dependabot[bot] opened a new pull request, #3824: URL: https://github.com/apache/iceberg-python/pull/3824
Bumps [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) from 2.0.51 to 2.0.52. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sqlalchemy/sqlalchemy/releases";>sqlalchemy's releases</a>.</em></p> <blockquote> <h1>2.0.52</h1> <p>Released: August 11, 2026</p> <h2>platform</h2> <ul> <li> <p><strong>[platform] [bug]</strong> Python 3.15 support has been added and tested, including minimal changes for full compatibility.</p> <p>References: <a href="https://www.sqlalchemy.org/trac/ticket/13477";>#13477</a></p> </li> </ul> <h2>orm</h2> <ul> <li> <p><strong>[orm] [bug]</strong> Fixed a result-column misalignment bug in ORM-enabled UPDATE statements where <code>synchronize_session="fetch"</code> is in use, either explicitly or because the statement uses constructs such as CTEs that implicitly select for it. Columns in rows returned by <code>.returning()</code> could be returned under incorrect keys (e.g. <code>row[SomeClass.a]</code> returning the value of a different column), a problem most likely to manifest under concurrent workloads. ORM DELETE statements were not affected.</p> <p>References: <a href="https://www.sqlalchemy.org/trac/ticket/13439";>#13439</a></p> </li> <li> <p><strong>[orm] [bug]</strong> Fixed bug where a failed <code>_orm.Session.bulk_insert_mappings()</code>, <code>_orm.Session.bulk_update_mappings()</code> or <code>_orm.Session.bulk_save_objects()</code> call could leave the <code>_orm.Session</code> permanently in a "flushing" state, such as when the transaction could not be begun because a previous flush had left it needing a rollback. Unlike <code>_orm.Session.flush()</code>, the bulk methods set the internal flushing flag and began the transaction outside of the <code>try</code>/<code>finally</code> block that resets it, so that neither <code>_orm.Session.rollback()</code> nor <code>_orm.Session.close()</code> would clear it, and every subsequent flush would raise <code>InvalidRequestError: Session is already flushing</code>. Pull request courtesy Hamody We.</p> <p>References: <a href="https://www.sqlalchemy.org/trac/ticket/13485";>#13485</a></p> </li> <li> <p><strong>[orm] [bug]</strong> Fixed issue where unpickling an ORM object that were loaded using loader options making use of wildcard tokens, such as <code>_orm.load_only()</code> or <code>_orm.raiseload()</code> with <code>"*"</code>, would fail with <code>KeyError</code> or <code>IndexError</code> if the process doing the unpickling had not yet constructed a loader path making use of that same token. This would typically be observed when the object were unpickled in a separate process, such as with the <code>spawn</code> or <code>forkserver</code> multiprocessing start methods, the latter of which became the default on POSIX platforms as of Python 3.14. The internal collection of these tokens is now established up front, so that it is identical in every process.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/sqlalchemy/sqlalchemy/commits";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
