[devin-ai-integration]

Summary

The SSRF protection in filtered_send (entrypoint.py) catches socket.gaierror from _is_private_url() and re-raises it as requests.exceptions.InvalidURL. While PR #384 mapped InvalidURL → RETRY in the CDK's DEFAULT_ERROR_MAPPING, this only helps CDK HTTP streams that use the error handler. External SDKs (e.g. facebook-business in source-facebook-marketing) bypass that mapping entirely, so a transient DNS blip ([Errno -3] Temporary failure in name resolution) causes an unrecoverable sync failure instead of a retry.

Fix: Re-raise socket.gaierror as requests.ConnectionError instead of InvalidURL. ConnectionError is universally retried by both CDK streams and external SDK error handlers.

 except socket.gaierror as exception:
-    raise requests.exceptions.InvalidURL(f"Invalid URL {parsed_url}: {exception}")
+    hostname = parsed_url.hostname or ""
+    raise requests.ConnectionError(
+        f"DNS resolution failed for {str(hostname)}: {str(exception)}"
+    )

The error message is also improved: "DNS resolution failed for graph.facebook.com: ..." instead of the misleading "Invalid URL ParseResult(...): ...".

Resolves https://github.com/airbytehq/oncall/issues/12976:

• https://github.com/airbytehq/oncall/issues/12976

Prior art:

• fix: Update DEFAULT_ERROR_MAPPING for InvalidURL to RETRY #384 (merged) — mapped InvalidURL → RETRY in error mapping, but only covers CDK HTTP streams
• fix: Add DNSResolutionError for handling DNS resolution failures #360 (closed) — attempted a DNSResolutionError class approach
• https://github.com/airbytehq/oncall/issues/11574 — prior identical issue

Breaking Change Evaluation

Not breaking. This change makes error handling more lenient (retryable instead of fatal) without changing any connector spec, schema, state format, or stream definition. No version bump artifacts needed — CDK uses dynamic versioning.

Test Coverage

Added parametrized tests in unit_tests/test_entrypoint.py covering the filtered_send code path directly:

• test_filtered_send_raises_connection_error_on_dns_failure — parametrized with EAI_AGAIN, EAI_NONAME, EAI_FAIL errno values
• test_filtered_send_does_not_raise_invalid_url_on_dns_failure — verifies old behavior (InvalidURL) no longer occurs
• Updated existing test_cloud_incorrect_ip_format_is_rejected to expect ConnectionError

Link to Devin session: https://app.devin.ai/sessions/ad69979101834fc8a9d3b334b1d131f9

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

💡 Show Tips and Tricks

Testing This CDK Version

You can test this version of the CDK using the following:

# Run the CLI from this branch:
uvx 'git+https://github.com/airbytehq/airbyte-python-cdk.git@devin/1782293727-fix-dns-gaierror-filtered-send#egg=airbyte-python-cdk[dev]' --help

# Update a connector to use the CDK from this branch ref:
cd airbyte-integrations/connectors/source-example
poe use-cdk-branch devin/1782293727-fix-dns-gaierror-filtered-send

PR Slash Commands

Airbyte Maintainers can execute the following slash commands on your PR:

• /autofix - Fixes most formatting and linting issues
• /poetry-lock - Updates poetry.lock file
• /test - Runs connector tests with the updated CDK
• /prerelease - Triggers a prerelease publish with default arguments
• /poe build - Regenerate git-committed build artifacts, such as the pydantic models which are generated from the manifest JSON schema in YAML.
• /poe <command> - Runs any poe command in the CDK environment

📚 Show Repo Guidance

Helpful Resources

• CDK API Reference

📝 Edit this welcome message.

[github-actions]

PyTest Results (Fast)

6 438 tests  +4   6 402 ✅ +5   10m 52s ⏱️ + 4m 25s
    1 suites ±0      36 💤  - 1 
    1 files   ±0       0 ❌ ±0 

Results for commit 512ca62. ± Comparison against base commit 314f8fb.

♻️ This comment has been updated with latest results.

[github-actions]

PyTest Results (Full)

6 441 tests  +4   6 405 ✅ +5   12m 16s ⏱️ +40s
    1 suites ±0      36 💤  - 1 
    1 files   ±0       0 ❌ ±0 

Results for commit 512ca62. ± Comparison against base commit 314f8fb.

♻️ This comment has been updated with latest results.

[Airbyte Support Bot (airbyte-support-bot)]

↪️ Starting a CI fix session per Hands-Free AI Triage Project triage next step.

Reason: required Pytest checks are red at 701f38b (likely test leakage from the new _init_internal_request_filter() tests) and the PR conflicts with main. The original fix session could not be revived, so Hands-Free asked a new fix session (https://app.devin.ai/sessions/fc95c065a6614c958222b2d8a767f895) to merge main, resolve the conflict and fix the failing required checks at 701f38b.

• https://github.com/airbytehq/oncall/issues/12976

Devin session

[devin-ai-integration]

❌ Cannot revive Devin session - the session is too old. Please start a new session instead.

View session

[Airbyte Support Bot (airbyte-support-bot)]

🙋 Escalated to the APIs oncall per Hands-Free AI Triage Project triage next step.

Reason: required checks are green at 512ca62 and the merge conflict is resolved, but the Hydra /ai-prove-fix, /ai-review and /ai-ready workflows only run on airbytehq/airbyte, so this CDK fix needs maintainer review to move forward.

• https://github.com/airbytehq/oncall/issues/12976

Devin session