[diskun00]

Fixes Dependabot alert #40 (oauthlib, HIGH: bearer token retrievable via device workflow with a valid client ID).

• Jira: AIP-1730
• oauthlib floor: >=4.0.0 → >=4.0.1 (patched version). No lockfile in this repo; Python range unchanged (>=3.10).
• Local: resolves with databricks-cli; pytest 6 passed, 2 skipped, 4 Spark tests need a local Java runtime (CI has one).

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review.

Summary

Risk Score: Low - Auto-merge Candidate

Raises the minimum oauthlib version from >=4.0.0 to >=4.0.1 in pyproject.toml. This patch upgrade addresses the reported security alert and reduces the risk of a bearer token being retrieved through the device workflow. No other files change.

The project’s minimum oauthlib dependency version changes from 4.0.0 to 4.0.1.

Assessment against linked issues:

Objective	Addressed	Explanation
Update the vulnerable oauthlib dependency AIP-1730	✅

Suggested labels: coderabbit-risk:low

Change: Other · Severity of issue fixed: High

Merge Risk: Minimal · up to 845e9

The dependency update addresses the reported advisory. No merge-blocking issue was identified.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central TS config (base), Organization UI (inherited); Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: b3e03324-260a-4256-b38d-b299ff5cbf22

Commits

Reviewing files that changed from the base of the PR and between cf72966 and 845e904.

Files selected for processing: 1

• pyproject.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.