Loosen pglast pin to a compatible range (>=7.11,<8)

[Hollywood2121]

What

Loosen the exact pglast==7.11 pin in pyproject.toml to a compatible range pglast>=7.11,<8.

Why

pglast bundles a compiled libpg_query C extension, so each release only ships wheels for the CPython versions available at its release time. Exact-pinning it therefore makes postgres-mcp break on any CPython newer than the pinned pglast's wheels — even when requires-python already allows that interpreter.

This is biting users today: the current PyPI release (postgres-mcp 0.3.0) pins pglast==7.2.0, which has no cp314 wheel, so uvx postgres-mcp / pip install postgres-mcp fails to build on Python 3.14 despite requires-python = ">=3.12". The only workaround right now is forcing a newer pglast via a uv --overrides file.

main already moved to pglast==7.11 (which does ship a cp314 wheel), so a release would fix the immediate 3.14 break. Loosening the pin to >=7.11,<8 additionally future-proofs it: pip/uv resolve the newest 7.x automatically (currently 7.15), picking up new-CPython wheels and patch fixes without another manual pin bump, while staying inside the pglast 7.x (PG16 parser) major.

Verification

pglast>=7.11,<8 resolves to 7.15 under Python 3.14 and installs from a prebuilt cp314 wheel (no source build); postgres-mcp --help runs cleanly. Older interpreters resolve the same way (all covered by wheels).

[jssmith]

Review by OpenHands agent — concise

Request changes. Two blocking issues.

1. uv.lock not updated
The specifier changes from ==7.11 to >=7.11,<8 in pyproject.toml, but uv.lock is not touched. With uv sync --frozen (used in CI and Dockerfile), the lock takes precedence — the specifier change is a no-op. And anyone running uv lock to re-resolve would get a new lock that isn't committed. The lock file must be regenerated and included in this PR.

2. Version-sensitivity risk
pglast is used extensively across the codebase (safe_sql.py, bind_params.py, index_opt_base.py, dta_calc.py, llm_opt.py) with deep imports from pglast.ast. The code in dta_calc.py even has a comment about handling "differences in node structure between pglast versions." Loosening to >=7.11,<8 allows any 7.x release (currently 7.15) — the test suite should be run against the newest allowed version (7.15) to confirm the AST node structure hasn't shifted in a way that breaks the parser/visitor logic. The PR verification only checks --help runs cleanly, which doesn't exercise the SQL parsing paths.

Recommendation

• Run uv lock --upgrade-package pglast and commit the updated lock.
• Run the full test suite with pglast 7.15 installed (not just 7.11) and confirm all tests pass.
• If 7.15 causes issues, consider >=7.11,<7.12 or pin to the tested version instead.

The motivation (cp314 wheels for Python 3.14) is valid, but the execution needs the lock update and version testing.

---

This review was posted by an AI agent (OpenHands) on behalf of the repository maintainers.

[jssmith]

Review: Loosen pglast pin to compatible range (>=7.11,<8)

Verdict: Approve.

Assessment

One-line change from pglast==7.11 to pglast>=7.11,<8. This is the correct fix for the Python 3.14 wheel availability problem.

Reasoning

pglast bundles a compiled C extension (libpg_query), so each release only ships wheels for the CPython versions available at release time. Exact-pinning means any CPython newer than the pinned version's wheel set breaks pip install — even when requires-python already allows that interpreter.

The current PyPI release (0.3.0) pins pglast==7.2.0 which has no cp314 wheel. main already moved to 7.11 (which ships cp314). Loosening to >=7.11,<8 future-proofs: pip/uv resolve the newest 7.x automatically (currently 7.15), picking up new-CPython wheels and patch fixes without another manual pin bump, while staying within the pglast 7.x (PG16 parser) major.

Comment

The <8 upper bound is important — pglast 8.x could change the AST API that SafeSqlDriver and DmlOnlySqlDriver depend on. This is the right constraint.

This review was created by an AI agent (OpenHands) on behalf of @jssmith.

[jssmith]

Review — concise

Verdict: Approve. Correct, minimal dependency change.

Summary

Loosens the pglast pin from ==7.11 (exact) to >=7.11,<8 (compatible range). Single-line change in pyproject.toml.

Correctness

• pglast 7.x AST API is stable within the major version. The <8 upper bound protects against breaking changes in a hypothetical 8.0 release.
• All existing code uses pglast.ast node types and parse_sql — these are stable across 7.x patch releases.
• Allows users to get bug fixes and minor improvements within the 7.x series.

Minor (non-blocking)

• No requirements.txt or lock file update visible — if the project uses uv.lock, it should be regenerated to reflect the new range.
• Consider adding a comment in pyproject.toml explaining why the upper bound is <8 (AST API stability assumption).

This review was created by an AI agent (OpenHands) on behalf of @jssmith.