Bump datacontract-cli from 0.11.7 to 1.0.2

[dependabot]

Bumps datacontract-cli from 0.11.7 to 1.0.2.

Release notes

Sourced from datacontract-cli's releases.

v1.0.2

[1.0.2] - 2026-06-11

Added

• datacontract edit now accepts a URL: it asks to download a local copy and opens that in the editor, using the configured API key (e.g., ENTROPY_DATA_API_KEY) to fetch the file.
• BigQuery: added support for a separate billing/compute project via the DATACONTRACT_BIGQUERY_BILLING_PROJECT environment variable. When set, query jobs are submitted to (and billed against) the billing project while data is read from the project specified in the server config. This enables cross-project and cross-organisation validation without requiring bigquery.jobUser on the data project.

Fixed

• datacontract test no longer fails on Spark/Databricks tables containing columns of types ibis cannot represent, such as VariantType (#1296)
• The postgres and redshift extras now install psycopg[binary], whose wheels bundle the libpq client library. Previously, datacontract test against PostgreSQL/Redshift failed on machines without PostgreSQL client libraries installed (couldn't import psycopg: no pq wrapper available).

v1.0.1

[1.0.1] - 2026-06-10

Added

• Environment variables (e.g., credentials for datacontract test) are now also loaded from a .env file in the current working directory, walking up parent directories until one is found. Already-set environment variables take precedence over .env values, so exported variables and CI secrets keep working unchanged. (#1295)
• datacontract edit <file> opens a local data contract file in the Data Contract Editor (web UI). Starts a local web server (default port 4243, requires the api extra) that serves the editor, writes saves directly back to the file, and doubles as the editor's test runner: "Run test" in the editor executes the data contract tests locally via the server's own /test endpoint. The editor is bundled with the CLI and works offline; --editor-version loads a specific editor version from the CDN instead, --editor-assets-url a self-hosted build. If the file does not exist, the command offers to initialize a new data contract (same template as datacontract init). Saving gives feedback in the editor and on the console.

Fixed

• datacontract test no longer fails with Compilation rule for RegexSearch operation is not defined when a contract uses logicalTypeOptions.pattern (or pattern) against SQL Server. SQL Server has no native regex operator, so the ibis mssql backend cannot compile re_search; pattern checks now fall back to a PATINDEX(...) > 0 LIKE match, restoring the behaviour of the former soda-core engine. Patterns that use real regex syntax (anchors, quantifiers, groups, .) cannot be expressed as a T-SQL LIKE pattern and now raise a clear error instead of failing cryptically. (#1284)

v1.0.0

[1.0.0] - 2026-06-04

Breaking Changes

• Replaced the Soda Core quality/test engine with ibis. datacontract test now compiles schema and quality checks into ibis expressions (dialect-correct SQL per backend via sqlglot, local/remote files via DuckDB) instead of generating SodaCL. Install extras now pull ibis-framework[<backend>] instead of soda-core-*. Check semantics and pass/fail results are preserved for the supported sources (postgres, redshift, mysql, snowflake, bigquery, databricks, sqlserver, oracle, trino, athena, impala, kafka/dataframe via the ibis Spark backend, and local/S3/GCS/Azure files).
• Raw SodaCL custom quality checks (quality.type: custom with engine: soda) are no longer executed and now report a warning. Migrate them to quality.type: sql or a library metric (e.g. metric: rowCount).

Added

• Python 3.13 and 3.14 support (requires-python now allows 3.10–3.14). On 3.13/3.14 the Spark-backed extras resolve to PySpark 4.0 (Spark 3.5 has no 3.13+ build); the Kafka/Avro connector jars already adapt to the runtime Spark/Scala version. create_spark_session now pins PYSPARK_PYTHON/PYSPARK_DRIVER_PYTHON to the running interpreter so Spark's Python workers match the driver.
• datacontract test against Databricks now supports more authentication methods beyond the personal access token (DATACONTRACT_DATABRICKS_TOKEN): an OAuth service principal for machine-to-machine auth (DATACONTRACT_DATABRICKS_CLIENT_ID + DATACONTRACT_DATABRICKS_CLIENT_SECRET), a local config profile via the Databricks SDK unified auth (DATACONTRACT_DATABRICKS_PROFILE, also covers Azure CLI/MSI), and an explicit connector auth type (DATACONTRACT_DATABRICKS_AUTH_TYPE, e.g. databricks-oauth for the interactive browser flow).
• datacontract test now records structured diagnostics on each check explaining why it passed or failed: the metric, measured value, threshold, and (for "bad row" metrics) the total row count and failed fraction. invalid_count checks also report the validity rule they enforced (e.g. {"max_length": 20}, {"pattern": "^.+@.+$"}). The diagnostics surface in the JSON output and the JUnit failure text. This replaces the Soda-specific diagnostics payload that the ibis migration had left unpopulated.
• datacontract test now honors ODCS quality.unit: percent on the count-of-bad-rows library metrics (nullValues, missingValues, invalidValues). The threshold is then compared against the failed fraction (0–100) of the model row count instead of an absolute count, so e.g. metric: nullValues, unit: percent, mustBeLessThan: 5 passes when fewer than 5% of rows are null. Percent on metrics where a row fraction has no meaning (rowCount, duplicateValues) logs a warning and falls back to the absolute count. The measured percent is added to the check diagnostics.
• datacontract test now honors ODCS quality.severity: a non-blocking severity (info, warning, low, minor, trivial) downgrades a failing quality check to a warning instead of a failed, so it no longer fails the run. Any other severity (or none) still fails. The severity is recorded in the check diagnostics.
• datacontract test --include-failed-samples collects a small sample of the rows that failed each missing/invalid/duplicate check (off by default). Each sample is restricted to the contract's identifier columns (unique / primaryKey fields) plus the offending column; duplicate checks report the duplicated key values and their counts. Columns whose ODCS classification marks them sensitive (pii, personal, confidential, restricted, sensitive, secret) are omitted. Samples are capped at 5 rows per check and surface on Check.failed_samples in the JSON output and in the JUnit failure text. This is local-only and needs no Soda Cloud (soda-core itself collects failed-row samples only via Soda Cloud).

Changed

• MySQL is tested through DuckDB's mysql extension instead of ibis's native MySQL backend, so the mysql extra stays pure-pip (no mysqlclient C build / system MySQL client libraries required).
• Bumped DuckDB to the 1.5.x line (from 1.0.x) with the bundled duckdb-extension-* wheels (httpfs/aws/azure) pinned in lockstep. The 1.5.x extension wheels publish arm64 Linux builds, so air-gapped installs on arm64 Linux are now supported (the previous platform skip markers were removed).
• The Kafka/Avro Spark connector jars are now derived from the installed PySpark at runtime (Spark version + Scala binary version), so both PySpark 3.5.x (Scala 2.12) and 4.x (Scala 2.13) work. The kafka and databricks extras allow pyspark<5.0.
• import protobuf now uses the pure-Python proto-schema-parser instead of the protoc system binary. The protobuf extra no longer requires protoc (or the protobuf runtime), so .proto import works out of the box, including transitive imports across subdirectories.
• Container image is now based on Docker Hardened Images: signed, ships SBOM/VEX, and has tighter CVE patch SLAs than upstream Debian. Runs as nonroot (uid 65532) instead of root. pip / uv installs at build time are routed through Socket Firewall Free, which blocks malicious dependencies. (#1275, #1277)
• Container image now ships Eclipse Temurin JRE 17, so PySpark-backed engines (Kafka, Spark) actually run inside the image — previously they failed at SparkSession startup because the base image had no JVM. End users pulling datacontract/cli are unaffected by the build-side changes. (#1277)

Fixed

• DuckDB S3 secret creation no longer fails (Secret Validation Failure) on DuckDB ≥1.5: explicit KEY_ID/SECRET now use the default config provider instead of CREDENTIAL_CHAIN.
• import csv no longer fails with a DuckDB binder error on DuckDB ≥1.5 (the uniqueness probe now uses count(DISTINCT ...) via SQL).

Removed

• The soda-core runtime dependency and all soda-core-* install extras, plus the setuptools runtime shim they required. The sodacl export format (datacontract export sodacl) is unchanged and is now generated independently of any Soda runtime.
• The unused details field on test-result checks (Run.checks[].details). It was a Soda-era placeholder that was never populated; the new structured diagnostics field replaces it. The JUnit failure text no longer prints a Details: line.

... (truncated)

Changelog

Sourced from datacontract-cli's changelog.

[1.0.2] - 2026-06-11

Added

• datacontract edit now accepts a URL: it asks to download a local copy and opens that in the editor, using the configured API key (e.g., ENTROPY_DATA_API_KEY) to fetch the file.
• BigQuery: added support for a separate billing/compute project via the DATACONTRACT_BIGQUERY_BILLING_PROJECT environment variable. When set, query jobs are submitted to (and billed against) the billing project while data is read from the project specified in the server config. This enables cross-project and cross-organisation validation without requiring bigquery.jobUser on the data project.

Fixed

• datacontract test no longer fails on Spark/Databricks tables containing columns of types ibis cannot represent, such as VariantType (#1296)
• The postgres and redshift extras now install psycopg[binary], whose wheels bundle the libpq client library. Previously, datacontract test against PostgreSQL/Redshift failed on machines without PostgreSQL client libraries installed (couldn't import psycopg: no pq wrapper available).

[1.0.1] - 2026-06-10

Added

• Environment variables (e.g., credentials for datacontract test) are now also loaded from a .env file in the current working directory, walking up parent directories until one is found. Already-set environment variables take precedence over .env values, so exported variables and CI secrets keep working unchanged. (#1295)
• datacontract edit <file> opens a local data contract file in the Data Contract Editor (web UI). Starts a local web server (default port 4243, requires the api extra) that serves the editor, writes saves directly back to the file, and doubles as the editor's test runner: "Run test" in the editor executes the data contract tests locally via the server's own /test endpoint. The editor is bundled with the CLI and works offline; --editor-version loads a specific editor version from the CDN instead, --editor-assets-url a self-hosted build. If the file does not exist, the command offers to initialize a new data contract (same template as datacontract init). Saving gives feedback in the editor and on the console.

Fixed

• datacontract test no longer fails with Compilation rule for RegexSearch operation is not defined when a contract uses logicalTypeOptions.pattern (or pattern) against SQL Server. SQL Server has no native regex operator, so the ibis mssql backend cannot compile re_search; pattern checks now fall back to a PATINDEX(...) > 0 LIKE match, restoring the behaviour of the former soda-core engine. Patterns that use real regex syntax (anchors, quantifiers, groups, .) cannot be expressed as a T-SQL LIKE pattern and now raise a clear error instead of failing cryptically. (#1284)

[1.0.0] - 2026-06-04

Breaking Changes

• Replaced the Soda Core quality/test engine with ibis. datacontract test now compiles schema and quality checks into ibis expressions (dialect-correct SQL per backend via sqlglot, local/remote files via DuckDB) instead of generating SodaCL. Install extras now pull ibis-framework[<backend>] instead of soda-core-*. Check semantics and pass/fail results are preserved for the supported sources (postgres, redshift, mysql, snowflake, bigquery, databricks, sqlserver, oracle, trino, athena, impala, kafka/dataframe via the ibis Spark backend, and local/S3/GCS/Azure files).
• Raw SodaCL custom quality checks (quality.type: custom with engine: soda) are no longer executed and now report a warning. Migrate them to quality.type: sql or a library metric (e.g. metric: rowCount).

Added

• Python 3.13 and 3.14 support (requires-python now allows 3.10–3.14). On 3.13/3.14 the Spark-backed extras resolve to PySpark 4.0 (Spark 3.5 has no 3.13+ build); the Kafka/Avro connector jars already adapt to the runtime Spark/Scala version. create_spark_session now pins PYSPARK_PYTHON/PYSPARK_DRIVER_PYTHON to the running interpreter so Spark's Python workers match the driver.
• datacontract test against Databricks now supports more authentication methods beyond the personal access token (DATACONTRACT_DATABRICKS_TOKEN): an OAuth service principal for machine-to-machine auth (DATACONTRACT_DATABRICKS_CLIENT_ID + DATACONTRACT_DATABRICKS_CLIENT_SECRET), a local config profile via the Databricks SDK unified auth (DATACONTRACT_DATABRICKS_PROFILE, also covers Azure CLI/MSI), and an explicit connector auth type (DATACONTRACT_DATABRICKS_AUTH_TYPE, e.g. databricks-oauth for the interactive browser flow).
• datacontract test now records structured diagnostics on each check explaining why it passed or failed: the metric, measured value, threshold, and (for "bad row" metrics) the total row count and failed fraction. invalid_count checks also report the validity rule they enforced (e.g. {"max_length": 20}, {"pattern": "^.+@.+$"}). The diagnostics surface in the JSON output and the JUnit failure text. This replaces the Soda-specific diagnostics payload that the ibis migration had left unpopulated.
• datacontract test now honors ODCS quality.unit: percent on the count-of-bad-rows library metrics (nullValues, missingValues, invalidValues). The threshold is then compared against the failed fraction (0–100) of the model row count instead of an absolute count, so e.g. metric: nullValues, unit: percent, mustBeLessThan: 5 passes when fewer than 5% of rows are null. Percent on metrics where a row fraction has no meaning (rowCount, duplicateValues) logs a warning and falls back to the absolute count. The measured percent is added to the check diagnostics.
• datacontract test now honors ODCS quality.severity: a non-blocking severity (info, warning, low, minor, trivial) downgrades a failing quality check to a warning instead of a failed, so it no longer fails the run. Any other severity (or none) still fails. The severity is recorded in the check diagnostics.
• datacontract test --include-failed-samples collects a small sample of the rows that failed each missing/invalid/duplicate check (off by default). Each sample is restricted to the contract's identifier columns (unique / primaryKey fields) plus the offending column; duplicate checks report the duplicated key values and their counts. Columns whose ODCS classification marks them sensitive (pii, personal, confidential, restricted, sensitive, secret) are omitted. Samples are capped at 5 rows per check and surface on Check.failed_samples in the JSON output and in the JUnit failure text. This is local-only and needs no Soda Cloud (soda-core itself collects failed-row samples only via Soda Cloud).

Changed

• MySQL is tested through DuckDB's mysql extension instead of ibis's native MySQL backend, so the mysql extra stays pure-pip (no mysqlclient C build / system MySQL client libraries required).
• Bumped DuckDB to the 1.5.x line (from 1.0.x) with the bundled duckdb-extension-* wheels (httpfs/aws/azure) pinned in lockstep. The 1.5.x extension wheels publish arm64 Linux builds, so air-gapped installs on arm64 Linux are now supported (the previous platform skip markers were removed).
• The Kafka/Avro Spark connector jars are now derived from the installed PySpark at runtime (Spark version + Scala binary version), so both PySpark 3.5.x (Scala 2.12) and 4.x (Scala 2.13) work. The kafka and databricks extras allow pyspark<5.0.
• import protobuf now uses the pure-Python proto-schema-parser instead of the protoc system binary. The protobuf extra no longer requires protoc (or the protobuf runtime), so .proto import works out of the box, including transitive imports across subdirectories.
• Container image is now based on Docker Hardened Images: signed, ships SBOM/VEX, and has tighter CVE patch SLAs than upstream Debian. Runs as nonroot (uid 65532) instead of root. pip / uv installs at build time are routed through Socket Firewall Free, which blocks malicious dependencies. (#1275, #1277)
• Container image now ships Eclipse Temurin JRE 17, so PySpark-backed engines (Kafka, Spark) actually run inside the image — previously they failed at SparkSession startup because the base image had no JVM. End users pulling datacontract/cli are unaffected by the build-side changes. (#1277)

Fixed

• DuckDB S3 secret creation no longer fails (Secret Validation Failure) on DuckDB ≥1.5: explicit KEY_ID/SECRET now use the default config provider instead of CREDENTIAL_CHAIN.
• import csv no longer fails with a DuckDB binder error on DuckDB ≥1.5 (the uniqueness probe now uses count(DISTINCT ...) via SQL).

Removed

• The soda-core runtime dependency and all soda-core-* install extras, plus the setuptools runtime shim they required. The sodacl export format (datacontract export sodacl) is unchanged and is now generated independently of any Soda runtime.
• The unused details field on test-result checks (Run.checks[].details). It was a Soda-era placeholder that was never populated; the new structured diagnostics field replaces it. The JUnit failure text no longer prints a Details: line.

[0.12.5] - 2026-05-30

... (truncated)

Commits

• 1320687 release: 1.0.2
• 3a7e905 feat: datacontract edit accepts a URL and offers to download a local copy t...
• 4ef1f64 fix: bundle libpq via psycopg[binary] in the postgres and redshift extras (#1...
• d15cdd1 feat(bigquery): support separate billing project for cross-project validation...
• 14cd2ad fix: tolerate columns with types ibis cannot represent in test, e.g. VariantT...
• f18e5c7 docs: add changelog entry style guidance to AGENTS.md
• 002e534 Release v1.0.1
• d9e86eb feat: datacontract edit — open a local file in the Data Contract Editor (di...
• 7a3b863 feat: load environment variables from a .env file (#1295)
• ac1e5a3 fix: support logicalTypeOptions.pattern on SQL Server via PATINDEX (#1284) (#...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.02%. Comparing base (9980c98) to head (eeccd98).

❗ There is a different number of reports uploaded between BASE (9980c98) and HEAD (eeccd98). Click for more details.

HEAD has 14 uploads less than BASE

Flag	BASE (9980c98)	HEAD (eeccd98)
unit	3	1
anomaly	3	0
anomaly-serverless	3	0
integration-serverless	3	0
integration	3	0

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #1258       +/-   ##
===========================================
- Coverage   92.56%   57.02%   -35.55%     
===========================================
  Files         102      102               
  Lines       10075    10075               
===========================================
- Hits         9326     5745     -3581     
- Misses        749     4330     +3581     

Flag	Coverage Δ
anomaly	?
anomaly-serverless	?
integration	?
integration-serverless	?
unit	57.02% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.