fix(hfs): upgrade Click security pin

Author: BlueSkyXN

.github/workflows/deploy-hf-space.yml

@@ -27,7 +27,7 @@ concurrency:
 
 env:
   HF_CLI_VERSION: "1.5.0"
-  HF_CLI_CLICK_VERSION: "8.3.1"
+  HF_CLI_CLICK_VERSION: "8.3.3"
 
 jobs:
   deploy:

docs/source-walkthrough.md

@@ -465,7 +465,7 @@ scripts/sample-hf-bucket-storage.sh \
   --ops-url https://blueskyxn-librefs-hfs.hf.space/_ops
 ```
 
-脚本固定验证 `huggingface_hub==1.5.0` 与 `click==8.3.1`，然后调用：
+脚本固定验证 `huggingface_hub==1.5.0` 与 `click==8.3.3`，然后调用：
 
 - `HfApi().bucket_info("$bucket")`，生成只包含 bucket metadata 的结构化 JSON
 - `python3 -m huggingface_hub.cli.hf buckets list "$bucket" --recursive --format json`

scripts/sample-hf-bucket-storage.sh

@@ -3,7 +3,7 @@ set -Eeuo pipefail
 
 DEFAULT_BUCKET="BlueSkyXN/librefs-hfs-data"
 EXPECTED_HF_HUB_VERSION="1.5.0"
-EXPECTED_CLICK_VERSION="8.3.1"
+EXPECTED_CLICK_VERSION="8.3.3"
 BUCKET="${HF_BUCKET_ID:-$DEFAULT_BUCKET}"
 OPS_URL="${OPS_URL:-}"
 INTERVAL=0

scripts/validate-contract.sh

@@ -207,7 +207,7 @@ require_pattern scripts/smoke-s3-curl.sh 'Refusing to use bucket' 'S3 smoke test
 
 check "storage sampler script contract" test -f scripts/sample-hf-bucket-storage.sh
 require_pattern scripts/sample-hf-bucket-storage.sh '^EXPECTED_HF_HUB_VERSION="1\.5\.0"$' 'storage sampler must pin huggingface_hub 1.5.0'
-require_pattern scripts/sample-hf-bucket-storage.sh '^EXPECTED_CLICK_VERSION="8\.3\.1"$' 'storage sampler must pin the module CLI click runtime'
+require_pattern scripts/sample-hf-bucket-storage.sh '^EXPECTED_CLICK_VERSION="8\.3\.3"$' 'storage sampler must pin the module CLI click runtime'
 require_pattern scripts/sample-hf-bucket-storage.sh 'HfApi\(\)\.bucket_info\(sys\.argv\[1\]\)' 'storage sampler must use structured HfApi bucket accounting'
 require_pattern scripts/sample-hf-bucket-storage.sh 'python3 -m huggingface_hub\.cli\.hf buckets list' 'storage sampler must use the pinned module CLI for the visible tree'
 require_pattern scripts/sample-hf-bucket-storage.sh '"\$BUCKET" --recursive --format json' 'storage sampler must request recursive JSON visible-tree output'
@@ -257,7 +257,7 @@ require_pattern .github/workflows/deploy-hf-space.yml 'Refuse a Space repository
 require_pattern .github/workflows/deploy-hf-space.yml 'huggingface_hub\.cli\.hf download' 'workflow must read back the Space repository through the pinned module CLI'
 require_pattern .github/workflows/deploy-hf-space.yml 'huggingface_hub\.cli\.hf upload' 'workflow must upload the Space repository through the pinned module CLI'
 require_pattern .github/workflows/deploy-hf-space.yml 'HF_CLI_VERSION: "1\.5\.0"' 'workflow must pin huggingface_hub 1.5.0'
-require_pattern .github/workflows/deploy-hf-space.yml 'HF_CLI_CLICK_VERSION: "8\.3\.1"' 'workflow must pin the module CLI click runtime'
+require_pattern .github/workflows/deploy-hf-space.yml 'HF_CLI_CLICK_VERSION: "8\.3\.3"' 'workflow must pin the module CLI click runtime'
 require_pattern .github/workflows/deploy-hf-space.yml 'huggingface_hub==\$\{HF_CLI_VERSION\}' 'workflow must install the pinned huggingface_hub version'
 require_pattern .github/workflows/deploy-hf-space.yml 'click==\$\{HF_CLI_CLICK_VERSION\}' 'workflow must install the pinned click version'
 require_pattern .github/workflows/deploy-hf-space.yml 'get_space_variables' 'workflow must read Space Variables through HfApi because the pinned CLI has no Settings subcommands'