
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
sqlalchemy-tx-context
Advanced tools
Minimalistic context-local session and transaction controller for SQLAlchemy AsyncSession.
sqlalchemy-tx-context
provides context-aware session and transaction management using Python’s contextvars,
eliminating the need to pass AsyncSession objects explicitly. Especially useful in code where database access should
be decoupled from explicit session passing - such as service layers or background jobs.
contextvars
, without relying on thread-locals or global session objects.async with
API for managing session and transaction scopes..execute(...)
automatically creates a session or transaction if none is active (optional fallback).pip install sqlalchemy-tx-context
from sqlalchemy.ext.asyncio import create_async_engine
from sqlalchemy_tx_context import SQLAlchemyTransactionContext
engine = create_async_engine("postgresql+asyncpg://user:pass@host/db")
db = SQLAlchemyTransactionContext(engine)
async def create_user():
async with db.transaction():
await db.execute(insert(User).values(name="John"))
async def get_users():
async with db.session():
result = await db.execute(select(User))
return result.scalars().all()
SQLAlchemyTransactionContext(
engine: AsyncEngine,
*,
default_session_maker: Optional[async_sessionmaker[AsyncSession]] = None,
auto_context_on_execute: bool = False,
auto_context_force_transaction: bool = False,
)
engine
- SQLAlchemy AsyncEngine
instance.default_session_maker
- Optional async session factory. If omitted, uses async_sessionmaker(engine)
.auto_context_on_execute
- If True
, allows .execute()
to run even without an active session
by creating a temporary one.auto_context_force_transaction
- If True
, .execute()
always runs inside a transaction when auto context is used.
If False
, it uses .session()
for read-only queries (like Select
or CompoundSelect
),
and .transaction()
for everything else, including Insert
, Update
, and raw SQL.session(...) -> AsyncIterator[AsyncSession]
- Enter a new session context, or reuse an existing
one if reuse_if_exists=True
.transaction(...) -> AsyncIterator[AsyncSession]
- Enter a transactional context.
Will nest if a transaction is already active.new_session(...) -> AsyncIterator[AsyncSession]
- Create a new isolated session, even if another is already active.
Overrides the context for the duration.new_transaction(...) -> AsyncIterator[AsyncSession]
- Create a new transaction in an isolated session.get_session(strict: bool = True) -> AsyncSession | None
- Return the current session from context.
Raises NoSessionError
if strict=True
and no session exists.execute(...) -> Result
- Execute a SQLAlchemy Executable
using the current or temporary context.
Uses the current session if one is active. Otherwise, behavior depends on auto_context_on_execute
-
a new session or transaction context may be created automatically.# Opens a temporary session or transaction depending on statement type
db = SQLAlchemyTransactionContext(engine, auto_context_on_execute=True)
await db.execute(insert(User).values(name="Alice"))
await db.execute(select(User))
For a complete working example using PostgreSQL, see
example/
.
It demonstrates table creation, data insertion, transactional rollback, and querying.
This library defines a few custom exceptions to help catch context-related mistakes:
NoSessionError
: Raised when attempting to access or use a session when none is active and fallback is disabled.SessionAlreadyActiveError
: Raised when entering .session()
while a session is already active
(unless reuse_if_exists=True
).TransactionAlreadyActiveError
: Raised when entering .transaction()
while a transaction is already active
and nesting is disabled.SQLAlchemy does not provide an out-of-the-box solution for context-local session tracking when working with
AsyncSession
. Passing sessions around explicitly can make service-layer code verbose and harder to maintain.
The library introduces a lightweight and predictable abstraction that:
ContextVar
.execute(...)
interface.session
explicitly.This library is best suited for functional or script-style code where sessions are not injected via DI frameworks.
.transaction()
or .session()
explicitly in your service-layer or job code
to clearly define execution boundaries..execute(...)
is ideal for small projects, functional-style code, or early-stage prototypes - it avoids
boilerplate and makes code fast to write.db.execute(...)
with self._session.execute(...)
and db.transaction()
with your own context (e.g., UnitOfWork
, session.begin()
) - the query logic remains the same.pytest --cov=sqlalchemy_tx_context --cov-report=term-missing
Tested on Python 3.9
- 3.12
.
MIT License
FAQs
Context-local session manager for SQLAlchemy AsyncSession
We found that sqlalchemy-tx-context demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.