From c27d7f9a14a448b6e58b638ce249b372de1ec982 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 28 Jul 2026 08:30:21 +0000
Subject: [PATCH 1/8] chore(deps): bump pymdown-extensions from 10.21.3 to 11.0

Bumps [pymdown-extensions](https://github.com/facelessuser/pymdown-extensions) from 10.21.3 to 11.0.
- [Release notes](https://github.com/facelessuser/pymdown-extensions/releases)
- [Commits](https://github.com/facelessuser/pymdown-extensions/compare/10.21.3...11.0)

---
updated-dependencies:
- dependency-name: pymdown-extensions
  dependency-version: '11.0'
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 uv.lock | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/uv.lock b/uv.lock
index b535212..6aa6671 100644
--- a/uv.lock
+++ b/uv.lock
@@ -309,7 +309,7 @@ name = "exceptiongroup"
 version = "1.3.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "typing-extensions" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/50/79/66800aadf48771f6b62f7eb014e352e5d06856655206165d775e675a02c9/exceptiongroup-1.3.1.tar.gz", hash = "sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219", size = 30371, upload-time = "2025-11-21T23:01:54.787Z" }
 wheels = [
@@ -700,15 +700,15 @@ wheels = [
 
 [[package]]
 name = "pymdown-extensions"
-version = "10.21.3"
+version = "11.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "markdown" },
     { name = "pyyaml" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/9e/26/d1015444da4d952a1ca487a236b522eb979766f0295a0bd0c5fc089989a9/pymdown_extensions-10.21.3.tar.gz", hash = "sha256:72cfcf55f07aea0d4af2c4f11dd4e52466ddfb1bb819673146398e0bd3a77354", size = 854140, upload-time = "2026-05-13T12:57:32.267Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/47/67/f1e79672a5f91985577c7984c9709ca110e4fd37fe7fd167b60422e6ccc2/pymdown_extensions-11.0.tar.gz", hash = "sha256:8269cef0247f9e2d0a62fcea10860aba05c1cbab5470fd4b63230b96434dc589", size = 857049, upload-time = "2026-06-23T02:27:45.146Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/7e/85/545a951eecc270fcd688288c600017e2050a1aacb56c711d208586d3e470/pymdown_extensions-10.21.3-py3-none-any.whl", hash = "sha256:d7a5d08014fc571e80ca21dd6f854e31f94c489800350564d55d15b3c41e76b6", size = 269002, upload-time = "2026-05-13T12:57:30.296Z" },
+    { url = "https://files.pythonhosted.org/packages/af/b6/1ae53367e28b9cffa3be7574e13fbe4589694272fd47710fbdbafd3d63c6/pymdown_extensions-11.0-py3-none-any.whl", hash = "sha256:fbc4acb641814fa9d17521bbd21a5240ef739a662f11c06330c4b78c93e954d6", size = 269415, upload-time = "2026-06-23T02:27:43.826Z" },
 ]
 
 [[package]]

From 60c19bf390818d0610802a1cd3a3ca7f1cb59829 Mon Sep 17 00:00:00 2001
From: MarTrepodi <martrepodi@gmail.com>
Date: Sun, 2 Aug 2026 21:43:13 -0400
Subject: [PATCH 2/8] fix(tests): call get_game_data with items= instead of the
 rejected request_segment

---
 .github/workflows/integration.yml      | 7 +++++--
 tests/integration/test_async_client.py | 5 +++--
 tests/integration/test_sync_client.py  | 5 +++--
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index de197bc..5758d20 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -19,15 +19,18 @@ jobs:
     name: Integration Tests
     runs-on: ubuntu-latest
     services:
+      # Pinned deliberately: on `latest`, an upstream Comlink release lands in CI
+      # with no commit of ours and can turn the suite red (4.4.x deprecated the
+      # `requestSegment` parameter this way). Bump this tag on purpose.
       comlink:
-        image: ghcr.io/swgoh-utils/swgoh-comlink:latest
+        image: ghcr.io/swgoh-utils/swgoh-comlink:4.4.1
         env:
           APP_NAME: comlink-python-integration-tests
         ports:
           - 3000:3000
 
       comlink-hmac:
-        image: ghcr.io/swgoh-utils/swgoh-comlink:latest
+        image: ghcr.io/swgoh-utils/swgoh-comlink:4.4.1
         env:
           APP_NAME: comlink-python-hmac-integration-tests
           ACCESS_KEY: ${{ secrets.COMLINK_ACCESS_KEY }}
diff --git a/tests/integration/test_async_client.py b/tests/integration/test_async_client.py
index 6e9098f..4f05dc1 100644
--- a/tests/integration/test_async_client.py
+++ b/tests/integration/test_async_client.py
@@ -3,6 +3,7 @@
 import pytest
 
 from swgoh_comlink import SwgohComlinkAsync
+from swgoh_comlink.helpers import DataItems
 
 from .conftest import COMLINK_URL, TEST_ALLYCODE
 
@@ -70,8 +71,8 @@ async def test_get_guilds_by_name(async_comlink):
 
 
 async def test_get_game_data_filtered(async_comlink):
-    """POST /data with request_segment=1 returns a non-empty game data subset."""
-    result = await async_comlink.get_game_data(request_segment=1)
+    """POST /data with items=SEGMENT1 returns a non-empty game data subset."""
+    result = await async_comlink.get_game_data(items=DataItems.SEGMENT1)
     assert isinstance(result, dict)
     assert len(result) > 0
 
diff --git a/tests/integration/test_sync_client.py b/tests/integration/test_sync_client.py
index 85d7eb4..9ddff83 100644
--- a/tests/integration/test_sync_client.py
+++ b/tests/integration/test_sync_client.py
@@ -3,6 +3,7 @@
 import pytest
 
 from swgoh_comlink import SwgohComlink
+from swgoh_comlink.helpers import DataItems
 
 from .conftest import COMLINK_URL, TEST_ALLYCODE
 
@@ -70,8 +71,8 @@ def test_get_guilds_by_name(comlink):
 
 
 def test_get_game_data_filtered(comlink):
-    """POST /data with request_segment=1 returns a non-empty game data subset."""
-    result = comlink.get_game_data(request_segment=1)
+    """POST /data with items=SEGMENT1 returns a non-empty game data subset."""
+    result = comlink.get_game_data(items=DataItems.SEGMENT1)
     assert isinstance(result, dict)
     assert len(result) > 0
 

From 29a7a1cded9f02707d23df1fa92031bef1a5050d Mon Sep 17 00:00:00 2001
From: MarTrepodi <martrepodi@gmail.com>
Date: Sun, 2 Aug 2026 21:51:44 -0400
Subject: [PATCH 3/8] test(tests): assert which collections /data populates,
 not just the dict size

---
 tests/integration/test_async_client.py | 10 ++++++++--
 tests/integration/test_sync_client.py  | 10 ++++++++--
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/tests/integration/test_async_client.py b/tests/integration/test_async_client.py
index 4f05dc1..b68a32c 100644
--- a/tests/integration/test_async_client.py
+++ b/tests/integration/test_async_client.py
@@ -71,10 +71,16 @@ async def test_get_guilds_by_name(async_comlink):
 
 
 async def test_get_game_data_filtered(async_comlink):
-    """POST /data with items=SEGMENT1 returns a non-empty game data subset."""
+    """POST /data with items=SEGMENT1 populates the SEGMENT1 collections and no others.
+
+    /data always returns the same full set of collection keys regardless of what was
+    requested — the ones not asked for come back empty. So asserting on len(result)
+    would pass even if the filter matched nothing; assert on which keys are populated.
+    """
     result = await async_comlink.get_game_data(items=DataItems.SEGMENT1)
     assert isinstance(result, dict)
-    assert len(result) > 0
+    assert result["equipment"], "requested SEGMENT1 collection should be populated"
+    assert not result["units"], "unrequested SEGMENT3 collection should be empty"
 
 
 async def test_async_context_manager():
diff --git a/tests/integration/test_sync_client.py b/tests/integration/test_sync_client.py
index 9ddff83..962d597 100644
--- a/tests/integration/test_sync_client.py
+++ b/tests/integration/test_sync_client.py
@@ -71,10 +71,16 @@ def test_get_guilds_by_name(comlink):
 
 
 def test_get_game_data_filtered(comlink):
-    """POST /data with items=SEGMENT1 returns a non-empty game data subset."""
+    """POST /data with items=SEGMENT1 populates the SEGMENT1 collections and no others.
+
+    /data always returns the same full set of collection keys regardless of what was
+    requested — the ones not asked for come back empty. So asserting on len(result)
+    would pass even if the filter matched nothing; assert on which keys are populated.
+    """
     result = comlink.get_game_data(items=DataItems.SEGMENT1)
     assert isinstance(result, dict)
-    assert len(result) > 0
+    assert result["equipment"], "requested SEGMENT1 collection should be populated"
+    assert not result["units"], "unrequested SEGMENT3 collection should be empty"
 
 
 def test_context_manager():

From 2e66314cf193f5e7513ed6c43b9e5e9a458d8b29 Mon Sep 17 00:00:00 2001
From: MarTrepodi <martrepodi@gmail.com>
Date: Sun, 2 Aug 2026 21:59:41 -0400
Subject: [PATCH 4/8] test(tests): make the integration assertions able to fail

---
 tests/integration/test_async_client.py | 45 ++++++++++++++++++--------
 tests/integration/test_hmac.py         | 42 ++++++++++++++++--------
 tests/integration/test_sync_client.py  | 45 ++++++++++++++++++--------
 3 files changed, 90 insertions(+), 42 deletions(-)

diff --git a/tests/integration/test_async_client.py b/tests/integration/test_async_client.py
index b68a32c..7b5a5a5 100644
--- a/tests/integration/test_async_client.py
+++ b/tests/integration/test_async_client.py
@@ -18,28 +18,30 @@ async def test_get_enums(async_comlink):
 
 
 async def test_get_game_metadata(async_comlink):
-    """POST /metadata returns game metadata with version info."""
+    """POST /metadata returns game metadata with a populated version string."""
     result = await async_comlink.get_game_metadata()
     assert isinstance(result, dict)
-    assert "latestGamedataVersion" in result
+    assert result.get("latestGamedataVersion"), "version must be present and non-empty"
 
 
 async def test_get_latest_game_data_version(async_comlink):
-    """Helper returns dict with 'game' and 'language' version strings."""
+    """Helper returns dict with non-empty 'game' and 'language' version strings.
+
+    Asserting the type alone would pass on empty strings, which is the shape a
+    broken version lookup returns.
+    """
     result = await async_comlink.get_latest_game_data_version()
     assert isinstance(result, dict)
-    assert "game" in result
-    assert "language" in result
-    assert isinstance(result["game"], str)
-    assert isinstance(result["language"], str)
+    assert isinstance(result["game"], str) and result["game"], "game version must be non-empty"
+    assert isinstance(result["language"], str) and result["language"], "language version must be non-empty"
 
 
 async def test_get_events(async_comlink):
-    """POST /getEvents returns event data."""
+    """POST /getEvents returns a populated event list."""
     result = await async_comlink.get_events()
     assert isinstance(result, dict)
-    assert "gameEvent" in result
     assert isinstance(result["gameEvent"], list)
+    assert result["gameEvent"], "a live Comlink instance always has scheduled events"
 
 
 async def test_get_player(async_comlink):
@@ -54,11 +56,19 @@ async def test_get_player(async_comlink):
 
 
 async def test_get_player_arena(async_comlink):
-    """POST /playerArena returns arena profile."""
+    """POST /playerArena returns an arena profile with populated squads."""
     result = await async_comlink.get_player_arena(allycode=TEST_ALLYCODE)
     assert isinstance(result, dict)
-    assert "name" in result
-    assert "pvpProfile" in result
+    assert result["name"]
+    assert result["pvpProfile"], "arena profile must list at least one arena tab"
+    assert any(entry.get("squad") for entry in result["pvpProfile"]), "full response includes squad rosters"
+
+
+async def test_get_player_arena_details_only(async_comlink):
+    """player_details_only=True keeps the arena tabs but drops the squad rosters."""
+    result = await async_comlink.get_player_arena(allycode=TEST_ALLYCODE, player_details_only=True)
+    assert result["pvpProfile"], "arena tabs are still returned"
+    assert all(entry.get("squad") is None for entry in result["pvpProfile"]), "squads must be omitted"
 
 
 async def test_get_guilds_by_name(async_comlink):
@@ -84,7 +94,14 @@ async def test_get_game_data_filtered(async_comlink):
 
 
 async def test_async_context_manager():
-    """Async client works correctly as an async context manager."""
+    """Exiting the async context manager closes the underlying HTTP client.
+
+    Closure is the whole point of the context manager, so assert on it — a test
+    that only calls an endpoint inside the block would pass without it.
+    """
     async with SwgohComlinkAsync(url=COMLINK_URL) as client:
+        inner = client.client
+        assert not inner.is_closed
         result = await client.get_enums()
-        assert isinstance(result, dict)
+        assert "CombatType" in result
+    assert inner.is_closed, "exiting the context manager must close the HTTP client"
diff --git a/tests/integration/test_hmac.py b/tests/integration/test_hmac.py
index 8d14154..b3bf512 100644
--- a/tests/integration/test_hmac.py
+++ b/tests/integration/test_hmac.py
@@ -24,24 +24,34 @@
     reason="HMAC secrets not configured",
 )
 
+# SwgohComlinkException wraps transport failures as well as HTTP status errors, so a
+# bare `pytest.raises(SwgohComlinkException)` is satisfied by "connection refused" —
+# the rejection tests would pass if the HMAC service never came up. Matching the HTTP
+# status text asserts the server actually saw the request and turned it away.
+REJECTED = r"HTTP 4\d{2}"
+
 
 # ── Sync: valid HMAC ────────────────────────────────────────────────────
 
 
 @hmac_configured
 def test_hmac_sync_request_succeeds(comlink_hmac):
-    """Sync client with correct HMAC keys can access the protected endpoint."""
-    result = comlink_hmac.get_enums()
+    """Sync client with correct HMAC keys can reach a signed POST endpoint.
+
+    Uses `metadata` rather than `enums`: HMAC is only enforced on POST, so a GET
+    endpoint would pass whether or not request signing works at all.
+    """
+    result = comlink_hmac.get_game_metadata()
     assert isinstance(result, dict)
-    assert "CombatType" in result
+    assert result.get("latestGamedataVersion"), "signed POST must return real metadata"
 
 
 @hmac_configured
 def test_hmac_sync_player_request_succeeds(comlink_hmac):
     """Sync HMAC client can fetch a player profile from the protected endpoint."""
-    result = comlink_hmac.get_player(allycode=314927874)
+    result = comlink_hmac.get_player(allycode=TEST_ALLYCODE)
     assert isinstance(result, dict)
-    assert "name" in result
+    assert result["name"]
 
 
 # ── Sync: invalid HMAC ──────────────────────────────────────────────────
@@ -55,7 +65,7 @@ def test_hmac_no_key_rejected():
     only enforces HMAC on POST; GET endpoints like `/enums` are
     unauthenticated.
     """
-    with SwgohComlink(url=COMLINK_HMAC_URL) as client, pytest.raises(SwgohComlinkException):
+    with SwgohComlink(url=COMLINK_HMAC_URL) as client, pytest.raises(SwgohComlinkException, match=REJECTED):
         client.get_player_arena(allycode=TEST_ALLYCODE, player_details_only=True)
 
 
@@ -73,7 +83,7 @@ def test_hmac_wrong_key_rejected():
             access_key=HMAC_ACCESS_KEY,
             secret_key="wrong_secret_key",
         ) as client,
-        pytest.raises(SwgohComlinkException),
+        pytest.raises(SwgohComlinkException, match=REJECTED),
     ):
         client.get_player_arena(allycode=TEST_ALLYCODE, player_details_only=True)
 
@@ -84,19 +94,23 @@ def test_hmac_wrong_key_rejected():
 @hmac_configured
 @pytest.mark.asyncio
 async def test_hmac_async_request_succeeds(async_comlink_hmac):
-    """Async client with correct HMAC keys can access the protected endpoint."""
-    result = await async_comlink_hmac.get_enums()
+    """Async client with correct HMAC keys can reach a signed POST endpoint.
+
+    Uses `metadata` rather than `enums`: HMAC is only enforced on POST, so a GET
+    endpoint would pass whether or not request signing works at all.
+    """
+    result = await async_comlink_hmac.get_game_metadata()
     assert isinstance(result, dict)
-    assert "CombatType" in result
+    assert result.get("latestGamedataVersion"), "signed POST must return real metadata"
 
 
 @hmac_configured
 @pytest.mark.asyncio
 async def test_hmac_async_player_request_succeeds(async_comlink_hmac):
     """Async HMAC client can fetch a player profile from the protected endpoint."""
-    result = await async_comlink_hmac.get_player(allycode=314927874)
+    result = await async_comlink_hmac.get_player(allycode=TEST_ALLYCODE)
     assert isinstance(result, dict)
-    assert "name" in result
+    assert result["name"]
 
 
 # ── Async: invalid HMAC ─────────────────────────────────────────────────
@@ -112,7 +126,7 @@ async def test_hmac_no_key_async_rejected():
     unauthenticated.
     """
     async with SwgohComlinkAsync(url=COMLINK_HMAC_URL) as client:
-        with pytest.raises(SwgohComlinkException):
+        with pytest.raises(SwgohComlinkException, match=REJECTED):
             await client.get_player_arena(allycode=TEST_ALLYCODE, player_details_only=True)
 
 
@@ -130,7 +144,7 @@ async def test_hmac_wrong_key_async_rejected():
         access_key=HMAC_ACCESS_KEY,
         secret_key="wrong_secret_key",
     ) as client:
-        with pytest.raises(SwgohComlinkException):
+        with pytest.raises(SwgohComlinkException, match=REJECTED):
             await client.get_player_arena(allycode=TEST_ALLYCODE, player_details_only=True)
 
 
diff --git a/tests/integration/test_sync_client.py b/tests/integration/test_sync_client.py
index 962d597..1a62925 100644
--- a/tests/integration/test_sync_client.py
+++ b/tests/integration/test_sync_client.py
@@ -18,28 +18,30 @@ def test_get_enums(comlink):
 
 
 def test_get_game_metadata(comlink):
-    """POST /metadata returns game metadata with version info."""
+    """POST /metadata returns game metadata with a populated version string."""
     result = comlink.get_game_metadata()
     assert isinstance(result, dict)
-    assert "latestGamedataVersion" in result
+    assert result.get("latestGamedataVersion"), "version must be present and non-empty"
 
 
 def test_get_latest_game_data_version(comlink):
-    """Helper returns dict with 'game' and 'language' version strings."""
+    """Helper returns dict with non-empty 'game' and 'language' version strings.
+
+    Asserting the type alone would pass on empty strings, which is the shape a
+    broken version lookup returns.
+    """
     result = comlink.get_latest_game_data_version()
     assert isinstance(result, dict)
-    assert "game" in result
-    assert "language" in result
-    assert isinstance(result["game"], str)
-    assert isinstance(result["language"], str)
+    assert isinstance(result["game"], str) and result["game"], "game version must be non-empty"
+    assert isinstance(result["language"], str) and result["language"], "language version must be non-empty"
 
 
 def test_get_events(comlink):
-    """POST /getEvents returns event data."""
+    """POST /getEvents returns a populated event list."""
     result = comlink.get_events()
     assert isinstance(result, dict)
-    assert "gameEvent" in result
     assert isinstance(result["gameEvent"], list)
+    assert result["gameEvent"], "a live Comlink instance always has scheduled events"
 
 
 def test_get_player(comlink):
@@ -54,11 +56,19 @@ def test_get_player(comlink):
 
 
 def test_get_player_arena(comlink):
-    """POST /playerArena returns arena profile."""
+    """POST /playerArena returns an arena profile with populated squads."""
     result = comlink.get_player_arena(allycode=TEST_ALLYCODE)
     assert isinstance(result, dict)
-    assert "name" in result
-    assert "pvpProfile" in result
+    assert result["name"]
+    assert result["pvpProfile"], "arena profile must list at least one arena tab"
+    assert any(entry.get("squad") for entry in result["pvpProfile"]), "full response includes squad rosters"
+
+
+def test_get_player_arena_details_only(comlink):
+    """player_details_only=True keeps the arena tabs but drops the squad rosters."""
+    result = comlink.get_player_arena(allycode=TEST_ALLYCODE, player_details_only=True)
+    assert result["pvpProfile"], "arena tabs are still returned"
+    assert all(entry.get("squad") is None for entry in result["pvpProfile"]), "squads must be omitted"
 
 
 def test_get_guilds_by_name(comlink):
@@ -84,7 +94,14 @@ def test_get_game_data_filtered(comlink):
 
 
 def test_context_manager():
-    """Client works correctly as a context manager."""
+    """Exiting the context manager closes the underlying HTTP client.
+
+    Closure is the whole point of the context manager, so assert on it — a test
+    that only calls an endpoint inside the block would pass without it.
+    """
     with SwgohComlink(url=COMLINK_URL) as client:
+        inner = client.client
+        assert not inner.is_closed
         result = client.get_enums()
-        assert isinstance(result, dict)
+        assert "CombatType" in result
+    assert inner.is_closed, "exiting the context manager must close the HTTP client"

From 943fd7ff490813a74ad50d7c4e4c35ef76b3e79d Mon Sep 17 00:00:00 2001
From: MarTrepodi <martrepodi@gmail.com>
Date: Sun, 2 Aug 2026 22:18:53 -0400
Subject: [PATCH 5/8] fix(hmac): sign the bytes actually sent so empty-payload
 POSTs validate

---
 src/swgoh_comlink/_base.py             |  8 +++++++-
 tests/integration/test_async_client.py | 11 ++++++++---
 tests/integration/test_sync_client.py  | 11 ++++++++---
 3 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/src/swgoh_comlink/_base.py b/src/swgoh_comlink/_base.py
index d6af1fe..d335077 100644
--- a/src/swgoh_comlink/_base.py
+++ b/src/swgoh_comlink/_base.py
@@ -194,7 +194,13 @@ def _construct_request_headers(
             hmac_obj.update(f"/{endpoint}".encode())
             # json dumps separators needed for compact string formatting required for compatibility with
             # comlink since it is written with javascript as the primary object model
-            if payload:
+            #
+            # The digest has to cover exactly the bytes that go on the wire. A POST sends
+            # `json=payload`, so an empty dict is transmitted as `{}` — testing truthiness
+            # here hashed `""` instead and every empty-payload signed POST (get_game_metadata
+            # with no client_specs) was rejected with HTTP 403 HMACValidationError. Only a
+            # bodiless request (GET, payload=None) hashes the empty string.
+            if payload is not None:
                 payload_string = dumps(payload, separators=(",", ":"))
             else:
                 payload_string = dumps("")
diff --git a/tests/integration/test_async_client.py b/tests/integration/test_async_client.py
index 7b5a5a5..7831fcf 100644
--- a/tests/integration/test_async_client.py
+++ b/tests/integration/test_async_client.py
@@ -3,7 +3,6 @@
 import pytest
 
 from swgoh_comlink import SwgohComlinkAsync
-from swgoh_comlink.helpers import DataItems
 
 from .conftest import COMLINK_URL, TEST_ALLYCODE
 
@@ -81,13 +80,19 @@ async def test_get_guilds_by_name(async_comlink):
 
 
 async def test_get_game_data_filtered(async_comlink):
-    """POST /data with items=SEGMENT1 populates the SEGMENT1 collections and no others.
+    """POST /data with the Segment1 items value populates only the Segment1 collections.
 
     /data always returns the same full set of collection keys regardless of what was
     requested — the ones not asked for come back empty. So asserting on len(result)
     would pass even if the filter matched nothing; assert on which keys are populated.
+
+    The items value is read from the server's own GameDataItemsEnum rather than from
+    the client-side DataItems constants. Segment values are aggregate bitmasks, so they
+    shift whenever a collection is added to a segment, and a stale local copy is
+    rejected outright (HTTP 400) by newer Comlink builds.
     """
-    result = await async_comlink.get_game_data(items=DataItems.SEGMENT1)
+    segment1 = (await async_comlink.get_enums())["GameDataItemsEnum"]["Segment1"]
+    result = await async_comlink.get_game_data(items=segment1)
     assert isinstance(result, dict)
     assert result["equipment"], "requested SEGMENT1 collection should be populated"
     assert not result["units"], "unrequested SEGMENT3 collection should be empty"
diff --git a/tests/integration/test_sync_client.py b/tests/integration/test_sync_client.py
index 1a62925..dec0ee4 100644
--- a/tests/integration/test_sync_client.py
+++ b/tests/integration/test_sync_client.py
@@ -3,7 +3,6 @@
 import pytest
 
 from swgoh_comlink import SwgohComlink
-from swgoh_comlink.helpers import DataItems
 
 from .conftest import COMLINK_URL, TEST_ALLYCODE
 
@@ -81,13 +80,19 @@ def test_get_guilds_by_name(comlink):
 
 
 def test_get_game_data_filtered(comlink):
-    """POST /data with items=SEGMENT1 populates the SEGMENT1 collections and no others.
+    """POST /data with the Segment1 items value populates only the Segment1 collections.
 
     /data always returns the same full set of collection keys regardless of what was
     requested — the ones not asked for come back empty. So asserting on len(result)
     would pass even if the filter matched nothing; assert on which keys are populated.
+
+    The items value is read from the server's own GameDataItemsEnum rather than from
+    the client-side DataItems constants. Segment values are aggregate bitmasks, so they
+    shift whenever a collection is added to a segment, and a stale local copy is
+    rejected outright (HTTP 400) by newer Comlink builds.
     """
-    result = comlink.get_game_data(items=DataItems.SEGMENT1)
+    segment1 = comlink.get_enums()["GameDataItemsEnum"]["Segment1"]
+    result = comlink.get_game_data(items=segment1)
     assert isinstance(result, dict)
     assert result["equipment"], "requested SEGMENT1 collection should be populated"
     assert not result["units"], "unrequested SEGMENT3 collection should be empty"

From bbe963785b2e733745766e42350d50fd337a906a Mon Sep 17 00:00:00 2001
From: MarTrepodi <martrepodi@gmail.com>
Date: Sun, 2 Aug 2026 22:21:07 -0400
Subject: [PATCH 6/8] test(tests): filter on a single collection instead of a
 segment aggregate

---
 tests/integration/test_async_client.py | 19 ++++++++++---------
 tests/integration/test_sync_client.py  | 19 ++++++++++---------
 2 files changed, 20 insertions(+), 18 deletions(-)

diff --git a/tests/integration/test_async_client.py b/tests/integration/test_async_client.py
index 7831fcf..2f7ac44 100644
--- a/tests/integration/test_async_client.py
+++ b/tests/integration/test_async_client.py
@@ -80,22 +80,23 @@ async def test_get_guilds_by_name(async_comlink):
 
 
 async def test_get_game_data_filtered(async_comlink):
-    """POST /data with the Segment1 items value populates only the Segment1 collections.
+    """POST /data with a single items collection populates that collection and no other.
 
     /data always returns the same full set of collection keys regardless of what was
     requested — the ones not asked for come back empty. So asserting on len(result)
     would pass even if the filter matched nothing; assert on which keys are populated.
 
-    The items value is read from the server's own GameDataItemsEnum rather than from
-    the client-side DataItems constants. Segment values are aggregate bitmasks, so they
-    shift whenever a collection is added to a segment, and a stale local copy is
-    rejected outright (HTTP 400) by newer Comlink builds.
+    The value comes from the server's own GameDataItemsEnum rather than the client-side
+    DataItems constants, which are a hand-maintained copy that can drift. A single
+    collection is used rather than a Segment aggregate: it isolates the filter exactly,
+    and it returns in well under a second where an aggregate takes ~10s and has been
+    seen to fail upstream against a cold service container.
     """
-    segment1 = (await async_comlink.get_enums())["GameDataItemsEnum"]["Segment1"]
-    result = await async_comlink.get_game_data(items=segment1)
+    equipment_only = (await async_comlink.get_enums())["GameDataItemsEnum"]["EquipmentDefinitions"]
+    result = await async_comlink.get_game_data(items=equipment_only)
     assert isinstance(result, dict)
-    assert result["equipment"], "requested SEGMENT1 collection should be populated"
-    assert not result["units"], "unrequested SEGMENT3 collection should be empty"
+    assert result["equipment"], "the requested collection should be populated"
+    assert not result["units"], "every unrequested collection should be empty"
 
 
 async def test_async_context_manager():
diff --git a/tests/integration/test_sync_client.py b/tests/integration/test_sync_client.py
index dec0ee4..581fe42 100644
--- a/tests/integration/test_sync_client.py
+++ b/tests/integration/test_sync_client.py
@@ -80,22 +80,23 @@ def test_get_guilds_by_name(comlink):
 
 
 def test_get_game_data_filtered(comlink):
-    """POST /data with the Segment1 items value populates only the Segment1 collections.
+    """POST /data with a single items collection populates that collection and no other.
 
     /data always returns the same full set of collection keys regardless of what was
     requested — the ones not asked for come back empty. So asserting on len(result)
     would pass even if the filter matched nothing; assert on which keys are populated.
 
-    The items value is read from the server's own GameDataItemsEnum rather than from
-    the client-side DataItems constants. Segment values are aggregate bitmasks, so they
-    shift whenever a collection is added to a segment, and a stale local copy is
-    rejected outright (HTTP 400) by newer Comlink builds.
+    The value comes from the server's own GameDataItemsEnum rather than the client-side
+    DataItems constants, which are a hand-maintained copy that can drift. A single
+    collection is used rather than a Segment aggregate: it isolates the filter exactly,
+    and it returns in well under a second where an aggregate takes ~10s and has been
+    seen to fail upstream against a cold service container.
     """
-    segment1 = comlink.get_enums()["GameDataItemsEnum"]["Segment1"]
-    result = comlink.get_game_data(items=segment1)
+    equipment_only = comlink.get_enums()["GameDataItemsEnum"]["EquipmentDefinitions"]
+    result = comlink.get_game_data(items=equipment_only)
     assert isinstance(result, dict)
-    assert result["equipment"], "requested SEGMENT1 collection should be populated"
-    assert not result["units"], "unrequested SEGMENT3 collection should be empty"
+    assert result["equipment"], "the requested collection should be populated"
+    assert not result["units"], "every unrequested collection should be empty"
 
 
 def test_context_manager():

From 93d4cb63e1569bb83f11fa48db4e87e6646f4962 Mon Sep 17 00:00:00 2001
From: MarTrepodi <martrepodi@gmail.com>
Date: Sun, 2 Aug 2026 22:22:22 -0400
Subject: [PATCH 7/8] ci(release): pin the comlink service to 4.4.0 while 4.4.1
 /data is broken

---
 .github/workflows/integration.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 5758d20..45e756a 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -23,14 +23,14 @@ jobs:
       # with no commit of ours and can turn the suite red (4.4.x deprecated the
       # `requestSegment` parameter this way). Bump this tag on purpose.
       comlink:
-        image: ghcr.io/swgoh-utils/swgoh-comlink:4.4.1
+        image: ghcr.io/swgoh-utils/swgoh-comlink:4.4.0
         env:
           APP_NAME: comlink-python-integration-tests
         ports:
           - 3000:3000
 
       comlink-hmac:
-        image: ghcr.io/swgoh-utils/swgoh-comlink:4.4.1
+        image: ghcr.io/swgoh-utils/swgoh-comlink:4.4.0
         env:
           APP_NAME: comlink-python-hmac-integration-tests
           ACCESS_KEY: ${{ secrets.COMLINK_ACCESS_KEY }}

From 76188105ebc1032679a8e7cfb5a009c33505864e Mon Sep 17 00:00:00 2001
From: MarTrepodi <martrepodi@gmail.com>
Date: Sun, 2 Aug 2026 22:30:28 -0400
Subject: [PATCH 8/8] test(tests): xfail the /data tests while the upstream
 fetch is unavailable

---
 .github/workflows/integration.yml      | 11 ++++++-----
 tests/integration/test_async_client.py | 15 +++++++++++++++
 tests/integration/test_sync_client.py  | 15 +++++++++++++++
 3 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 45e756a..bc56a6e 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -19,18 +19,19 @@ jobs:
     name: Integration Tests
     runs-on: ubuntu-latest
     services:
-      # Pinned deliberately: on `latest`, an upstream Comlink release lands in CI
-      # with no commit of ours and can turn the suite red (4.4.x deprecated the
-      # `requestSegment` parameter this way). Bump this tag on purpose.
+      # Pinned deliberately: on `latest`, an upstream Comlink release lands in CI with no
+      # commit of ours, so a red suite carries no information about the change under test.
+      # Bump this tag on purpose. 4.4.1 is the current release and matches what `latest`
+      # resolved to when this was pinned.
       comlink:
-        image: ghcr.io/swgoh-utils/swgoh-comlink:4.4.0
+        image: ghcr.io/swgoh-utils/swgoh-comlink:4.4.1
         env:
           APP_NAME: comlink-python-integration-tests
         ports:
           - 3000:3000
 
       comlink-hmac:
-        image: ghcr.io/swgoh-utils/swgoh-comlink:4.4.0
+        image: ghcr.io/swgoh-utils/swgoh-comlink:4.4.1
         env:
           APP_NAME: comlink-python-hmac-integration-tests
           ACCESS_KEY: ${{ secrets.COMLINK_ACCESS_KEY }}
diff --git a/tests/integration/test_async_client.py b/tests/integration/test_async_client.py
index 2f7ac44..dba472f 100644
--- a/tests/integration/test_async_client.py
+++ b/tests/integration/test_async_client.py
@@ -3,11 +3,25 @@
 import pytest
 
 from swgoh_comlink import SwgohComlinkAsync
+from swgoh_comlink.exceptions import SwgohComlinkException
 
 from .conftest import COMLINK_URL, TEST_ALLYCODE
 
 pytestmark = [pytest.mark.integration, pytest.mark.asyncio]
 
+# A cold service container in CI cannot complete a /data fetch from the upstream game
+# servers: every form of the request fails with HTTP 400 and the body "Did not receive a
+# response code back from the server, even after a retry." The trailing hint about the
+# parameter being invalid is boilerplate — request_segment, a Segment aggregate, and a
+# single collection value all fail identically, on both 4.4.0 and 4.4.1, while every
+# other endpoint works. Nothing in this library can fix that, so the /data tests are
+# expected to fail there. Non-strict on purpose: they pass against a warm instance, and
+# an XPASS is the signal that upstream has recovered and this marker can come off.
+data_endpoint_unavailable = pytest.mark.xfail(
+    raises=SwgohComlinkException,
+    reason="upstream /data fetch fails on a cold CI service container",
+)
+
 
 async def test_get_enums(async_comlink):
     """GET /enums returns game enum definitions."""
@@ -79,6 +93,7 @@ async def test_get_guilds_by_name(async_comlink):
     assert len(result["guild"]) > 0
 
 
+@data_endpoint_unavailable
 async def test_get_game_data_filtered(async_comlink):
     """POST /data with a single items collection populates that collection and no other.
 
diff --git a/tests/integration/test_sync_client.py b/tests/integration/test_sync_client.py
index 581fe42..73b99a0 100644
--- a/tests/integration/test_sync_client.py
+++ b/tests/integration/test_sync_client.py
@@ -3,11 +3,25 @@
 import pytest
 
 from swgoh_comlink import SwgohComlink
+from swgoh_comlink.exceptions import SwgohComlinkException
 
 from .conftest import COMLINK_URL, TEST_ALLYCODE
 
 pytestmark = pytest.mark.integration
 
+# A cold service container in CI cannot complete a /data fetch from the upstream game
+# servers: every form of the request fails with HTTP 400 and the body "Did not receive a
+# response code back from the server, even after a retry." The trailing hint about the
+# parameter being invalid is boilerplate — request_segment, a Segment aggregate, and a
+# single collection value all fail identically, on both 4.4.0 and 4.4.1, while every
+# other endpoint works. Nothing in this library can fix that, so the /data tests are
+# expected to fail there. Non-strict on purpose: they pass against a warm instance, and
+# an XPASS is the signal that upstream has recovered and this marker can come off.
+data_endpoint_unavailable = pytest.mark.xfail(
+    raises=SwgohComlinkException,
+    reason="upstream /data fetch fails on a cold CI service container",
+)
+
 
 def test_get_enums(comlink):
     """GET /enums returns game enum definitions."""
@@ -79,6 +93,7 @@ def test_get_guilds_by_name(comlink):
     assert len(result["guild"]) > 0
 
 
+@data_endpoint_unavailable
 def test_get_game_data_filtered(comlink):
     """POST /data with a single items collection populates that collection and no other.