Release 1.0.0: remove support for Python 3.6, 3.7; fix linting errors by richdawe-cio · Pull Request #5 · customerio/cdp-analytics-python

richdawe-cio · 2026-06-17T12:32:26Z

Changes:

Remove support for Python 3.6 and 3.7. We need to use a version of requests later than 2.32.0, because there are important security fixes. requests changelog
Bump version to 1.0.0, since removing support for Python versions is a breaking change.
Fix pylint errors: missing __init__.py, import ordering, exception handling
- Add customerio/__init__.py so pylint can resolve the package hierarchy.
- Fix raise-missing-from, return-in-finally, and import ordering warnings.
- Fix RuntimeError formatting bug where %-placeholders were not interpolated.
Easier local dev experience using mise and venvs.
Split linting out of tests.
Fail CI on linting errors.

Note

Medium Risk
Breaking change for users on Python 3.6/3.7 and a major version bump; dependency floor changes install behavior, though application logic changes are small.

Overview
Major release 1.0.0 drops Python 3.6/3.7 (python_requires>=3.8) and raises requests to >=2.32.4 (and related pins) for security fixes. Version is bumped in .bumpversion.cfg and version.py.

CI and local dev are reworked: a dedicated Lint workflow runs make lint-ci; tests no longer run pylint/flake8. The test matrix covers 3.8–3.14 with fail-fast: false, and GitHub Actions use checkout/setup-python v6. mise (.mise.toml) and .venv in .gitignore support local workflows; Makefile adds lint, lint-ci, and clean.

Small runtime fixes: oversized-message RuntimeError in client.py uses correct formatting; consumer.py returns upload success outside finally; request.py chains ValueError when building APIError. README doc URLs are updated.

^{Reviewed by Cursor Bugbot for commit ddc5d6a. Bugbot is set up for automated code reviews on this repo. Configure here.}

socket-security · 2026-06-17T12:37:07Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/pylint@3.3.3
	pypi/mock@2.0.0
	pypi/flake8@3.7.9
	pypi/python-dateutil@2.8.2

View full report

socket-security · 2026-06-17T12:37:09Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		License policy violation: pypi `enum34` under BSD-3-Clause Location:Package overview From:`?` → `pypi/flake8@3.7.9` → `pypi/enum34@1.1.10` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/enum34@1.1.10`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `enum34` under BSD-3-Clause Location:Package overview From:`?` → `pypi/flake8@3.7.9` → `pypi/enum34@1.1.10` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/enum34@1.1.10`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `enum34` under BSD-3-Clause Location:Package overview From:`?` → `pypi/flake8@3.7.9` → `pypi/enum34@1.1.10` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/enum34@1.1.10`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `mock` Location:Package overview From:requirements.txt → `pypi/mock@2.0.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/mock@2.0.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `pylint` Location:Package overview From:requirements.txt → `pypi/pylint@3.3.3` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/pylint@3.3.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `pylint` Location:Package overview From:requirements.txt → `pypi/pylint@3.3.3` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/pylint@3.3.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `python-dateutil` under BSD-3-Clause Location:Package overview From:requirements.txt → `pypi/python-dateutil@2.8.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/python-dateutil@2.8.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `python-dateutil` under BSD-3-Clause Location:Package overview From:requirements.txt → `pypi/python-dateutil@2.8.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/python-dateutil@2.8.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

…ix on failure

jatinn · 2026-06-23T14:56:21Z

+ fail-fast: false
 matrix:
- python-version: [3.7, 3.8, 3.9]
+ python-version: [ "3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14" ]


seems like 3.8 & 3.9 are also eol https://endoflife.date/python should we remove those as well?

I think I would keep these for now, since they are still available in GitHub runners.

…quests requirement

cursor · 2026-06-25T09:11:13Z

-.PHONY: install test
+clean:
+	rm -rf .venv
+	mise deps


Clean target wrong mise command
Medium Severity
The new clean target removes .venv then runs mise deps, but this project’s .mise.toml only configures a Python venv and tasks—no mise deps providers. That command does not recreate the venv or reinstall pip install -e '.[test]', so make clean leaves local dev without the environment the PR documents.
^{Reviewed by Cursor Bugbot for commit c761e31. Configure here.}

mise deps does actually recreate the venv. That's why I included it in this make target.

cursor

Cursor Bugbot has reviewed your changes and found 2 potential issues.

There are 3 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7673d4e. Configure here.}

cursor · 2026-06-25T09:45:47Z

+	flake8 --max-complexity=10 --statistics --exit-zero customerio/analytics
+
+lint-ci:
+	pylint --rcfile=.pylintrc --exit-zero --fail-on=E customerio/analytics


Pylint CI never fails
Medium Severity
The new lint-ci target passes both --exit-zero and --fail-on=E to pylint. --exit-zero forces a zero exit status even when errors are reported, so the Lint workflow can pass while pylint reports E-level issues, undermining the split lint CI gate.
^{Reviewed by Cursor Bugbot for commit 7673d4e. Configure here.}

--fail-on=E seems to take precedence over --exit-zero, as seen in this failed lint run: https://github.com/customerio/cdp-analytics-python/actions/runs/28161429326/job/83402638737

cursor · 2026-06-25T09:45:47Z

-.PHONY: install test
+lint:
+	pylint --rcfile=.pylintrc --reports=y --exit-zero customerio/analytics
+	flake8 --max-complexity=10 --statistics --exit-zero customerio/analytics


Invalid flake8 exit-zero flag
Medium Severity
The local lint target adds --exit-zero to the flake8 command. Flake8 3.7.x does not define that option (unlike pylint), so flake8 typically exits with an unrecognized-argument error and make lint / mise run lint fails before reporting style issues.
^{Reviewed by Cursor Bugbot for commit 7673d4e. Configure here.}

Back in reality, this does not happen, and the command completes successfully with flake 3.7.9.

…ndling Add customerio/__init__.py so pylint can resolve the package hierarchy. Fix raise-missing-from, return-in-finally, and import ordering warnings. Fix RuntimeError formatting bug where %-placeholders were not interpolated. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

richdawe-cio · 2026-06-25T10:08:10Z

+
+[settings]
+python.uv_venv_auto = false
+python.venv_stdlib = true


Prefer using venv over uv, and ensure that pip is installed in the venv.

richdawe-cio added 3 commits June 17, 2026 11:07

mise venv for local development
b735d60

Test with more recent Python 3.x versions
aa04d43

Sync setup and test matrix Python versions
7edc159

richdawe-cio marked this pull request as draft June 17, 2026 12:32

cursorBot reviewed Jun 17, 2026
View reviewed changes

Comment thread.github/workflows/test.yml Outdated

Update GHA; quote Python versions in test matrix
01bff49

richdawe-cio added 12 commits June 17, 2026 13:42

Python 3.6 is not supported by newer setup-python action
e866deb

Downgrade setup-python, re-enable Python 3.6, and run whole test matr…
e068f47
…ix on failure

Split linting out from tests
880bd73

Remove Python 3.6, 3.7 from test matrix
d7873fe

Bump setup-python in lint too
c747ab1

Typo
c65edf8

Another typo
5a8da0c

Remove support for Python 3.6, 3.7
c6b8a3f

Latest doc URLs
1688eba

Bump version to 0.1.0
1fc2506

Synchronise setup.py and requirements.txt
9f4d991

Relax pylint
22b9a98

richdawe-cio changed the title ~~Cdp 6173~~Bump version to 0.1.0; modernize development environmentJun 22, 2026

richdawe-cio marked this pull request as ready for review June 22, 2026 13:23

jatinn approved these changes Jun 23, 2026
View reviewed changes

Bump version to 1.0.0; drop support for Python 3.6, 3.7 because of re…
c761e31
…quests requirement

cursorBot reviewed Jun 25, 2026
View reviewed changes

Bump version to 1.0.0
5b5a65b

cursorBot reviewed Jun 25, 2026
View reviewed changes

Comment threadsetup.py Outdated
Comment thread.github/workflows/lint.yml Outdated

richdawe-cio added 2 commits June 25, 2026 10:20

Review feedback
d5ded78

Add lint-ci which fails only on linting errors
7673d4e

richdawe-cio changed the title ~~Bump version to 0.1.0; modernize development environment~~Bump version to 1.0.0; modernize development environmentJun 25, 2026

cursorBot reviewed Jun 25, 2026
View reviewed changes

richdawe-cioand others added 2 commits June 25, 2026 10:58

Prefer using pip from venv to uv
de0ee97

richdawe-cio changed the title ~~Bump version to 1.0.0; modernize development environment~~Release 1.0.0: remove support for Python 3.6, 3.7; fix linting errorsJun 25, 2026

richdawe-cio commented Jun 25, 2026
View reviewed changes

richdawe-cio merged commit dccaa90 into mainJun 25, 2026
11 checks passed

richdawe-cio deleted the cdp-6173 branch June 25, 2026 10:23

Uh oh!

Conversation

richdawe-cio commented Jun 17, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

socket-securityBot commented Jun 17, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-securityBot commented Jun 17, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jatinnJun 23, 2026

Choose a reason for hiding this comment

Uh oh!

richdawe-cioJun 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursorBotJun 25, 2026

Choose a reason for hiding this comment

Clean target wrong mise command

Uh oh!

richdawe-cioJun 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cursorBot left a comment

Choose a reason for hiding this comment

Uh oh!

cursorBotJun 25, 2026

Choose a reason for hiding this comment

Pylint CI never fails

Uh oh!

richdawe-cioJun 25, 2026

Choose a reason for hiding this comment

Uh oh!

cursorBotJun 25, 2026

Choose a reason for hiding this comment

Invalid flake8 exit-zero flag

Uh oh!

richdawe-cioJun 25, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

richdawe-cioJun 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

richdawe-cio commented Jun 17, 2026•
edited
Loading

socket-securityBot commented Jun 17, 2026•
edited
Loading

socket-securityBot commented Jun 17, 2026•
edited
Loading

richdawe-cioJun 25, 2026•
edited
Loading