Verification

Is each requirement verified, by the method it calls for, on the build that matters? Every result below names the build it applies to. Parent requirements roll up their children: one failure fails the parent.

Latest main-branch build of each repository 0.28.1 · 2024-12-06 0.28.0 · 2024-11-28 8.5.0 · 2026-08-22 8.4.2 · 2026-06-24 8.4.1 · 2026-05-22 8.4.0 · 2026-05-16 v2.34.2 · 2026-05-14 v2.34.1 · 2026-05-13 v2.34.0 · 2026-05-11 v2.34.0.dev1 · 2026-05-03 v2.33.1 · 2026-03-30 v2.33.0 · 2026-03-25

FailedRe-verifyVerifiedVerified on older buildNot verified

Requirement	Method	Status	Criteria	Target build
SYS-01 v1 Third-party client libraries meet the platform dependency baseline	roll-up	Failed	2 requirements below	each child against its own build
SUB-CLI-01 v1 Command-line output library (click) meets the baseline	roll-up	Failed	3 requirements below	each child against its own build
REQ-CLICK-01 v2 Terminal output respects user configuration	test	Failed	3/4 on this build	#1049 2247b35ea1 pallets/click · 2026-10-04 · build failure · synthetic CI
REQ-CLICK-02 v1 Styled output degrades gracefully	test	Partially verified	4/5 on this build	#1049 2247b35ea1 pallets/click · 2026-10-04 · build failure · synthetic CI
REQ-CLICK-03 v1 Breaking changes are announced one minor release ahead	inspection	Partially verified	2/4 on this build	#1049 2247b35ea1 pallets/click · 2026-10-04 · build failure · synthetic CI
SUB-HTTP-01 v1 HTTP client libraries (requests, httpx) meet the baseline	roll-up	Failed	6 requirements below	each child against its own build
REQ-HTTPX-01 v2 TLS configuration has one obvious way	test	Needs re-verification 6 open re-verification items	0/6 on this build	#1047 b5addb64f0 encode/httpx · 2026-02-23 · synthetic CI
REQ-HTTPX-02 v1 URLs are encoded the way browsers encode them	test	Not verified	0/3 on this build	#1047 b5addb64f0 encode/httpx · 2026-02-23 · synthetic CI
REQ-HTTPX-03 v1 Secrets never appear in logs	inspection	Failed	0/1 on this build	#1047 b5addb64f0 encode/httpx · 2026-02-23 · synthetic CI
REQ-REQ-01 v1 Anything that behaves like a file is accepted	test	Partially verified	2/3 on this build	#1051 d38495c906 psf/requests · 2026-07-09 · synthetic CI
REQ-REQ-02 v3 Public type hints describe what callers may pass	analysis	Needs re-verification 3 open re-verification items	0/3 on this build	#1051 d38495c906 psf/requests · 2026-07-09 · synthetic CI
REQ-REQ-03 v1 Security-relevant code works under FIPS	demonstration	Partially verified	0/2 on this build	#1051 d38495c906 psf/requests · 2026-07-09 · synthetic CI

REQ-CLICK-01 · Terminal output respects user configuration Failed

Verified by test. Only test evidence counts; status is against build #1049.

Criterion	Status	Result applies to	Evidence
AC-CLICK-101-1 history When PAGER contains extra arguments (for example `less -R`), the temporary-file pager passes those arguments to the pager command instead of dropping them.	Verified	build #1049 2247b35ea1 2026-10-04	passed `test_pipepager_less_detection_matches_stem`tests/test_termui.py 7 invalidated results build #1042: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1043: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1044 (8.5.0): passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1045: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1046: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1047: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 and 1 earlier.
AC-CLICK-101-2 history Raw-mode detection treats only real `-R`/`-r` short-option clusters or `--raw-control-chars` as a raw-mode request, not filenames or option values that happen to contain the letter r.	Verified	build #1049 2247b35ea1 2026-10-04	passed `test_pipepager_less_raw_mode_detection`tests/test_termui.py 7 invalidated results build #1042: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1043: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1044 (8.5.0): passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1045: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1046: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1047: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 and 1 earlier.
AC-CLICK-101-3 history If an exception is raised while paging on Windows, the original exception is reported instead of a PermissionError from deleting the temporary file.	Failed	build #1049 2247b35ea1 2026-10-04	failed `test_tempfile_pager_closes_file_before_unlink`tests/test_termui.pyAssertionError: temp file still open at unlink: PermissionError: [WinError 32] The process cannot access the file because it is being used by another process 11 invalidated results build #1042: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1043: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1044 (8.5.0): passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1045: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1046: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1047: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 and 5 earlier.
AC-CLICK-103-4 history Writing a `str` to `get_pager_file()` works on Windows instead of raising TypeError.	Verified	build #1049 2247b35ea1 2026-10-04	passed `test_tempfile_pager_accepts_text`tests/test_termui.py 13 invalidated results build #1042: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1043: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1044 (8.5.0): passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1045: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1046: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 build #1047: passed · REQ-CLICK-01 changed to v2 on 2026-09-10 and 7 earlier.

REQ-CLICK-02 · Styled output degrades gracefully Partially verified

Verified by test. Only test evidence counts; status is against build #1049.

Criterion	Status	Result applies to	Evidence
AC-CLICK-102-1 history Help text wrapping measures line width in visible characters, so ANSI escape sequences don't count toward the width.	Verified	build #1049 2247b35ea1 2026-10-04	passed `test_wrap_text_visible_width`tests/test_formatting.py
AC-CLICK-102-2 history `confirm()` and `prompt()` remove colour codes from the prompt when the output stream doesn't support colour.	Verified	build #1049 2247b35ea1 2026-10-04	passed `test_prompt_and_confirm_ansi_respects_color`tests/test_termui.py
AC-CLICK-102-3 history `unstyle()` removes colon-delimited true-colour sequences such as `\x1b[38:2:255:0:0m`.	Verified	build #1049 2247b35ea1 2026-10-04	passed `test_strip_ansi_removes_full_sequence`tests/test_compat.py
AC-CLICK-102-4 history `style()` raises an error for an invalid colour name, and the error message lists the valid colour names.	Not verified	–	No test evidence recorded.
AC-CLICK-102-5 history Passing `fg=0` to `style()` produces the 256-colour code for black instead of being silently ignored.	Verified	build #1049 2247b35ea1 2026-10-04	passed `test_styling_invalid_color`tests/test_utils/test_style.py

REQ-CLICK-03 · Breaking changes are announced one minor release ahead Partially verified

Verified by inspection. Only inspection evidence counts; status is against build #1049.

Criterion	Status	Result applies to	Evidence
AC-CLICK-201-1 history Declaring a parameter whose name is not a valid Python identifier, or is a Python keyword, emits a DeprecationWarning.	Verified	build #1049 2247b35ea1 2026-10-04	Inspection passed, signed off by sofia-reyes on 2026-10-05 Upgrade guide lists the deprecation; a scratch project shows the DeprecationWarning for 'class' and '0foo'.
AC-CLICK-201-3 history `Parameter.human_readable_name` keeps working but emits a DeprecationWarning that points to `Parameter.spec`.	Verified	build #1049 2247b35ea1 2026-10-04	Inspection passed, signed off by sofia-reyes on 2026-10-05 human_readable_name still returns the spec and warns, pointing to Parameter.spec.
AC-CLICK-201-4 history A codemod script renames deprecated parameter names in user projects automatically.	Not verified	–	No inspection evidence recorded.
AC-CLICK-204-2 history `CliRunner.isolated_filesystem()` emits a DeprecationWarning, and the testing docs show the temporary-directory replacement.	Verified on older build	build #1028 cfa01eeb78 2026-07-20	Inspection passed, signed off by sofia-reyes on 2026-07-21 Testing docs show the tmp_path replacement; warning observed.

REQ-HTTPX-01 · TLS configuration has one obvious way Needs re-verification

Verified by test. Only test evidence counts; status is against build #1047.

Criterion	Status	Result applies to	Evidence
AC-HTTPX-101-1 history `verify` accepts `True`, `False` or an `ssl.SSLContext`, and the separate `ssl_context` parameter is removed.	Re-verify	–	Re-verify: requirement changed to v2 on 2025-01-10; no passing test since.
AC-HTTPX-101-2 history Passing a string to `verify` raises an error that tells the user to use `ssl.create_default_context(cafile=...)` instead.	Re-verify	–	Re-verify: requirement changed to v2 on 2025-01-10; no passing test since.
AC-HTTPX-101-3 history Passing a string to `verify` raises `TypeError`.	Re-verify	–	Re-verify: requirement changed to v2 on 2025-01-10; no passing test since.
AC-HTTPX-101-4 history Importing httpx does not import the `ssl` module until a client actually needs it.	Re-verify	–	Re-verify: requirement changed to v2 on 2025-01-10; no passing test since.
AC-HTTPX-101-5 history Using `verify=False` together with a client certificate (`cert=...`) still loads the certificate instead of ignoring it.	Re-verify	–	Re-verify: requirement changed to v2 on 2025-01-10; no passing test since.
AC-HTTPX-101-6 history The documentation describes the `SSL_CERT_FILE` and `SSL_CERT_DIR` environment variables.	Re-verify	–	Re-verify: requirement changed to v2 on 2025-01-10; no passing test since.

REQ-HTTPX-02 · URLs are encoded the way browsers encode them Not verified

Verified by test. Only test evidence counts; status is against build #1047.

Criterion	Status	Result applies to	Evidence
AC-HTTPX-201-1 history Query parameters encode spaces as `+` (form encoding).	Not verified	–	No test evidence recorded.
AC-HTTPX-201-2 history A `/` inside a query parameter value is percent-encoded as `%2F`.	Not verified	–	No test evidence recorded.
AC-HTTPX-201-3 history The behaviour change is called out in the CHANGELOG under backwards-incompatible changes.	Not verified	–	No test evidence recorded.

REQ-HTTPX-03 · Secrets never appear in logs Failed

Verified by inspection. Only inspection evidence counts; status is against build #1047.

Criterion	Status	Result applies to	Evidence
AC-HTTPX-102-3 history Proxy credentials (user and password in the proxy URL) are never written to log output.	Failed	build #1047 b5addb64f0 2026-02-23	Inspection failed, signed off by jamal-wright on 2026-02-24 The transport logs proxy.url at DEBUG, which includes user:password. Credentials are not masked.

REQ-REQ-01 · Anything that behaves like a file is accepted Partially verified

Verified by test. Only test evidence counts; status is against build #1051.

Criterion	Status	Result applies to	Evidence
AC-REQ-101-1 history Request bodies that wrap a file through `__getattr__` (without defining `__iter__` themselves) are streamed instead of rejected.	Verified	build #1051 d38495c906 2026-07-09	passed `test_getattr_proxy_stream_follows_redirect`tests/test_requests.py
AC-REQ-101-2 history Multipart uploads accept file objects that only expose `read` through `__getattr__`.	Verified	build #1051 d38495c906 2026-07-09	passed `test_post_getattr_proxy_read_only`tests/test_requests.py
AC-REQ-101-3 history All read-capability checks go through one helper function instead of repeated isinstance checks.	Not verified	–	No test evidence recorded.

REQ-REQ-02 · Public type hints describe what callers may pass Needs re-verification

Verified by analysis. Only analysis evidence counts; status is against build #1051.

Criterion	Status	Result applies to	Evidence
AC-REQ-201-1 history `Request.hooks` has a type annotation.	Re-verify	–	Re-verify: requirement changed to v3 on 2026-06-20; no passing analysis since. 1 invalidated result build #1046: passed · REQ-REQ-02 changed to v3 on 2026-06-20
AC-REQ-202-1 history `Request.headers` is typed as a read-only `Mapping[str, str \| bytes]`.	Re-verify	–	Re-verify: requirement changed to v3 on 2026-06-20; no passing analysis since. 1 invalidated result build #1046: passed · REQ-REQ-02 changed to v3 on 2026-06-20
AC-REQ-202-2 history `Response.reason` is typed as `str`.	Re-verify	–	Re-verify: requirement changed to v3 on 2026-06-20; no passing analysis since. 1 invalidated result build #1046: passed · REQ-REQ-02 changed to v3 on 2026-06-20

REQ-REQ-03 · Security-relevant code works under FIPS Partially verified

Verified by demonstration. Only demonstration evidence counts; status is against build #1051.

Criterion	Status	Result applies to	Evidence
AC-REQ-203-1 history DigestAuth works on FIPS-enabled systems by passing `usedforsecurity=False` to every hashlib call it makes.	Verified on older build	build #1036 (v2.34.0) 0b401c76b6 2026-05-11	Demonstration passed, signed off by jamal-wright on 2026-05-12 DigestAuth exchange completed on a FIPS-enabled host; no hashlib errors.
AC-REQ-203-3 history DigestAuth supports the SHA-512-256 algorithm.	Not verified	–	No demonstration evidence recorded.

Recent builds

Build	Repository	Commit	Result	Finished
#1049	pallets/click	2247b35ea1	failure	2026-10-04
#1048	pallets/click	06b2a67874	success	2026-09-23
#1047	pallets/click	6aabf099bf	success	2026-09-06
#1046	pallets/click	36baa15ff8	success	2026-08-27
#1045	pallets/click	68e7ea7228	success	2026-08-25
#1044 (8.5.0)	pallets/click	8b19813f2b	success	2026-08-22
#1043	pallets/click	2c8cd3ac95	success	2026-08-20
#1042	pallets/click	e1fd5946ab	success	2026-08-20
#1041	pallets/click	2103e15768	success	2026-08-19
#1040	pallets/click	61b69e967e	success	2026-08-18
#1039	pallets/click	f36d58bbd7	success	2026-08-18
#1038	pallets/click	cbd7a4109d	success	2026-08-16
#1037	pallets/click	fc5c7f45da	success	2026-08-16
#1036	pallets/click	150d1071d6	success	2026-08-15
#1035	pallets/click	8b44edfff7	success	2026-08-14
#1034	pallets/click	9c4dfdaebe	success	2026-08-09
#1033	pallets/click	00e592cea7	success	2026-07-24
#1032	pallets/click	5aa8ac4352	success	2026-07-23
#1031	pallets/click	42235de05e	success	2026-07-23
#1030	pallets/click	398f915431	success	2026-07-22
#1029	pallets/click	5e906a8afb	success	2026-07-22
#1028	pallets/click	cfa01eeb78	success	2026-07-20
#1027	pallets/click	333c28d79c	success	2026-07-17
#1026	pallets/click	7df2f82305	success	2026-07-17
#1025	pallets/click	b551fe8571	success	2026-07-16

In the offline demo the builds and test results are synthetic (git keeps no CI history) and flagged as such; release tags are real. A live sync reads GitHub Actions runs, and devtrack ingest-junit loads real test reports.

Data classification

Repository	Class	External models
encode/httpx Open-source dependency.	public	allowed
pallets/click Open-source dependency.	public	allowed
psf/requests Open-source dependency.	public	allowed

A repository with no classification is treated as controlled. Controlled code is only ever judged by an approved internal model.