dependabot[bot] opened a new pull request, #45693: URL: https://github.com/apache/superset/pull/45693
Bumps [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) from 2.0.52 to 2.1.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sqlalchemy/sqlalchemy/releases";>sqlalchemy's releases</a>.</em></p> <blockquote> <h1>2.1.5</h1> <p>Released: October 16, 2026</p> <h2>orm</h2> <ul> <li> <p><strong>[orm] [feature]</strong> Added the <code>_orm.Unmapped</code> annotation and the <code>_orm.unmapped_column()</code> construct, providing a declarative-compatible approach to having "excluded" columns in a Declarative model, that is, columns that are part of the <code>_schema.Table</code> but are not mapped, replacing the use of <code>_orm.Mapper.exclude_properties</code> for this purpose when using a Declarative mapping.</p> <p>References: <a href="https://www.sqlalchemy.org/trac/ticket/13650";>#13650</a></p> </li> <li> <p><strong>[orm] [bug] [regression]</strong> Fixed regression caused by <a href="https://www.sqlalchemy.org/trac/ticket/11917";>#11917</a> in version 2.0.36 where an ORM enabled <code>_sql.update()</code> using WHERE criteria which matched more than one object present in the <code>_orm.Session</code> would expire server-side onupdate columns, as well as columns that were SET to a SQL expression, on only one of the matched objects, leaving the remaining objects with stale values for those attributes. The columns are now expired for all matched objects.</p> <p>This change is also <strong>backported</strong> to: 2.0.55</p> <p>References: <a href="https://www.sqlalchemy.org/trac/ticket/13675";>#13675</a></p> </li> <li> <p><strong>[orm] [deprecated]</strong> Using the <code>_orm.Mapper.exclude_properties</code> or <code>_orm.Mapper.include_properties</code> parameters on a Declarative mapping to exclude attributes that are declared on the class, such as with <code>_orm.mapped_column()</code>, is deprecated and now emits a deprecation warning. This use was never supported, and depending on the arguments passed to <code>_orm.mapped_column()</code>, the attribute could remain mapped regardless; in particular, as of 2.1 this includes ORM mapped dataclasses where <code>_orm.mapped_column.default</code> is present. The new <code>_orm.unmapped_column()</code> construct should be used instead. Excluding columns that are present only in the <code>_schema.Table</code>, such as those from <code>__table__</code>, <code>__table_args__</code> or table reflection, is not affected.</p> <p>References: <a href="https://www.sqlalchemy.org/trac/ticket/13650";>#13650</a></p> </li> </ul> <h2>schema</h2> <ul> <li><strong>[schema] [bug]</strong> Fixed issue where dialect-specific keyword arguments established on a <code>ForeignKeyConstraint</code>, <code>ForeignKey</code> or <code>CheckConstraint</code>, such as <code>postgresql_not_valid</code>, were not carried along to the copy of the constraint produced by</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/sqlalchemy/sqlalchemy/commits";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
