dependabot[bot] opened a new pull request, #4046: URL: https://github.com/apache/iceberg-python/pull/4046
Bumps [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) from 2.0.52 to 2.0.54. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sqlalchemy/sqlalchemy/releases";>sqlalchemy's releases</a>.</em></p> <blockquote> <h1>2.0.54</h1> <p>Released: September 15, 2026</p> <h2>platform</h2> <ul> <li> <p><strong>[platform] [change]</strong> Binary wheels are no longer built for Python 3.7. PyPI now rejects wheel files whose filename does not begin with the normalized project name, and the packaging tools that can be installed on Python 3.7 do not produce such a filename. As a result, SQLAlchemy 2.0.44 was the last release to publish Python 3.7 wheels to PyPI, and releases 2.0.45 and later have been available on Python 3.7 only as a source distribution; the wheel builds for Python 3.7 are now removed. Python 3.7 remains supported by the 2.0 series.</p> </li> <li> <p><strong>[platform] [bug]</strong> Fixed issue where the Cython extensions were compiled without the <code>freethreading_compatible</code> directive, so that they did not declare themselves as safe to run without the GIL. On a free-threaded Python interpreter such as Python 3.13t or 3.14t, importing SQLAlchemy would cause the interpreter to re-enable the GIL, emitting a <code>RuntimeWarning</code>. The directive is now set when building for Python 3.13 and above, and a test has been added which confirms that importing SQLAlchemy on a free-threaded build does not enable the GIL.</p> <p>References: <a href="https://www.sqlalchemy.org/trac/ticket/13592";>#13592</a></p> </li> </ul> <h1>2.0.53</h1> <p>Released: September 14, 2026</p> <h2>orm</h2> <ul> <li> <p><strong>[orm] [bug]</strong> Fixed issue where an expression passed to <code>_orm.with_expression()</code> that embedded a <code>_sql.select()</code>, such as a correlated <code>_sql.exists()</code>, would fail to populate the attribute correctly on the second and subsequent executions of an otherwise identical statement, when the <code>_orm.query_expression()</code> attribute was loaded by a relationship loader that emits a second query, i.e. <code>_orm.selectinload()</code>, <code>_orm.lazyload()</code> or <code>_orm.immediateload()</code>.</p> <p>References: <a href="https://www.sqlalchemy.org/trac/ticket/13560";>#13560</a></p> </li> <li> <p><strong>[orm] [bug]</strong> Fixed memory issue where mapped classes, along with their <code>Table</code> and <code>_orm.Mapper</code> objects, would not be garbage collected after the <code>_orm.registry</code> in which they were mapped had been disposed and dereferenced. The issue would occur for mappings that made use of <code>_orm.relationship()</code> together with constructs such as an</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/sqlalchemy/sqlalchemy/commits";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
