dependabot[bot] opened a new pull request, #45411: URL: https://github.com/apache/superset/pull/45411
Bumps [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) from 2.0.52 to 2.1.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sqlalchemy/sqlalchemy/releases";>sqlalchemy's releases</a>.</em></p> <blockquote> <h1>2.1.4</h1> <p>Released: October 7, 2026</p> <h2>orm</h2> <ul> <li> <p><strong>[orm] [bug] [regression]</strong> Fixed regression caused by <a href="https://www.sqlalchemy.org/trac/ticket/13333";>#13333</a> where assigning a <code>MetaData</code> object to the <code>metadata</code> attribute of a mapped Declarative class, in order to place that class's <code>Table</code> in a <code>MetaData</code> collection other than that of the <code>_orm.registry</code>, would emit a warning that the attribute name <code>metadata</code> should be left reserved. The warning is now emitted only when the <code>metadata</code> attribute is assigned to an object other than a <code>MetaData</code>.</p> <p>References: <a href="https://www.sqlalchemy.org/trac/ticket/13659";>#13659</a></p> </li> </ul> <h2>engine</h2> <ul> <li> <p><strong>[engine] [bug] [regression]</strong> Fixed regression from the 1.4 series where the DBAPI cursor used for a compiled statement that returns no rows, which includes DDL constructs such as <code>CreateTable</code> and <code>DropTable</code> as well as the SAVEPOINT, ROLLBACK TO SAVEPOINT and RELEASE SAVEPOINT statements emitted by <code>_engine.Connection.begin_nested()</code>, was not closed after execution, and was instead left to be released when garbage collected. The cursor is now closed immediately, as was the case in 1.3 and as is already the case for INSERT, UPDATE, DELETE and <code>_sql.text()</code> statements.</p> <p>This change is also <strong>backported</strong> to: 2.0.55</p> <p>References: <a href="https://www.sqlalchemy.org/trac/ticket/13640";>#13640</a></p> </li> <li> <p><strong>[engine] [bug]</strong> Fixed issue in the <code>_engine.Connection.execution_options.logging_token</code> option where setting the value to <code>None</code> or another false value would raise <code>AttributeError</code> if a logging token had not already been established on that <code>_engine.Connection</code>, such as on a newly checked out connection, when the option was set at the <code>_engine.Engine</code> level, or when the token was reset to <code>None</code> more than once. Regression introduced in 2.0.30 as part of <a href="https://www.sqlalchemy.org/trac/ticket/11210";>#11210</a>.</p> <p>This change is also <strong>backported</strong> to: 2.0.55</p> <p>References: <a href="https://www.sqlalchemy.org/trac/ticket/13641";>#13641</a></p> </li> <li> <p><strong>[engine] [bug] [regression]</strong> Fixed regression where iterating a <code>Result</code> directly would create reference cycles that prevented the <code>Result</code> along with the DBAPI</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/sqlalchemy/sqlalchemy/commits";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
