Skip to content

chore(deps): update sqlalchemy requirement from <2.1,>=2.0.51 to >=2.0.52,<2.1 in /backend - #906

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/sqlalchemy-gte-2.0.52-and-lt-2.1
Open

chore(deps): update sqlalchemy requirement from <2.1,>=2.0.51 to >=2.0.52,<2.1 in /backend#906
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/sqlalchemy-gte-2.0.52-and-lt-2.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 16, 2026 •
edited by devin-ai-integration Bot
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on sqlalchemy to permit the latest version.

Release notes

Sourced from sqlalchemy's releases.

2.0.52

Released: August 11, 2026

platform

  • [platform] [bug] Python 3.15 support has been added and tested, including minimal changes for full compatibility.

    References: #13477

orm

  • [orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements where synchronize_session="fetch" is in use, either explicitly or because the statement uses constructs such as CTEs that implicitly select for it. Columns in rows returned by .returning() could be returned under incorrect keys (e.g. row[SomeClass.a] returning the value of a different column), a problem most likely to manifest under concurrent workloads. ORM DELETE statements were not affected.

    References: #13439

  • [orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(), _orm.Session.bulk_update_mappings() or _orm.Session.bulk_save_objects() call could leave the _orm.Session permanently in a "flushing" state, such as when the transaction could not be begun because a previous flush had left it needing a rollback. Unlike _orm.Session.flush(), the bulk methods set the internal flushing flag and began the transaction outside of the try/finally block that resets it, so that neither _orm.Session.rollback() nor _orm.Session.close() would clear it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.

    References: #13485

  • [orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader options making use of wildcard tokens, such as _orm.load_only() or _orm.raiseload() with "*", would fail with KeyError or IndexError if the process doing the unpickling had not yet constructed a loader path making use of that same token. This would typically be observed when the object were unpickled in a separate process, such as with the spawn or forkserver multiprocessing start methods, the latter of which became the default on POSIX platforms as of Python 3.14. The internal collection of these tokens is now established up front, so that it is identical in every process.

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Open in Devin Review

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 16, 2026
opencode-agent[bot]
opencode-agent Bot requested changes Aug 18, 2026
View reviewed changes

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

  • Problem: Failed same-head checks remain for afd9a886ff569cd64f9cf41a3bb0af586b6fe064.
  • Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
  • Fix: Read and fix the failed check logs below, then rerun the current-head checks.
  • Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Backend: pyproject.toml"]
  S1 --> I1["API and service runtime"]
  I1 --> R1["Review risk: Backend: pyproject.toml"]
  R1 --> V1["backend tests"]
Loading

@opencode-agent

opencode-agent Bot commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

OpenCode Review Overview

  • Head SHA: afd9a886ff569cd64f9cf41a3bb0af586b6fe064
  • Workflow run: 32128008350
  • Workflow attempt: 1
  • Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

  • Problem: Failed same-head checks remain for afd9a886ff569cd64f9cf41a3bb0af586b6fe064.
  • Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
  • Fix: Read and fix the failed check logs below, then rerun the current-head checks.
  • Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Backend: pyproject.toml"]
  S1 --> I1["API and service runtime"]
  I1 --> R1["Review risk: Backend: pyproject.toml"]
  R1 --> V1["backend tests"]
Loading

@seonghobae
seonghobae enabled auto-merge August 20, 2026 05:44
@dependabot @seonghobae
chore(deps): update sqlalchemy requirement in /backend
c87982f 
Updates the requirements on [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) to permit the latest version.
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

---
updated-dependencies:
- dependency-name: sqlalchemy
  dependency-version: 2.0.52
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@seonghobae
seonghobae force-pushed the dependabot/pip/backend/sqlalchemy-gte-2.0.52-and-lt-2.1 branch from 3c6db17 to c87982f Compare August 20, 2026 19:10
devin-ai-integration[bot]
devin-ai-integration Bot reviewed Aug 20, 2026
View reviewed changes

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 1 potential issue.

Open in Devin Review

Comment thread backend/pyproject.toml
"pydantic>=2.13.4",
"pydantic-settings>=2.14.2",
"sqlalchemy[asyncio]>=2.0.51,<2.1",
"sqlalchemy[asyncio]>=2.0.52,<2.1",

@devin-ai-integration devin-ai-integration Bot Aug 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Dependency version bump not reflected in lockfiles, breaking installs and CI

The required version of the database library is raised (sqlalchemy[asyncio]>=2.0.52,<2.1 at backend/pyproject.toml:19) without regenerating the hash-locked lists, which still pin the old 2.0.51, so hash-locked installs and CI fail with an unsatisfiable version conflict.

Impact: Continuous integration and reproducible installs break because the pinned version no longer satisfies the declared minimum.

Lockfiles still pin 2.0.51 while pyproject requires >=2.0.52

The repo rules (AGENTS.md / CLAUDE.md) state that when changing dependencies in backend/pyproject.toml, both backend/requirements.lock and backend/requirements-dev.lock must be regenerated with uv --generate-hashes. CI installs backend deps with pip install --require-hashes -r requirements-dev.lock, and pip install -e . (or dependency-review) validates against pyproject.toml.

Both lockfiles still contain sqlalchemy==2.0.51 (backend/requirements.lock:1315, backend/requirements-dev.lock:1637), which does not satisfy the new constraint >=2.0.52,<2.1. This produces a resolution/conflict error and leaves supply-chain pinning inconsistent.

Fix: regenerate both lockfiles, e.g.
uv pip compile backend/pyproject.toml --python-version 3.10 --generate-hashes -o backend/requirements.lock
uv pip compile backend/pyproject.toml --python-version 3.10 --generate-hashes --extra dev -o backend/requirements-dev.lock

Prompt for agents 
backend/pyproject.toml now requires sqlalchemy[asyncio]>=2.0.52,<2.1, but backend/requirements.lock (line 1315) and backend/requirements-dev.lock (line 1637) still pin sqlalchemy==2.0.51 with hashes. Per AGENTS.md/CLAUDE.md, both lockfiles must be regenerated whenever dependencies in pyproject.toml change, since CI uses pip install --require-hashes and the pinned 2.0.51 no longer satisfies >=2.0.52. Regenerate both lockfiles with uv --generate-hashes (the requirements-dev.lock with --extra dev) so sqlalchemy and any transitively affected packages/hashes are updated to a 2.0.52+ version.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@opencode-agent
opencode-agent Bot disabled auto-merge August 20, 2026 19:32
@opencode-agent opencode-agent Bot added area: data Database, schema, migration, ETL, or lineage priority: medium Normal-priority or P2 work status: needs-review Open pull request requiring current-head review or checks type: maintenance Maintenance, build, dependency, or operational upkeep labels Aug 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@devin-ai-integration devin-ai-integration[bot] devin-ai-integration[bot] left review comments
@opencode-agent opencode-agent[bot] opencode-agent[bot] requested changes

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

area: data Database, schema, migration, ETL, or lineage dependencies Pull requests that update a dependency file priority: medium Normal-priority or P2 work python Pull requests that update python code status: needs-review Open pull request requiring current-head review or checks type: maintenance Maintenance, build, dependency, or operational upkeep

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants