Skip to content

chore(deps): bump sqlalchemy from 1.4.54 to 2.0.51 - #40830

Closed
dependabot[bot] wants to merge 3 commits into
masterfrom
dependabot/pip/sqlalchemy-2.0.50
Closed

chore(deps): bump sqlalchemy from 1.4.54 to 2.0.51#40830
dependabot[bot] wants to merge 3 commits into
masterfrom
dependabot/pip/sqlalchemy-2.0.50

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 6, 2026

Copy link
Copy Markdown
Contributor

Bumps sqlalchemy from 1.4.54 to 2.0.50.

Release notes

Sourced from sqlalchemy's releases.

2.0.50

Released: May 24, 2026

orm

  • [orm] [bug] Fixed issue where using _orm.joinedload() with PropComparator.of_type() targeting a joined-table subclass combined with PropComparator.and_() referencing a column on that subclass would generate invalid SQL, where the subclass column was not adapted to the subquery alias. Pull request courtesy Joaquin Hui Gomez.

    References: #13203

  • [orm] [bug] Fixed issue where the presence of a SessionEvents.do_orm_execute() event hook would cause internal execution options such as yield_per and loader-specific state from the first orm_pre_session_exec pass to leak into the second pass, leading to errors when using relationship loaders such as selectinload() and immediateload(). The execution options passed to the second compilation pass are now based on the original options plus only the explicit updates made via ORMExecuteState.update_execution_options() within the event hook.

    References: #13301

  • [orm] [bug] Fixed issue where using _orm.with_polymorphic() on a leaf class (a subclass with no further descendants) or a non-inherited class would fail with an AttributeError when used in an ORM statement, due to _orm.configure_mappers() not being triggered implicitly. The fix ensures that AliasedInsp participates in the _post_inspect hook, triggering mapper configuration during ORM statement compilation.

    References: #13319

sql

  • [sql] [bug] Fixed issue where floor division (//) between a Float or Numeric numerator and an Integer denominator would omit the FLOOR() SQL wrapper on dialects where Dialect.div_is_floordiv is True (the default, including PostgreSQL and SQLite). FLOOR() is now applied if either the denominator or the numerator is a non-integer, so that expressions such as float_col // int_col render as FLOOR(float_col / int_col) instead of the incorrect float_col / int_col. Pull request courtesy r266-tech.

    References: #10528

postgresql

... (truncated)

Commits

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependabot pip Dependabot - pip related PRs labels Jun 6, 2026
@dosubot dosubot Bot added dependencies:python risk:breaking-change Issues or PRs that will introduce breaking changes labels Jun 6, 2026
@bito-code-review

bito-code-review Bot commented Jun 6, 2026

Copy link
Copy Markdown
Contributor

Code Review Agent Run #46b5d8

Actionable Suggestions - 0
Review Details
  • Files reviewed - 1 · Commit Range: 59937ea..59937ea
    • pyproject.toml
  • Files skipped - 0
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by Bito Logo

@dependabot
dependabot Bot force-pushed the dependabot/pip/sqlalchemy-2.0.50 branch 3 times, most recently from 17dd8ca to a3e2e61 Compare June 7, 2026 06:19
@bito-code-review

bito-code-review Bot commented Jun 7, 2026

Copy link
Copy Markdown
Contributor

Code Review Agent Run #da5055

Actionable Suggestions - 0
Review Details
  • Files reviewed - 1 · Commit Range: a3e2e61..a3e2e61
    • pyproject.toml
  • Files skipped - 0
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by Bito Logo

@dependabot
dependabot Bot force-pushed the dependabot/pip/sqlalchemy-2.0.50 branch from a3e2e61 to 6119417 Compare June 7, 2026 10:04
@bito-code-review

bito-code-review Bot commented Jun 7, 2026

Copy link
Copy Markdown
Contributor

Code Review Agent Run #030bb0

Actionable Suggestions - 0
Filtered by Review Rules

Bito filtered these suggestions based on rules created automatically for your feedback. Manage rules.

  • pyproject.toml - 1
Review Details
  • Files reviewed - 1 · Commit Range: 6119417..6119417
    • pyproject.toml
  • Files skipped - 0
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by Bito Logo

@rusackas

rusackas commented Jun 9, 2026

Copy link
Copy Markdown
Member

I dug into this SA 1.4 → 2.0 bump to see how far it can be made to land safely. Short version: there is no longer a hard upstream blocker (FAB 5.x already supports SA2), but this is a real multi-PR ORM migration and isn't fully landable in one shot. I've pushed a coherent, backward-compatible prep commit (731d115) and here's the full picture.

No hard upstream dependency blocker

Resolving the PR's constraints (flask-appbuilder>=5.2.1, sqlalchemy>=2.0.50,<3) pulls a clean, fully SA2-compatible set:

  • flask-appbuilder 5.2.1 (requires SQLAlchemy <3,>=1.4) ✅
  • Flask-SQLAlchemy 3.1.1 ✅ (2.5.1 does not support SA2; 3.x does)
  • marshmallow-sqlalchemy 1.5.0 ✅ (0.28.x pins <2.0; 1.x supports SA2)
  • SQLAlchemy-Utils 0.42.1

So the historical "FAB pins SA<2" wall is gone. The work is application-code migration, not waiting on upstream.

What I fixed and verified (pushed in 731d115)

All changes are written to work on both SA1.4/FSA2.x and SA2/FSA3, so they do not regress the current baseline (verified: the tests/unit_tests/db_engine_specs/test_sqlite.py suite still goes 47/47 on SA1.4 with these changes, and dao/ + models/ introduce zero new failures vs. master — the 2 test_dttm_sql_literal failures are pre-existing).

Breaking-change categories addressed:

  • Removed eagerload (alias of joinedload) → superset/security/manager.py.
  • Legacy select([...]) / case([...]) list-form (hard ArgumentError in SA2) → select(...)/case(...) in connectors/sqla/models.py, models/helpers.py, utils/core.py, extensions/metadb.py, common/tags.py, commands/importers/v1/utils.py.
  • flask_sqlalchemy.BaseQuery removed in FSA3flask_sqlalchemy.query.Query with a FSA2 fallback (queries/filters.py, queries/saved_queries/filters.py).
  • sqlalchemy.sql.visitors.VisitableType removedsqlalchemy.types.TypeEngine (utils/mock_data.py, commands/dataset/importers/v1/utils.py).
  • Annotated Declarative (SA2 inspects type annotations on mapped classes): @declared_attr columns/relationships now need Mapped[...] return annotations — fixed created_by_fk/changed_by_fk and BaseDatasource.slices; set __allow_unmapped__ = True on the FAB declarative base in superset/__init__.py so remaining legacy 1.x annotations are tolerated during incremental migration.
  • Engine.execute / raw-string execution removed: wrapped the startup health check and the secrets-migrator queries in text(), used a Connection, switched **kwargs binds to a single dict, and moved Row string-key access to row._mapping[...] (initialization/__init__.py, utils/encrypt.py).
  • Bumped the in-repo apache-superset-core SQLAlchemy pin to >=2.0.50,<3 (superset-core/pyproject.toml) — it was still pinned <2.0.

With these, the full app boots under SQLAlchemy 2.0.50 (create_app() succeeds, all models map). That was the first wall and it's cleared.

The dominant remaining blocker (why this isn't fully landable yet)

SA 2.0's autobegin / connection-transaction semantics break the app/test bootstrap. During appbuilder.init_app → FAB _create_db()inspect(engine).get_table_names() then Model.metadata.create_all(engine), SA2 raises:

InvalidRequestError: This connection has already initialized a SQLAlchemy Transaction() object via begin() or autobegin; can't call begin() here unless rollback() or commit() is called first.

This errors every unit test that boots the app fixture (e.g. all of tests/unit_tests/dao/* error at setup; test_sqlite.py goes 47 passed → 47 errors). It reproduces specifically with the in-memory sqlite single-connection pool that the test harness uses. This is a genuine SA2 regression (confirmed against the pristine baseline) and needs deliberate session/engine-lifecycle work — likely committing/closing the session before FAB's create_all, or a small upstream FAB fix — not a mechanical edit. I deliberately did not force a speculative fix here.

Remaining migration plan (by category, with refs)

  1. Resolve the autobegin/create_all transaction conflict in the bootstrap (FAB _create_db path). This is the gating item; once green, the unit suite can be run end-to-end on SA2.
  2. Regenerate lockfiles: requirements/base.txt and requirements/development.txt still pin sqlalchemy==1.4.54, flask-sqlalchemy==2.5.1, marshmallow-sqlalchemy==1.4.0. These must be re-pip-compiled from pyproject.toml (FSA must move to 3.x). The dependabot PR only touched pyproject.toml, so even the dependency layer is incomplete.
  3. Engine.execute(<raw str>) in db_engine_specs (runtime breaks, db-specific, not on the core path): db_engine_specs/doris.py:310, hive.py:237,263, databricks.py:557,561, impala.py:100. Wrap in text() + use a Connection.
  4. Query.get()Session.get() (deprecated, still works, low risk): security/manager.py:2082, cli/export_example.py:158, mcp_service/chart/preview_utils.py:84, commands/importers/v1/examples.py:71, commands/dataset/duplicate.py:58, commands/sql_lab/estimate.py:60, daos/dataset.py:417.
  5. Migration files: ~100 Alembic migrations import declarative_base from sqlalchemy.ext.declarative (still works, deprecation warning) and a handful use MetaData(bind=...) / select([...]) (break only if that migration runs). Sweep when convenient.
  6. Full integration-test pass + Row/result-API audit once 1–3 are done.

I'll keep the pushed commit as the SA2-prep base since it's safe on the current baseline. Happy to take the autobegin fix next as a follow-up once we decide whether to patch it Superset-side or push it upstream to FAB.

@netlify

netlify Bot commented Jun 9, 2026

Copy link
Copy Markdown

Deploy Preview for superset-docs-preview ready!

Name Link
🔨 Latest commit 731d115
🔍 Latest deploy log https://app.netlify.com/projects/superset-docs-preview/deploys/6a276a7cf583d20008a13c6d
😎 Deploy Preview https://deploy-preview-40830--superset-docs-preview.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@bito-code-review bito-code-review Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review Agent Run #f8abd4

Actionable Suggestions - 1
  • superset-core/pyproject.toml - 1
    • SQLAlchemy 2.0 migration incomplete · Line 49-49
Review Details
  • Files reviewed - 16 · Commit Range: 6119417..731d115
    • superset-core/pyproject.toml
    • superset/__init__.py
    • superset/commands/dataset/importers/v1/utils.py
    • superset/commands/importers/v1/utils.py
    • superset/common/tags.py
    • superset/connectors/sqla/models.py
    • superset/extensions/metadb.py
    • superset/initialization/__init__.py
    • superset/models/helpers.py
    • superset/queries/filters.py
    • superset/queries/saved_queries/filters.py
    • superset/security/manager.py
    • superset/utils/core.py
    • superset/utils/encrypt.py
    • superset/utils/mock_data.py
    • tests/integration_tests/reports/commands_tests.py
  • Files skipped - 0
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful
    • MyPy (Static Code Analysis) - ✔︎ Successful
    • Astral Ruff (Static Code Analysis) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by Bito Logo

Comment thread superset-core/pyproject.toml

@rusackas rusackas left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR may or may not be needed in the end... there are other PRs working toward 2.0 compatability, so it's just a matter of landing planes in the right order.

@dependabot @github

dependabot Bot commented on behalf of github Jun 27, 2026

Copy link
Copy Markdown
Contributor Author

A newer version of sqlalchemy exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

dependabot Bot and others added 2 commits July 7, 2026 10:03
Bumps [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) from 1.4.54 to 2.0.50.
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

---
updated-dependencies:
- dependency-name: sqlalchemy
  dependency-version: 2.0.50
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…on layer)

Companion code changes for the SQLAlchemy 1.4 -> 2.0 bump. These are
backward-compatible with SQLAlchemy 1.4 / Flask-SQLAlchemy 2.x, so they do
not regress the current baseline, while unblocking the SA2 import/boot path.

Mechanical SA2 breaking-change fixes:
- Removed `sqlalchemy.orm.eagerload` (alias of `joinedload`) in security manager.
- Legacy list-form `select([...])` -> `select(...)` and `case([...])` ->
  `case(...)` across runtime code (connectors, models/helpers, utils/core,
  extensions/metadb, common/tags, importers).
- `flask_sqlalchemy.BaseQuery` removed in FSA 3.x -> import from
  `flask_sqlalchemy.query.Query` with a fallback to FSA 2.x.
- `sqlalchemy.sql.visitors.VisitableType` removed -> `sqlalchemy.types.TypeEngine`.
- Annotated Declarative: `@declared_attr` columns/relationships now require
  `Mapped[...]` return annotations (created_by_fk/changed_by_fk, BaseDatasource.slices);
  set `__allow_unmapped__` on the FAB declarative base to allow remaining legacy
  1.x annotations during incremental migration.
- Raw-string execution / Engine.execute removal: wrap startup health check and
  secrets-migrator SQL in `text()`, use a Connection, pass a single bind dict
  instead of **kwargs, and access Row values via `row._mapping[...]`.
- Bump in-repo `apache-superset-core` SQLAlchemy pin to >=2.0.50,<3.

This does not complete the full 2.0 migration. The dominant remaining blocker is
SA 2.0 autobegin / connection-transaction semantics in the app/test bootstrap
(FAB `_create_db` -> `Model.metadata.create_all`), plus lockfile regeneration and
db_engine_spec raw-SQL execution. See the PR discussion for the full plan.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@rusackas
rusackas force-pushed the dependabot/pip/sqlalchemy-2.0.50 branch from 731d115 to 53ce978 Compare July 7, 2026 17:07
@pull-request-size pull-request-size Bot added size/XS and removed size/L labels Jul 7, 2026
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@pull-request-size pull-request-size Bot added size/S and removed size/XS labels Jul 7, 2026
@bito-code-review

bito-code-review Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Code Review Agent Run #e2c6d4

Actionable Suggestions - 0
Filtered by Review Rules

Bito filtered these suggestions based on rules created automatically for your feedback. Manage rules.

  • requirements/development.txt - 1
    • BLOCKER: Flask-SQLAlchemy version mismatch · Line 973-973
Review Details
  • Files reviewed - 4 · Commit Range: 562b1f2..a21af75
    • pyproject.toml
    • requirements/base.txt
    • requirements/development.txt
    • superset-core/pyproject.toml
  • Files skipped - 0
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by Bito Logo

@rusackas rusackas changed the title chore(deps): bump sqlalchemy from 1.4.54 to 2.0.50 chore(deps): bump sqlalchemy from 1.4.54 to 2.0.51 Jul 7, 2026
@rusackas rusackas closed this Jul 13, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 13, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/pip/sqlalchemy-2.0.50 branch July 13, 2026 19:03
@rusackas

Copy link
Copy Markdown
Member

We'll tackle this by hand... making incremental steps on this front.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependabot pip Dependabot - pip related PRs risk:breaking-change Issues or PRs that will introduce breaking changes size/S

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant