SQLAlchemy 2.1

Apply these rules to SQLAlchemy 2.1 Core and ORM after the Python baseline; they were checked against 2.1.4. Use a maintained Python release at or above 3.11; Python template-string examples require 3.14 or later. Apply the deployed database and DBAPI driver's security requirements as well.

Runtime and connection configuration

• Install SQLAlchemy[asyncio] when using AsyncEngine or AsyncSession; 2.1 no longer installs the required greenlet dependency by default. Select a compatible asynchronous DBAPI for create_async_engine().
• Specify the DBAPI explicitly in connection URLs and test its authentication, TLS, and transaction settings. In 2.1, bare postgresql:// selects psycopg 3 and bare oracle:// selects python-oracledb; use postgresql+psycopg2 or oracle+cx_oracle explicitly when those drivers are intentional.
• Construct credentials with URL.create() and unescaped field values instead of assembling a URL string. Keep the driver, host, database, URL query parameters, connect_args, and engine plugins under trusted configuration; URL parsing and quoting do not authorize a destination or neutralize driver options.
• Configure certificate and hostname verification through the selected driver's connection arguments. For psycopg/libpq TCP connections, use sslmode=verify-full with a trusted sslrootcert; prefer permits plaintext fallback, and require alone does not verify the hostname. Test rejected certificates and hostnames with the deployed driver.

SQL construction and binding

• Pass data through SQLAlchemy expressions or named