In general, to fix this issue you either (a) make the method a proper classmethod and keep cls as the first parameter, or (b) leave it as an instance method and rename the first parameter to self (and adjust its internal usage accordingly). Since this validator logically operates on the class (cls) and not on an instance, the best fix without changing functionality is to convert it to a classmethod.

Concretely, in src/auth0/management/core/pydantic_utilities.py, within the else: branch of class UniversalBaseModel(pydantic.BaseModel):, we should add the @classmethod decorator immediately above the existing @pydantic.root_validator(pre=True) decorator. The method signature can remain def _coerce_field_names_to_aliases(cls, values: Any) -> Any: because once @classmethod is applied, cls is the correct conventional name. The body of the method does not need any changes, since it already refers to cls correctly and uses values as the second argument.

No new imports or additional definitions are required; classmethod is built in and already available.

In general, to fix an unused global variable you either (1) remove it if it truly adds no behavior, (2) rename it to an “unused” style name if it is intentionally unused, or (3) actually use it in logic if it was meant to be used. Here, _STARTED is only meaningful inside _start_wiremock and is not exposed outside the module; we can avoid the global state entirely and instead infer whether WireMock has already been started from an observable side effect we already rely on: the WIREMOCK_PORT environment variable.

Best fix without changing external functionality:

• Remove the module-level _STARTED declaration.
• Stop using _STARTED as a guard in _start_wiremock.
• Use os.environ.get("WIREMOCK_PORT") as the “started” flag: if it is set, we consider WireMock already started and return immediately. This maintains the “start once per process” behavior while removing the unused global.
• Because the code already sets os.environ["WIREMOCK_PORT"] after starting WireMock, no additional imports are needed.

Concretely in tests/conftest.py:

1. Delete line 17 (_STARTED: bool = False).
2. In _start_wiremock, remove _STARTED from the global statement.
3. Replace the if _STARTED: guard with an environment-based guard.
4. Remove the assignment _STARTED = True after a successful start.

No other files need to be touched.

In general, an empty except should either be removed (letting the exception propagate), narrowed to only the expected error type, or augmented to log and/or document why the exception is being ignored. For feature-detection patterns like this (trying one API shape and falling back to another), the best fix is to keep the fallback behavior but add a clear comment and minimal logging of the exception so it’s not entirely silent.

For this specific code in tests/wire/conftest.py, we should:

• Keep the try/except and the fallback construction using httpx.Client, so existing test behavior is unchanged.
• Add a short explanatory comment in the except block stating that this is a compatibility fallback for different Auth0 constructor signatures.
• Optionally (and still lightweight), log the exception to pytest’s internal logging or to standard output, but since we should avoid changing imports too much and keep tests quiet, a simple comment is enough to satisfy both CodeQL and clarity; however, to meaningfully “handle” the exception, the minimal change is to add a comment plus an explicit no-op statement like # ... plus return or just leave the fallback; in Python, a comment alone doesn’t count as code, but CodeQL’s rule is mainly about explanation. To be safe we can add a comment explaining the swallow, leaving pass as the explicit no-op.

The smallest change within the shown snippet is to replace the bare pass with a comment explaining the intentional ignore plus pass. No imports or new methods are required.