wrolpi/.github/dependabot.yml
lrnselfreliance dab333124e
Upgrade to SQLAlchemy 2.0 (synchronous) (#803)
SQLAlchemy 1.3 has been end-of-life since 2021, and alembic was held at 1.10
because newer releases need SQLAlchemy 2.  This is a mechanical port; the code
stays synchronous.

- SQLAlchemy[asyncio]==2.0.54, alembic==1.20.0.
- Model annotations use Mapped[...] (2.0 rejects bare annotations on mapped
  attributes); declarative_base moves to sqlalchemy.orm.
- Plain SQL strings go through text() or exec_driver_sql; schema_ddl.execute_sql
  accepts a SQLAlchemy Connection or a raw sqlite3 connection, so rebuild_fts
  works from the baseline migration again.
- Session.get replaces Query.get; session.in_transaction() replaces
  session.transaction; cache_ok on MediaPathType and FancyJSON.
- The tag-directory sync query joins through TagFile's relationships instead of
  the legacy two-entity outerjoin.
- Section-hint rows use attribute access (2.0 rows are tuples).
- Migrations run on an AUTOCOMMIT connection, matching 1.3, where each
  statement committed on its own.  2.0 autobegins, so the unique-stem
  migration's read snapshot could not become a writer after its helpers wrote
  on another connection ("database is locked").  The begin listener emits no
  BEGIN for AUTOCOMMIT connections.
- Newer alembic compares column types: WrolpiKV now describes the TEXT table
  its migration created.
- The test database installs its DDL inside engine.begin(); 2.0 connections
  no longer autocommit, so the FTS tables were rolled back.
- Dependabot now holds SQLAlchemy at 2.0 instead of 1.3.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-09 15:08:40 -06:00

87 lines
2.9 KiB
YAML

version: 2
updates:
# Python - root (requirements.txt)
- package-ecosystem: "pip"
directory: "/"
schedule:
interval: "monthly"
target-branch: "master"
open-pull-requests-limit: 5
ignore:
# SQLAlchemy 2.1 is a minor release with its own deprecations; upgrade it
# deliberately rather than by an automatic bump.
- dependency-name: "SQLAlchemy"
versions: [">=2.1"]
groups:
python-dependencies:
patterns:
- "*"
update-types:
- "patch"
- "minor"
# Python - controller
- package-ecosystem: "pip"
directory: "/controller"
schedule:
interval: "monthly"
target-branch: "master"
open-pull-requests-limit: 5
groups:
controller-dependencies:
patterns:
- "*"
update-types:
- "patch"
- "minor"
# npm - app
- package-ecosystem: "npm"
directory: "/app"
schedule:
interval: "monthly"
target-branch: "master"
open-pull-requests-limit: 5
ignore:
# Major upgrades below need their own migration branch, not a bump PR.
# maplibre-gl 6: /map build depends on pinned babel/terser handling.
- dependency-name: "maplibre-gl"
versions: [">=6"]
# react-dropzone 15+ changed the accept API; 20 requires Node >=22.
- dependency-name: "react-dropzone"
versions: [">=15"]
# React 19: @react-three/fiber 8 pins react <19.
- dependency-name: "react"
update-types: ["version-update:semver-major"]
- dependency-name: "react-dom"
update-types: ["version-update:semver-major"]
- dependency-name: "@types/react"
update-types: ["version-update:semver-major"]
- dependency-name: "@types/react-dom"
update-types: ["version-update:semver-major"]
# TypeScript 6+/7 breaks the react-scripts toolchain.
- dependency-name: "typescript"
versions: [">=6"]
# Mantine 9: all @mantine packages move together with app code changes.
- dependency-name: "@mantine/*"
update-types: ["version-update:semver-major"]
# Cypress 16 requires Node >=22; CI and the app image run Node 20.
- dependency-name: "cypress"
versions: [">=16"]
# react-router 8 is a routing migration across ~40 files.
- dependency-name: "react-router"
update-types: ["version-update:semver-major"]
# @testing-library/react 14+ async act semantics break menu/popover tests.
- dependency-name: "@testing-library/react"
update-types: ["version-update:semver-major"]
# Cypress component testing resolves the top-level webpack-dev-server and only
# accepts major 5; 6 crashes cypress.config.js ("Unexpected major version").
- dependency-name: "webpack-dev-server"
versions: [">=6"]
groups:
npm-dependencies:
patterns:
- "*"
update-types:
- "patch"
- "minor"