Start here
The safe first move
Start with deterministic fixes like Query.get(...), string joins, string loader paths, and select([..]) list syntax. Treat broad Query-to-select rewrites as manual review.
Stop before automation when: Broad Query-to-select rewrites. Result-shape changes.
Target shape
query = session.query(User) # still legacy, not the first rewrite target
user = session.get(User, user_id)
rows = session.query(User).join(User.addresses).all()