Bump dropbox from 11.36.2 to 12.0.2

[dependabot]

Bumps dropbox from 11.36.2 to 12.0.2.

Release notes

Sourced from dropbox's releases.

v12.0.2

Release Notes:

• Remove the pin for urllib3 (#507)

v12.0.1

Release Notes:

• Fix incorrect pin of requests (#505)

v12.0.0

Release Notes:

• Fixes to Restore CI (#492, #501)
• Fixes to doc generation (#500, #503)
• Manual Spec Update (#498)
• Stop providing a hardcoded CA bundle (#489, #499)

Commits

• b397049 12.0.2 release
• c5ea3f8 Remove the pin for urllib3 (#507)
• b474e21 Fix incorrect pin of requests (#505)
• 1d379b4 Further fixes to doc generation (#503)
• 52893f0 Fix doc generation and PyPI uploads by pinning to Python 3.7 (#500)
• 3173f6e Remove CI for Python 3.5 (#501)
• e2b0ca8 Prepare Release Notes for v12 (#499)
• 5c6809d Manual Spec Update (#498)
• 41e4b00 Stop providing a hardcoded CA bundle (#489)
• 75596da Restore CI, including Python 2.7 (#492)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

🔍 Dependency Analysis Summary

This PR upgrades the dropbox Python SDK by a full major version (11.36.2 → 12.0.2). The v12 release is primarily a maintenance/infrastructure release — the headline change is the removal of the SDK's bundled CA certificate, with no existing APIs removed. Overall risk is LOW.

📋 Detailed Changelog Review

dropbox (11.36.2 → 12.0.2)

• Changes:

  • v12.0.0: Removed the hardcoded CA bundle the SDK previously shipped with. SSL verification now delegates to requests' default mechanism (i.e. certifi and/or system certificates). The optional ca_certs parameter on the Dropbox client is still supported for custom pinning. The runtime dependency on pkg_resources/setuptools was removed as a side effect. An API spec update added 18 new team_log_generated struct types (ransomware restoration, encryption key management, backup features) and minor updates to files, check_api_v2_types, and team_policies; no existing routes were removed.
  • v12.0.1: Fixed an overly strict requests version pin that caused install conflicts.
  • v12.0.2: Removed the urllib3 version pin, resolving similar conflicts.

• Breaking Changes: None for CommCare HQ's usage. The CA bundle removal is the only structural change, and requests handles SSL transparently in standard environments.

• Migration Notes: None required. If CommCare HQ ever instantiates Dropbox(..., ca_certs=...) with a custom bundle, that path still works. No usage of that parameter was found in the codebase.

⚠️ Impact Assessment

• Breaking Changes Found: No — all APIs used by CommCare HQ are unchanged across this version range.

• Affected Files: The following files import from the dropbox package and were audited:

  • corehq/apps/dropbox/utils.py — Dropbox, CommitInfo, UploadSessionCursor, WriteMode, DropboxOAuth2Flow
  • corehq/apps/dropbox/tasks.py — Dropbox, RequestedVisibility, SharedLinkSettings
  • corehq/apps/dropbox/views.py — DropboxOAuth2Flow and OAuth exception classes
  • corehq/apps/dropbox/models.py — Dropbox, AuthError
  • corehq/apps/dropbox/decorators.py — get_dropbox_auth_flow wrapper
  • corehq/apps/dropbox/management/commands/upload_file_to_dropbox.py — upload_to_dropbox
  • corehq/ex-submodules/soil/util.py — references Dropbox URL only (no SDK import)

  All imports and method calls (files_upload_session_start, files_upload_session_append_v2, files_upload_session_finish, sharing_create_shared_link_with_settings, users_get_current_account, DropboxOAuth2Flow.start()/.finish()) exist unchanged in v12.

• Test Impact: No test changes needed. corehq/apps/dropbox/tests/test_dropbox_upload_helper.py patches _ensure_valid_token and won't be affected.

• Configuration Changes: None.

🛠️ Recommendations

• Action Required: None — this upgrade is a straightforward drop-in.
• Testing Focus: Smoke-test the Dropbox OAuth flow and a file upload in staging if a Dropbox-connected environment is available, since this is a major version bump. The functional change (CA bundle) is handled by requests/certifi, so it should be transparent.
• Follow-up Tasks: None.
• Merge Recommendation: APPROVE — no breaking changes, no API removals, and the dependency pin fixes in v12.0.1/12.0.2 are a net positive for future compatibility.

📚 Useful Links

• v12.0.0 release
• CA bundle removal PR #489
• API spec update PR #498

[millerdev]

Upgrade also done by #37669, so this PR will be automatically closed if that one gets merged.

[dependabot]

Looks like dropbox is up-to-date now, so this is no longer needed.