chore(deps): bump @mikro-orm/sqlite from 6.6.14 to 6.6.15

[dependabot]

Bumps @mikro-orm/sqlite from 6.6.14 to 6.6.15.

Release notes

Sourced from @​mikro-orm/sqlite's releases.

v6.6.15

6.6.15 (2026-06-17)

Bug Fixes

• core: avoid crash on STI subclass narrowing an inverse collection (#7868) (49d73a5), closes #7636 #7867
• core: avoid stack overflow in IdentityMap.keys()/values() for large maps (#7849) (a3db208)
• core: preserve sibling conditions next to $and/$or on relation filters (#7791) (5c5e4c9), closes #7790
• core: reload suppressed entities from partially-suppressed upsertMany (#7780) (65e1967), closes #7779 #7775
• knex: resolve target entity schema in nested collection operators (#7898) (6040aa1), closes #7895 #7894

Changelog

Sourced from @​mikro-orm/sqlite's changelog.

6.6.15 (2026-06-17)

Bug Fixes

• core: avoid crash on STI subclass narrowing an inverse collection (#7868) (49d73a5), closes #7636 #7867
• core: avoid stack overflow in IdentityMap.keys()/values() for large maps (#7849) (a3db208)
• core: preserve sibling conditions next to $and/$or on relation filters (#7791) (5c5e4c9), closes #7790
• core: reload suppressed entities from partially-suppressed upsertMany (#7780) (65e1967), closes #7779 #7775
• knex: resolve target entity schema in nested collection operators (#7898) (6040aa1), closes #7895 #7894

Commits

• 7b194c2 chore(release): v6.6.15 [skip ci]
• 96e2f0f test: cover multi-element array operator nested under a relation (#7901)
• 6040aa1 fix(knex): resolve target entity schema in nested collection operators (#7898)
• 49d73a5 fix(core): avoid crash on STI subclass narrowing an inverse collection (#7868)
• a3db208 fix(core): avoid stack overflow in IdentityMap.keys()/values() for large maps...
• 5c5e4c9 fix(core): preserve sibling conditions next to $and/$or on relation filte...
• 65e1967 fix(core): reload suppressed entities from partially-suppressed upsertMany (#...
• 3e50f3a chore(ci): stop tagging v6 releases as latest (#7666)
• 4ece4fa chore(release): update internal dependencies [skip ci]
• See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
@mikro-orm/sqlite	[>= 7.a, < 8]

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2c233a2398

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Keep MikroORM packages on the same version

When the ADK DatabaseSessionService initializes in server/agent/http.ts:createDefaultAgentHandler, it calls MikroORM.init(), whose package-version guard rejects official @mikro-orm/* packages that do not exactly match @mikro-orm/core. This line installs @mikro-orm/sqlite 6.6.15 while the previous line leaves @mikro-orm/core at 6.6.14, so the agent sidecar/session tests fail as soon as the SQLite session store initializes; bump core/reflection with the driver or keep sqlite at 6.6.14.

Useful? React with 👍 / 👎.

[helebest]

Automated Dependabot review — ⛔ stopped (fail-fast)

Step 1 — Code review

• Change: @mikro-orm/sqlite 6.6.14 → 6.6.15 (patch, direct production dependency). It backs ADK's DatabaseSessionService (sqlite-persisted agent sessions). The PR bumps only @mikro-orm/sqlite; @mikro-orm/core stays at 6.6.14.

Step 2/3 — Regression + CI: ❌ FAILED

• CI run 28695932564 failed: 13 tests failed across server/agent/adkSessionStore.test.ts, contextCompaction.integration.test.ts, and http.test.ts.
• Root cause is a hard runtime error at MikroORM.init:

  Error: Bad @mikro-orm/sqlite version 6.6.15.
  All official @mikro-orm/* packages need to have the exact same version as @mikro-orm/core (6.6.14).
  

  MikroORM enforces an exact-version lockstep across all @mikro-orm/* packages at runtime (stricter than the ^6.0.0 peer range). With sqlite at 6.6.15 and core still at 6.6.14, every DatabaseSessionService.init() throws, so session create/get and the agent HTTP surface break.

Step 4 — Decision: Not merged. Per fail-fast, stopping here.

To unblock: bump @mikro-orm/core (and any other installed @mikro-orm/* packages) to 6.6.15 in lockstep within this PR. Dependabot's grouping should ideally keep the MikroORM packages together; a standalone @mikro-orm/sqlite bump is inherently incompatible while core lags.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — ❌ blocked, not merged

Step 1 — Code review
Bumps @mikro-orm/sqlite 6.6.14 → 6.6.15 (package.json + package-lock.json only). Description matches the diff.

Step 2/3 — Regression / CI: FAILED
The required Verify job failed in the server unit tests (server/agent/http.test.ts) with a runtime MikroORM error:

All official @mikro-orm/* packages need to have the exact same version as @mikro-orm/core (6.6.14).
 ❯ ConfigurationLoader.checkPackageVersion node_modules/@mikro-orm/core/utils/ConfigurationLoader.js:359
 ❯ MikroORM.init ...
 ❯ DatabaseSessionService.init node_modules/@google/adk/.../database_session_service.js
 ...
AssertionError: expected 500 to be 200   (server/agent/http.test.ts:396)

Root cause: MikroORM enforces that every @mikro-orm/* package matches @mikro-orm/core exactly. This PR raises @mikro-orm/sqlite to 6.6.15 while @mikro-orm/core stays pinned at 6.6.14, so MikroORM.init (invoked by ADK's DatabaseSessionService, which backs the agent's sqlite session store) throws checkPackageVersion at runtime. The agent HTTP handlers then return 500 and the tests fail. Bumping @mikro-orm/sqlite in isolation is not a valid upgrade for this package family.

Step 4 — Decision: not merging (fail-fast).
The fix is to bump @mikro-orm/core and @mikro-orm/sqlite together to 6.6.15 (ideally via a Dependabot group so the two always move in lockstep, or a single paired bump). Holding this PR until core is bumped to match.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — ⛔ Blocked, not merged

Step 1 — Code review

Scope is clean (only package.json + package-lock.json): @mikro-orm/sqlite 6.6.14 → 6.6.15, pulling its transitive @mikro-orm/knex to 6.6.15. The upstream 6.6.15 release is bug-fix-only (STI subclass crash, IdentityMap stack overflow, relation-filter $and/$or, upsertMany, knex nested collection operators) — no breaking API changes. On its own the bump is desirable.

Step 2/3 — Regression & CI

The required Verify check is ❌ failing — this is a genuine incompatibility, not a flake, so per the fail-fast policy this PR is not being merged.

MikroORM enforces strict version lockstep: every official @mikro-orm/* package must be the exact same version as @mikro-orm/core. This PR bumps @mikro-orm/sqlite to 6.6.15 but leaves @mikro-orm/core pinned at 6.6.14, so MikroORM.init() — reached through ADK's DatabaseSessionService in the chat-agent session store — throws at runtime:

Error: Bad @mikro-orm/sqlite version 6.6.15.
All official @mikro-orm/* packages need to have the exact same version as @mikro-orm/core (6.6.14).
  ❯ ConfigurationLoader.checkPackageVersion node_modules/@mikro-orm/core/utils/ConfigurationLoader.js:359
  ❯ MikroORM.init node_modules/@mikro-orm/core/MikroORM.js:29
  ❯ DatabaseSessionService.init  (@google/adk)
  ❯ AdkSessionStore.createSession server/agent/adkSessionStore.ts:50

13 sidecar tests fail as a result (server/agent/adkSessionStore.test.ts, http.test.ts, contextCompaction.integration.test.ts) — every path that boots the sqlite-backed session store. This would break the chat agent at runtime, not just in tests. Rebasing onto the latest main will not resolve it: the core-vs-sqlite mismatch is independent of the base.

Recommended remediation — bump the two MikroORM packages together so @mikro-orm/core and @mikro-orm/sqlite both land on 6.6.15:

• Group @mikro-orm/* in .github/dependabot.yml so future updates move them in lockstep; or
• Update this PR to also bump @mikro-orm/core to ^6.6.15 (and regenerate the lockfile) — e.g. ·@·d·ependabot r·ecreate after adding the group, or a manual npm install @mikro-orm/core@6.6.15 @mikro-orm/sqlite@6.6.15.

Leaving open for a maintainer decision.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — ❌ blocked, not merged

Step 1 — Code review

The PR bumps @mikro-orm/sqlite 6.6.14 → 6.6.15 (and its transitive @mikro-orm/knex to 6.6.15), touching only package.json + package-lock.json. Description matches the diff; it's a patch release with no advisories (the prod dependency audit passed). However, the group is incomplete: @mikro-orm/core is left at ^6.6.14 while @mikro-orm/sqlite/@mikro-orm/knex move to 6.6.15.

Step 2 / Step 3 — Regression verification & CI

The required Verify (typecheck + coverage + build + e2e) job failed. Reproduced locally — 13 server tests in server/agent/adkSessionStore.test.ts and server/agent/http.test.ts fail at ORM init:

Error: Bad @mikro-orm/sqlite version 6.6.15.
All official @mikro-orm/* packages need to have the exact same version as @mikro-orm/core (6.6.14).
 ❯ Function.checkPackageVersion node_modules/@mikro-orm/core/utils/ConfigurationLoader.js:359
 ❯ Function.init node_modules/@mikro-orm/core/MikroORM.js:29
 ❯ DatabaseSessionService.init node_modules/@google/adk/dist/esm/sessions/database_session_service.js:61
 ❯ AdkSessionStore.createSession server/agent/adkSessionStore.ts:50

Root cause: MikroORM enforces at runtime (checkPackageVersion) that every @mikro-orm/* package matches @mikro-orm/core's exact version. This PR bumps sqlite/knex to 6.6.15 but not core, so MikroORM.init throws — which breaks the ADK DatabaseSessionService that backs the agent's sqlite session persistence. This is a real runtime regression, not a flaky/environment failure.

Confirmed the fix locally: bumping @mikro-orm/core to 6.6.15 in lockstep makes the session-store suite pass (8/8 green).

All other checks (CodeQL, Analyze, dependency audit, gitleaks, Trivy, gate-integrity) passed.

Step 4 — Merge

Not merged. Per fail-fast policy, the required Verify job is red and merging would break agent sessions on main.

Recommended path

@mikro-orm/* packages must move together. Options:

1. Preferred: add @mikro-orm/core@6.6.15 to this PR (npm i @mikro-orm/core@6.6.15 @mikro-orm/sqlite@6.6.15, commit the regenerated lockfile), then re-run CI. Note that editing the branch takes it out of Dependabot's auto-rebase management.
2. Configure a Dependabot group for @mikro-orm/* so core + sqlite (+ knex) are always bumped in one PR, then recreate this one.

I have not modified the branch.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — ⛔ blocked at regression verification

Step 1 — Code review

• Change: @mikro-orm/sqlite 6.6.14 → 6.6.15 (+ nested @mikro-orm/knex 6.6.15). Diff is limited to package.json / package-lock.json and matches the PR description.
• Changelog: patch release, bug-fixes only (STI subclass narrowing, IdentityMap stack-overflow, relation-filter sibling conditions, upsertMany, knex nested collection operators). No API/behavior breaking changes in the intended scope.
• Note (pre-existing, not a regression): the lockfile also heals a package.json/package-lock.json version drift (0.6.1 → 0.8.9 in the lock, matching package.json). Benign side-effect of the lock regeneration.

Step 2 — Regression verification: FAILED ❌

CI Verify (typecheck + coverage + build + e2e) fails on the unit suite (server/agent/http.test.ts, 4 tests) with expected 500 to be 200. Root cause, reproduced deterministically:

Error: Bad @mikro-orm/sqlite version 6.6.15.
All official @mikro-orm/* packages need to have the exact same version as @mikro-orm/core (6.6.14).
    at ConfigurationLoader.checkPackageVersion (@mikro-orm/core/utils/ConfigurationLoader.js)
    at MikroORM.init (@mikro-orm/core/MikroORM.js)
    at DatabaseSessionService.init (@google/adk/.../database_session_service.js)

MikroORM enforces that every @mikro-orm/* package resolves to the exact same version as @mikro-orm/core. This PR bumps @mikro-orm/sqlite (and its nested @mikro-orm/knex) to 6.6.15 while @mikro-orm/core stays pinned at 6.6.14. As a result MikroORM.init() throws, and the ADK-backed DatabaseSessionService (used by every /agent/sessions route) returns 500.

Isolation (same Node 22, only the dependency changed):

• @mikro-orm/sqlite@6.6.14 → server/agent/http.test.ts 12/12 pass
• @mikro-orm/sqlite@6.6.15 (core still 6.6.14) → 4 fail with the mismatch error above

Because main already carries the other merged bumps and is green, this mismatch is the sole delta.

Decision — fail-fast: not merging

Per the review policy, a failed regression step stops the pipeline before merge. This PR is not safe to merge as-is.

Recommended resolution

@mikro-orm/sqlite@6.6.15 requires @mikro-orm/core@6.6.15 in lockstep. Options:

1. Bump @mikro-orm/core (and @mikro-orm/knex) to 6.6.15 alongside @mikro-orm/sqlite in this PR, or
2. Configure a Dependabot group for @mikro-orm/* so these always update together, then ·@·d·ependabot r·ecreate.

Since option 1 adds a production-dependency change beyond this PR's stated scope, it's left to a maintainer's decision rather than amended automatically here.

_{Reviewed by an automated agent. CI run: Verify job on head e25faa1.}

---

Generated by Claude Code

[helebest]

Automated dependency review

Change: @mikro-orm/sqlite 6.6.14 → 6.6.15 (also pulls the transitive @mikro-orm/knex up to 6.6.15).

Step 1 — Code review

The diff is confined to package.json / package-lock.json and matches the PR description. However, it bumps only @mikro-orm/sqlite while leaving @mikro-orm/core pinned at 6.6.14.

Step 2 — Regression verification ❌

The Verify CI job fails. MikroORM enforces that every official @mikro-orm/* package shares the exact same version as @mikro-orm/core:

All official @mikro-orm/* packages need to have the exact same version as @mikro-orm/core (6.6.14).
 ❯ ConfigurationLoader.checkPackageVersion
 ❯ MikroORM.init
 ❯ DatabaseSessionService.init  (node_modules/@google/adk/.../database_session_service.js)
 ❯ appendEvent  (server/agent/http.test.ts)

With @mikro-orm/sqlite@6.6.15 against @mikro-orm/core@6.6.14, MikroORM.init() throws, the ADK DatabaseSessionService cannot initialize, and the agent HTTP tests fail (observed 500 responses where 200 is expected).

Decision — not merged (fail-fast)

This bump cannot be merged in isolation. @mikro-orm/core must be bumped to 6.6.15 in lockstep with @mikro-orm/sqlite. Recommended fix: group the @mikro-orm/* packages in the Dependabot config so they always update together, or add the matching @mikro-orm/core bump to this PR. Stopping here per the fail-fast policy; no further steps taken.

---

Generated by Claude Code

[helebest]

Automated dependency review — ⛔ held, not merged

Step 1 — Code review

• Scope matches description: package.json + package-lock.json only, bumping @mikro-orm/sqlite 6.6.14 → 6.6.15 (patch; upstream changelog is bug-fixes only, and the bump stays within the configured >= 7.a, < 8 ignore bound). No source changes.

Step 2 — Regression verification — FAILED
The Verify (typecheck + coverage + build + e2e) job failed:

All official @mikro-orm/* packages need to have the exact same version as @mikro-orm/core (6.6.14).
 ❯ ConfigurationLoader.checkPackageVersion node_modules/@mikro-orm/core/utils/ConfigurationLoader.js:359
 ❯ MikroORM.init …
 ❯ DatabaseSessionService.init node_modules/@google/adk/…/database_session_service.js
 ❯ server/agent/http.test.ts  → AssertionError: expected 500 to be 200

Root cause: MikroORM enforces at runtime that every @mikro-orm/* package resolve to the exact same version as @mikro-orm/core. This PR bumps only @mikro-orm/sqlite to 6.6.15 while the lockfile keeps @mikro-orm/core pinned at 6.6.14, so MikroORM.init() throws — which breaks ADK's DatabaseSessionService and fails the agent HTTP tests (500 instead of 200). This is a genuine breakage, not a flake.

Decision (fail-fast): not merging. This PR cannot be merged in isolation. The correct fix is a grouped bump that moves @mikro-orm/core (and its transitive @mikro-orm/knex) to 6.6.15 in lockstep with @mikro-orm/sqlite. Recommend either configuring a Dependabot group for @mikro-orm/*, or superseding this PR with a combined @mikro-orm/core + @mikro-orm/sqlite → 6.6.15 bump. Holding #148 open pending that.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — @mikro-orm/sqlite 6.6.14 → 6.6.15

Step 1 — Code review

• Scope is package.json + package-lock.json only; @mikro-orm/sqlite is bumped ^6.6.14 → ^6.6.15, pulling its matching @mikro-orm/knex@6.6.15. sqlite3@5.1.7 and @mikro-orm/core are unchanged. No source changes.
• (The version 0.8.9 → 0.8.10 line in the raw diff is stale-merge-base noise — base and head are both already at 0.8.10.)
• This backs the agent's ADK DatabaseSessionService sqlite session store. A 6.6.14 → 6.6.15 patch bump within the same MikroORM 6.x line carries no API change.
• No functional code changed — the existing suite is the regression guard.

Step 2 / Step 3 — CI status: stale, re-running before any merge

• The most recent CI on this PR is from 2026-07-05 and predates several main commits. Its one red job, Verify, failed in server/agent/http.test.ts with expected 500 to be 200 — a failure unrelated to a SQLite patch bump, and one that the same test suite passes on today's main (the four sibling OTel/lucide Dependabot PRs all went green on 07-11 running this exact suite).
• Per fail-fast, I will not merge on a stale red run. Triggering a rebase onto current main to obtain a fresh CI pass; will merge only once it is green.

---

Generated by Claude Code

[helebest]

·@·d·ependabot r·ebase

---

Generated by Claude Code

[helebest]

Automated Dependabot review — ❌ blocked (fail-fast)

Step 1 — Code review
Patch bump of @mikro-orm/sqlite 6.6.14 → 6.6.15 (plus its transitive @mikro-orm/knex 6.6.15, nested in the lockfile). The package.json / package-lock.json changes are consistent with the PR description.

Step 2 — Regression verification: FAILED
The Verify (typecheck + coverage + build + e2e) check fails, and it is not flaky — the failure is structural:

All official @mikro-orm/* packages need to have the exact same version as @mikro-orm/core (6.6.14).
 ❯ ConfigurationLoader.checkPackageVersion node_modules/@mikro-orm/core/utils/ConfigurationLoader.js:359
 ❯ MikroORM.init … DatabaseSessionService.init … appendEvent server/agent/http.test.ts:71
AssertionError: expected 500 to be 200   (server/agent/http.test.ts:396)

MikroORM enforces that every @mikro-orm/* package resolves to the exact same version as @mikro-orm/core. This PR moves @mikro-orm/sqlite (and knex) to 6.6.15 while @mikro-orm/core stays at ^6.6.14 → 6.6.14. At runtime MikroORM.init() throws, which breaks the ADK DatabaseSessionService and cascades into 500s across the server/agent/http.test.ts agent-endpoint tests.

Step 4 — Decision: not merging.
Per the fail-fast policy, verification did not pass, so CI monitoring and merge are skipped. To unblock, @mikro-orm/core (and the top-level @mikro-orm/knex) must be bumped to 6.6.15 in lockstep with @mikro-orm/sqlite — ideally by grouping all @mikro-orm/* updates into a single Dependabot PR. A ·@·d·ependabot r·ecreate alone will not fix this while @mikro-orm/core remains pinned at ^6.6.14.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — ⛔ blocked, not merged

Step 1 — Code review
The diff bumps only @mikro-orm/sqlite 6.6.14 → 6.6.15, leaving @mikro-orm/core pinned at 6.6.14. MikroORM enforces at runtime (ConfigurationLoader.checkPackageVersion, called from MikroORM.init()) that all official @mikro-orm/* packages share the exact same version as @mikro-orm/core. A lone @mikro-orm/sqlite bump therefore breaks initialization.

Step 2/3 — Regression / CI verification (fail-fast)
The branch was rebased onto current main and re-run; Verify still fails. The failure is not a stale base or a flake — it reproduces on latest main:

Error: Bad @mikro-orm/sqlite version 6.6.15.
All official @mikro-orm/* packages need to have the exact same version as @mikro-orm/core (6.6.14).
 ❯ ConfigurationLoader.checkPackageVersion node_modules/@mikro-orm/core/utils/ConfigurationLoader.js:359
 ❯ MikroORM.init … ❯ DatabaseSessionService.init … ❯ AdkSessionStore.createSession server/agent/adkSessionStore.ts:50

Because the agent's ADK DatabaseSessionService (the SQLite session store) calls MikroORM.init(), the mismatch fails it at runtime, cascading into:

• server/agent/adkSessionStore.test.ts
• server/agent/contextCompaction.integration.test.ts
• server/agent/http.test.ts (agent stream yields error instead of tool_event/message_delta/source/agent_end; endpoint returns 500 instead of 200)

This is a genuine incompatibility that would break the running agent, not just the tests.

Step 4 — Decision: Per fail-fast policy, not merged.

Suggested remediation (for a maintainer):

• @mikro-orm/sqlite and @mikro-orm/core must be upgraded together to the same version (6.6.15). This PR needs a matching @mikro-orm/core 6.6.15 bump before it can pass.
• To prevent recurrence, group the MikroORM packages in dependabot.yml (e.g. a mikro-orm group covering @mikro-orm/*) so they always bump in lockstep. Then ·@·d·ependabot r·ecreate here.

The other open dependency PRs have been processed independently.

---

Generated by Claude Code

[helebest]

Correction & final decision — ⛔ not merging

The fresh CI run against current main (after rebase) also failed Verify, so my earlier "stale, unrelated flake" assessment was incorrect — I withdraw it. The failure is real, reproducible, and directly caused by this bump. Apologies for the premature read; this is exactly why the run was re-triggered before merging.

Root cause. Verify fails in server/agent/http.test.ts because MikroORM enforces a same-version invariant across its packages:

All official @mikro-orm/* packages need to have the exact same version as @mikro-orm/core (6.6.14).
 ❯ ConfigurationLoader.checkPackageVersion  (@mikro-orm/core/utils/ConfigurationLoader.js:359)
 ❯ MikroORM.init
 ❯ DatabaseSessionService.init  (@google/adk .../database_session_service.js)
 ❯ appendEvent  server/agent/http.test.ts:71
→ AssertionError: expected 500 to be 200

This PR bumps @mikro-orm/sqlite (and its @mikro-orm/knex) to 6.6.15, but @mikro-orm/core stays at 6.6.14. At runtime MikroORM.init() (used by ADK's DatabaseSessionService, our agent sqlite session store) calls checkPackageVersion, sees 6.6.15 !== 6.6.14, and throws — so the agent HTTP endpoints return 500 and the tests fail. A SQLite-only bump can never pass on its own.

Required resolution (maintainer action): bump @mikro-orm/core to 6.6.15 in the same change so all @mikro-orm/* packages are aligned (ideally group @mikro-orm/* together in dependabot.yml so they always bump in lockstep). With core also at 6.6.15 the invariant holds and this suite passes.

Decision: Not merging (fail-fast). Leaving the PR open for the @mikro-orm/core companion bump. The other Dependabot PRs were processed independently: #152, #153, #154, #155 reviewed and squash-merged; #156 blocked on an unrelated ERESOLVE conflict (documented on that PR).

---

Generated by Claude Code

[dependabot]

A newer version of @​mikro-orm/sqlite exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

[helebest]

Automated Dependabot review — ❌ blocked, not merging

Step 1 — Code review
This PR bumps only @mikro-orm/sqlite 6.6.14 → 6.6.15, leaving @mikro-orm/core (and the other @mikro-orm/* packages) at 6.6.14. MikroORM enforces that every official @mikro-orm/* package resolve to the exact same version as @mikro-orm/core, so a single-package bump is inherently inconsistent for this dependency.

Step 2 / 3 — Regression & CI
The CI Verify job (typecheck + coverage + build + e2e) fails on the current head (078db0e). Root cause, from the run log:

Error: Bad @mikro-orm/sqlite version 6.6.15.
All official @mikro-orm/* packages need to have the exact same version as @mikro-orm/core (6.6.14).
 ❯ ConfigurationLoader.checkPackageVersion
 ❯ MikroORM.init
 ❯ DatabaseSessionService.init  (@google/adk)

MikroORM.init() throws at runtime, which takes down ADK's DatabaseSessionService (the agent's sqlite session store). This cascades into several server-test failures, e.g. server/agent/http.test.ts (500 instead of 200, event stream collapses to ['error']) and server/agent/contextCompaction.integration.test.ts. This is a genuine functional break, not a flake.

Step 4 — Decision
Per the fail-fast rule, I am stopping here and not merging. To make this bump viable, @mikro-orm/core (and any other installed @mikro-orm/* packages) must be bumped to 6.6.15 in lockstep — i.e. this should come through as a grouped MikroORM update rather than a lone @mikro-orm/sqlite bump. Recommend closing this PR in favour of a grouped update (or ·@·d·ependabot r·ecreate once the group is available).

---

Generated by Claude Code

[helebest]

Automated dependency review — ❌ blocked (not merged)

Step 1 — Code review

• Scope matches the description: @mikro-orm/sqlite ^6.6.14 → ^6.6.15 in package.json + package-lock.json (patch, bug-fixes only per the release notes). No source changes.
• Correctness issue: the bump moves @mikro-orm/sqlite (and its transitive @mikro-orm/knex) to 6.6.15 but leaves @mikro-orm/core pinned at 6.6.14. MikroORM enforces a same-version invariant across all official @mikro-orm/* packages at runtime.

Step 2 — Regression verification: FAILED
The Verify (typecheck + coverage + build + e2e) job fails deterministically:

Error: Bad @mikro-orm/sqlite version 6.6.15.
All official @mikro-orm/* packages need to have the exact same version as @mikro-orm/core (6.6.14).
 ❯ ConfigurationLoader.checkPackageVersion node_modules/@mikro-orm/core/utils/ConfigurationLoader.js:359
 ❯ MikroORM.init … DatabaseSessionService.init …

This throws inside DatabaseSessionService.init, cascading into the agent session/HTTP tests (server/agent/contextCompaction.integration.test.ts, server/agent/http.test.ts — expected [ 'error' ], 500 to be 200).

Decision (fail-fast): Not merging. This is not flaky — re-running will not help. The fix is to bump @mikro-orm/core to 6.6.15 in the same PR so all @mikro-orm/* packages stay in lockstep. As opened (sqlite-only), the PR cannot pass CI.

Automated review; CI status was already red on the current head (078db0ed).

---

Generated by Claude Code

[helebest]

Dependabot review — @mikro-orm/sqlite 6.6.14 → 6.6.15

Step 1 — Code review. The change touches only package.json / package-lock.json. However, @mikro-orm/sqlite must be kept in exact lockstep with @mikro-orm/core. This PR advances @mikro-orm/sqlite to 6.6.15 while @mikro-orm/core stays at 6.6.14.

Step 2 — Regression verification. ❌ Failed. MikroORM's runtime version check aborts initialization:

Error: Bad @mikro-orm/sqlite version 6.6.15.
All official @mikro-orm/* packages need to have the exact same version as @mikro-orm/core (6.6.14).

This crashes ADK's DatabaseSessionService (the sidecar's sqlite session store), which cascades through the whole server/agent/* suite — adkSessionStore.test.ts, contextCompaction.integration.test.ts, and http.test.ts (expected 500 to be 200).

Step 3 — CI. Verify (typecheck + coverage + build + e2e) = failure.

Decision. 🛑 Not merged (fail-fast). This is a genuine, PR-caused breakage — not flaky or environmental. The fix is to bump all @mikro-orm/* packages (notably @mikro-orm/core) to 6.6.15 in the same change so the versions match. Recommend closing in favor of a grouped MikroORM update, or ·@·d·ependabot r·ecreate once the packages can be bumped together.

---

Generated by Claude Code

[helebest]

Automated Dependabot review

Step 1 — Code review

• Consistency: Version-only bump of @mikro-orm/sqlite 6.6.14 → 6.6.15 in package.json + package-lock.json, matching the description.
• Correctness / effectiveness: Patch release — bug fixes only (STI subclass crash, IdentityMap stack overflow on large maps, $and/$or relation-filter sibling conditions, upsertMany reload, knex nested-collection schema). Used only by the sidecar's ADK session store. No breaking changes, no API surface we consume.
• Security: No advisory in the bump.
• Test coverage: No functional source change; regression is covered by the existing suite.

Steps 2 & 3 — Regression / CI

• ❌ mergeable_state: behind — this branch is based on a stale main (base a9be493, ~2026-07-11) and its check runs are from that time. It cannot be evaluated or merged as-is; it needs a rebase onto current main (·@·d·ependabot r·ebase).
• Note: once rebased it will also hit the base-branch security-scan block currently affecting every open PR — the required Dependency audit (prod, high+) and Container scan (trivy) jobs fail on main's current dependency tree due to newly-published CVEs (tar CVE-2026-59873, js-yaml CVE-2026-59869, fast-uri CVE-2026-16221, and the @google-cloud/* audit tree). main last passed CI on 2026-07-18, before these advisories.

Step 4 — Decision: not merged. Per fail-fast, I am not merging a branch that is behind and whose checks are stale. It needs a rebase, after which the shared base-branch vulnerability triage (see #161–#165) also applies. The bump itself is a low-risk patch.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — @mikro-orm/sqlite 6.6.14 → 6.6.15

Code review: package.json + lockfile patch bump. The upstream changelog is bug-fixes only, nothing breaking for our usage.

Regression verification: ❌ fails. The required Verify check fails in server/agent/http.test.ts. MikroORM's ConfigurationLoader.checkPackageVersion requires every official @mikro-orm/* package to match @mikro-orm/core exactly. This PR moves @mikro-orm/sqlite (and its nested @mikro-orm/knex) to 6.6.15 while @mikro-orm/core stays 6.6.14, so MikroORM.init throws → DatabaseSessionService init fails → the agent HTTP tests return 500:

All official @mikro-orm/* packages need to have the exact same version as @mikro-orm/core (6.6.14).

Decision: not merging. This needs @mikro-orm/core bumped to 6.6.15 in the same change — ideally Dependabot should group the @mikro-orm/* packages so they move together. The branch is also behind main and its last CI run is stale, but the version-mismatch failure is deterministic and would recur on a re-run.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — ⛔ not merging (fail-fast)

I rebased this branch onto the latest main (e4ce3a0) to get an authoritative CI run. Two independent blockers stop this merge.

Step 1 — Code review

The version bump itself (@mikro-orm/sqlite 6.6.14 → 6.6.15) is a patch release containing only bug fixes, with Dependabot's ignore rule correctly capping it below the >=7 major. However, the change is incomplete and introduces a runtime regression: MikroORM requires every official @mikro-orm/* package to resolve to the exact same version as @mikro-orm/core. This PR moves @mikro-orm/sqlite (and its nested @mikro-orm/knex) to 6.6.15 while @mikro-orm/core stays at 6.6.14, so MikroORM.init() throws checkPackageVersion at runtime.

Step 2/3 — Verification & CI (fresh run on the rebased branch)

• ❌ Verify (typecheck + coverage + build + e2e) — 13 tests fail, all from the ADK sqlite session store:

  Error: Bad @mikro-orm/sqlite version 6.6.15.
  All official @mikro-orm/* packages need to have the exact same version as @mikro-orm/core (6.6.14).
  ❯ ConfigurationLoader.checkPackageVersion @mikro-orm/core/utils/ConfigurationLoader.js:359
  ❯ MikroORM.init → DatabaseSessionService.init/createSession/getSession
  

  (server/agent/adkSessionStore.test.ts, server/agent/http.test.ts, contextCompaction.integration.test.ts). This is caused by this PR.
• ❌ Dependency audit (prod, high+) and ❌ Container scan (trivy) — failing, but not caused by this PR. These are newly-published npm advisories that also fail on main itself (main last passed on 2026-07-18). I reproduced the audit against main's own lockfile: 23 vulns incl. high (js-yaml GHSA-52cp-r559-cp3m, fast-uri, brace-expansion) and critical node-tar (GHSA-w8wr-v893-vjvp; trivy: CVE-2026-59873/59874). See the repo-wide note below.
• ✅ Gate integrity, gitleaks, CodeQL/Analyze passed.

Step 4 — Merge

Not merging. Per fail-fast, the failing required checks stop the process here.

Recommended follow-up

• For this PR: it can only go green once @mikro-orm/core is bumped to 6.6.15 in lockstep (e.g. group all @mikro-orm/* updates, or ·@·d·ependabot r·ecreate after core is aligned). A single-package bump of @mikro-orm/sqlite will always break the version-lockstep check.
• Repo-wide: the audit + trivy security gates are currently red on main due to advisories disclosed since 2026-07-18; all open Dependabot PRs inherit these failures. Resolving them requires maintainer decisions because the clean fixes are breaking majors (@mikro-orm/sqlite@7 — currently ignored by Dependabot config — @google/adk@0.3.0, @google/genai@1.36.0).

---

Generated by Claude Code

[helebest]

Automated Dependabot review — ❌ not merging

Step 1 (code review) / Step 2 (regression): this bump introduces a real runtime regression, reproduced locally.

MikroORM enforces that every @mikro-orm/* package resolves to the exact same version as @mikro-orm/core. This PR bumps only @mikro-orm/sqlite to 6.6.15 while @mikro-orm/core stays at 6.6.14, so at runtime @mikro-orm/sqlite throws:

Error: Bad @mikro-orm/sqlite version 6.6.15.
All official @mikro-orm/* packages need to have the exact same version as @mikro-orm/core (6.6.14).

@mikro-orm/sqlite backs the agent's DatabaseSessionService (SQLite-backed ADK sessions), so every /agent session operation 500s. Verified on the two versions:

• @mikro-orm/sqlite@6.6.14 (pre-bump): server/agent/http.test.ts → 12/12 pass.
• @mikro-orm/sqlite@6.6.15 (this PR): server/agent/http.test.ts → 4 tests fail (session create / rename / delete return 500 instead of 200).

This is the cause of the failing Verify (typecheck + coverage + build + e2e) check on this PR.

Step 3 (CI): in addition to the above, the required Dependency audit (prod, high+) and Container scan (trivy) checks are red repo-wide (pre-existing transitive vulns / base-image CVEs, unrelated to this bump).

Decision: not merged. A lone @mikro-orm/sqlite bump cannot land — @mikro-orm/core (and any other installed @mikro-orm/*) must move to 6.6.15 in the same change. Recommend grouping the @mikro-orm/* packages in dependabot.yml, or ·@·d·ependabot r·ecreate once core catches up, otherwise this PR should be closed.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — not merged (fail-fast) ❌

Scope: @mikro-orm/sqlite 6.6.14 → 6.6.15.

Blocking finding (Step 2 — regression): the required Verify check fails — MikroORM enforces that every official @mikro-orm/* package matches @mikro-orm/core, which this PR leaves at 6.6.14:

All official @mikro-orm/* packages need to have the exact same version as @mikro-orm/core (6.6.14).
 ❯ ConfigurationLoader.checkPackageVersion
 ❯ MikroORM.init
 ❯ DatabaseSessionService.init  (@google/adk)
 ❯ appendEvent  server/agent/http.test.ts

The sidecar's ADK DatabaseSessionService cannot initialize, so server/agent/http.test.ts fails (500s where 200 is expected). Per fail-fast, the PR was not merged.

Recommended resolution: bump the whole @mikro-orm/* family together (@mikro-orm/core + @mikro-orm/sqlite, plus any other @mikro-orm/* in use) to 6.6.15. Grouping the @mikro-orm/* packages in the Dependabot config will keep them in lockstep. ·@·d·ependabot r·ecreate after grouping should yield a mergeable PR.

---

Generated by Claude Code