Modernize dependencies for SQLAlchemy 2.x, Flask 3.x, and Python 3.9-3.13

.github/workflows/code-quality.yaml

@@ -18,25 +18,16 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
-        python-version: [3.7, 3.8, 3.9]
-        exclude:
-          - os: windows-latest
-            python-version: 3.7
-          - os: windows-latest
-            python-version: 3.8
-          - os: macos-latest
-            python-version: 3.7
-          - os: macos-latest
-            python-version: 3.8
+        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v2.3.4
+      - uses: actions/checkout@v4
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v2.2.2
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install poetry
         run: pip install poetry
-      - uses: actions/cache@v2.1.6
+      - uses: actions/cache@v4
         id: cache-poetry
         with:
           path: ~/.virtualenvs
@@ -48,10 +39,10 @@ jobs:
       - name: Install dependencies
         if: steps.cache-poetry.outputs.cache-hit != 'true'
         run: |
-          poetry install
+          poetry install --all-extras
       - name: Test with pytest
         run: |
-          poetry run pytest || (poetry install && poetry run pytest)
+          poetry run pytest || (poetry install --all-extras && poetry run pytest)
       - name: Test the examples
         run: |
           poetry run ./tests/test_examples
@@ -64,14 +55,14 @@ jobs:
           - poetry run bandit -r open_alchemy -s B101,B303,B310
           - poetry run rstcheck -r docs
     steps:
-      - uses: actions/checkout@v2.3.4
+      - uses: actions/checkout@v4
       - name: Set up Python
-        uses: actions/setup-python@v2.2.2
+        uses: actions/setup-python@v5
         with:
-          python-version: 3.9
+          python-version: "3.12"
       - name: Install poetry
         run: pip install poetry
-      - uses: actions/cache@v2.1.6
+      - uses: actions/cache@v4
         id: cache-poetry
         with:
           path: ~/.virtualenvs
@@ -83,10 +74,10 @@ jobs:
       - name: Install dependencies
         if: steps.cache-poetry.outputs.cache-hit != 'true'
         run: |
-          poetry install
+          poetry install --all-extras
       - name: Run static code analyser
         run: |
-          ${{ matrix.command }} || (poetry install && ${{ matrix.command }})
+          ${{ matrix.command }} || (poetry install --all-extras && ${{ matrix.command }})
 
   staticNode:
     runs-on: ubuntu-latest
@@ -96,11 +87,11 @@ jobs:
           - npx cspell "open_alchemy/**/*.py" "open_alchemy/**/*.json" "open_alchemy/**/*.j2" "docs/**/*.rst" "docs/**/*/yml" "docs/**/*.yaml" "tests/**/*.py" "*.yaml" "*.json" "*.yml" "examples/**/*.py" "examples/**/*.yaml" "examples/**/*.yml"
           - find examples -name "*spec.yml" ! -path "*/remote/*" ! -path "*/openapi-3-1/*" | xargs -n 1 sh -c 'npx swagger-cli validate $0 || exit 255'
     steps:
-      - uses: actions/checkout@v2.3.4
+      - uses: actions/checkout@v4
       - name: Set up Node
-        uses: actions/setup-node@v2.4.0
+        uses: actions/setup-node@v4
         with:
-          node-version: 14.x
+          node-version: 20.x
       - name: Install dependencies
         run: npm install cspell @apidevtools/swagger-cli
       - name: Run static code analyser
@@ -109,12 +100,12 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2.3.4
+      - uses: actions/checkout@v4
       - name: Set up Python
-        uses: actions/setup-python@v2.2.2
+        uses: actions/setup-python@v5
         with:
-          python-version: 3.9
-      - uses: pre-commit/action@v2.0.3
+          python-version: "3.12"
+      - uses: pre-commit/action@v3.0.1
 
   build:
     runs-on: ubuntu-latest
@@ -124,14 +115,14 @@ jobs:
       - staticNode
       - staticPython
     steps:
-      - uses: actions/checkout@v2.3.4
+      - uses: actions/checkout@v4
       - name: Set up Python
-        uses: actions/setup-python@v2.2.2
+        uses: actions/setup-python@v5
         with:
-          python-version: 3.9
+          python-version: "3.12"
       - name: Install poetry
         run: pip install poetry
-      - uses: actions/cache@v2.1.6
+      - uses: actions/cache@v4
         id: cache-poetry
         with:
           path: ~/.virtualenvs
@@ -143,22 +134,22 @@ jobs:
       - name: Install dependencies
         if: steps.cache-poetry.outputs.cache-hit != 'true'
         run: |
-          poetry install
+          poetry install --all-extras
       - name: Build packages
         run: poetry build
       - name: Upload artifacts for release
         if: startsWith(github.ref, 'refs/tags/')
-        uses: actions/upload-artifact@v2.2.4
+        uses: actions/upload-artifact@v4
         with:
           name: wheel
           path: dist/
       - name: Build the documentation
         run: |
           cd docs
-          poetry run make html || (poetry install && poetry run make html)
+          poetry run make html || (poetry install --all-extras && poetry run make html)
       - name: Upload documentation for release
         if: startsWith(github.ref, 'refs/tags/')
-        uses: actions/upload-artifact@v2.2.4
+        uses: actions/upload-artifact@v4
         with:
           name: docs
           path: docs/build/html/
@@ -170,12 +161,12 @@ jobs:
       - build
     steps:
       - name: Retrieve packages
-        uses: actions/download-artifact@v2.0.10
+        uses: actions/download-artifact@v4
         with:
           name: wheel
           path: dist/
       - name: Publish distribution 📦 to Test PyPI
-        uses: pypa/gh-action-pypi-publish@v1.4.2
+        uses: pypa/gh-action-pypi-publish@release/v1
         with:
           password: ${{ secrets.test_pypi_password }}
           repository_url: https://test.pypi.org/legacy/
@@ -186,11 +177,11 @@ jobs:
     needs:
       - release-test-pypi
     steps:
-      - uses: actions/checkout@v2.3.4
+      - uses: actions/checkout@v4
       - name: Set up Python
-        uses: actions/setup-python@v2.2.2
+        uses: actions/setup-python@v5
         with:
-          python-version: 3.9
+          python-version: "3.12"
       - name: install pipenv
         run: |
           python -m pip install --upgrade pip
@@ -217,13 +208,13 @@ jobs:
       - test-production-test-pypi
     steps:
       - name: Retrieve packages
-        uses: actions/download-artifact@v2.0.10
+        uses: actions/download-artifact@v4
         with:
           name: wheel
           path: dist/
       - name: Publish distribution 📦 to PyPI
         if: startsWith(github.ref, 'refs/tags')
-        uses: pypa/gh-action-pypi-publish@v1.4.2
+        uses: pypa/gh-action-pypi-publish@release/v1
         with:
           password: ${{ secrets.pypi_password }}
           repository_url: https://upload.pypi.org/legacy/
@@ -234,11 +225,11 @@ jobs:
     needs:
       - release-pypi
     steps:
-      - uses: actions/checkout@v2.3.4
+      - uses: actions/checkout@v4
       - name: Set up Python
-        uses: actions/setup-python@v2.2.2
+        uses: actions/setup-python@v5
         with:
-          python-version: 3.9
+          python-version: "3.12"
       - name: install pipenv
         run: |
           python -m pip install --upgrade pip
@@ -269,7 +260,7 @@ jobs:
         run: |
           echo ::set-output name=current_version::${GITHUB_REF#refs/tags/v}
         shell: bash
-      - uses: actions/checkout@v2.3.4
+      - uses: actions/checkout@v4
       - name: Get latest Changelog Entry
         id: changelog_reader
         uses: mindsers/changelog-reader-action@v2

.github/workflows/periodic.yaml

@@ -14,11 +14,11 @@ jobs:
           - https://test.pypi.org/simple/
           - https://pypi.org/simple/
     steps:
-      - uses: actions/checkout@v2.3.4
+      - uses: actions/checkout@v4
       - name: Set up Python
-        uses: actions/setup-python@v2.2.2
+        uses: actions/setup-python@v5
         with:
-          python-version: 3.9
+          python-version: "3.12"
       - name: install pipenv
         run: |
           python -m pip install --upgrade pip

.pre-commit-config.yaml

@@ -13,30 +13,33 @@ repos:
         entry: "print\\((?!.*allow-print)"
         language: pygrep
         types: [python]
-  - repo: https://github.com/ambv/black
-    rev: 20.8b1
+  - repo: https://github.com/psf/black
+    rev: 24.10.0
     hooks:
       - id: black
-        language_version: python3.9
-  - repo: https://github.com/pre-commit/mirrors-isort
-    rev: v5.4.2
+        language_version: python3.12
+  - repo: https://github.com/pycqa/isort
+    rev: 5.13.2
     hooks:
       - id: isort
+  - repo: https://github.com/pycqa/flake8
+    rev: 7.1.1
+    hooks:
+      - id: flake8
+        exclude: "^example|conf.py$"
   - repo: https://github.com/chewse/pre-commit-mirrors-pydocstyle
     rev: v2.1.1
     hooks:
       - id: pydocstyle
         args: ["--add-select=D213,D404", "--ignore=D202,D212,D406,D407,D203"]
         exclude: "^test|^example"
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v0.790
+    rev: v1.11.2
     hooks:
       - id: mypy
         exclude: "^example|conf.py$"
-        additional_dependencies:
-          - "sqlalchemy-stubs"
   - repo: https://github.com/pre-commit/mirrors-pylint
-    rev: "v2.6.0"
+    rev: "v3.0.0a5"
     hooks:
       - id: pylint
         exclude: "^example|conf.py$"

.pylintrc

@@ -1,5 +1,4 @@
 [MASTER]
-init-hook='import sys; sys.path.append("/Users/davidandersson/src/odin/api")'
 
 # Specify a configuration file.
 #rcfile=
@@ -35,16 +34,6 @@ unsafe-load-any-extension=no
 # run arbitrary code
 extension-pkg-whitelist=mypy
 
-# Allow optimization of some AST trees. This will activate a peephole AST
-# optimizer, which will apply various small optimizations. For instance, it can
-# be used to obtain the result of joining multiple strings with the addition
-# operator. Joining a lot of strings can lead to a maximum recursion error in
-# Pylint and this flag can prevent that. It has one side effect, the resulting
-# AST will be different than the one from reality. This option is deprecated
-# and it will be removed in Pylint 2.0.
-optimize-ast=no
-
-
 [MESSAGES CONTROL]
 
 # Only show warnings with the listed confidence levels. Leave empty to show
@@ -67,7 +56,7 @@ enable=useless-suppression
 # no Warning level messages displayed, use"--disable=all --enable=classes
 # --disable=W"
 # disable=long-suffix,standarderror-builtin,indexing-exception,delslice-method,unichr-builtin,dict-view-method,parameter-unpacking,unicode-builtin,cmp-builtin,intern-builtin,round-builtin,backtick,nonzero-method,xrange-builtin,coerce-method,raw_input-builtin,old-division,filter-builtin-not-iterating,old-octal-literal,input-builtin,map-builtin-not-iterating,buffer-builtin,basestring-builtin,zip-builtin-not-iterating,using-cmp-argument,unpacking-in-except,old-raise-syntax,coerce-builtin,dict-iter-method,hex-method,range-builtin-not-iterating,useless-suppression,cmp-method,print-statement,reduce-builtin,file-builtin,long-builtin,getslice-method,execfile-builtin,no-absolute-import,metaclass-assignment,oct-method,reload-builtin,import-star-module-level,suppressed-message,apply-builtin,raising-string,next-method-called,setslice-method,old-ne-operator,arguments-differ,wildcard-import,locally-disabled
-disable=duplicate-code,bad-continuation,import-error,unsubscriptable-object,inherit-non-class
+disable=duplicate-code,import-error,unsubscriptable-object,inherit-non-class
 
 
 [REPORTS]
@@ -77,12 +66,6 @@ disable=duplicate-code,bad-continuation,import-error,unsubscriptable-object,inhe
 # mypackage.mymodule.MyReporterClass.
 output-format=text
 
-# Put messages in a separate file for each module / package specified on the
-# command line instead of printing them on stdout. Reports (if any) will be
-# written in a file name "pylint_global.[txt|html]". This option is deprecated
-# and it will be removed in Pylint 2.0.
-files-output=no
-
 # Tells whether to display a full report or only the messages
 reports=yes
 
@@ -204,12 +187,6 @@ ignore-long-lines=^\s*(# )?<?https?://\S+>?$
 # else.
 single-line-if-stmt=y
 
-# List of optional constructs for which whitespace checking is disabled. `dict-
-# separator` is used to allow tabulation in dicts, etc.: {1  : 1,\n222: 2}.
-# `trailing-comma` allows a space between comma and closing bracket: (a, ).
-# `empty-line` allows space-only lines.
-no-space-check=trailing-comma,dict-separator
-
 # Maximum number of lines in a module
 max-module-lines=1000
 

examples/app/models_autogenerated.py

@@ -45,14 +45,12 @@ class TEmployee(typing.Protocol):
     query: orm.Query
 
     # Model properties
-    id: "sqlalchemy.Column[int]"
-    name: "sqlalchemy.Column[str]"
-    division: "sqlalchemy.Column[str]"
-    salary: "sqlalchemy.Column[typing.Optional[float]]"
-
-    def __init__(
-        self, id: int, name: str, division: str, salary: typing.Optional[float] = None
-    ) -> None:
+    id: 'sqlalchemy.Column[int]'
+    name: 'sqlalchemy.Column[str]'
+    division: 'sqlalchemy.Column[str]'
+    salary: 'sqlalchemy.Column[typing.Optional[float]]'
+
+    def __init__(self, id: int, name: str, division: str, salary: typing.Optional[float] = None) -> None:
         """
         Construct.
 
@@ -66,9 +64,7 @@ def __init__(
         ...
 
     @classmethod
-    def from_dict(
-        cls, id: int, name: str, division: str, salary: typing.Optional[float] = None
-    ) -> "TEmployee":
+    def from_dict(cls, id: int, name: str, division: str, salary: typing.Optional[float] = None) -> "TEmployee":
         """
         Construct from a dictionary (eg. a POST payload).
 

open_alchemy/__init__.py

@@ -5,7 +5,7 @@
 import types as py_types
 import typing
 
-from sqlalchemy.ext import declarative
+from sqlalchemy.orm import declarative_base
 
 from open_alchemy import types as oa_types
 
@@ -116,7 +116,7 @@ def _init_optional_base(
 ) -> BaseAndModelFactory:
     """Wrap init_model_factory with optional base."""
     if base is None:
-        base = declarative.declarative_base()
+        base = declarative_base()
     return (
         base,
         init_model_factory(

open_alchemy/build/__init__.py

@@ -159,7 +159,7 @@ def calculate_version(*, spec: typing.Any, schemas: types.Schemas) -> TVersion:
         pass
 
     spec_str = json.dumps({"components": {"schemas": schemas}}, separators=(",", ":"))
-    return hashlib.sha1(spec_str.encode()).hexdigest()[:20]
+    return hashlib.sha1(spec_str.encode(), usedforsecurity=False).hexdigest()[:20]
 
 
 @dataclasses.dataclass