chore(deps): upgrade project dependencies

[iktakahiro]

Summary

• Upgrade sqlalchemy from 2.0.46 to 2.0.48
• Upgrade fastapi[standard] from 0.128.0 to 0.135.3
• Upgrade dev dependencies: mypy to >=1.20.0, ruff to >=0.15.9
• Add [tool.uv] settings (package = false, exclude-newer = "1 week")

Test plan

• CI passes (tests, lint, type check)
• Confirm application starts correctly with updated dependencies

Summary by CodeRabbit

• Chores
  • Updated core dependencies: FastAPI and SQLAlchemy to latest versions
  • Updated development tools (mypy, ruff) for improved code quality
  • Optimized development environment configuration

[coderabbitai]

Walkthrough

Project dependencies updated with newer versions of SQLAlchemy and FastAPI, dev tool versions bumped (mypy and ruff), and a new UV tool configuration section added. Makefile venv target now clears existing environments on creation.

Changes

Cohort / File(s)	Summary
Build Configuration Makefile	Venv target now includes --clear flag to reset virtual environment contents during creation.
Project Dependencies & Configuration pyproject.toml	Bumped SQLAlchemy to 2.0.48, FastAPI[standard] to 0.135.3, mypy to >=1.20.0, and ruff to >=0.15.9. Added [tool.uv] section with package = false and exclude-newer = "1 week". Reformatted dependency lists to multi-line format.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 With versions fresh and venvs clear,
We hop toward a better year!
Dependencies dance in neat array,
UV tools light the dev way.
Small tweaks that make the project shine ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore(deps): upgrade project dependencies' accurately summarizes the main changes: dependency upgrades in both runtime and development dependencies.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/upgrade-project-dependencies

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (2)

Makefile (1)

12-12: Use $(VENV) instead of a hardcoded .venv for consistency.

Line 12 works, but reusing the declared variable avoids drift if the environment path changes later.

Proposed small refactor

 venv:
-	uv venv .venv --clear
+	uv venv $(VENV) --clear

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@Makefile` at line 12, Replace the hardcoded ".venv" with the declared
Makefile variable by changing the invocation that currently reads "uv venv .venv
--clear" to use "$(VENV)" instead, so the target and any future changes to the
VENV variable stay consistent; locate the line containing the "uv venv"
invocation in the Makefile and swap the literal path for "$(VENV)".

pyproject.toml (1)

24-27: Good hardening defaults; add an explicit emergency override workflow.

Line 24-27 improves supply-chain posture, but please document how to bypass exclude-newer for urgent CVE patching so response time isn’t blocked.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pyproject.toml` around lines 24 - 27, Document and implement an emergency
override for the [tool.uv] exclude-newer setting: add a short entry to the repo
SECURITY or CONTRIBUTING docs that explains how to bypass exclude-newer for
urgent CVE patches, and add a CI workflow (e.g., a GitHub Actions workflow named
uv-emergency-override) that accepts an authenticated, auditable trigger (branch
label or protected workflow_dispatch with required reviewers) and sets an
environment flag to disable or shorten exclude-newer at runtime; also update
pyproject.toml comments near the exclude-newer setting to reference this
emergency process and the workflow name so maintainers know how to invoke it.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@Makefile`:
- Line 12: Replace the hardcoded ".venv" with the declared Makefile variable by
changing the invocation that currently reads "uv venv .venv --clear" to use
"$(VENV)" instead, so the target and any future changes to the VENV variable
stay consistent; locate the line containing the "uv venv" invocation in the
Makefile and swap the literal path for "$(VENV)".

In `@pyproject.toml`:
- Around line 24-27: Document and implement an emergency override for the
[tool.uv] exclude-newer setting: add a short entry to the repo SECURITY or
CONTRIBUTING docs that explains how to bypass exclude-newer for urgent CVE
patches, and add a CI workflow (e.g., a GitHub Actions workflow named
uv-emergency-override) that accepts an authenticated, auditable trigger (branch
label or protected workflow_dispatch with required reviewers) and sets an
environment flag to disable or shorten exclude-newer at runtime; also update
pyproject.toml comments near the exclude-newer setting to reference this
emergency process and the workflow name so maintainers know how to invoke it.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: c2d80770-95ac-4ff1-ba9a-4323628dcc44

📥 Commits

Reviewing files that changed from the base of the PR and between 19d3f58 and 7ee766d.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• Makefile
• pyproject.toml