dependabot[bot] opened a new pull request, #45703: URL: https://github.com/apache/superset/pull/45703
Bumps [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) from 2.0.52 to 2.0.55. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sqlalchemy/sqlalchemy/releases";>sqlalchemy's releases</a>.</em></p> <blockquote> <h1>2.0.55</h1> <p>Released: October 16, 2026</p> <h2>orm</h2> <ul> <li> <p><strong>[orm] [bug]</strong> Fixed issue in Annotated Declarative where an annotation naming an undefined symbol, where the annotation is not wrapped in <code>_orm.Mapped</code>, would raise <code>TypeError</code> rather than the expected <code>MappedAnnotationError</code> when running under Python 3.14 without <code>from __future__ import annotations</code> in effect. Under <a href="https://peps.python.org/pep-0649";>PEP 649</a>, such an annotation is delivered as a <code>ForwardRef</code> rather than a string, a form which was not accommodated by the check that determines whether an unresolvable annotation was intended to be mapped.</p> <p>References: <a href="https://www.sqlalchemy.org/trac/ticket/13602";>#13602</a></p> </li> <li> <p><strong>[orm] [bug] [regression]</strong> Fixed regression caused by <a href="https://www.sqlalchemy.org/trac/ticket/11917";>#11917</a> in version 2.0.36 where an ORM enabled <code>_sql.update()</code> using WHERE criteria which matched more than one object present in the <code>_orm.Session</code> would expire server-side onupdate columns, as well as columns that were SET to a SQL expression, on only one of the matched objects, leaving the remaining objects with stale values for those attributes. The columns are now expired for all matched objects.</p> <p>References: <a href="https://www.sqlalchemy.org/trac/ticket/13675";>#13675</a></p> </li> </ul> <h2>orm extensions</h2> <ul> <li> <p><strong>[bug] [orm extensions]</strong> Fixed issue in the <code>mutable_toplevel</code> extension where the in-place <code>|=</code> operator on <code>MutableDict</code> and the in-place <code>*=</code> operator on <code>MutableList</code> did not emit change events, so that the modification was not detected and was not persisted on the next flush. These operators now invoke <code>Mutable.changed()</code> in the same way as the in-place set operators of <code>MutableSet</code> and the <code>+=</code> operator of <code>MutableList</code>.</p> <p>References: <a href="https://www.sqlalchemy.org/trac/ticket/13643";>#13643</a></p> </li> </ul> <h2>engine</h2> <ul> <li><strong>[engine] [bug] [regression]</strong> Fixed regression from the 1.4 series where the DBAPI cursor used for a compiled statement that returns no rows, which includes DDL constructs such as <code>CreateTable</code> and <code>DropTable</code> as well as the SAVEPOINT, ROLLBACK TO SAVEPOINT and RELEASE SAVEPOINT statements emitted by <code>_engine.Connection.begin_nested()</code>, was not closed after execution, and was instead left to be released when garbage collected.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/sqlalchemy/sqlalchemy/commits";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
