[Bug] click version

[CarstenLeue]

Description

The version constraint on click is too tight.

trcli/setup.py

Line 19 in 89e75ed

"click>=8.1.0,<8.2.2", # Note: click version 8.2.2 is yanked as of Aug 2, 2025!

This gives rise to CVE-2026-7246
Recommendation is to upgrade to click 8.3.3 or higher, but with the constraint <8.2.2 this is not possible.

Steps to reproduce

Expected result

should be able to use the library without CVEs in the system

Actual result

CVE-2026-7246

Severity

S1 Critical — API down or data loss

Reproducibility

Always (100%)

Language and runtime versions

independent

Framework and library versions

independent

CI provider (if applicable)

None

OS and architecture

independent

Provide the command(s) used

-

Affected TestRail version

Affected CLI version

v1.15.1

Logs and diagnostics

CVE-2026-7246

Attachments

No response

Workaround

No response

Pre-submission checks

• I searched for existing issues and discussions
• I masked secrets and personal data