dependabot[bot] opened a new pull request, #43419: URL: https://github.com/apache/superset/pull/43419
Updates the requirements on [clickhouse-connect](https://github.com/ClickHouse/clickhouse-connect) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ClickHouse/clickhouse-connect/releases";>clickhouse-connect's releases</a>.</em></p> <blockquote> <h2>v1.7.1</h2> <h2>clickhouse-connect v1.7.1</h2> <p>This is a patch release with two SQLAlchemy compatibility fixes.</p> <h2>What's Changed</h2> <h3>Bug Fixes</h3> <ul> <li><strong>SQLAlchemy 2.1 compatibility</strong>: Identifier quoting forwarded the deprecated <code>force</code> argument to <code>IdentifierPreparer.quote</code>, which SQLAlchemy 2.1 removed, causing any dialect use to raise <code>TypeError</code> on 2.1.0b3. The parent call now passes only the identifier. The optional <code>force</code> parameter remains available on the ClickHouse preparer for direct callers. Closes <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/954";>#954</a>.</li> <li><strong>SQLAlchemy 1.4 compatibility</strong>: Column DDL using the <code>clickhouse_materialized</code>, <code>clickhouse_alias</code>, or <code>clickhouse_ttl</code> options raised <code>AttributeError</code> on SQLAlchemy 1.4 because it called a rendering helper that only exists in 2.0. The helper is now implemented locally. This appears to have been broken since 1.1.0.</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ClickHouse/clickhouse-connect/compare/v1.7.0...v1.7.1";>https://github.com/ClickHouse/clickhouse-connect/compare/v1.7.0...v1.7.1</a></p> <h2>Installation</h2> <pre><code>pip install clickhouse-connect </code></pre> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ClickHouse/clickhouse-connect/blob/main/CHANGELOG.md";>clickhouse-connect's changelog</a>.</em></p> <blockquote> <h2>1.7.1, 2026-08-12</h2> <h3>Bug Fixes</h3> <ul> <li>SQLAlchemy 2.1 compatibility. Identifier quoting forwarded the deprecated <code>force</code> argument to <code>IdentifierPreparer.quote</code>, which SQLAlchemy 2.1 removed, so any dialect use raised <code>TypeError</code> on 2.1.0b3. The parent call now passes only the identifier. The optional <code>force</code> parameter stays on the ClickHouse preparer for direct callers. Closes <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/954";>#954</a>.</li> <li>SQLAlchemy 1.4 compatibility. Column DDL using the <code>clickhouse_materialized</code>, <code>clickhouse_alias</code>, or <code>clickhouse_ttl</code> options raised <code>AttributeError</code> on SQLAlchemy 1.4 because it called a rendering helper that only exists in 2.0. The helper is now implemented locally. This appears to have been broken since 1.1.0.</li> </ul> <h2>1.7.0, 2026-08-11</h2> <h3>Improvements</h3> <ul> <li>SQLAlchemy JSON columns now support storage-backed subcolumn access with <code>column["segment"]</code>, <code>column.subcolumn("segment", type_=...)</code>, and the statically typed <code>json_subcolumn(...)</code> helper. Nested paths compile as independently quoted dotted identifiers, and typed access uses <code>CAST</code>. Closes <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/899";>#899</a>.</li> <li><code>show_clickhouse_errors</code> now accepts <code>"scrub"</code> in addition to <code>True</code>/<code>False</code>. Scrub mode keeps the SQL exception text and symbolic name (for example <code>UNKNOWN_TABLE</code>) while stripping the server URL and trailing <code>(version ...)</code> trailer from client exception messages. Transport errors and mid-stream <code>StreamFailureError</code> messages honor the same setting. When error detail is disabled (<code>False</code>), the displayed exception string is generic. The chDB backend now uses the same generic text as HTTP, without its former trailing period. This setting governs <code>str(exc)</code> only. Transport errors remain attached as <code>__cause__</code>, so tracebacks can still contain the original host, URL, or library error text. Historical string booleans still work, but non-boolean values such as integers and unrecognized strings now raise <code>ProgrammingError</code>. Addresses the middle ground req uested in <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/344";>#344</a>.</li> <li>SQLAlchemy: added support for materialized common table expressions. <code>cc_sqlalchemy.select(...).cte("name", materialized=True)</code> emits <code>WITH name AS MATERIALIZED (...)</code>, so a CTE referenced more than once is computed once instead of being inlined and re-executed at each reference. A module-level <code>cc_sqlalchemy.cte(statement, "name", materialized=True)</code> does the same for a statement built with the standard <code>sqlalchemy.select</code>. The keyword renders only on the ClickHouse dialect. The server materializes the CTE only when the experimental <code>enable_materialized_cte</code> setting is also enabled for the query and the analyzer is enabled. Materialized CTEs require ClickHouse 26.3 or later. The SQLAlchemy helpers reject <code>recursive=True</code> with <code>materialized=True</code> because ClickHouse does not support recursive materialized CTEs. Closes <a href="https://redirect.github.com/ClickHouse/clickhouse-connec t/issues/900">#900</a>.</li> <li>Added the global <code>naive_datetime_insert</code> setting for Python object inserts, including naive ISO strings accepted by <code>DateTime64</code>. Set it to <code>"server"</code> to interpret a naive <code>datetime</code> in the timezone declared by the <code>DateTime</code> or <code>DateTime64</code> column, or in the server timezone when the column has no timezone. The default remains <code>"local"</code> in 1.x and preserves the existing host-local conversion. This setting does not change <code>datetime64</code>-dtype NumPy and Pandas columns. Use <code>naive_datetime_binding</code> to control naive <code>datetime</code> query parameters. See <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/938";>#938</a>.</li> </ul> <h3>Behavior Changes</h3> <ul> <li>Removed runtime compatibility branches for unsupported ClickHouse server versions older than 25.8. Client initialization no longer substitutes the <code>common.readonly</code> value for servers older than 19.17 and always attempts guarded Native protocol negotiation, retaining the existing proxy-safe fallback. JSON inserts no longer fall back to <code>String</code> serialization for 24.8 and 24.9 servers. The module attribute <code>clickhouse_connect.datatypes.dynamic.json_serialization_format</code> remains importable for compatibility but assigning it no longer changes insert behavior. The generated <code>cast_string_to_dynamic_use_inference</code> default no longer depends on the obsolete <code>allow_experimental_json_type</code> setting. The global <code>common.readonly</code> option is deprecated and retained as a no-op. The default local Docker server is now ClickHouse 25.8.</li> <li><code>datetime.time</code> and <code>datetime.timedelta</code> query parameters are now rendered as quoted literals. A <code>time</code> value was previously rendered without quotes and the server rejected it, so some queries added the quotes in the query text as a workaround, for example <code>WHERE t = '%(t)s'</code>. Those queries now produce a doubled quote and fail. Remove the manual quotes and bind the value normally. See <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/919";>#919</a>.</li> <li>Naive <code>datetime</code> query parameters now bind as wall time instead of being interpreted in the client host timezone. Previously a naive value passed through <code>astimezone</code> for server-side <code>{name:DateTime}</code> parameters and <code>DT64Param</code> values, so the same query could match different rows depending on the timezone of the machine running it. Only workloads that bind naive datetime parameters with a non-UTC host timezone or a non-UTC target timezone are affected. Environments where both the host and the bind target are UTC see no change, and client-side <code>%</code> parameters against a UTC server were already sent verbatim. Two changes are observable. First, on a non-UTC host with a UTC target, server-side parameters and <code>DT64Param</code> values no longer shift, which corrects silently wrong results. Second, when the bind target is a non-UTC timezone, a naive value now means wall time in that timezone instead of the instant implied by t he client local timezone, which can change matched rows for code that relied on the old conversion. A related consequence is that inserting a naive datetime and then filtering with the same naive value no longer matches on a non-UTC host, because the insert path still interprets naive values as host local time. <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/938";>#938</a> tracks unifying insert semantics. Timezone-aware datetimes are unchanged and still convert to the target bind timezone. Set <code>common.set_setting("naive_datetime_binding", "legacy")</code> to restore the previous behavior exactly. To make a naive value represent a specific instant under either mode, attach the intended <code>tzinfo</code> before binding.</li> </ul> <h3>Bug Fixes</h3> <ul> <li>SQLAlchemy identifiers containing <code>%</code> now compile safely in statements with bound parameters. The DB-API bulk INSERT path also restores escaped percent signs in table and column names, so <code>executemany</code> keeps using one bulk insert instead of falling back to row-by-row execution or sending the wrong identifier. This includes <code>%2E</code> JSON key encodings used with <code>json_type_escape_dots_in_keys</code>.</li> <li><code>datetime.time</code> and <code>datetime.timedelta</code> query parameters now bind as a quoted <code>HH:MM:SS[.ffffff]</code> literal for <code>Time</code> and <code>Time64</code> columns. This fixes client-side <code>%(name)s</code> binding, timezone-aware <code>time</code> values, <code>timedelta</code> values, and values nested in arrays and tuples. A naive scalar <code>time</code> at the top level of a server-side <code>{name:Time}</code> bind already worked and is unchanged. A <code>timedelta</code> may be negative and may exceed 24 hours, and a pandas <code>Timedelta</code> with sub-microsecond nanoseconds formats a nine digit fraction. Plain <code>Time</code> accepts only whole seconds. Addresses the <code>Time</code> parameter failure in <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/919";>#919</a>.</li> <li>SQLAlchemy: <code>Time</code> and <code>Time64</code> columns now accept <code>datetime.time</code> and <code>datetime.timedelta</code> values in inserts and comparisons, and render correctly with <code>literal_binds</code>. The types inherit from the SQLAlchemy <code>Interval</code> type, which converted every bound value to an epoch datetime that the server rejected and coerced comparison values to its <code>DateTime</code> implementation. Reads still return <code>timedelta</code>. Part of <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/919";>#919</a>.</li> <li>DB API module now provides the PEP 249 type constructors <code>Binary</code>, <code>Date</code>, <code>Time</code>, <code>Timestamp</code>, <code>DateFromTicks</code>, <code>TimeFromTicks</code>, and <code>TimestampFromTicks</code>. SQLAlchemy <code>LargeBinary</code> inserts no longer raise <code>AttributeError</code>. Addresses the Binary constructor failure in <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/919";>#919</a>.</li> <li>Fractional <code>DateTime64</code> values before the Unix epoch now serialize with the correct second. The serializer truncated negative timestamps toward zero before adding the fractional component, which shifted affected values forward by one second. This affected Python <code>datetime</code> values and accepted ISO strings in both naive datetime insert modes. See <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/938";>#938</a>.</li> <li>Parsing a nested <code>Variant</code>, <code>Tuple</code>, <code>Nested</code>, or typed <code>JSON</code> column type whose element is an <code>Enum</code> with an escaped single quote in a value name no longer corrupts the escape sequence and fails while re-parsing the element type. Closes <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/878";>#878</a>.</li> <li><code>None</code> nested inside an <code>Array</code> or <code>Tuple</code>, or inside a <code>Map</code> when <code>dict_parameter_format="map"</code>, now renders as the SQL <code>NULL</code> keyword instead of the <code>\N</code> sentinel used for top-level values. Top-level scalar <code>None</code> binds are unchanged. Closes <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/879";>#879</a>.</li> <li>Inserting empty bytes <code>b""</code> into a non-nullable <code>FixedString(N)</code> column now zero-pads to N bytes instead of raising <code>DataError</code>, matching the existing string and nullable-bytes write paths. Closes <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/880";>#880</a>.</li> <li>Per-query and client settings that are not present in <code>system.settings</code> for the current user (including custom settings declared <code>CHANGEABLE_IN_READONLY</code> on a role) are now forwarded to ClickHouse instead of raising <code>ProgrammingError: Setting ... is unknown or readonly</code>. The client cannot discover those settings without extra privileges, so the server is treated as authoritative. Setting <code>invalid_setting_action</code> to <code>drop</code> still drops them, so a single settings dict stays portable across server versions. Known readonly settings still honor <code>invalid_setting_action</code>, and reserved HTTP request parameter names such as <code>query</code>, <code>user</code>, <code>default_format</code>, and the <code>param_</code> bound-parameter namespace still raise a client-side <code>ProgrammingError</code> because they are not settings. Closes <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/530";>#530</a>. </li> <li>SQLAlchemy reflection and metadata queries now force internal <code>String</code> decoding, so <code>set_default_formats("String", "bytes")</code> no longer turns reflected database, table, or column names into <code>bytes</code>. The Alembic startup current database lookup uses the same internal format. Alembic version table queries do not use the internal override and remain affected by a global <code>String</code> bytes format. Closes <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/920";>#920</a>.</li> <li>Removing a block comment for query type detection no longer joins the tokens around it. The server lexer treats a comment as a token separator, but <code>remove_sql_comments</code> replaced it with nothing, so <code>SELECT/*c*/number FROM numbers(9)</code> became the single token <code>SELECTnumber</code>, stopped looking like a <code>SELECT</code>, and the client side <code>query_limit</code> was silently dropped, while <code>SELECT number FROM numbers(9)/*c*/LIMIT 1</code> became <code>numbers(9)LIMIT 1</code>, hid the real <code>LIMIT</code>, and the client appended a second one that the server rejected with <code>Code: 62</code>. A removed block comment now leaves a single space behind, and the trailing <code>LIMIT 0</code> check that routes a query to the columns only metadata probe accepts any whitespace between <code>LIMIT</code> and <code>0</code> instead of exactly one space, so <code>LIMIT /*c*/0</code> keeps reaching that probe. A <code>--</code> line comment is unc hanged, its terminating newline was already kept. Closes <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/928";>#928</a>.</li> <li>The native streaming response buffer again detects mid-stream server exceptions proactively. Its in-band exception scan built the markers as <code>__exception__<tag></code> and <code><tag>__exception__</code>, but the server separates <code>__exception__</code> from the tag with a CRLF on both markers (<code>__exception__\r\n<tag></code> ... <code><tag>\r\n__exception__</code>), so the scan never matched and the exception block was only recovered by the last-chunk fallback in <code>NativeTransform.parse_response</code>. When the block spanned a transport-chunk boundary that fallback saw just a fragment and surfaced a truncated or garbled error instead of the real ClickHouse exception. Both the pure Python and compiled Cython buffers are corrected. Closes <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/915";>#915</a>.</li> <li>DB-API <code>Cursor.description</code> now reports the result type's top-level nullability instead of hardcoding <code>null_ok=True</code>, including the implicit null values supported by <code>Variant</code>, <code>Dynamic</code>, and <code>SimpleAggregateFunction</code> over a nullable element type. Existing <code>type_code</code> values are unchanged, and types whose nullability is unknown report <code>None</code>. The empty-result metadata probe also recognizes leading ClickHouse comments, including nested block comments, and is best effort, so a failed probe leaves <code>description</code> empty instead of raising after the original query succeeded. Closes <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/902";>#902</a>, <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/907";>#907</a>, and <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/909";>#909</a>.</li> <li>Compound values stored in JSON shared data, such as arrays of objects, heterogeneous arrays, and nested arrays, are now decoded to Python objects instead of being returned as raw bytes. <code>Date</code>, <code>DateTime</code>, and <code>DateTime64</code> values in shared data, both as scalars and inside arrays, now decode as well. Closes <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/897";>#897</a>.</li> <li><code>AsyncClient</code> no longer tears down the aiohttp response from the parser's executor thread when a query fails mid-stream. The synchronous cleanup cancelled the producer task and closed the response directly, which raced with the event loop handling the server's connection abort and could surface an <code>AttributeError</code> from asyncio's SSL shutdown on TLS connections instead of the real <code>StreamFailureError</code>. Cleanup is now scheduled onto the event loop with <code>call_soon_threadsafe</code>.</li> </ul> <h2>1.6.0, 2026-07-23</h2> <h3>Bug Fixes</h3> <ul> <li><code>AsyncClient</code> initialization no longer overwrites user-supplied session settings with generated defaults. A client created with <code>settings={'date_time_input_format': 'basic'}</code> previously had that value replaced by the generated <code>best_effort</code> default. User settings now always win, matching the sync client.</li> <li>An <code>AsyncClient</code> created with both client certificates and an access token now sends the mutual TLS authentication headers and the <code>Authorization: Bearer</code> header together, matching the sync client. The certificates previously suppressed the token at construction, while the <code>token_provider</code> option re-added its token right after initialization, so the two async token paths disagreed with each other. The server resolves the credential precedence.</li> <li>Dict-valued settings such as <code>additional_table_filters</code> no longer crash with <code>DB::Exception: Cannot parse quoted string</code> when passed through <code>query()</code>'s <code>settings</code> parameter. The value was rendered with Python's own <code>str()</code>/<code>repr()</code> of the dict, which mixes single and double quotes and is not valid ClickHouse map-literal syntax; it is now rendered as a properly single-quoted, escaped ClickHouse map literal. Closes <a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/501";>#501</a>.</li> </ul> <h3>Improvements</h3> <ul> <li>Async clients now emit URL query parameters in the same order as the sync client on every request. The parameter names and values are unchanged, so this is only visible to systems that match or sign the exact request URL.</li> <li>Client creation no longer fails when the <code>client_protocol_version</code> capability probe errors on the sync client. The client falls back to running without the newer native protocol features and logs the probe failure at debug level, matching the async client.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ClickHouse/clickhouse-connect/commit/d479216811a746281bad1dc194bcfa8ef13fefb1";><code>d479216</code></a> release prep v1.7.1 (<a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/957";>#957</a>)</li> <li><a href="https://github.com/ClickHouse/clickhouse-connect/commit/6d63e377e02460472366f671abb6596f8c355f83";><code>6d63e37</code></a> fix SQLAlchemy 2.1 identifier quoting and broken 1.4 column ddl (<a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/956";>#956</a>)</li> <li><a href="https://github.com/ClickHouse/clickhouse-connect/commit/1503beac06e5801b070c726f94819584618a7f07";><code>1503bea</code></a> add publish_core workflow for clickhouse-connect-core wheels (<a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/955";>#955</a>)</li> <li><a href="https://github.com/ClickHouse/clickhouse-connect/commit/f25bb0d2b41fe0de3f709f65487e571f98e19a1f";><code>f25bb0d</code></a> release prep for v1.7.0 (<a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/953";>#953</a>)</li> <li><a href="https://github.com/ClickHouse/clickhouse-connect/commit/948d46001efc7b6735129fd32da838faa350014b";><code>948d460</code></a> Remove old server version checks (<a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/945";>#945</a>)</li> <li><a href="https://github.com/ClickHouse/clickhouse-connect/commit/c81f3bdde4935717852ef095a71a5b346ac45447";><code>c81f3bd</code></a> add SQLAlchemy JSON subcolumn access (<a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/944";>#944</a>)</li> <li><a href="https://github.com/ClickHouse/clickhouse-connect/commit/6446994cee9564f2c3382229b92e27fa5eda3768";><code>6446994</code></a> fix bind time and timedelta parameters as Time literals (<a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/943";>#943</a>)</li> <li><a href="https://github.com/ClickHouse/clickhouse-connect/commit/a114c627e23b62ead3737bdaf51487e04e6b49b8";><code>a114c62</code></a> Add show_clickhouse_errors="scrub" to hide host and version (<a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/937";>#937</a>)</li> <li><a href="https://github.com/ClickHouse/clickhouse-connect/commit/55e105169123f25f60cc31286311bc9d67480c23";><code>55e1051</code></a> fix: protect SQLAlchemy reflection from String bytes format (<a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/935";>#935</a>)</li> <li><a href="https://github.com/ClickHouse/clickhouse-connect/commit/32c93d8dfb5228dc54a120070fe1f6b59480ea19";><code>32c93d8</code></a> add PEP 249 DB API constructors (<a href="https://redirect.github.com/ClickHouse/clickhouse-connect/issues/940";>#940</a>)</li> <li>Additional commits viewable in <a href="https://github.com/ClickHouse/clickhouse-connect/compare/v1.6.0...v1.7.1";>compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
