Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 13, 2025

Updates the requirements on duckdb to permit the latest version.

Release notes

Sourced from duckdb's releases.

Python DuckDB v1.4.2

This is a bug fix release for various issues discovered after we released v1.4.1.

Also see the DuckDB v1.4.2 Changelog.

What's Changed

Full Changelog: duckdb/duckdb-python@v1.4.1...v1.4.2

Changelog

Sourced from duckdb's changelog.

Changelog

v1.4.1

DuckDB Core: v1.4.1

Bug Fixes

  • ADBC Driver: Fixed ADBC driver implementation (#81)
  • SQLAlchemy compatibility: Added __hash__ method overload (#61)
  • Error Handling: Reset PyErr before throwing Python exceptions (#69)
  • Polars Lazyframes: Fixed Polars expression pushdown (#102)

Code Quality Improvements & Developer Experience

  • MyPy Support: MyPy is functional again and better integrated with the dev workflow
  • Stubs: Re-created and manually curated stubs for the binary extension
  • Type Shadowing: Deprecated typing and functional modules
  • Linting & Formatting: Comprehensive code quality improvements with Ruff
  • Type Annotations: Added missing overloads and improved type coverage
  • Pre-commit Integration: Added ruff, clang-format, cmake-format and mypy configs
  • CI/CD: Added code quality workflow
Commits
  • 70380a1 Submodule at 68d7555 for 1.4.2 release
  • 13827e7 Fix InsertRelation on attached database (#155)
  • 7ccc8e9 Add explicit .pl(lazy=True) overload (#172)
  • 20bfd52 review feedback
  • 10e0ef3 Add explicit polars overloads
  • 95a9968 Fix InsertRelation on attached database
  • f3b8c8a Bumped submodule
  • f5618a3 Bumped submodule
  • 17a0cad remove experimental import because of the transitive dependencies that requires
  • e35a2ce mypy shouldn't check experimental.spark
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot added bot Automated pull requests or issues dependabot Pull requests from Dependabot dependencies Pull requests that update a dependency file skip:test:long_running Skip long-running tests (≥5min) labels Nov 13, 2025
@dependabot dependabot bot added dependencies Pull requests that update a dependency file bot Automated pull requests or issues dependabot Pull requests from Dependabot skip:test:long_running Skip long-running tests (≥5min) labels Nov 13, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Nov 13, 2025

Claude encountered an error —— View job


I'll analyze this and get back to you.

@dependabot dependabot bot force-pushed the dependabot/pip/duckdb-gte-0.10.0-and-lte-1.4.2 branch from 0ae7bee to 76cf555 Compare November 13, 2025 20:57
@github-actions
Copy link
Contributor

github-actions bot commented Nov 13, 2025

Claude encountered an error —— View job


I'll analyze this and get back to you.

Updates the requirements on [duckdb](https://github.com/duckdb/duckdb-python) to permit the latest version.
- [Release notes](https://github.com/duckdb/duckdb-python/releases)
- [Changelog](https://github.com/duckdb/duckdb-python/blob/main/CHANGELOG.md)
- [Commits](duckdb/duckdb-python@v1.3.0...v1.4.2)

---
updated-dependencies:
- dependency-name: duckdb
  dependency-version: 1.4.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/pip/duckdb-gte-0.10.0-and-lte-1.4.2 branch from 76cf555 to 31bc6ba Compare November 19, 2025 22:34
@github-actions
Copy link
Contributor

github-actions bot commented Nov 19, 2025

Claude encountered an error —— View job


I'll analyze this and get back to you.

@github-actions
Copy link
Contributor

github-actions bot commented Nov 22, 2025

Claude finished @dependabot[bot]'s task —— View job


✅ DuckDB Dependency Update Review Complete

Summary

This is a safe and recommended dependency update from DuckDB v1.4.1 to v1.4.2 (patch release).

Change Analysis

Modified File: pyproject.toml (line 96)

- "duckdb>=0.10.0,<=1.4.1",
+ "duckdb>=0.10.0,<=1.4.2",

Impact Assessment

1. Scope of Usage ✅

  • Limited Impact: DuckDB is only used in src/aignostics/third_party/idc_index.py (6 import statements)
  • Purpose: IDC (Imaging Data Commons) dataset indexing and querying
  • No breaking changes expected for this localized use case

2. DuckDB v1.4.2 Changes (Bug Fix Release)

Key Improvements:

  • Python 3.14 support added (future-proofing)
  • ADBC driver path resolution fix when importlib.util not loaded
  • Config dict value typehint fix (type safety improvement)
  • Polars integration fixes (.pl(lazy=True) overload, DataFrame column handling)
  • InsertRelation fix for attached databases
  • Spark imports fix (transitive dependencies)

Breaking Changes: ❌ None identified

All changes are bug fixes and enhancements with no API-breaking modifications.

Validation Results

✅ Code Quality (All Passed)

make lint
  • ✅ Ruff formatting: 152 files already formatted
  • ✅ Ruff linting: 0 errors, 0 warnings
  • ✅ PyRight: No issues found
  • ✅ MyPy: Success (79 source files)

✅ Test Execution

uv run pytest tests/aignostics/dataset/cli_test.py::test_cli_idc_indices -v
  • Test passed in 8.94s with 24% coverage
  • ✅ DuckDB functionality verified working with v1.4.2

✅ Architecture Compliance

  • No architectural changes required
  • Dependency update only affects dataset module (IDC functionality)
  • Modulith boundaries maintained

✅ CI/CD Status

  • 4 workflows triggered (CI/CD, Build Native, Claude Code)
  • ✅ SonarQube Quality Gate: Passed (0 new issues, 0 security hotspots)

Security & Compliance

✅ No Security Issues

  • Patch version bump (1.4.1 → 1.4.2)
  • No known CVEs in either version
  • Bug fixes improve stability

✅ License Compliance

  • DuckDB: MIT License (compatible with this project's MIT license)
  • No license changes in v1.4.2

Recommendations

APPROVE - Safe to Merge

Reasoning:

  1. ✅ Patch version with only bug fixes (no breaking changes)
  2. ✅ Limited scope of impact (only IDC indexing functionality)
  3. ✅ All quality checks passed (lint, type checking, tests)
  4. ✅ Improves future compatibility (Python 3.14 support)
  5. ✅ Dependabot auto-update is appropriate for this change

Post-Merge Actions

  • No action required - this is a transparent dependency update
  • Monitor CI/CD pipeline for any edge cases in full test suite
  • Consider adding skip:test_long_running label if PR tests are taking too long

Additional Notes

Known Issue (Unrelated to This PR)

There is a test collection error in tests/aignostics/platform/e2e_test.py:

ImportError: cannot import name 'SPECIAL_APPLICATION_ID' from 'tests.constants_test'

This is a pre-existing issue on main branch and not caused by the DuckDB update.

DuckDB Version Matrix

  • Minimum supported: 0.10.0
  • Maximum supported: 1.4.2 (after this PR)
  • Python versions: 3.11, 3.12, 3.13 (and 3.14 with v1.4.2)

Review Checklist (Per CLAUDE.md)

  • Test Markers: N/A (no test changes)
  • Coverage: N/A (no code changes)
  • Linting: ✅ All checks passed
  • Conventional Commits: ✅ Dependabot commit follows convention
  • Architecture: ✅ No architectural impact
  • Testing Strategy: ✅ Existing tests validate compatibility
  • Medical Device Security: ✅ No security concerns
  • Breaking Changes: ✅ None
  • CI/CD Impact: ✅ No workflow changes
  • Documentation: ✅ No user-facing changes

Verdict: ✅ LGTM - Approve and merge when CI passes

This dependency update follows best practices and improves the SDK's compatibility and stability without introducing any risks.


@codecov
Copy link

codecov bot commented Nov 22, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

❌ Your project check has failed because the head coverage (63.43%) is below the target coverage (70.00%). You can increase the head coverage or adjust the target coverage.
see 21 files with indirect coverage changes

@sonarqubecloud
Copy link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bot Automated pull requests or issues dependabot Pull requests from Dependabot dependencies Pull requests that update a dependency file skip:test:long_running Skip long-running tests (≥5min)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants