Bump falkordb from 1.2.2 to 1.4.0

[dependabot]

Bumps falkordb from 1.2.2 to 1.4.0.

Release notes

Sourced from falkordb's releases.

v1.4.0

What's Changed

• Update dependencies versions and remove EOL python versions by @​gkorland in FalkorDB/falkordb-py#145

• Fix Path.str() TypeError when edge.id is None by @​Copilot in FalkorDB/falkordb-py#144

Full Changelog: FalkorDB/falkordb-py@v1.2.2...v1.4.0

Commits

• fe85af5 Merge pull request #145 from FalkorDB/gkorland-patch-1
• 5f4bb8c Update pyproject.toml
• 4ba3271 Update test.yml
• 90dfb98 Update dependencies versions
• 0f04009 Merge pull request #102 from wilhelmagren/tests/improve-coverage
• 46f804f Remove unnecessary string equality assertion
• 292c810 Update test_path.py
• 5534d24 Fix path string representation in test
• f4b92c3 Update test_path.py
• 357e19e Merge branch 'main' into tests/improve-coverage
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[overcut-ai]

Completed Working on "Code Review"

✅ Workflow completed successfully.

---

👉 View complete log

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/falkordb	1.4.0	Unknown	Unknown
pip/redis	7.1.0	🟢 6.8	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Security-Policy ⚠️ 0 security policy file not detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Vulnerabilities 🟢 4 6 existing vulnerabilities detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool is run on all commits

Scanned Files

• Pipfile.lock

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[overcut-ai]

Review summary

• BLOCKER: 0
• CRITICAL: 0
• MAJOR: 1
• MINOR: 0
• SUGGESTION: 0
• PRAISE: 0

Key themes

1. The redis client jump to 7.1.0 changes the async connection-pool internals that power FalkorDB bootstrap, yet we have zero test coverage exercising those redis paths, so we could ship a silent regression.

Next steps
Add an integration/regression test that instantiates the redis/FalkorDB connection (fakeredis or live) and proves the async pool still works on 7.1, or keep redis pinned to 6.4.0 until that coverage exists.

[overcut-ai]

[major]: Redis client bump lacks coverage

@@ Pipfile.lock:2303 @@
"redis": {
"markers": "python_version >= '3.10'",
"version": "==7.1.0"
}

This lock refresh upgrades redis from 6.4.0 to the 7.x line, which changes the async client internals that power redis.asyncio.BlockingConnectionPool in api/extensions.py for every FalkorDB connection, yet the test suite never touches redis/fakeredis (no occurrences under tests/). Without any automated coverage the upgrade could silently break cache/bootstrap flows and would only surface in production. Please add a regression/integration test that instantiates the redis connection (e.g. via fakeredis or a FalkorDB container) and exercises the path, or pin redis back to 6.4.0 until such a test exists.

Suggested fix: Add a test under tests/ that imports api.extensions.db (or uses fakeredis) and verifies a query succeeds through redis.asyncio.BlockingConnectionPool, or keep redis pinned to 6.4.0 until that coverage exists.

[overcut-ai]

Bumping redis to 7.1.0 is more than a patch update: 7.x reworked the asyncio connection pools (redis.asyncio.BlockingConnectionPool) that we use in api/extensions.py to bootstrap every FalkorDB connection. Our current test suite never exercises those redis/fakeredis paths (no tests reference redis at all), so this change could introduce regressions that only show up in production when the async pool semantics diverge. Please either (1) add an integration/regression test that instantiates the FalkorDB redis connection (fakeredis or a live container) and proves queries still succeed on 7.1, or (2) keep redis pinned at 6.4.0 until we have coverage. Without one of those safeguards we have no signal that the upgrade is safe.