[dependabot]

Summary

I qualified SQLAlchemy 2.1 and narrowed this update to sqlalchemy[asyncio]>=2.1.4,<2.2, rather than claiming one application typing/runtime contract across both 2.0 and 2.1.

• Adapt typing to the 2.1 API without changing SQL, query behavior or transaction ownership.
• Use structured SQLite URL fields for import session selection and legacy scheduler sidecar paths. SQLAlchemy 2.1 now escapes the database portion when rendering URLs, which broke literal :memory: detection and encoded filesystem paths.
• Add regression coverage for real memory/file-backed session isolation, URL parsing, autoflush admission and lock ordering, including separately executed PostgreSQL checks.

Existing commits, rollbacks, savepoints, flush/no-autoflush scopes, migrations, test cases, worker counts, coverage gates and security policy are preserved. The live instance and recovery worktree were not changed.

Validation

The final test-only follow-up keeps three PostgreSQL URL negative cases independent of optional asyncpg; real SQLAlchemy URLs, all original assertions/cases, and every real SQLite engine/isolation check remain. I reproduced the driver-import dependency, confirmed the backend-negative assertions still fail for deliberately broken classification, and ran all 58 owning cases plus the full local pipeline in a separate environment without asyncpg. The driver remained absent after validation. Production transaction/autoflush behavior is unchanged.

• Four representative failures reproduced on SQLAlchemy 2.1; the same cases passed on 2.0. After the URL correction, all 23 failures from the first full run passed.
• Import owning suites: 418 passed. Scheduler owning suites: 72 passed. Strict typing: 853 source files passed.
• Autoflush/admission checks: eight passed, including two real PostgreSQL cases; deliberate gate-bypass and lock-exclusion controls failed as expected.
• Full local make ci-full: exit 0, including Docker.
  • Main: 15,883 passed, 1,592 skipped, one expected failure; production coverage 91.67% against the unchanged 90% gate.
  • Accessibility: 26 passed.
  • Chromium and Firefox: 742 passed and two skipped each.
  • Production Docker build, runtime security checks, unchanged Grype High gate and seven smoke tests passed.
• Independent source and complete-log audits found no blocking issue. All original main test identities remain, plus 53 approved URL regression cases; browser identities/outcomes are unchanged.

The local Docker build used native ARM64 with cached native/OS layers and a rebuilt application environment containing SQLAlchemy 2.1.4; it is not fresh AMD64 or multi-architecture qualification. Existing lower-severity Grype findings and npm/Bandit advisories remain. Coverage remains above the gate, but individual line coverage is not claimed identical.

Remote exact-head required checks remain the final merge gate. The Dependabot branch's public Docker sanity workflow is distinct from the locally validated production image/runtime security checks.

[dependabot]

Labels

The following labels could not be found: python. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.