Since approximately 2026-07-22 ~16:30 UTC, dependency resolution fails with a gRPC Internal error for the sqlalchemy package (PyPI) — every version we tested — and for packages depending on it (e.g. snowflake-sqlalchemy).
Repro
osv-scanner v2.3.8 (which uses the deps.dev resolution API for transitive resolution of requirements.txt):
$ echo "sqlalchemy==2.0.51" > requirements.txt
$ osv-scanner scan source --recursive .
Scanned .../requirements.txt file and found 1 package
failed resolution for .../requirements.txt: rpc error: code = Internal desc = internal error
Error during extraction: (extracting as transitivedependency/requirements) failed resolution for .../requirements.txt: rpc error: code = Internal desc = internal error
Fails identically for:
sqlalchemy==2.0.51sqlalchemy==2.0.50sqlalchemy==1.4.54snowflake-sqlalchemy==1.10.1
Resolves fine (control group, same machine/time):
requests==2.32.3fastapi==0.115.0duckdb==1.1.3greenlet==3.1.1typing-extensions==4.12.2
The REST API returns 200 for the same versions (e.g. GET /v3/systems/pypi/packages/sqlalchemy/versions/2.0.51:dependencies), so this looks specific to the resolution endpoint's index for this package family — similar in shape to #362 (npm) and #375 (Cargo).
Consistently reproducible for ~18 hours now (retried every 30 minutes). This blocks osv-scanner pre-commit gates in any repo that pins sqlalchemy, which given its popularity is likely a lot of CI out there.
Since approximately 2026-07-22 ~16:30 UTC, dependency resolution fails with a gRPC
Internalerror for thesqlalchemypackage (PyPI) — every version we tested — and for packages depending on it (e.g.snowflake-sqlalchemy).Repro
osv-scanner v2.3.8 (which uses the deps.dev resolution API for transitive resolution of
requirements.txt):Fails identically for:
sqlalchemy==2.0.51sqlalchemy==2.0.50sqlalchemy==1.4.54snowflake-sqlalchemy==1.10.1Resolves fine (control group, same machine/time):
requests==2.32.3fastapi==0.115.0duckdb==1.1.3greenlet==3.1.1typing-extensions==4.12.2The REST API returns 200 for the same versions (e.g.
GET /v3/systems/pypi/packages/sqlalchemy/versions/2.0.51:dependencies), so this looks specific to the resolution endpoint's index for this package family — similar in shape to #362 (npm) and #375 (Cargo).Consistently reproducible for ~18 hours now (retried every 30 minutes). This blocks osv-scanner pre-commit gates in any repo that pins sqlalchemy, which given its popularity is likely a lot of CI out there.