Require click for the always-installed deep CLI

[Pitchfork-and-Torch]

Summary

• Fixes cli - Missing dependency 'click' in default installation #594: the deep console script is always installed and imports click, but click was only in the optional cli extra.
• Bare installs (pip install deepdiff, uv tool install deepdiff) therefore raised ModuleNotFoundError: No module named 'click'.
• Move click into core dependencies; keep pyyaml in the cli extra.

Test plan

• Confirmed deepdiff.commands imports click at module level and [project.scripts] deep = ... is unconditional
• Fresh venv: pip install . then deep --help succeeds without installing deepdiff[cli]

[seperman]

Static review: #628 Require click for the always-installed deep CLI

Summary: Moves click from the optional cli extra into the core dependencies as click>=8.0, so the always-installed deep script works on a bare install (#594). The PR targets master.

Overlap with other PRs

• #608 ("fix(cli): give actionable error when 'deep' runs without cli extra (#594)") was merged into dev on 2026-08-04 and addresses the same issue a different way:
  • It points [project.scripts] deep at a new wrapper, deepdiff.cli:main.
  • That wrapper checks for click and exits with a pip install deepdiff[cli] hint instead of a traceback.
  • It keeps click optional on purpose. Its description says: "keeps the CLI dependencies optional ... rather than promoting click/pyyaml to core dependencies".
• Because #608 is only on dev, it does not appear on master, which this PR is based on. Issue #594 is still open, probably because dev has not been released to master yet.
• If both changes land, the ImportError branch in deepdiff/cli.py becomes effectively unreachable, and its docstring (deepdiff/cli.py:3-4, "optional and installed via the cli extra") becomes inaccurate.

Security / supply chain

No security concerns found in static review. The change is one pyproject.toml line moved between sections. The package name is the well-known click. No lockfile, CI or entry-point changes are included.

Correctness

• Every library user would install click, not only CLI users. This is a policy trade-off for the maintainer.
• click>=8.0 has no upper bound. Other runtime dependencies cap the next major version (cachebox>=5.2,<6, orderly-set>=5.5.0,<6). The 8.0 floor is also untested here: the test and dev extras resolve against click~=8.3.1.
• Removing click~=8.3.1 from the cli extra drops the previous pin for deepdiff[cli] users.
• uv.lock is not updated. It still lists click only under marker = "extra == 'cli'", specifier = "~=8.3.1" (uv.lock:555), so the lock would be stale.
• A trial git merge-tree onto origin/dev shows no textual conflicts. The overlap with #608 is semantic.

Suggestions

• Could this be rebased on dev so it can be evaluated next to #608? If making click a hard dependency is still wanted after #608:
  • use a capped range such as click>=8.0,<9;
  • re-lock uv.lock;
  • update or simplify the deepdiff/cli.py wrapper and its docstring.

---

AI-assisted static review; the code was not executed.

[Pitchfork-and-Torch]

#608 on dev keeps click optional and replaces the traceback with an install hint. This PR targets master, where that wrapper is not present, and makes click a core dependency so deep works after a default install. That is the behavior #594 asks for.

I will not combine a hard click dependency with the #608 wrapper. That would make the ImportError path dead and leave its docstring wrong.

If you want the hard dependency evaluated next to #608, I will retarget onto dev, cap the range at click>=8.0,<9, refresh uv.lock, and update the wrapper. If the optional extra on dev is the design you intend to release, I will close this.