot-pull-request-reviewer[bot]: you're right that pymdown-extensions' major-version jump (11.0.2 → 12.1, swept into docs/Pipfile.lock by the urllib3 lock refresh) was not individually assessed in the original PR body, even though it independently crosses a major version the same way pyflakes does.

Updated the PR description with a dedicated pymdown-extensions risk entry: 0 CVEs apply in this version range (5 historical advisories all fixed in ≤ 11.0.1, before this batch's starting version), and the only touched extensions upstream (betterem/tilde/caret/mark/bracketspan) are not among the ones this repo's docs/mkdocs.yml enables. The batch risk tier stays HIGH (unchanged) — it was already HIGH for pyflakes — but the stated reasoning now correctly reflects both major-version crossings instead of just one.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Two major-version upgrades require human review, and the reported blackbox validations remain pending.

Review effort: Balanced
Findings: None

[delphix-devops-bot]

Addressing feedback from @copilot-pull-request-reviewer[bot]:

• "Two major-version upgrades require human review" — both are already documented with a dedicated risk entry in the PR description: pyflakes (3→4) and pymdown-extensions (11→12.1, swept in transitively via the urllib3-triggered docs/Pipfile.lock refresh). Both are why this batch's risk tier is HIGH; no additional analysis beyond what's already in the "Batch risk tier" / per-dependency sections is pending on this point.
• "the reported blackbox validations remain pending" — accurate as of your review timestamp; both [async] blackbox triggers (virtualization_sdk, appdata_basic) were fired after this PR opened and are tracked via the Jenkins URLs already in the PR body's "Additional automations" section. Per this skill's design, async automation results are informational only and are never polled or factored into the risk tier — a human reviewer should check those tracking URLs directly before merging.

No code or manifest change results from this comment — it's a status clarification, not a requested edit.

[Copilot]

🔵 Needs a closer look

The Pyflakes and Pymdown Extensions major upgrades require human validation, and the triggered blackbox results are not reported.

0 open findings

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.