feat!: remove session/sandbox support, require hotdata >=0.9 - #43
Conversation
connect() and the hotdata:// URL no longer accept session_id, the --session example flag and HOTDATA_SESSION_ID are gone, and no X-Session-Id header is sent. Forced by the SDK. hotdata 0.9.0 removes the SessionId security scheme, so Configuration(session_id=...) raises TypeError rather than being ignored, and http.py passed it unconditionally -- every connection would have failed. Proven by sabotage: reviving it from the environment (no signature change at all) takes the suite to 37 failed / 72 passed, because the client cannot even construct. WHY THIS PACKAGE IS ON THE CRITICAL PATH. Its hotdata cap was <0.9, and hotdata-dlt-destination pulls it in through its [ibis] extra -- so this cap was what stopped the destination adopting hotdata 0.9 and hotdata-framework 0.12, which in turn blocked dlthubworker from using the SDK's new table-layout API instead of hand-built HTTP. Four repos deep, and this is the bottom of it. The X-Session-Id test is inverted rather than deleted: it now asserts the header is ABSENT, at the HTTP layer, because that is the only place a revival shows up. It also asserts connect(session_id=...) raises, which is what catches a signature revival -- sabotaged both directions. Test fixtures gained partition_by / sorted_by on every TableInfo dict. 0.9.0 makes both required, so a listing response omitting them fails validation for the whole information_schema call rather than for that field. Nine tests failed on exactly this before the fixtures were updated -- the same total-rather-than-partial failure mode flagged in review of sdk-python#160. 109 passed.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Removal is complete and consistent: no session_id left in backend.py, http.py, examples/_helpers.py, or the README, and the dependency floor plus uv.lock match. The inverted X-Session-Id test asserting absence at the HTTP layer plus the TypeError signature check is the right pair of assertions for this removal.
Two non-blocking comments inline. Note that the Python test matrix was still pending when this review ran, so I have not seen the suite result myself.
The changelog claimed the hotdata:// URL "no longer accepts" session_id. Verified otherwise: _from_url builds its arguments from named lookups and discards whatever else is in the query string, so session_id there is IGNORED, not rejected -- an existing URL still connects, minus the header. Only the keyword argument raises. Now says so, and says the asymmetry is deliberate. The fixture explanation was pasted verbatim above all seven TableInfo dicts. Replaced with a spread constant so the reason is stated once and the next required field is a one-line change rather than seven. Kept as a spread rather than a full helper because the seven literals differ in which other keys they set, and rewriting them risked changing what each fixture means. 109 passed.
There was a problem hiding this comment.
Both prior nits addressed — CHANGELOG now states the URL-ignores / keyword-raises asymmetry, and _REQUIRED_TABLE_FIELDS removes the repeated comment blocks without retrofitting a helper over fixtures that differ. No remaining session_id plumbing outside the test asserting its absence.
Note: the Python 3.10–3.14 test jobs were still queued/in progress when this review ran, so I have not seen their results.
1 participant
connect() and the hotdata:// URL no longer accept session_id, the --session
example flag and HOTDATA_SESSION_ID are gone, and no X-Session-Id header is sent.
Forced by the SDK. hotdata 0.9.0 removes the SessionId security scheme, so
Configuration(session_id=...) raises TypeError rather than being ignored, and
http.py passed it unconditionally -- every connection would have failed. Proven
by sabotage: reviving it from the environment (no signature change at all) takes
the suite to 37 failed / 72 passed, because the client cannot even construct.
WHY THIS PACKAGE IS ON THE CRITICAL PATH. Its hotdata cap was <0.9, and
hotdata-dlt-destination pulls it in through its [ibis] extra -- so this cap was
what stopped the destination adopting hotdata 0.9 and hotdata-framework 0.12,
which in turn blocked dlthubworker from using the SDK's new table-layout API
instead of hand-built HTTP. Four repos deep, and this is the bottom of it.
The X-Session-Id test is inverted rather than deleted: it now asserts the header
is ABSENT, at the HTTP layer, because that is the only place a revival shows up.
It also asserts connect(session_id=...) raises, which is what catches a signature
revival -- sabotaged both directions.
Test fixtures gained partition_by / sorted_by on every TableInfo dict. 0.9.0
makes both required, so a listing response omitting them fails validation for the
whole information_schema call rather than for that field. Nine tests failed on
exactly this before the fixtures were updated -- the same total-rather-than-partial
failure mode flagged in review of sdk-python#160.
109 passed.
Why now
This package's
hotdata<0.9cap is the bottom of a four-repo chain:hotdata0.9.0 andhotdata-framework0.12.0 are both published; this is what unblocks consuming them.Verification