[PR #318] [CLOSED] Scheduled weekly dependency update for week 15 #325

New issue

Closed

opened 2026-02-26 01:34:02 +03:00 by kerem · 0 comments

kerem commented 2026-02-26 01:34:02 +03:00

Owner

Copy link

📋 Pull Request Information

Original PR: https://github.com/jeffknupp/sandman2/pull/318
Author: @pyup-bot
Created: 4/10/2023
Status: ❌ Closed

Base: master ← Head: pyup-scheduled-update-2023-04-10

---

📝 Commits (10+)

• ee2fa2f Update flask from 1.1.2 to 2.2.3
• f69ff6e Update flask-admin from 1.5.7 to 1.6.1
• 4fe954b Update flask-sqlalchemy from 2.4.4 to 3.0.3
• 7fb7d11 Update sqlalchemy from 1.3.20 to 2.0.9
• 68e9f3f Update wtforms from 2.3.3 to 3.0.1
• 600898e Update coverage from 5.3 to 7.2.3
• 52edde7 Update pytest from 6.2.0 to 7.3.0
• 488f755 Update flask-cors from 3.0.9 to 3.0.10
• f16bde0 Update pytest-cov from 2.10.1 to 4.0.0
• bed22ee Update pytest-flask from 1.1.0 to 1.2.0

📊 Changes

1 file changed (+15 additions, -15 deletions)

View changed files

📝 requirements.txt (+15 -15)

📄 Description

Update Flask from 1.1.2 to 2.2.3.

Changelog

2.2.3

-------------

Released 2023-02-15

-   Autoescape is enabled by default for ``.svg`` template files. :issue:`4831`
-   Fix the type of ``template_folder`` to accept ``pathlib.Path``. :issue:`4892`
-   Add ``--debug`` option to the ``flask run`` command. :issue:`4777`

2.2.2

-------------

Released 2022-08-08

-   Update Werkzeug dependency to >= 2.2.2. This includes fixes related
 to the new faster router, header parsing, and the development
 server. :pr:`4754`
-   Fix the default value for ``app.env`` to be ``"production"``. This
 attribute remains deprecated. :issue:`4740`

2.2.1

-------------

Released 2022-08-03

-   Setting or accessing ``json_encoder`` or ``json_decoder`` raises a
 deprecation warning. :issue:`4732`

2.2.0

-------------

Released 2022-08-01

-   Remove previously deprecated code. :pr:`4667`

 -   Old names for some ``send_file`` parameters have been removed.
     ``download_name`` replaces ``attachment_filename``, ``max_age``
     replaces ``cache_timeout``, and ``etag`` replaces ``add_etags``.
     Additionally, ``path`` replaces ``filename`` in
     ``send_from_directory``.
 -   The ``RequestContext.g`` property returning ``AppContext.g`` is
     removed.

-   Update Werkzeug dependency to >= 2.2.
-   The app and request contexts are managed using Python context vars
 directly rather than Werkzeug's ``LocalStack``. This should result
 in better performance and memory use. :pr:`4682`

 -   Extension maintainers, be aware that ``_app_ctx_stack.top``
     and ``_request_ctx_stack.top`` are deprecated. Store data on
     ``g`` instead using a unique prefix, like
     ``g._extension_name_attr``.

-   The ``FLASK_ENV`` environment variable and ``app.env`` attribute are
 deprecated, removing the distinction between development and debug
 mode. Debug mode should be controlled directly using the ``--debug``
 option or ``app.run(debug=True)``. :issue:`4714`
-   Some attributes that proxied config keys on ``app`` are deprecated:
 ``session_cookie_name``, ``send_file_max_age_default``,
 ``use_x_sendfile``, ``propagate_exceptions``, and
 ``templates_auto_reload``. Use the relevant config keys instead.
 :issue:`4716`
-   Add new customization points to the ``Flask`` app object for many
 previously global behaviors.

 -   ``flask.url_for`` will call ``app.url_for``. :issue:`4568`
 -   ``flask.abort`` will call ``app.aborter``.
     ``Flask.aborter_class`` and ``Flask.make_aborter`` can be used
     to customize this aborter. :issue:`4567`
 -   ``flask.redirect`` will call ``app.redirect``. :issue:`4569`
 -   ``flask.json`` is an instance of ``JSONProvider``. A different
     provider can be set to use a different JSON library.
     ``flask.jsonify`` will call ``app.json.response``, other
     functions in ``flask.json`` will call corresponding functions in
     ``app.json``. :pr:`4692`

-   JSON configuration is moved to attributes on the default
 ``app.json`` provider. ``JSON_AS_ASCII``, ``JSON_SORT_KEYS``,
 ``JSONIFY_MIMETYPE``, and ``JSONIFY_PRETTYPRINT_REGULAR`` are
 deprecated. :pr:`4692`
-   Setting custom ``json_encoder`` and ``json_decoder`` classes on the
 app or a blueprint, and the corresponding ``json.JSONEncoder`` and
 ``JSONDecoder`` classes, are deprecated. JSON behavior can now be
 overridden using the ``app.json`` provider interface. :pr:`4692`
-   ``json.htmlsafe_dumps`` and ``json.htmlsafe_dump`` are deprecated,
 the function is built-in to Jinja now. :pr:`4692`
-   Refactor ``register_error_handler`` to consolidate error checking.
 Rewrite some error messages to be more consistent. :issue:`4559`
-   Use Blueprint decorators and functions intended for setup after
 registering the blueprint will show a warning. In the next version,
 this will become an error just like the application setup methods.
 :issue:`4571`
-   ``before_first_request`` is deprecated. Run setup code when creating
 the application instead. :issue:`4605`
-   Added the ``View.init_every_request`` class attribute. If a view
 subclass sets this to ``False``, the view will not create a new
 instance on every request. :issue:`2520`.
-   A ``flask.cli.FlaskGroup`` Click group can be nested as a
 sub-command in a custom CLI. :issue:`3263`
-   Add ``--app`` and ``--debug`` options to the ``flask`` CLI, instead
 of requiring that they are set through environment variables.
 :issue:`2836`
-   Add ``--env-file`` option to the ``flask`` CLI. This allows
 specifying a dotenv file to load in addition to ``.env`` and
 ``.flaskenv``. :issue:`3108`
-   It is no longer required to decorate custom CLI commands on
 ``app.cli`` or ``blueprint.cli`` with ``with_appcontext``, an app
 context will already be active at that point. :issue:`2410`
-   ``SessionInterface.get_expiration_time`` uses a timezone-aware
 value. :pr:`4645`
-   View functions can return generators directly instead of wrapping
 them in a ``Response``. :pr:`4629`
-   Add ``stream_template`` and ``stream_template_string`` functions to
 render a template as a stream of pieces. :pr:`4629`
-   A new implementation of context preservation during debugging and
 testing. :pr:`4666`

 -   ``request``, ``g``, and other context-locals point to the
     correct data when running code in the interactive debugger
     console. :issue:`2836`
 -   Teardown functions are always run at the end of the request,
     even if the context is preserved. They are also run after the
     preserved context is popped.
 -   ``stream_with_context`` preserves context separately from a
     ``with client`` block. It will be cleaned up when
     ``response.get_data()`` or ``response.close()`` is called.

-   Allow returning a list from a view function, to convert it to a
 JSON response like a dict is. :issue:`4672`
-   When type checking, allow ``TypedDict`` to be returned from view
 functions. :pr:`4695`
-   Remove the ``--eager-loading/--lazy-loading`` options from the
 ``flask run`` command. The app is always eager loaded the first
 time, then lazily loaded in the reloader. The reloader always prints
 errors immediately but continues serving. Remove the internal
 ``DispatchingApp`` middleware used by the previous implementation.
 :issue:`4715`

2.1.3

-------------

Released 2022-07-13

-   Inline some optional imports that are only used for certain CLI
 commands. :pr:`4606`
-   Relax type annotation for ``after_request`` functions. :issue:`4600`
-   ``instance_path`` for namespace packages uses the path closest to
 the imported submodule. :issue:`4610`
-   Clearer error message when ``render_template`` and
 ``render_template_string`` are used outside an application context.
 :pr:`4693`

2.1.2

-------------

Released 2022-04-28

-   Fix type annotation for ``json.loads``, it accepts str or bytes.
 :issue:`4519`
-   The ``--cert`` and ``--key`` options on ``flask run`` can be given
 in either order. :issue:`4459`

2.1.1

-------------

Released on 2022-03-30

-   Set the minimum required version of importlib_metadata to 3.6.0,
 which is required on Python < 3.10. :issue:`4502`

2.1.0

-------------

Released 2022-03-28

-   Drop support for Python 3.6. :pr:`4335`
-   Update Click dependency to >= 8.0. :pr:`4008`
-   Remove previously deprecated code. :pr:`4337`

 -   The CLI does not pass ``script_info`` to app factory functions.
 -   ``config.from_json`` is replaced by
     ``config.from_file(name, load=json.load)``.
 -   ``json`` functions no longer take an ``encoding`` parameter.
 -   ``safe_join`` is removed, use ``werkzeug.utils.safe_join``
     instead.
 -   ``total_seconds`` is removed, use ``timedelta.total_seconds``
     instead.
 -   The same blueprint cannot be registered with the same name. Use
     ``name=`` when registering to specify a unique name.
 -   The test client's ``as_tuple`` parameter is removed. Use
     ``response.request.environ`` instead. :pr:`4417`

-   Some parameters in ``send_file`` and ``send_from_directory`` were
 renamed in 2.0. The deprecation period for the old names is extended
 to 2.2. Be sure to test with deprecation warnings visible.

 -   ``attachment_filename`` is renamed to ``download_name``.
 -   ``cache_timeout`` is renamed to ``max_age``.
 -   ``add_etags`` is renamed to ``etag``.
 -   ``filename`` is renamed to ``path``.

-   The ``RequestContext.g`` property is deprecated. Use ``g`` directly
 or ``AppContext.g`` instead. :issue:`3898`
-   ``copy_current_request_context`` can decorate async functions.
 :pr:`4303`
-   The CLI uses ``importlib.metadata`` instead of ``setuptools`` to
 load command entry points. :issue:`4419`
-   Overriding ``FlaskClient.open`` will not cause an error on redirect.
 :issue:`3396`
-   Add an ``--exclude-patterns`` option to the ``flask run`` CLI
 command to specify patterns that will be ignored by the reloader.
 :issue:`4188`
-   When using lazy loading (the default with the debugger), the Click
 context from the ``flask run`` command remains available in the
 loader thread. :issue:`4460`
-   Deleting the session cookie uses the ``httponly`` flag.
 :issue:`4485`
-   Relax typing for ``errorhandler`` to allow the user to use more
 precise types and decorate the same function multiple times.
 :issue:`4095, 4295, 4297`
-   Fix typing for ``__exit__`` methods for better compatibility with
 ``ExitStack``. :issue:`4474`
-   From Werkzeug, for redirect responses the ``Location`` header URL
 will remain relative, and exclude the scheme and domain, by default.
 :pr:`4496`
-   Add ``Config.from_prefixed_env()`` to load config values from
 environment variables that start with ``FLASK_`` or another prefix.
 This parses values as JSON by default, and allows setting keys in
 nested dicts. :pr:`4479`

2.0.3

-------------

Released 2022-02-14

-   The test client's ``as_tuple`` parameter is deprecated and will be
 removed in Werkzeug 2.1. It is now also deprecated in Flask, to be
 removed in Flask 2.1, while remaining compatible with both in
 2.0.x. Use ``response.request.environ`` instead. :pr:`4341`
-   Fix type annotation for ``errorhandler`` decorator. :issue:`4295`
-   Revert a change to the CLI that caused it to hide ``ImportError``
 tracebacks when importing the application. :issue:`4307`
-   ``app.json_encoder`` and ``json_decoder`` are only passed to
 ``dumps`` and ``loads`` if they have custom behavior. This improves
 performance, mainly on PyPy. :issue:`4349`
-   Clearer error message when ``after_this_request`` is used outside a
 request context. :issue:`4333`

2.0.2

-------------

Released 2021-10-04

-   Fix type annotation for ``teardown_*`` methods. :issue:`4093`
-   Fix type annotation for ``before_request`` and ``before_app_request``
 decorators. :issue:`4104`
-   Fixed the issue where typing requires template global
 decorators to accept functions with no arguments. :issue:`4098`
-   Support View and MethodView instances with async handlers. :issue:`4112`
-   Enhance typing of ``app.errorhandler`` decorator. :issue:`4095`
-   Fix registering a blueprint twice with differing names. :issue:`4124`
-   Fix the type of ``static_folder`` to accept ``pathlib.Path``.
 :issue:`4150`
-   ``jsonify`` handles ``decimal.Decimal`` by encoding to ``str``.
 :issue:`4157`
-   Correctly handle raising deferred errors in CLI lazy loading.
 :issue:`4096`
-   The CLI loader handles ``**kwargs`` in a ``create_app`` function.
 :issue:`4170`
-   Fix the order of ``before_request`` and other callbacks that trigger
 before the view returns. They are called from the app down to the
 closest nested blueprint. :issue:`4229`

2.0.1

-------------

Released 2021-05-21

-   Re-add the ``filename`` parameter in ``send_from_directory``. The
 ``filename`` parameter has been renamed to ``path``, the old name
 is deprecated. :pr:`4019`
-   Mark top-level names as exported so type checking understands
 imports in user projects. :issue:`4024`
-   Fix type annotation for ``g`` and inform mypy that it is a namespace
 object that has arbitrary attributes. :issue:`4020`
-   Fix some types that weren't available in Python 3.6.0. :issue:`4040`
-   Improve typing for ``send_file``, ``send_from_directory``, and
 ``get_send_file_max_age``. :issue:`4044`, :pr:`4026`
-   Show an error when a blueprint name contains a dot. The ``.`` has
 special meaning, it is used to separate (nested) blueprint names and
 the endpoint name. :issue:`4041`
-   Combine URL prefixes when nesting blueprints that were created with
 a ``url_prefix`` value. :issue:`4037`
-   Revert a change to the order that URL matching was done. The
 URL is again matched after the session is loaded, so the session is
 available in custom URL converters. :issue:`4053`
-   Re-add deprecated ``Config.from_json``, which was accidentally
 removed early. :issue:`4078`
-   Improve typing for some functions using ``Callable`` in their type
 signatures, focusing on decorator factories. :issue:`4060`
-   Nested blueprints are registered with their dotted name. This allows
 different blueprints with the same name to be nested at different
 locations. :issue:`4069`
-   ``register_blueprint`` takes a ``name`` option to change the
 (pre-dotted) name the blueprint is registered with. This allows the
 same blueprint to be registered multiple times with unique names for
 ``url_for``. Registering the same blueprint with the same name
 multiple times is deprecated. :issue:`1091`
-   Improve typing for ``stream_with_context``. :issue:`4052`

2.0.0

-------------

Released 2021-05-11

-   Drop support for Python 2 and 3.5.
-   Bump minimum versions of other Pallets projects: Werkzeug >= 2,
 Jinja2 >= 3, MarkupSafe >= 2, ItsDangerous >= 2, Click >= 8. Be sure
 to check the change logs for each project. For better compatibility
 with other applications (e.g. Celery) that still require Click 7,
 there is no hard dependency on Click 8 yet, but using Click 7 will
 trigger a DeprecationWarning and Flask 2.1 will depend on Click 8.
-   JSON support no longer uses simplejson. To use another JSON module,
 override ``app.json_encoder`` and ``json_decoder``. :issue:`3555`
-   The ``encoding`` option to JSON functions is deprecated. :pr:`3562`
-   Passing ``script_info`` to app factory functions is deprecated. This
 was not portable outside the ``flask`` command. Use
 ``click.get_current_context().obj`` if it's needed. :issue:`3552`
-   The CLI shows better error messages when the app failed to load
 when looking up commands. :issue:`2741`
-   Add ``SessionInterface.get_cookie_name`` to allow setting the
 session cookie name dynamically. :pr:`3369`
-   Add ``Config.from_file`` to load config using arbitrary file
 loaders, such as ``toml.load`` or ``json.load``.
 ``Config.from_json`` is deprecated in favor of this. :pr:`3398`
-   The ``flask run`` command will only defer errors on reload. Errors
 present during the initial call will cause the server to exit with
 the traceback immediately. :issue:`3431`
-   ``send_file`` raises a ``ValueError`` when passed an ``io`` object
 in text mode. Previously, it would respond with 200 OK and an empty
 file. :issue:`3358`
-   When using ad-hoc certificates, check for the cryptography library
 instead of PyOpenSSL. :pr:`3492`
-   When specifying a factory function with ``FLASK_APP``, keyword
 argument can be passed. :issue:`3553`
-   When loading a ``.env`` or ``.flaskenv`` file, the current working
 directory is no longer changed to the location of the file.
 :pr:`3560`
-   When returning a ``(response, headers)`` tuple from a view, the
 headers replace rather than extend existing headers on the response.
 For example, this allows setting the ``Content-Type`` for
 ``jsonify()``. Use ``response.headers.extend()`` if extending is
 desired. :issue:`3628`
-   The ``Scaffold`` class provides a common API for the ``Flask`` and
 ``Blueprint`` classes. ``Blueprint`` information is stored in
 attributes just like ``Flask``, rather than opaque lambda functions.
 This is intended to improve consistency and maintainability.
 :issue:`3215`
-   Include ``samesite`` and ``secure`` options when removing the
 session cookie. :pr:`3726`
-   Support passing a ``pathlib.Path`` to ``static_folder``. :pr:`3579`
-   ``send_file`` and ``send_from_directory`` are wrappers around the
 implementations in ``werkzeug.utils``. :pr:`3828`
-   Some ``send_file`` parameters have been renamed, the old names are
 deprecated. ``attachment_filename`` is renamed to ``download_name``.
 ``cache_timeout`` is renamed to ``max_age``. ``add_etags`` is
 renamed to ``etag``. :pr:`3828, 3883`
-   ``send_file`` passes ``download_name`` even if
 ``as_attachment=False`` by using ``Content-Disposition: inline``.
 :pr:`3828`
-   ``send_file`` sets ``conditional=True`` and ``max_age=None`` by
 default. ``Cache-Control`` is set to ``no-cache`` if ``max_age`` is
 not set, otherwise ``public``. This tells browsers to validate
 conditional requests instead of using a timed cache. :pr:`3828`
-   ``helpers.safe_join`` is deprecated. Use
 ``werkzeug.utils.safe_join`` instead. :pr:`3828`
-   The request context does route matching before opening the session.
 This could allow a session interface to change behavior based on
 ``request.endpoint``. :issue:`3776`
-   Use Jinja's implementation of the ``|tojson`` filter. :issue:`3881`
-   Add route decorators for common HTTP methods. For example,
 ``app.post("/login")`` is a shortcut for
 ``app.route("/login", methods=["POST"])``. :pr:`3907`
-   Support async views, error handlers, before and after request, and
 teardown functions. :pr:`3412`
-   Support nesting blueprints. :issue:`593, 1548`, :pr:`3923`
-   Set the default encoding to "UTF-8" when loading ``.env`` and
 ``.flaskenv`` files to allow to use non-ASCII characters. :issue:`3931`
-   ``flask shell`` sets up tab and history completion like the default
 ``python`` shell if ``readline`` is installed. :issue:`3941`
-   ``helpers.total_seconds()`` is deprecated. Use
 ``timedelta.total_seconds()`` instead. :pr:`3962`
-   Add type hinting. :pr:`3973`.

1.1.4

-------------

Released 2021-05-13

-   Update ``static_folder`` to use ``_compat.fspath`` instead of
 ``os.fspath`` to continue supporting Python < 3.6 :issue:`4050`

1.1.3

-------------

Released 2021-05-13

-   Set maximum versions of Werkzeug, Jinja, Click, and ItsDangerous.
 :issue:`4043`
-   Re-add support for passing a ``pathlib.Path`` for ``static_folder``.
 :pr:`3579`

Links

• PyPI: https://pypi.org/project/flask
• Changelog: https://pyup.io/changelogs/flask/
• Homepage: https://palletsprojects.com/p/flask

Update Flask-Admin from 1.5.7 to 1.6.1.

Changelog

1.6.1

-----

* SQLAlchemy 2.x support
* General updates and bug fixes
* Dropped WTForms 1 support

1.6.0

-----

* Dropped Python 2 support
* WTForms 3.0 support
* Various fixes

1.5.8

-----

* SQLAlchemy 1.4.5+ compatibility fixes
* Redis CLI fixes

Links

• PyPI: https://pypi.org/project/flask-admin
• Changelog: https://pyup.io/changelogs/flask-admin/
• Repo: https://github.com/flask-admin/flask-admin/
• Docs: https://pythonhosted.org/Flask-Admin/

Update Flask-SQLAlchemy from 2.4.4 to 3.0.3.

Changelog

3.0.2

-------------

Released 2022-10-14

-   Update compatibility with SQLAlchemy 2. :issue:`1122`

3.0.1

-------------

Released 2022-10-11

-   Export typing information instead of using external typeshed definitions.
 :issue:`1112`
-   If default engine options are set, but ``SQLALCHEMY_DATABASE_URI`` is not set, an
 invalid default bind will not be configured. :issue:`1117`

3.0.0

-------------

Released 2022-10-04

-   Drop support for Python 2, 3.4, 3.5, and 3.6.
-   Bump minimum version of Flask to 2.2.
-   Bump minimum version of SQLAlchemy to 1.4.18.
-   Remove previously deprecated code.
-   The session is scoped to the current app context instead of the thread. This
 requires that an app context is active. This ensures that the session is cleaned up
 after every request.
-   An active Flask application context is always required to access ``session`` and
 ``engine``, regardless of if an application was passed to the constructor.
 :issue:`508, 944`
-   Different bind keys use different SQLAlchemy ``MetaData`` registries, allowing
 tables in different databases to have the same name. Bind keys are stored and looked
 up on the resulting metadata rather than the model or table.
-   ``SQLALCHEMY_DATABASE_URI`` does not default to ``sqlite:///:memory:``. An error is
 raised if neither it nor ``SQLALCHEMY_BINDS`` define any engines. :pr:`731`
-   Configuring SQLite with a relative path is relative to ``app.instance_path`` instead
 of ``app.root_path``. The instance folder is created if necessary. :issue:`462`
-   Added ``get_or_404``, ``first_or_404``, ``one_or_404``, and ``paginate`` methods to
 the extension object. These use SQLAlchemy's preferred ``session.execute(select())``
 pattern instead of the legacy query interface. :issue:`1088`
-   Setup methods that create the engines and session are renamed with a leading
 underscore. They are considered internal interfaces which may change at any time.
-   All parameters to ``SQLAlchemy`` except ``app`` are keyword-only.
-   Renamed the ``bind`` parameter to ``bind_key`` and removed the ``app`` parameter
 from various ``SQLAlchemy`` methods.
-   The extension object uses ``__getattr__`` to alias names from the SQLAlchemy
 package, rather than copying them as attributes.
-   The extension object is stored directly as ``app.extensions["sqlalchemy"]``.
 :issue:`698`
-   The session class can be customized by passing the ``class_`` key in the
 ``session_options`` parameter. :issue:`327`
-   ``SignallingSession`` is renamed to ``Session``.
-   ``Session.get_bind`` more closely matches the base implementation.
-   Model classes and the ``db`` instance are available without imports in
 ``flask shell``. :issue:`1089`
-   The ``CamelCase`` to ``snake_case`` table name converter handles more patterns
 correctly. If model that was already created in the database changed, either use
 Alembic to rename the table, or set ``__tablename__`` to keep the old name.
 :issue:`406`
-   ``Model`` ``repr`` distinguishes between transient and pending instances.
 :issue:`967`
-   A custom model class can implement ``__init_subclass__`` with class parameters.
 :issue:`1002`
-   ``db.Table`` is a subclass instead of a function.
-   The ``engine_options`` parameter is applied as defaults before per-engine
 configuration.
-   ``SQLALCHEMY_BINDS`` values can either be an engine URL, or a dict of engine options
 including URL, for each bind. ``SQLALCHEMY_DATABASE_URI`` and
 ``SQLALCHEMY_ENGINE_OPTIONS`` correspond to the ``None`` key and take precedence.
 :issue:`783`
-   Engines are created when calling ``init_app`` rather than the first time they are
 accessed. :issue:`698`
-   ``db.engines`` exposes the map of bind keys to engines for the current app.
-   ``get_engine``, ``get_tables_for_bind``, and ``get_binds`` are deprecated.
-   SQLite driver-level URIs that look like ``sqlite:///file:name.db?uri=true`` are
 supported. :issue:`998, 1045`
-   SQLite engines do not use ``NullPool`` if ``pool_size`` is 0.
-   MySQL engines use the "utf8mb4" charset by default. :issue:`875`
-   MySQL engines do not set ``pool_size`` to 10.
-   MySQL engines don't set a default for ``pool_recycle`` if not using a queue pool.
 :issue:`803`
-   ``Query`` is renamed from ``BaseQuery``.
-   Added ``Query.one_or_404``.
-   The query class is applied to ``backref`` in ``relationship``. :issue:`417`
-   Creating ``Pagination`` objects manually is no longer a public API. They should be
 created with ``db.paginate`` or ``query.paginate``. :issue:`1088`
-   ``Pagination.iter_pages`` and ``Query.paginate`` parameters are keyword-only.
-   ``Pagination`` is iterable, iterating over its items. :issue:`70`
-   Pagination count query is more efficient.
-   ``Pagination.iter_pages`` is more efficient. :issue:`622`
-   ``Pagination.iter_pages`` ``right_current`` parameter is inclusive.
-   Pagination ``per_page`` cannot be 0. :issue:`1091`
-   Pagination ``max_per_page`` defaults to 100. :issue:`1091`
-   Added ``Pagination.first`` and ``last`` properties, which give the number of the
 first and last item on the page. :issue:`567`
-   ``SQLALCHEMY_RECORD_QUERIES`` is disabled by default, and is not enabled
 automatically with ``app.debug`` or ``app.testing``. :issue:`1092`
-   ``get_debug_queries`` is renamed to ``get_recorded_queries`` to better match the
 config and functionality.
-   Recorded query info is a dataclass instead of a tuple. The ``context`` attribute is
 renamed to ``location``. Finding the location uses a more inclusive check.
-   ``SQLALCHEMY_TRACK_MODIFICATIONS`` is disabled by default. :pr:`727`
-   ``SQLALCHEMY_COMMIT_ON_TEARDOWN`` is deprecated. It can cause various design issues
 that are difficult to debug. Call ``db.session.commit()`` directly instead.
 :issue:`216`

2.5.1

-------------

Released 2021-03-18

-   Fix compatibility with Python 2.7.

2.5.0

-------------

Released 2021-03-18

-   Update to support SQLAlchemy 1.4.
-   SQLAlchemy ``URL`` objects are immutable. Some internal methods have
 changed to return a new URL instead of ``None``. :issue:`885`

Links

• PyPI: https://pypi.org/project/flask-sqlalchemy
• Changelog: https://pyup.io/changelogs/flask-sqlalchemy/
• Docs: https://pythonhosted.org/Flask-SQLAlchemy/

Update SQLAlchemy from 1.3.20 to 2.0.9.

Changelog

2.0.9

:released: April 5, 2023

 .. change::
     :tags: bug, mssql
     :tickets: 9603

     Due to a critical bug identified in SQL Server, the SQLAlchemy
     "insertmanyvalues" feature which allows fast INSERT of many rows while also
     supporting RETURNING unfortunately needs to be disabled for SQL Server. SQL
     Server is apparently unable to guarantee that the order of rows inserted
     matches the order in which they are sent back by OUTPUT inserted when
     table-valued rows are used with INSERT in conjunction with OUTPUT inserted.
     We are trying to see if Microsoft is able to confirm this undocumented
     behavior however there is no known workaround, other than it's not safe to
     use table-valued expressions with OUTPUT inserted for now.


 .. change::
     :tags: bug, mariadb
     :tickets: 9588

     Added ``row_number`` as reserved word in MariaDb.

 .. change::
     :tags: bug, mssql
     :tickets: 9586

     Changed the bulk INSERT strategy used for SQL Server "executemany" with
     pyodbc when ``fast_executemany`` is set to ``True`` by using
     ``fast_executemany`` / ``cursor.executemany()`` for bulk INSERT that does
     not include RETURNING, restoring the same behavior as was used in
     SQLAlchemy 1.4 when this parameter is set.

     New performance details from end users have shown that ``fast_executemany``
     is still much faster for very large datasets as it uses ODBC commands that
     can receive all rows in a single round trip, allowing for much larger
     datasizes than the batches that can be sent by "insertmanyvalues"
     as was implemented for SQL Server.

     While this change was made such that "insertmanyvalues" continued to be
     used for INSERT that includes RETURNING, as well as if ``fast_executemany``
     were not set, due to :ticket:`9603`, the "insertmanyvalues" strategy has
     been disabled for SQL Server across the board in any case.

.. changelog::

2.0.8

:released: March 31, 2023

 .. change::
     :tags: bug, orm
     :tickets: 9553

     Fixed issue in ORM Annotated Declarative where using a recursive type (e.g.
     using a nested Dict type) would result in a recursion overflow in the ORM's
     annotation resolution logic, even if this datatype were not necessary to
     map the column.

 .. change::
     :tags: bug, examples

     Fixed issue in "versioned history" example where using a declarative base
     that is derived from :class:`_orm.DeclarativeBase` would fail to be mapped.
     Additionally, repaired the given test suite so that the documented
     instructions for running the example using Python unittest now work again.

 .. change::
     :tags: bug, orm
     :tickets: 9550

     Fixed issue where the :func:`_orm.mapped_column` construct would raise an
     internal error if used on a Declarative mixin and included the
     :paramref:`_orm.mapped_column.deferred` parameter.

 .. change::
     :tags: bug, mysql
     :tickets: 9544

     Fixed issue where string datatypes such as :class:`_sqltypes.CHAR`,
     :class:`_sqltypes.VARCHAR`, :class:`_sqltypes.TEXT`, as well as binary
     :class:`_sqltypes.BLOB`, could not be produced with an explicit length of
     zero, which has special meaning for MySQL. Pull request courtesy J. Nick
     Koston.

 .. change::
     :tags: bug, orm
     :tickets: 9537

     Expanded the warning emitted when a plain :func:`_sql.column` object is
     present in a Declarative mapping to include any arbitrary SQL expression
     that is not declared within an appropriate property type such as
     :func:`_orm.column_property`, :func:`_orm.deferred`, etc. These attributes
     are otherwise not mapped at all and remain unchanged within the class
     dictionary. As it seems likely that such an expression is usually not
     what's intended, this case now warns for all such otherwise ignored
     expressions, rather than just the :func:`_sql.column` case.

 .. change::
     :tags: bug, orm
     :tickets: 9519

     Fixed regression where accessing the expression value of a hybrid property
     on a class that was either unmapped or not-yet-mapped (such as calling upon
     it within a :func:`_orm.declared_attr` method) would raise an internal
     error, as an internal fetch for the parent class' mapper would fail and an
     instruction for this failure to be ignored were inadvertently removed in
     2.0.

 .. change::
     :tags: bug, orm
     :tickets: 9350

     Fields that are declared on Declarative Mixins and then combined with
     classes that make use of :class:`_orm.MappedAsDataclass`, where those mixin
     fields are not themselves part of a dataclass, now emit a deprecation
     warning as these fields will be ignored in a future release, as Python
     dataclasses behavior is to ignore these fields. Type checkers will not see
     these fields under pep-681.

     .. seealso::

         :ref:`error_dcmx` - background on rationale

         :ref:`orm_declarative_dc_mixins`

 .. change::
     :tags: bug, postgresql
     :tickets: 9511

     Fixed critical regression in PostgreSQL dialects such as asyncpg which rely
     upon explicit casts in SQL in order for datatypes to be passed to the
     driver correctly, where a :class:`.String` datatype would be cast along
     with the exact column length being compared, leading to implicit truncation
     when comparing a ``VARCHAR`` of a smaller length to a string of greater
     length regardless of operator in use (e.g. LIKE, MATCH, etc.). The
     PostgreSQL dialect now omits the length from ``VARCHAR`` when rendering
     these casts.

 .. change::
     :tags: bug, util
     :tickets: 9487

     Implemented missing methods ``copy`` and ``pop`` in
     OrderedSet class.

 .. change::
     :tags: bug, typing
     :tickets: 9536

     Fixed typing for :func:`_orm.deferred` and :func:`_orm.query_expression`
     to work correctly with 2.0 style mappings.

 .. change::
     :tags: bug, orm
     :tickets: 9526

     Fixed issue where the :meth:`_sql.BindParameter.render_literal_execute`
     method would fail when called on a parameter that also had ORM annotations
     associated with it. In practice, this would be observed as a failure of SQL
     compilation when using some combinations of a dialect that uses "FETCH
     FIRST" such as Oracle along with a :class:`_sql.Select` construct that uses
     :meth:`_sql.Select.limit`, within some ORM contexts, including if the
     statement were embedded within a relationship primaryjoin expression.


 .. change::
     :tags: usecase, orm
     :tickets: 9563

     Exceptions such as ``TypeError`` and ``ValueError`` raised by Python
     dataclasses when making use of the :class:`_orm.MappedAsDataclass` mixin
     class or :meth:`_orm.registry.mapped_as_dataclass` decorator are now
     wrapped within an :class:`.InvalidRequestError` wrapper along with
     informative context about the error message, referring to the Python
     dataclasses documentation as the authoritative source of background
     information on the cause of the exception.

     .. seealso::

         :ref:`error_dcte`


 .. change::
     :tags: bug, orm
     :tickets: 9549

     Towards maintaining consistency with unit-of-work changes made for
     :ticket:`5984` and :ticket:`8862`, both of which disable "lazy='raise'"
     handling within :class:`_orm.Session` processes that aren't triggered by
     attribute access, the :meth:`_orm.Session.delete` method will now also
     disable "lazy='raise'" handling when it traverses relationship paths in
     order to process the "delete" and "delete-orphan" cascade rules.
     Previously, there was no easy way to generically call
     :meth:`_orm.Session.delete` on an object that had "lazy='raise'" set up
     such that only the necessary relationships would be loaded. As
     "lazy='raise'" is primarily intended to catch SQL loading that emits on
     attribute access, :meth:`_orm.Session.delete` is now made to behave like
     other :class:`_orm.Session` methods including :meth:`_orm.Session.merge` as
     well as :meth:`_orm.Session.flush` along with autoflush.

 .. change::
     :tags: bug, orm
     :tickets: 9564

     Fixed issue where an annotation-only :class:`_orm.Mapped` directive could
     not be used in a Declarative mixin class, without that attribute attempting
     to take effect for single- or joined-inheritance subclasses of mapped
     classes that had already mapped that attribute on a superclass, producing
     conflicting column errors and/or warnings.


 .. change::
     :tags: bug, orm, typing
     :tickets: 9514

     Properly type :paramref:`_dml.Insert.from_select.names` to accept
     a list of string or columns or mapped attributes.

.. changelog::

2.0.7

:released: March 18, 2023

 .. change::
     :tags: usecase, postgresql
     :tickets: 9416

     Added new PostgreSQL type :class:`_postgresql.CITEXT`. Pull request
     courtesy Julian David Rath.

 .. change::
     :tags: bug, typing
     :tickets: 9502

     Fixed typing issue where :func:`_orm.composite` would not allow an
     arbitrary callable as the source of the composite class.

 .. change::
       :tags: usecase, postgresql
       :tickets: 9442

       Modifications to the base PostgreSQL dialect to allow for better integration with the
       sqlalchemy-redshift third party dialect for SQLAlchemy 2.0. Pull request courtesy
       matthewgdv.

.. changelog::

2.0.6

:released: March 13, 2023

 .. change::
     :tags: bug, sql, regression
     :tickets: 9461

     Fixed regression where the fix for :ticket:`8098`, which was released in
     the 1.4 series and provided a layer of concurrency-safe checks for the
     lambda SQL API, included additional fixes in the patch that failed to be
     applied to the main branch. These additional fixes have been applied.

 .. change::
     :tags: bug, typing
     :tickets: 9451

     Fixed typing issue where :meth:`.ColumnElement.cast` did not allow a
     :class:`.TypeEngine` argument independent of the type of the
     :class:`.ColumnElement` itself, which is the purpose of
     :meth:`.ColumnElement.cast`.

 .. change::
     :tags: bug, orm
     :tickets: 9460

     Fixed bug where the "active history" feature was not fully
     implemented for composite attributes, making it impossible to receive
     events that included the "old" value.   This seems to have been the case
     with older SQLAlchemy versions as well, where "active_history" would
     be propagated to the underlying column-based attributes, but an event
     handler listening to the composite attribute itself would not be given
     the "old" value being replaced, even if the composite() were set up
     with active_history=True.

     Additionally, fixed a regression that's local to 2.0 which disallowed
     active_history on composite from being assigned to the impl with
     ``attr.impl.active_history=True``.


 .. change::
     :tags: bug, oracle
     :tickets: 9459

     Fixed reflection bug where Oracle "name normalize" would not work correctly
     for reflection of symbols that are in the "PUBLIC" schema, such as
     synonyms, meaning the PUBLIC name could not be indicated as lower case on
     the Python side for the :paramref:`_schema.Table.schema` argument. Using
     uppercase "PUBLIC" would work, but would then lead to awkward SQL queries
     including a quoted ``"PUBLIC"`` name as well as indexing the table under
     uppercase "PUBLIC", which was inconsistent.

 .. change::
     :tags: bug, typing

     Fixed issues to allow typing tests to pass under Mypy 1.1.1.

 .. change::
     :tags: bug, sql
     :tickets: 9440

     Fixed regression where the :func:`_sql.select` construct would not be able
     to render if it were given no columns and then used in the context of an
     EXISTS, raising an internal exception instead. While an empty "SELECT" is
     not typically valid SQL, in the context of EXISTS databases such as
     PostgreSQL allow it, and in any case the condition now no longer raises
     an internal exception.


 .. change::
     :tags: bug, orm
     :tickets: 9418

     Fixed regression involving pickling of Python rows between the cython and
     pure Python implementations of :class:`.Row`, which occurred as part of
     refactoring code for version 2.0 with typing. A particular constant were
     turned into a string based ``Enum`` for the pure Python version of
     :class:`.Row` whereas the cython version continued to use an integer
     constant, leading to deserialization failures.

.. changelog::

2.0.5.post1

:released: March 5, 2023

 .. change::
     :tags: bug, orm
     :tickets: 9418

     Added constructor arguments to the built-in mapping collection types
     including :class:`.KeyFuncDict`, :func:`_orm.attribute_keyed_dict`,
     :func:`_orm.column_keyed_dict` so that these dictionary types may be
     constructed in place given the data up front; this provides further
     compatibility with tools such as Python dataclasses ``.asdict()`` which
     relies upon invoking these classes directly as ordinary dictionary classes.

 .. change::
     :tags: bug, orm, regression
     :tickets: 9424

     Fixed multiple regressions due to :ticket:`8372`, involving
     :func:`_orm.attribute_mapped_collection` (now called
     :func:`_orm.attribute_keyed_dict`).

     First, the collection was no longer usable with "key" attributes that were
     not themselves ordinary mapped attributes; attributes linked to descriptors
     and/or association proxy attributes have been fixed.

     Second, if an event or other operation needed access to the "key" in order
     to populate the dictionary from an mapped attribute that was not
     loaded, this also would raise an error inappropriately, rather than
     trying to load the attribute as was the behavior in 1.4.  This is also
     fixed.

     For both cases, the behavior of :ticket:`8372` has been expanded.
     :ticket:`8372` introduced an error that raises when the derived key that
     would be used as a mapped dictionary key is effectively unassigned. In this
     change, a warning only is emitted if the effective value of the ".key"
     attribute is ``None``, where it cannot be unambiguously determined if this
     ``None`` was intentional or not. ``None`` will be not supported as mapped
     collection dictionary keys going forward (as it typically refers to NULL
     which means "unknown"). Setting
     :paramref:`_orm.attribute_keyed_dict.ignore_unpopulated_attribute` will now
     cause such ``None`` keys to be ignored as well.

 .. change::
     :tags: engine, performance
     :tickets: 9343

     A small optimization to the Cython implementation of :class:`.Result`
     using a cdef for a particular int value to avoid Python overhead. Pull
     request courtesy Matus Valo.


 .. change::
     :tags: bug, mssql
     :tickets: 9414

     Fixed issue in the new :class:`.Uuid` datatype which prevented it from
     working with the pymssql driver. As pymssql seems to be maintained again,
     restored testing support for pymssql.

 .. change::
     :tags: bug, mssql

     Tweaked the pymssql dialect to take better advantage of
     RETURNING for INSERT statements in order to retrieve last inserted primary
     key values, in the same way as occurs for the mssql+pyodbc dialect right
     now.

 .. change::
     :tags: bug, orm

     Identified that the ``sqlite`` and ``mssql+pyodbc`` dialects are now
     compatible with the SQLAlchemy ORM's "versioned rows" feature, since
     SQLAlchemy now computes rowcount for a RETURNING statement in this specific
     case by counting the rows returned, rather than relying upon
     ``cursor.rowcount``.  In particular, the ORM versioned rows use case
     (documented at :ref:`mapper_version_counter`) should now be fully
     supported with the SQL Server pyodbc dialect.


 .. change::
     :tags: bug, postgresql
     :tickets: 9349

     Fixed issue in PostgreSQL :class:`_postgresql.ExcludeConstraint` where
     literal values were being compiled as bound parameters and not direct
     inline values as is required for DDL.

 .. change::
     :tags: bug, typing

     Fixed bug where the :meth:`_engine.Connection.scalars` method was not typed
     as allowing a multiple-parameters list, which is now supported using
     insertmanyvalues operations.

 .. change::
     :tags: bug, typing
     :tickets: 9376

     Improved typing for the mapping passed to :meth:`.Insert.values` and
     :meth:`.Update.values` to be more open-ended about collection type, by
     indicating read-only ``Mapping`` instead of writeable ``Dict`` which would
     error out on too limited of a key type.

 .. change::
     :tags: schema

     Validate that when provided the :paramref:`_schema.MetaData.schema`
     argument of :class:`_schema.MetaData` is a string.

 .. change::
     :tags: typing, usecase
     :tickets: 9338

     Exported the type returned by
     :meth:`_orm.scoped_session.query_property` using a new public type
     :class:`.orm.QueryPropertyDescriptor`.

 .. change::
     :tags: bug, mysql, postgresql
     :tickets: 5648

     The support for pool ping listeners to receive exception events via the
     :meth:`.DialectEvents.handle_error` event added in 2.0.0b1 for
     :ticket:`5648` failed to take into account dialect-specific ping routines
     such as that of MySQL and PostgreSQL. The dialect feature has been reworked
     so that all dialects participate within event handling.   Additionally,
     a new boolean element :attr:`.ExceptionContext.is_pre_ping` is added
     which identifies if this operation is occurring within the pre-ping
     operation.

     For this release, third party dialects which implement a custom
     :meth:`_engine.Dialect.do_ping` method can opt in to the newly improved
     behavior by having their method no longer catch exceptions or check
     exceptions for "is_disconnect", instead just propagating all exceptions
     outwards. Checking the exception for "is_disconnect" is now done by an
     enclosing method on the default dialect, which ensures that the event hook
     is invoked for all exception scenarios before testing the exception as a
     "disconnect" exception. If an existing ``do_ping()`` method continues to
     catch exceptions and check "is_disconnect", it will continue to work as it
     did previously, but ``handle_error`` hooks will not have access to the
     exception if it isn't propagated outwards.

 .. change::
     :tags: bug, ext
     :tickets: 9367

     Fixed issue in automap where calling :meth:`_automap.AutomapBase.prepare`
     from a specific mapped class, rather than from the
     :class:`_automap.AutomapBase` directly, would not use the correct base
     class when automap detected new tables, instead using the given class,
     leading to mappers trying to configure inheritance. While one should
     normally call :meth:`_automap.AutomapBase.prepare` from the base in any
     case, it shouldn't misbehave that badly when called from a subclass.


 .. change::
     :tags: bug, sqlite, regression
     :tickets: 9379

     Fixed regression for SQLite connections where use of the ``deterministic``
     parameter when establishing database functions would fail for older SQLite
     versions, those prior to version 3.8.3. The version checking logic has been
     improved to accommodate for this case.

 .. change::
     :tags: bug, typing
     :tickets: 9391

     Added missing init overload to the :class:`_types.Numeric` type object so
     that pep-484 type checkers may properly resolve the complete type, deriving
     from the :paramref:`_types.Numeric.asdecimal` parameter whether ``Decimal``
     or ``float`` objects will be represented.

 .. change::
     :tags: bug, typing
     :tickets: 9398

     Fixed typing bug where :meth:`_sql.Select.from_statement` would not accept
     :func:`_sql.text` or :class:`.TextualSelect` objects as a valid type.
     Additionally repaired the :class:`.TextClause.columns` method to have a
     return type, which was missing.

 .. change::
     :tags: bug, orm declarative
     :tickets: 9332

     Fixed issue where new :paramref:`_orm.mapped_column.use_existing_column`
     feature would not work if the two same-named columns were mapped under
     attribute names that were differently-named from an explicit name given to
     the column itself. The attribute names can now be differently named when
     using this parameter.

 .. change::
     :tags: bug, orm
     :tickets: 9373

     Added support for the :paramref:`_orm.Mapper.polymorphic_load` parameter to
     be applied to each mapper in an inheritance hierarchy more than one level
     deep, allowing columns to load for all classes in the hierarchy that
     indicate ``"selectin"`` using a single statement, rather than ignoring
     elements on those intermediary classes that nonetheless indicate they also
     would participate in ``"selectin"`` loading and were not part of the
     base-most SELECT statement.

 .. change::
     :tags: bug, orm
     :tickets: 8853, 9335

     Continued the fix for :ticket:`8853`, allowing the :class:`_orm.Mapped`
     name to be fully qualified regardless of whether or not
     ``from __annotations__ import future`` were present. This issue first fixed
     in 2.0.0b3 confirmed that this case worked via the test suite, however the
     test suite apparently was not testing the behavior for the name
     :class:`_orm.Mapped` not being locally present at all; string resolution
     has been updated to ensure the :class:`_orm.Mapped` symbol is locatable as
     applies to how the ORM uses these functions.

 .. change::
     :tags: bug, typing
     :tickets: 9340

     Fixed typing issue where :func:`_orm.with_polymorphic` would not
     record the class type correctly.

 .. change::
     :tags: bug, ext, regression
     :tickets: 9380

     Fixed regression caused by typing added to ``sqlalchemy.ext.mutable`` for
     :ticket:`8667`, where the semantics of the ``.pop()`` method changed such
     that the method was non-working. Pull request courtesy Nils Philippsen.

 .. change::
     :tags: bug, sql, regression
     :tickets: 9390

     Restore the :func:`.nullslast` and :func:`.nullsfirst` legacy functions
     into the ``sqlalchemy`` import namespace. Previously, the newer
     :func:`.nulls_last` and :func:`.nulls_first` functions were available, but
     the legacy ones were inadvertently removed.

 .. change::
     :tags: bug, postgresql
     :tickets: 9401

     Fixed issue where the PostgreSQL :class:`_postgresql.ExcludeConstraint`
     construct would not be copyable within operations such as
     :meth:`_schema.Table.to_metadata` as well as within some Alembic scenarios,
     if the constraint contained textual expression elements.

 .. change::
     :tags: bug, engine
     :tickets: 9423

     Fixed bug where :class:`_engine.Row` objects could not be reliably unpickled
     across processes due to an accidental reliance on an unstable hash value.

.. changelog::

2.0.4

:released: February 17, 2023

 .. change::
     :tags: bug, orm, regression
     :tickets: 9273

     Fixed regression introduced in version 2.0.2 due to :ticket:`9217` where
     using DML RETURNING statements, as well as
     :meth:`_sql.Select.from_statement` constructs as was "fixed" in
     :ticket:`9217`, in conjunction with ORM mapped classes that used
     expressions such as with :func:`_orm.column_property`, would lead to an
     internal error within Core where it would attempt to match the expression
     by name. The fix repairs the Core issue, and also adjusts the fix in
     :ticket:`9217` to not take effect for the DML RETURNING use case, where it
     adds unnecessary overhead.

 .. change::
     :tags: usecase, typing
     :tickets: 9321

     Improved the typing support for the :ref:`hybrids_toplevel`
     extension, updated all documentation to use ORM Annotated Declarative
     mappings, and added a new modifier called :attr:`.hybrid_property.inplace`.
     This modifier provides a way to alter the state of a :class:`.hybrid_property`
     **in place**, which is essentially what very early versions of hybrids
     did, before SQLAlchemy version 1.2.0 :ticket:`3912` changed this to
     remove in-place mutation.  This in-place mutation is now restored on an
     **opt-in** basis to allow a single hybrid to have multiple methods
     set up, without the need to name all the methods the same and without the
     need to carefully "chain" differently-named methods in order to maintain
     the composition.  Typing tools such as Mypy and Pyright do not allow
     same-named methods on a class, so with this change a succinct method
     of setting up hybrids with typing support is restored.

     .. seealso::

         :ref:`hybrid_pep484_naming`

 .. change::
     :tags: bug, orm

     Marked the internal ``EvaluatorCompiler`` module as private to the ORM, and
     renamed it to ``_EvaluatorCompiler``. For users that may have been relying
     upon this, the name ``EvaluatorCompiler`` is still present, however this
     use is not supported and will be removed in a future release.

 .. change::
     :tags: orm, use_case
     :tickets: 9297

     To accommodate a change in column ordering used by ORM Declarative in
     SQLAlchemy 2.0, a new parameter :paramref:`_orm.mapped_column.sort_order`
     has been added that can be used to control the order of the columns defined
     in the table by the ORM, for common use cases such as mixins with primary
     key columns that should appear first in tables. The change notes at
     :ref:`change_9297` illustrate the default change in ordering behavior
     (which is part of all SQLAlchemy 2.0 releases) as well as use of the
     :paramref:`_orm.mapped_column.sort_order` to control column ordering when
     using mixins and multiple classes (new in 2.0.4).

     .. seealso::

         :ref:`change_9297`

 .. change::
     :tags: sql
     :tickets: 9277

     Added public property :attr:`_schema.Table.autoincrement_column` that
     returns the column identified as autoincrementing in the column.

 .. change::
     :tags: oracle, bug
     :tickets: 9295

     Adjusted the behavior of the ``thick_mode`` parameter for the
     :ref:`oracledb` dialect to correctly accept ``False`` as a value.
     Previously, only ``None`` would indicate that thick mode should be
     disabled.

 .. change::
     :tags: usecase, orm
     :tickets: 9298

     The :meth:`_orm.Session.refresh` method will now immediately load a
     relationship-bound attribute that is explicitly named within the
     :paramref:`_orm.Session.refresh.attribute_names` collection even if it is
     currently linked to the "select" loader, which normally is a "lazy" loader
     that does not fire off during a refresh. The "lazy loader" strategy will
     now detect that the operation is specifically a user-initiated
     :meth:`_orm.Session.refresh` operation which named this attribute
     explicitly, and will then call upon the "immediateload" strategy to
     actually emit SQL to load the attribute. This should be helpful in
     particular for some asyncio situations where the loading of an unloaded
     lazy-loaded attribute must be forced, without using the actual lazy-loading
     attribute pattern not supported in asyncio.


 .. change::
     :tags: bug, sql
     :tickets: 9313

     Fixed issue where element types of a tuple value would be hardcoded to take
     on the types from a compared-to tuple, when the comparison were using the
     :meth:`.ColumnOperators.in_` operator. This was inconsistent with the usual
     way that types are determined for a binary expression, which is that the
     actual element type on the right side is considered first before applying
     the left-hand-side type.

 .. change::
     :tags: usecase, orm declarative
     :tickets: 9266

     Added new parameter ``dataclasses_callable`` to both the
     :class:`_orm.MappedAsDataclass` class as well as the
     :meth:`_orm.registry.mapped_as_dataclass` method which allows an
     alternative callable to Python ``dataclasses.dataclass`` to be used in
     order to produce dataclasses. The use case here is to drop in Pydantic's
     dataclass function instead. Adjustments have been made to the mixin support
     added for :ticket:`9179` in version 2.0.1 so that the ``__annotations__``
     collection of the mixin is rewritten to not include the
     :class:`_orm.Mapped` container, in the same way as occurs with mapped
     classes, so that the Pydantic dataclasses constructor is not exposed to
     unknown types.

     .. seealso::

         :ref:`dataclasses_pydantic`


.. changelog::

2.0.3

:released: February 9, 2023

 .. change::
     :tags: typing, bug
     :tickets: 9254

     Remove ``typing.Self`` workaround, now using :pep:`673` for most methods
     that return ``Self``. As a consequence of this change ``mypy>=1.0.0`` is
     now required to type check SQLAlchemy code.
     Pull request courtesy Yurii Karabas.

 .. change::
     :tags: bug, sql, regression
     :tickets: 9271

     Fixed critical regression in SQL expression formulation in the 2.0 series
     due to :ticket:`7744` which improved support for SQL expressions that
     contained many elements against the same operator repeatedly; parenthesis
     grouping would be lost with expression elements beyond the first two
     elements.


.. changelog::

2.0.2

:released: February 6, 2023

 .. change::
     :tags: bug, orm declarative
     :tickets: 9249

     Fixed regression caused by the fix for :ticket:`9171`, which itself was
     fixing a regression, involving the mechanics of ``__init__()`` on classes
     that extend from :class:`_orm.DeclarativeBase`. The change made it such
     that ``__init__()`` was applied to the user-defined base if there were no
     ``__init__()`` method directly on the class. This has been adjusted so that
     ``__init__()`` is applied only if no other class in the hierarchy of the
     user-defined base has an ``__init__()`` method. This again allows
     user-defined base classes based on :class:`_orm.DeclarativeBase` to include
     mixins that themselves include a custom ``__init__()`` method.

 .. change::
     :tags: bug, mysql, regression
     :tickets: 9251

     Fixed regression caused by issue :ticket:`9058` which adjusted the MySQL
     dialect's ``has_table()`` to again use "DESCRIBE", where the specific error
     code raised by MySQL version 8 when using a non-existent schema name was
     unexpected and failed to be interpreted as a boolean result.



 .. change::
     :tags: bug, sqlite
     :tickets: 9251

     Fixed the SQLite dialect's ``has_table()`` function to correctly report
     False for queries that include a non-None schema name for a schema that
     doesn't exist; previously, a database error was raised.


 .. change::
     :tags: bug, orm declarative
     :tickets: 9226

     Fixed issue in ORM Declarative Dataclass mappings related to newly added
     support for mixins added in 2.0.1 via :ticket:`9179`, where a combination
     of using mixins plus ORM inheritance would mis-classify fields in some
     cases leading to field-level dataclass arguments such as ``init=False`` being
     lost.

 .. change::
     :tags: bug, orm, ression
     :tickets: 9232

     Fixed obscure ORM inheritance issue caused by :ticket:`8705` where some
     scenarios of inheriting mappers that indicated groups of columns from the
     local table and the inheriting table together under a
     :func:`_orm.column_property` would nonetheless warn that properties of the
     same name were being combined implicitly.

 .. change::
     :tags: orm, bug, regression
     :tickets: 9228

     Fixed regression where using the :paramref:`_orm.Mapper.version_id_col`
     feature with a regular Python-side incrementing column would fail to work
     for SQLite and other databases that don't support "rowcount" with
     "RETURNING", as "RETURNING" would be assumed for such columns even though
     that's not what actually takes place.

 .. change::
     :tags: bug, orm declarative
     :tickets: 9240

     Repaired ORM Declarative mappings to allow for the
     :paramref:`_orm.Mapper.primary_key` parameter to be specified within
     ``__mapper_args__`` when using :func:`_orm.mapped_column`. Despite this
     usage being directly in the 2.0 documentation, the :class:`_orm.Mapper` was
     not accepting the :func:`_orm.mapped_column` construct in this context. Ths
     feature was already working for the :paramref:`_orm.Mapper.version_id_col`
     and :paramref:`_orm.Mapper.polymorphic_on` parameters.

     As part of this change, the ``__mapper_args__`` attribute may be specified
     without using :func:`_orm.declared_attr` on a non-mapped mixin class,
     including a ``"primary_key"`` entry that refers to :class:`_schema.Column`
     or :func:`_orm.mapped_column` objects locally present on the mixin;
     Declarative will also translate these columns into the correct ones for a
     particular mapped class. This again was working already for the
     :paramref:`_orm.Mapper.version_id_col` and
     :paramref:`_orm.Mapper.polymorphic_on` parameters.  Additionally,
     elements within ``"primary_key"`` may be indicated as string names of
     existing mapped properties.

 .. change::
     :tags: usecase, sql
     :tickets: 8780

     Added a full suite of new SQL bitwise operators, for performing
     database-side bitwise expressions on appropriate data values such as
     integers, bit-strings, and similar. Pull request courtesy Yegor Statkevich.

     .. seealso::

         :ref:`operators_bitwise`


 .. change::
     :tags: bug, orm declarative
     :tickets: 9211

     An explicit error is raised if a mapping attempts to mix the use of
     :class:`_orm.MappedAsDataclass` with
     :meth:`_orm.registry.mapped_as_dataclass` within the same class hierarchy,
     as this produces issues with the dataclass function being applied at the
     wrong time to the mapped class, leading to errors during the mapping
     process.

 .. change::
     :tags: bug, orm, regression
     :tickets: 9217

     Fixed regression when using :meth:`_sql.Select.from_statement` in an ORM
     context, where matching of columns to SQL labels based on name alone was
     disabled for ORM-statements that weren't fully textual. This would prevent
     arbitrary SQL expressions with column-name labels from matching up to the
     entity to be loaded, which previously would work within the 1.4
     and previous series, so the previous behavior has been restored.

 .. change::
     :tags: bug, asyncio
     :tickets: 9237

     Repaired a regression caused by the fix for :ticket:`8419` which caused
     asyncpg connections to be reset (i.e. transaction ``rollback()`` called)
     and returned to the pool normally in the case that the connection were not
     explicitly returned to the connection pool and was instead being
     

---

<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

## 📋 Pull Request Information **Original PR:** https://github.com/jeffknupp/sandman2/pull/318 **Author:** [@pyup-bot](https://github.com/pyup-bot) **Created:** 4/10/2023 **Status:** ❌ Closed **Base:** `master` ← **Head:** `pyup-scheduled-update-2023-04-10` --- ### 📝 Commits (10+) - [`ee2fa2f`](https://github.com/jeffknupp/sandman2/commit/ee2fa2f2e45eef39f32b72b30c7ae1f046d95b13) Update flask from 1.1.2 to 2.2.3 - [`f69ff6e`](https://github.com/jeffknupp/sandman2/commit/f69ff6eaa677c94522f599590e7255bbac44f152) Update flask-admin from 1.5.7 to 1.6.1 - [`4fe954b`](https://github.com/jeffknupp/sandman2/commit/4fe954be9e390944aee631a2df60159da36567cc) Update flask-sqlalchemy from 2.4.4 to 3.0.3 - [`7fb7d11`](https://github.com/jeffknupp/sandman2/commit/7fb7d11c5430c9ea0a670df7d651ff2f0580ac67) Update sqlalchemy from 1.3.20 to 2.0.9 - [`68e9f3f`](https://github.com/jeffknupp/sandman2/commit/68e9f3ff7f1aa113f1fb48b14269850faf7c2073) Update wtforms from 2.3.3 to 3.0.1 - [`600898e`](https://github.com/jeffknupp/sandman2/commit/600898eae064131be086b2af3253e42b3ca71034) Update coverage from 5.3 to 7.2.3 - [`52edde7`](https://github.com/jeffknupp/sandman2/commit/52edde71c0a8a9c75414b23bf88cffe9d62237be) Update pytest from 6.2.0 to 7.3.0 - [`488f755`](https://github.com/jeffknupp/sandman2/commit/488f7558077eb33eae13999883e836239cccce0d) Update flask-cors from 3.0.9 to 3.0.10 - [`f16bde0`](https://github.com/jeffknupp/sandman2/commit/f16bde0e343360e1d7ddaea3ea42c8fa2b34bae8) Update pytest-cov from 2.10.1 to 4.0.0 - [`bed22ee`](https://github.com/jeffknupp/sandman2/commit/bed22ee250329ed8145e52b344da0cbdfd296383) Update pytest-flask from 1.1.0 to 1.2.0 ### 📊 Changes **1 file changed** (+15 additions, -15 deletions) <details> <summary>View changed files</summary> 📝 `requirements.txt` (+15 -15) </details> ### 📄 Description ### Update [Flask](https://pypi.org/project/Flask) from **1.1.2** to **2.2.3**. <details> <summary>Changelog</summary> ### 2.2.3 ``` ------------- Released 2023-02-15 - Autoescape is enabled by default for ``.svg`` template files. :issue:`4831` - Fix the type of ``template_folder`` to accept ``pathlib.Path``. :issue:`4892` - Add ``--debug`` option to the ``flask run`` command. :issue:`4777` ``` ### 2.2.2 ``` ------------- Released 2022-08-08 - Update Werkzeug dependency to &gt;= 2.2.2. This includes fixes related to the new faster router, header parsing, and the development server. :pr:`4754` - Fix the default value for ``app.env`` to be ``&quot;production&quot;``. This attribute remains deprecated. :issue:`4740` ``` ### 2.2.1 ``` ------------- Released 2022-08-03 - Setting or accessing ``json_encoder`` or ``json_decoder`` raises a deprecation warning. :issue:`4732` ``` ### 2.2.0 ``` ------------- Released 2022-08-01 - Remove previously deprecated code. :pr:`4667` - Old names for some ``send_file`` parameters have been removed. ``download_name`` replaces ``attachment_filename``, ``max_age`` replaces ``cache_timeout``, and ``etag`` replaces ``add_etags``. Additionally, ``path`` replaces ``filename`` in ``send_from_directory``. - The ``RequestContext.g`` property returning ``AppContext.g`` is removed. - Update Werkzeug dependency to &gt;= 2.2. - The app and request contexts are managed using Python context vars directly rather than Werkzeug&#x27;s ``LocalStack``. This should result in better performance and memory use. :pr:`4682` - Extension maintainers, be aware that ``_app_ctx_stack.top`` and ``_request_ctx_stack.top`` are deprecated. Store data on ``g`` instead using a unique prefix, like ``g._extension_name_attr``. - The ``FLASK_ENV`` environment variable and ``app.env`` attribute are deprecated, removing the distinction between development and debug mode. Debug mode should be controlled directly using the ``--debug`` option or ``app.run(debug=True)``. :issue:`4714` - Some attributes that proxied config keys on ``app`` are deprecated: ``session_cookie_name``, ``send_file_max_age_default``, ``use_x_sendfile``, ``propagate_exceptions``, and ``templates_auto_reload``. Use the relevant config keys instead. :issue:`4716` - Add new customization points to the ``Flask`` app object for many previously global behaviors. - ``flask.url_for`` will call ``app.url_for``. :issue:`4568` - ``flask.abort`` will call ``app.aborter``. ``Flask.aborter_class`` and ``Flask.make_aborter`` can be used to customize this aborter. :issue:`4567` - ``flask.redirect`` will call ``app.redirect``. :issue:`4569` - ``flask.json`` is an instance of ``JSONProvider``. A different provider can be set to use a different JSON library. ``flask.jsonify`` will call ``app.json.response``, other functions in ``flask.json`` will call corresponding functions in ``app.json``. :pr:`4692` - JSON configuration is moved to attributes on the default ``app.json`` provider. ``JSON_AS_ASCII``, ``JSON_SORT_KEYS``, ``JSONIFY_MIMETYPE``, and ``JSONIFY_PRETTYPRINT_REGULAR`` are deprecated. :pr:`4692` - Setting custom ``json_encoder`` and ``json_decoder`` classes on the app or a blueprint, and the corresponding ``json.JSONEncoder`` and ``JSONDecoder`` classes, are deprecated. JSON behavior can now be overridden using the ``app.json`` provider interface. :pr:`4692` - ``json.htmlsafe_dumps`` and ``json.htmlsafe_dump`` are deprecated, the function is built-in to Jinja now. :pr:`4692` - Refactor ``register_error_handler`` to consolidate error checking. Rewrite some error messages to be more consistent. :issue:`4559` - Use Blueprint decorators and functions intended for setup after registering the blueprint will show a warning. In the next version, this will become an error just like the application setup methods. :issue:`4571` - ``before_first_request`` is deprecated. Run setup code when creating the application instead. :issue:`4605` - Added the ``View.init_every_request`` class attribute. If a view subclass sets this to ``False``, the view will not create a new instance on every request. :issue:`2520`. - A ``flask.cli.FlaskGroup`` Click group can be nested as a sub-command in a custom CLI. :issue:`3263` - Add ``--app`` and ``--debug`` options to the ``flask`` CLI, instead of requiring that they are set through environment variables. :issue:`2836` - Add ``--env-file`` option to the ``flask`` CLI. This allows specifying a dotenv file to load in addition to ``.env`` and ``.flaskenv``. :issue:`3108` - It is no longer required to decorate custom CLI commands on ``app.cli`` or ``blueprint.cli`` with ``with_appcontext``, an app context will already be active at that point. :issue:`2410` - ``SessionInterface.get_expiration_time`` uses a timezone-aware value. :pr:`4645` - View functions can return generators directly instead of wrapping them in a ``Response``. :pr:`4629` - Add ``stream_template`` and ``stream_template_string`` functions to render a template as a stream of pieces. :pr:`4629` - A new implementation of context preservation during debugging and testing. :pr:`4666` - ``request``, ``g``, and other context-locals point to the correct data when running code in the interactive debugger console. :issue:`2836` - Teardown functions are always run at the end of the request, even if the context is preserved. They are also run after the preserved context is popped. - ``stream_with_context`` preserves context separately from a ``with client`` block. It will be cleaned up when ``response.get_data()`` or ``response.close()`` is called. - Allow returning a list from a view function, to convert it to a JSON response like a dict is. :issue:`4672` - When type checking, allow ``TypedDict`` to be returned from view functions. :pr:`4695` - Remove the ``--eager-loading/--lazy-loading`` options from the ``flask run`` command. The app is always eager loaded the first time, then lazily loaded in the reloader. The reloader always prints errors immediately but continues serving. Remove the internal ``DispatchingApp`` middleware used by the previous implementation. :issue:`4715` ``` ### 2.1.3 ``` ------------- Released 2022-07-13 - Inline some optional imports that are only used for certain CLI commands. :pr:`4606` - Relax type annotation for ``after_request`` functions. :issue:`4600` - ``instance_path`` for namespace packages uses the path closest to the imported submodule. :issue:`4610` - Clearer error message when ``render_template`` and ``render_template_string`` are used outside an application context. :pr:`4693` ``` ### 2.1.2 ``` ------------- Released 2022-04-28 - Fix type annotation for ``json.loads``, it accepts str or bytes. :issue:`4519` - The ``--cert`` and ``--key`` options on ``flask run`` can be given in either order. :issue:`4459` ``` ### 2.1.1 ``` ------------- Released on 2022-03-30 - Set the minimum required version of importlib_metadata to 3.6.0, which is required on Python &lt; 3.10. :issue:`4502` ``` ### 2.1.0 ``` ------------- Released 2022-03-28 - Drop support for Python 3.6. :pr:`4335` - Update Click dependency to &gt;= 8.0. :pr:`4008` - Remove previously deprecated code. :pr:`4337` - The CLI does not pass ``script_info`` to app factory functions. - ``config.from_json`` is replaced by ``config.from_file(name, load=json.load)``. - ``json`` functions no longer take an ``encoding`` parameter. - ``safe_join`` is removed, use ``werkzeug.utils.safe_join`` instead. - ``total_seconds`` is removed, use ``timedelta.total_seconds`` instead. - The same blueprint cannot be registered with the same name. Use ``name=`` when registering to specify a unique name. - The test client&#x27;s ``as_tuple`` parameter is removed. Use ``response.request.environ`` instead. :pr:`4417` - Some parameters in ``send_file`` and ``send_from_directory`` were renamed in 2.0. The deprecation period for the old names is extended to 2.2. Be sure to test with deprecation warnings visible. - ``attachment_filename`` is renamed to ``download_name``. - ``cache_timeout`` is renamed to ``max_age``. - ``add_etags`` is renamed to ``etag``. - ``filename`` is renamed to ``path``. - The ``RequestContext.g`` property is deprecated. Use ``g`` directly or ``AppContext.g`` instead. :issue:`3898` - ``copy_current_request_context`` can decorate async functions. :pr:`4303` - The CLI uses ``importlib.metadata`` instead of ``setuptools`` to load command entry points. :issue:`4419` - Overriding ``FlaskClient.open`` will not cause an error on redirect. :issue:`3396` - Add an ``--exclude-patterns`` option to the ``flask run`` CLI command to specify patterns that will be ignored by the reloader. :issue:`4188` - When using lazy loading (the default with the debugger), the Click context from the ``flask run`` command remains available in the loader thread. :issue:`4460` - Deleting the session cookie uses the ``httponly`` flag. :issue:`4485` - Relax typing for ``errorhandler`` to allow the user to use more precise types and decorate the same function multiple times. :issue:`4095, 4295, 4297` - Fix typing for ``__exit__`` methods for better compatibility with ``ExitStack``. :issue:`4474` - From Werkzeug, for redirect responses the ``Location`` header URL will remain relative, and exclude the scheme and domain, by default. :pr:`4496` - Add ``Config.from_prefixed_env()`` to load config values from environment variables that start with ``FLASK_`` or another prefix. This parses values as JSON by default, and allows setting keys in nested dicts. :pr:`4479` ``` ### 2.0.3 ``` ------------- Released 2022-02-14 - The test client&#x27;s ``as_tuple`` parameter is deprecated and will be removed in Werkzeug 2.1. It is now also deprecated in Flask, to be removed in Flask 2.1, while remaining compatible with both in 2.0.x. Use ``response.request.environ`` instead. :pr:`4341` - Fix type annotation for ``errorhandler`` decorator. :issue:`4295` - Revert a change to the CLI that caused it to hide ``ImportError`` tracebacks when importing the application. :issue:`4307` - ``app.json_encoder`` and ``json_decoder`` are only passed to ``dumps`` and ``loads`` if they have custom behavior. This improves performance, mainly on PyPy. :issue:`4349` - Clearer error message when ``after_this_request`` is used outside a request context. :issue:`4333` ``` ### 2.0.2 ``` ------------- Released 2021-10-04 - Fix type annotation for ``teardown_*`` methods. :issue:`4093` - Fix type annotation for ``before_request`` and ``before_app_request`` decorators. :issue:`4104` - Fixed the issue where typing requires template global decorators to accept functions with no arguments. :issue:`4098` - Support View and MethodView instances with async handlers. :issue:`4112` - Enhance typing of ``app.errorhandler`` decorator. :issue:`4095` - Fix registering a blueprint twice with differing names. :issue:`4124` - Fix the type of ``static_folder`` to accept ``pathlib.Path``. :issue:`4150` - ``jsonify`` handles ``decimal.Decimal`` by encoding to ``str``. :issue:`4157` - Correctly handle raising deferred errors in CLI lazy loading. :issue:`4096` - The CLI loader handles ``**kwargs`` in a ``create_app`` function. :issue:`4170` - Fix the order of ``before_request`` and other callbacks that trigger before the view returns. They are called from the app down to the closest nested blueprint. :issue:`4229` ``` ### 2.0.1 ``` ------------- Released 2021-05-21 - Re-add the ``filename`` parameter in ``send_from_directory``. The ``filename`` parameter has been renamed to ``path``, the old name is deprecated. :pr:`4019` - Mark top-level names as exported so type checking understands imports in user projects. :issue:`4024` - Fix type annotation for ``g`` and inform mypy that it is a namespace object that has arbitrary attributes. :issue:`4020` - Fix some types that weren&#x27;t available in Python 3.6.0. :issue:`4040` - Improve typing for ``send_file``, ``send_from_directory``, and ``get_send_file_max_age``. :issue:`4044`, :pr:`4026` - Show an error when a blueprint name contains a dot. The ``.`` has special meaning, it is used to separate (nested) blueprint names and the endpoint name. :issue:`4041` - Combine URL prefixes when nesting blueprints that were created with a ``url_prefix`` value. :issue:`4037` - Revert a change to the order that URL matching was done. The URL is again matched after the session is loaded, so the session is available in custom URL converters. :issue:`4053` - Re-add deprecated ``Config.from_json``, which was accidentally removed early. :issue:`4078` - Improve typing for some functions using ``Callable`` in their type signatures, focusing on decorator factories. :issue:`4060` - Nested blueprints are registered with their dotted name. This allows different blueprints with the same name to be nested at different locations. :issue:`4069` - ``register_blueprint`` takes a ``name`` option to change the (pre-dotted) name the blueprint is registered with. This allows the same blueprint to be registered multiple times with unique names for ``url_for``. Registering the same blueprint with the same name multiple times is deprecated. :issue:`1091` - Improve typing for ``stream_with_context``. :issue:`4052` ``` ### 2.0.0 ``` ------------- Released 2021-05-11 - Drop support for Python 2 and 3.5. - Bump minimum versions of other Pallets projects: Werkzeug &gt;= 2, Jinja2 &gt;= 3, MarkupSafe &gt;= 2, ItsDangerous &gt;= 2, Click &gt;= 8. Be sure to check the change logs for each project. For better compatibility with other applications (e.g. Celery) that still require Click 7, there is no hard dependency on Click 8 yet, but using Click 7 will trigger a DeprecationWarning and Flask 2.1 will depend on Click 8. - JSON support no longer uses simplejson. To use another JSON module, override ``app.json_encoder`` and ``json_decoder``. :issue:`3555` - The ``encoding`` option to JSON functions is deprecated. :pr:`3562` - Passing ``script_info`` to app factory functions is deprecated. This was not portable outside the ``flask`` command. Use ``click.get_current_context().obj`` if it&#x27;s needed. :issue:`3552` - The CLI shows better error messages when the app failed to load when looking up commands. :issue:`2741` - Add ``SessionInterface.get_cookie_name`` to allow setting the session cookie name dynamically. :pr:`3369` - Add ``Config.from_file`` to load config using arbitrary file loaders, such as ``toml.load`` or ``json.load``. ``Config.from_json`` is deprecated in favor of this. :pr:`3398` - The ``flask run`` command will only defer errors on reload. Errors present during the initial call will cause the server to exit with the traceback immediately. :issue:`3431` - ``send_file`` raises a ``ValueError`` when passed an ``io`` object in text mode. Previously, it would respond with 200 OK and an empty file. :issue:`3358` - When using ad-hoc certificates, check for the cryptography library instead of PyOpenSSL. :pr:`3492` - When specifying a factory function with ``FLASK_APP``, keyword argument can be passed. :issue:`3553` - When loading a ``.env`` or ``.flaskenv`` file, the current working directory is no longer changed to the location of the file. :pr:`3560` - When returning a ``(response, headers)`` tuple from a view, the headers replace rather than extend existing headers on the response. For example, this allows setting the ``Content-Type`` for ``jsonify()``. Use ``response.headers.extend()`` if extending is desired. :issue:`3628` - The ``Scaffold`` class provides a common API for the ``Flask`` and ``Blueprint`` classes. ``Blueprint`` information is stored in attributes just like ``Flask``, rather than opaque lambda functions. This is intended to improve consistency and maintainability. :issue:`3215` - Include ``samesite`` and ``secure`` options when removing the session cookie. :pr:`3726` - Support passing a ``pathlib.Path`` to ``static_folder``. :pr:`3579` - ``send_file`` and ``send_from_directory`` are wrappers around the implementations in ``werkzeug.utils``. :pr:`3828` - Some ``send_file`` parameters have been renamed, the old names are deprecated. ``attachment_filename`` is renamed to ``download_name``. ``cache_timeout`` is renamed to ``max_age``. ``add_etags`` is renamed to ``etag``. :pr:`3828, 3883` - ``send_file`` passes ``download_name`` even if ``as_attachment=False`` by using ``Content-Disposition: inline``. :pr:`3828` - ``send_file`` sets ``conditional=True`` and ``max_age=None`` by default. ``Cache-Control`` is set to ``no-cache`` if ``max_age`` is not set, otherwise ``public``. This tells browsers to validate conditional requests instead of using a timed cache. :pr:`3828` - ``helpers.safe_join`` is deprecated. Use ``werkzeug.utils.safe_join`` instead. :pr:`3828` - The request context does route matching before opening the session. This could allow a session interface to change behavior based on ``request.endpoint``. :issue:`3776` - Use Jinja&#x27;s implementation of the ``|tojson`` filter. :issue:`3881` - Add route decorators for common HTTP methods. For example, ``app.post(&quot;/login&quot;)`` is a shortcut for ``app.route(&quot;/login&quot;, methods=[&quot;POST&quot;])``. :pr:`3907` - Support async views, error handlers, before and after request, and teardown functions. :pr:`3412` - Support nesting blueprints. :issue:`593, 1548`, :pr:`3923` - Set the default encoding to &quot;UTF-8&quot; when loading ``.env`` and ``.flaskenv`` files to allow to use non-ASCII characters. :issue:`3931` - ``flask shell`` sets up tab and history completion like the default ``python`` shell if ``readline`` is installed. :issue:`3941` - ``helpers.total_seconds()`` is deprecated. Use ``timedelta.total_seconds()`` instead. :pr:`3962` - Add type hinting. :pr:`3973`. ``` ### 1.1.4 ``` ------------- Released 2021-05-13 - Update ``static_folder`` to use ``_compat.fspath`` instead of ``os.fspath`` to continue supporting Python &lt; 3.6 :issue:`4050` ``` ### 1.1.3 ``` ------------- Released 2021-05-13 - Set maximum versions of Werkzeug, Jinja, Click, and ItsDangerous. :issue:`4043` - Re-add support for passing a ``pathlib.Path`` for ``static_folder``. :pr:`3579` ``` </details> <details> <summary>Links</summary> - PyPI: https://pypi.org/project/flask - Changelog: https://pyup.io/changelogs/flask/ - Homepage: https://palletsprojects.com/p/flask </details> ### Update [Flask-Admin](https://pypi.org/project/Flask-Admin) from **1.5.7** to **1.6.1**. <details> <summary>Changelog</summary> ### 1.6.1 ``` ----- * SQLAlchemy 2.x support * General updates and bug fixes * Dropped WTForms 1 support ``` ### 1.6.0 ``` ----- * Dropped Python 2 support * WTForms 3.0 support * Various fixes ``` ### 1.5.8 ``` ----- * SQLAlchemy 1.4.5+ compatibility fixes * Redis CLI fixes ``` </details> <details> <summary>Links</summary> - PyPI: https://pypi.org/project/flask-admin - Changelog: https://pyup.io/changelogs/flask-admin/ - Repo: https://github.com/flask-admin/flask-admin/ - Docs: https://pythonhosted.org/Flask-Admin/ </details> ### Update [Flask-SQLAlchemy](https://pypi.org/project/Flask-SQLAlchemy) from **2.4.4** to **3.0.3**. <details> <summary>Changelog</summary> ### 3.0.2 ``` ------------- Released 2022-10-14 - Update compatibility with SQLAlchemy 2. :issue:`1122` ``` ### 3.0.1 ``` ------------- Released 2022-10-11 - Export typing information instead of using external typeshed definitions. :issue:`1112` - If default engine options are set, but ``SQLALCHEMY_DATABASE_URI`` is not set, an invalid default bind will not be configured. :issue:`1117` ``` ### 3.0.0 ``` ------------- Released 2022-10-04 - Drop support for Python 2, 3.4, 3.5, and 3.6. - Bump minimum version of Flask to 2.2. - Bump minimum version of SQLAlchemy to 1.4.18. - Remove previously deprecated code. - The session is scoped to the current app context instead of the thread. This requires that an app context is active. This ensures that the session is cleaned up after every request. - An active Flask application context is always required to access ``session`` and ``engine``, regardless of if an application was passed to the constructor. :issue:`508, 944` - Different bind keys use different SQLAlchemy ``MetaData`` registries, allowing tables in different databases to have the same name. Bind keys are stored and looked up on the resulting metadata rather than the model or table. - ``SQLALCHEMY_DATABASE_URI`` does not default to ``sqlite:///:memory:``. An error is raised if neither it nor ``SQLALCHEMY_BINDS`` define any engines. :pr:`731` - Configuring SQLite with a relative path is relative to ``app.instance_path`` instead of ``app.root_path``. The instance folder is created if necessary. :issue:`462` - Added ``get_or_404``, ``first_or_404``, ``one_or_404``, and ``paginate`` methods to the extension object. These use SQLAlchemy&#x27;s preferred ``session.execute(select())`` pattern instead of the legacy query interface. :issue:`1088` - Setup methods that create the engines and session are renamed with a leading underscore. They are considered internal interfaces which may change at any time. - All parameters to ``SQLAlchemy`` except ``app`` are keyword-only. - Renamed the ``bind`` parameter to ``bind_key`` and removed the ``app`` parameter from various ``SQLAlchemy`` methods. - The extension object uses ``__getattr__`` to alias names from the SQLAlchemy package, rather than copying them as attributes. - The extension object is stored directly as ``app.extensions[&quot;sqlalchemy&quot;]``. :issue:`698` - The session class can be customized by passing the ``class_`` key in the ``session_options`` parameter. :issue:`327` - ``SignallingSession`` is renamed to ``Session``. - ``Session.get_bind`` more closely matches the base implementation. - Model classes and the ``db`` instance are available without imports in ``flask shell``. :issue:`1089` - The ``CamelCase`` to ``snake_case`` table name converter handles more patterns correctly. If model that was already created in the database changed, either use Alembic to rename the table, or set ``__tablename__`` to keep the old name. :issue:`406` - ``Model`` ``repr`` distinguishes between transient and pending instances. :issue:`967` - A custom model class can implement ``__init_subclass__`` with class parameters. :issue:`1002` - ``db.Table`` is a subclass instead of a function. - The ``engine_options`` parameter is applied as defaults before per-engine configuration. - ``SQLALCHEMY_BINDS`` values can either be an engine URL, or a dict of engine options including URL, for each bind. ``SQLALCHEMY_DATABASE_URI`` and ``SQLALCHEMY_ENGINE_OPTIONS`` correspond to the ``None`` key and take precedence. :issue:`783` - Engines are created when calling ``init_app`` rather than the first time they are accessed. :issue:`698` - ``db.engines`` exposes the map of bind keys to engines for the current app. - ``get_engine``, ``get_tables_for_bind``, and ``get_binds`` are deprecated. - SQLite driver-level URIs that look like ``sqlite:///file:name.db?uri=true`` are supported. :issue:`998, 1045` - SQLite engines do not use ``NullPool`` if ``pool_size`` is 0. - MySQL engines use the &quot;utf8mb4&quot; charset by default. :issue:`875` - MySQL engines do not set ``pool_size`` to 10. - MySQL engines don&#x27;t set a default for ``pool_recycle`` if not using a queue pool. :issue:`803` - ``Query`` is renamed from ``BaseQuery``. - Added ``Query.one_or_404``. - The query class is applied to ``backref`` in ``relationship``. :issue:`417` - Creating ``Pagination`` objects manually is no longer a public API. They should be created with ``db.paginate`` or ``query.paginate``. :issue:`1088` - ``Pagination.iter_pages`` and ``Query.paginate`` parameters are keyword-only. - ``Pagination`` is iterable, iterating over its items. :issue:`70` - Pagination count query is more efficient. - ``Pagination.iter_pages`` is more efficient. :issue:`622` - ``Pagination.iter_pages`` ``right_current`` parameter is inclusive. - Pagination ``per_page`` cannot be 0. :issue:`1091` - Pagination ``max_per_page`` defaults to 100. :issue:`1091` - Added ``Pagination.first`` and ``last`` properties, which give the number of the first and last item on the page. :issue:`567` - ``SQLALCHEMY_RECORD_QUERIES`` is disabled by default, and is not enabled automatically with ``app.debug`` or ``app.testing``. :issue:`1092` - ``get_debug_queries`` is renamed to ``get_recorded_queries`` to better match the config and functionality. - Recorded query info is a dataclass instead of a tuple. The ``context`` attribute is renamed to ``location``. Finding the location uses a more inclusive check. - ``SQLALCHEMY_TRACK_MODIFICATIONS`` is disabled by default. :pr:`727` - ``SQLALCHEMY_COMMIT_ON_TEARDOWN`` is deprecated. It can cause various design issues that are difficult to debug. Call ``db.session.commit()`` directly instead. :issue:`216` ``` ### 2.5.1 ``` ------------- Released 2021-03-18 - Fix compatibility with Python 2.7. ``` ### 2.5.0 ``` ------------- Released 2021-03-18 - Update to support SQLAlchemy 1.4. - SQLAlchemy ``URL`` objects are immutable. Some internal methods have changed to return a new URL instead of ``None``. :issue:`885` ``` </details> <details> <summary>Links</summary> - PyPI: https://pypi.org/project/flask-sqlalchemy - Changelog: https://pyup.io/changelogs/flask-sqlalchemy/ - Docs: https://pythonhosted.org/Flask-SQLAlchemy/ </details> ### Update [SQLAlchemy](https://pypi.org/project/SQLAlchemy) from **1.3.20** to **2.0.9**. <details> <summary>Changelog</summary> ### 2.0.9 ``` :released: April 5, 2023 .. change:: :tags: bug, mssql :tickets: 9603 Due to a critical bug identified in SQL Server, the SQLAlchemy &quot;insertmanyvalues&quot; feature which allows fast INSERT of many rows while also supporting RETURNING unfortunately needs to be disabled for SQL Server. SQL Server is apparently unable to guarantee that the order of rows inserted matches the order in which they are sent back by OUTPUT inserted when table-valued rows are used with INSERT in conjunction with OUTPUT inserted. We are trying to see if Microsoft is able to confirm this undocumented behavior however there is no known workaround, other than it&#x27;s not safe to use table-valued expressions with OUTPUT inserted for now. .. change:: :tags: bug, mariadb :tickets: 9588 Added ``row_number`` as reserved word in MariaDb. .. change:: :tags: bug, mssql :tickets: 9586 Changed the bulk INSERT strategy used for SQL Server &quot;executemany&quot; with pyodbc when ``fast_executemany`` is set to ``True`` by using ``fast_executemany`` / ``cursor.executemany()`` for bulk INSERT that does not include RETURNING, restoring the same behavior as was used in SQLAlchemy 1.4 when this parameter is set. New performance details from end users have shown that ``fast_executemany`` is still much faster for very large datasets as it uses ODBC commands that can receive all rows in a single round trip, allowing for much larger datasizes than the batches that can be sent by &quot;insertmanyvalues&quot; as was implemented for SQL Server. While this change was made such that &quot;insertmanyvalues&quot; continued to be used for INSERT that includes RETURNING, as well as if ``fast_executemany`` were not set, due to :ticket:`9603`, the &quot;insertmanyvalues&quot; strategy has been disabled for SQL Server across the board in any case. .. changelog:: ``` ### 2.0.8 ``` :released: March 31, 2023 .. change:: :tags: bug, orm :tickets: 9553 Fixed issue in ORM Annotated Declarative where using a recursive type (e.g. using a nested Dict type) would result in a recursion overflow in the ORM&#x27;s annotation resolution logic, even if this datatype were not necessary to map the column. .. change:: :tags: bug, examples Fixed issue in &quot;versioned history&quot; example where using a declarative base that is derived from :class:`_orm.DeclarativeBase` would fail to be mapped. Additionally, repaired the given test suite so that the documented instructions for running the example using Python unittest now work again. .. change:: :tags: bug, orm :tickets: 9550 Fixed issue where the :func:`_orm.mapped_column` construct would raise an internal error if used on a Declarative mixin and included the :paramref:`_orm.mapped_column.deferred` parameter. .. change:: :tags: bug, mysql :tickets: 9544 Fixed issue where string datatypes such as :class:`_sqltypes.CHAR`, :class:`_sqltypes.VARCHAR`, :class:`_sqltypes.TEXT`, as well as binary :class:`_sqltypes.BLOB`, could not be produced with an explicit length of zero, which has special meaning for MySQL. Pull request courtesy J. Nick Koston. .. change:: :tags: bug, orm :tickets: 9537 Expanded the warning emitted when a plain :func:`_sql.column` object is present in a Declarative mapping to include any arbitrary SQL expression that is not declared within an appropriate property type such as :func:`_orm.column_property`, :func:`_orm.deferred`, etc. These attributes are otherwise not mapped at all and remain unchanged within the class dictionary. As it seems likely that such an expression is usually not what&#x27;s intended, this case now warns for all such otherwise ignored expressions, rather than just the :func:`_sql.column` case. .. change:: :tags: bug, orm :tickets: 9519 Fixed regression where accessing the expression value of a hybrid property on a class that was either unmapped or not-yet-mapped (such as calling upon it within a :func:`_orm.declared_attr` method) would raise an internal error, as an internal fetch for the parent class&#x27; mapper would fail and an instruction for this failure to be ignored were inadvertently removed in 2.0. .. change:: :tags: bug, orm :tickets: 9350 Fields that are declared on Declarative Mixins and then combined with classes that make use of :class:`_orm.MappedAsDataclass`, where those mixin fields are not themselves part of a dataclass, now emit a deprecation warning as these fields will be ignored in a future release, as Python dataclasses behavior is to ignore these fields. Type checkers will not see these fields under pep-681. .. seealso:: :ref:`error_dcmx` - background on rationale :ref:`orm_declarative_dc_mixins` .. change:: :tags: bug, postgresql :tickets: 9511 Fixed critical regression in PostgreSQL dialects such as asyncpg which rely upon explicit casts in SQL in order for datatypes to be passed to the driver correctly, where a :class:`.String` datatype would be cast along with the exact column length being compared, leading to implicit truncation when comparing a ``VARCHAR`` of a smaller length to a string of greater length regardless of operator in use (e.g. LIKE, MATCH, etc.). The PostgreSQL dialect now omits the length from ``VARCHAR`` when rendering these casts. .. change:: :tags: bug, util :tickets: 9487 Implemented missing methods ``copy`` and ``pop`` in OrderedSet class. .. change:: :tags: bug, typing :tickets: 9536 Fixed typing for :func:`_orm.deferred` and :func:`_orm.query_expression` to work correctly with 2.0 style mappings. .. change:: :tags: bug, orm :tickets: 9526 Fixed issue where the :meth:`_sql.BindParameter.render_literal_execute` method would fail when called on a parameter that also had ORM annotations associated with it. In practice, this would be observed as a failure of SQL compilation when using some combinations of a dialect that uses &quot;FETCH FIRST&quot; such as Oracle along with a :class:`_sql.Select` construct that uses :meth:`_sql.Select.limit`, within some ORM contexts, including if the statement were embedded within a relationship primaryjoin expression. .. change:: :tags: usecase, orm :tickets: 9563 Exceptions such as ``TypeError`` and ``ValueError`` raised by Python dataclasses when making use of the :class:`_orm.MappedAsDataclass` mixin class or :meth:`_orm.registry.mapped_as_dataclass` decorator are now wrapped within an :class:`.InvalidRequestError` wrapper along with informative context about the error message, referring to the Python dataclasses documentation as the authoritative source of background information on the cause of the exception. .. seealso:: :ref:`error_dcte` .. change:: :tags: bug, orm :tickets: 9549 Towards maintaining consistency with unit-of-work changes made for :ticket:`5984` and :ticket:`8862`, both of which disable &quot;lazy=&#x27;raise&#x27;&quot; handling within :class:`_orm.Session` processes that aren&#x27;t triggered by attribute access, the :meth:`_orm.Session.delete` method will now also disable &quot;lazy=&#x27;raise&#x27;&quot; handling when it traverses relationship paths in order to process the &quot;delete&quot; and &quot;delete-orphan&quot; cascade rules. Previously, there was no easy way to generically call :meth:`_orm.Session.delete` on an object that had &quot;lazy=&#x27;raise&#x27;&quot; set up such that only the necessary relationships would be loaded. As &quot;lazy=&#x27;raise&#x27;&quot; is primarily intended to catch SQL loading that emits on attribute access, :meth:`_orm.Session.delete` is now made to behave like other :class:`_orm.Session` methods including :meth:`_orm.Session.merge` as well as :meth:`_orm.Session.flush` along with autoflush. .. change:: :tags: bug, orm :tickets: 9564 Fixed issue where an annotation-only :class:`_orm.Mapped` directive could not be used in a Declarative mixin class, without that attribute attempting to take effect for single- or joined-inheritance subclasses of mapped classes that had already mapped that attribute on a superclass, producing conflicting column errors and/or warnings. .. change:: :tags: bug, orm, typing :tickets: 9514 Properly type :paramref:`_dml.Insert.from_select.names` to accept a list of string or columns or mapped attributes. .. changelog:: ``` ### 2.0.7 ``` :released: March 18, 2023 .. change:: :tags: usecase, postgresql :tickets: 9416 Added new PostgreSQL type :class:`_postgresql.CITEXT`. Pull request courtesy Julian David Rath. .. change:: :tags: bug, typing :tickets: 9502 Fixed typing issue where :func:`_orm.composite` would not allow an arbitrary callable as the source of the composite class. .. change:: :tags: usecase, postgresql :tickets: 9442 Modifications to the base PostgreSQL dialect to allow for better integration with the sqlalchemy-redshift third party dialect for SQLAlchemy 2.0. Pull request courtesy matthewgdv. .. changelog:: ``` ### 2.0.6 ``` :released: March 13, 2023 .. change:: :tags: bug, sql, regression :tickets: 9461 Fixed regression where the fix for :ticket:`8098`, which was released in the 1.4 series and provided a layer of concurrency-safe checks for the lambda SQL API, included additional fixes in the patch that failed to be applied to the main branch. These additional fixes have been applied. .. change:: :tags: bug, typing :tickets: 9451 Fixed typing issue where :meth:`.ColumnElement.cast` did not allow a :class:`.TypeEngine` argument independent of the type of the :class:`.ColumnElement` itself, which is the purpose of :meth:`.ColumnElement.cast`. .. change:: :tags: bug, orm :tickets: 9460 Fixed bug where the &quot;active history&quot; feature was not fully implemented for composite attributes, making it impossible to receive events that included the &quot;old&quot; value. This seems to have been the case with older SQLAlchemy versions as well, where &quot;active_history&quot; would be propagated to the underlying column-based attributes, but an event handler listening to the composite attribute itself would not be given the &quot;old&quot; value being replaced, even if the composite() were set up with active_history=True. Additionally, fixed a regression that&#x27;s local to 2.0 which disallowed active_history on composite from being assigned to the impl with ``attr.impl.active_history=True``. .. change:: :tags: bug, oracle :tickets: 9459 Fixed reflection bug where Oracle &quot;name normalize&quot; would not work correctly for reflection of symbols that are in the &quot;PUBLIC&quot; schema, such as synonyms, meaning the PUBLIC name could not be indicated as lower case on the Python side for the :paramref:`_schema.Table.schema` argument. Using uppercase &quot;PUBLIC&quot; would work, but would then lead to awkward SQL queries including a quoted ``&quot;PUBLIC&quot;`` name as well as indexing the table under uppercase &quot;PUBLIC&quot;, which was inconsistent. .. change:: :tags: bug, typing Fixed issues to allow typing tests to pass under Mypy 1.1.1. .. change:: :tags: bug, sql :tickets: 9440 Fixed regression where the :func:`_sql.select` construct would not be able to render if it were given no columns and then used in the context of an EXISTS, raising an internal exception instead. While an empty &quot;SELECT&quot; is not typically valid SQL, in the context of EXISTS databases such as PostgreSQL allow it, and in any case the condition now no longer raises an internal exception. .. change:: :tags: bug, orm :tickets: 9418 Fixed regression involving pickling of Python rows between the cython and pure Python implementations of :class:`.Row`, which occurred as part of refactoring code for version 2.0 with typing. A particular constant were turned into a string based ``Enum`` for the pure Python version of :class:`.Row` whereas the cython version continued to use an integer constant, leading to deserialization failures. .. changelog:: ``` ### 2.0.5.post1 ``` :released: March 5, 2023 .. change:: :tags: bug, orm :tickets: 9418 Added constructor arguments to the built-in mapping collection types including :class:`.KeyFuncDict`, :func:`_orm.attribute_keyed_dict`, :func:`_orm.column_keyed_dict` so that these dictionary types may be constructed in place given the data up front; this provides further compatibility with tools such as Python dataclasses ``.asdict()`` which relies upon invoking these classes directly as ordinary dictionary classes. .. change:: :tags: bug, orm, regression :tickets: 9424 Fixed multiple regressions due to :ticket:`8372`, involving :func:`_orm.attribute_mapped_collection` (now called :func:`_orm.attribute_keyed_dict`). First, the collection was no longer usable with &quot;key&quot; attributes that were not themselves ordinary mapped attributes; attributes linked to descriptors and/or association proxy attributes have been fixed. Second, if an event or other operation needed access to the &quot;key&quot; in order to populate the dictionary from an mapped attribute that was not loaded, this also would raise an error inappropriately, rather than trying to load the attribute as was the behavior in 1.4. This is also fixed. For both cases, the behavior of :ticket:`8372` has been expanded. :ticket:`8372` introduced an error that raises when the derived key that would be used as a mapped dictionary key is effectively unassigned. In this change, a warning only is emitted if the effective value of the &quot;.key&quot; attribute is ``None``, where it cannot be unambiguously determined if this ``None`` was intentional or not. ``None`` will be not supported as mapped collection dictionary keys going forward (as it typically refers to NULL which means &quot;unknown&quot;). Setting :paramref:`_orm.attribute_keyed_dict.ignore_unpopulated_attribute` will now cause such ``None`` keys to be ignored as well. .. change:: :tags: engine, performance :tickets: 9343 A small optimization to the Cython implementation of :class:`.Result` using a cdef for a particular int value to avoid Python overhead. Pull request courtesy Matus Valo. .. change:: :tags: bug, mssql :tickets: 9414 Fixed issue in the new :class:`.Uuid` datatype which prevented it from working with the pymssql driver. As pymssql seems to be maintained again, restored testing support for pymssql. .. change:: :tags: bug, mssql Tweaked the pymssql dialect to take better advantage of RETURNING for INSERT statements in order to retrieve last inserted primary key values, in the same way as occurs for the mssql+pyodbc dialect right now. .. change:: :tags: bug, orm Identified that the ``sqlite`` and ``mssql+pyodbc`` dialects are now compatible with the SQLAlchemy ORM&#x27;s &quot;versioned rows&quot; feature, since SQLAlchemy now computes rowcount for a RETURNING statement in this specific case by counting the rows returned, rather than relying upon ``cursor.rowcount``. In particular, the ORM versioned rows use case (documented at :ref:`mapper_version_counter`) should now be fully supported with the SQL Server pyodbc dialect. .. change:: :tags: bug, postgresql :tickets: 9349 Fixed issue in PostgreSQL :class:`_postgresql.ExcludeConstraint` where literal values were being compiled as bound parameters and not direct inline values as is required for DDL. .. change:: :tags: bug, typing Fixed bug where the :meth:`_engine.Connection.scalars` method was not typed as allowing a multiple-parameters list, which is now supported using insertmanyvalues operations. .. change:: :tags: bug, typing :tickets: 9376 Improved typing for the mapping passed to :meth:`.Insert.values` and :meth:`.Update.values` to be more open-ended about collection type, by indicating read-only ``Mapping`` instead of writeable ``Dict`` which would error out on too limited of a key type. .. change:: :tags: schema Validate that when provided the :paramref:`_schema.MetaData.schema` argument of :class:`_schema.MetaData` is a string. .. change:: :tags: typing, usecase :tickets: 9338 Exported the type returned by :meth:`_orm.scoped_session.query_property` using a new public type :class:`.orm.QueryPropertyDescriptor`. .. change:: :tags: bug, mysql, postgresql :tickets: 5648 The support for pool ping listeners to receive exception events via the :meth:`.DialectEvents.handle_error` event added in 2.0.0b1 for :ticket:`5648` failed to take into account dialect-specific ping routines such as that of MySQL and PostgreSQL. The dialect feature has been reworked so that all dialects participate within event handling. Additionally, a new boolean element :attr:`.ExceptionContext.is_pre_ping` is added which identifies if this operation is occurring within the pre-ping operation. For this release, third party dialects which implement a custom :meth:`_engine.Dialect.do_ping` method can opt in to the newly improved behavior by having their method no longer catch exceptions or check exceptions for &quot;is_disconnect&quot;, instead just propagating all exceptions outwards. Checking the exception for &quot;is_disconnect&quot; is now done by an enclosing method on the default dialect, which ensures that the event hook is invoked for all exception scenarios before testing the exception as a &quot;disconnect&quot; exception. If an existing ``do_ping()`` method continues to catch exceptions and check &quot;is_disconnect&quot;, it will continue to work as it did previously, but ``handle_error`` hooks will not have access to the exception if it isn&#x27;t propagated outwards. .. change:: :tags: bug, ext :tickets: 9367 Fixed issue in automap where calling :meth:`_automap.AutomapBase.prepare` from a specific mapped class, rather than from the :class:`_automap.AutomapBase` directly, would not use the correct base class when automap detected new tables, instead using the given class, leading to mappers trying to configure inheritance. While one should normally call :meth:`_automap.AutomapBase.prepare` from the base in any case, it shouldn&#x27;t misbehave that badly when called from a subclass. .. change:: :tags: bug, sqlite, regression :tickets: 9379 Fixed regression for SQLite connections where use of the ``deterministic`` parameter when establishing database functions would fail for older SQLite versions, those prior to version 3.8.3. The version checking logic has been improved to accommodate for this case. .. change:: :tags: bug, typing :tickets: 9391 Added missing init overload to the :class:`_types.Numeric` type object so that pep-484 type checkers may properly resolve the complete type, deriving from the :paramref:`_types.Numeric.asdecimal` parameter whether ``Decimal`` or ``float`` objects will be represented. .. change:: :tags: bug, typing :tickets: 9398 Fixed typing bug where :meth:`_sql.Select.from_statement` would not accept :func:`_sql.text` or :class:`.TextualSelect` objects as a valid type. Additionally repaired the :class:`.TextClause.columns` method to have a return type, which was missing. .. change:: :tags: bug, orm declarative :tickets: 9332 Fixed issue where new :paramref:`_orm.mapped_column.use_existing_column` feature would not work if the two same-named columns were mapped under attribute names that were differently-named from an explicit name given to the column itself. The attribute names can now be differently named when using this parameter. .. change:: :tags: bug, orm :tickets: 9373 Added support for the :paramref:`_orm.Mapper.polymorphic_load` parameter to be applied to each mapper in an inheritance hierarchy more than one level deep, allowing columns to load for all classes in the hierarchy that indicate ``&quot;selectin&quot;`` using a single statement, rather than ignoring elements on those intermediary classes that nonetheless indicate they also would participate in ``&quot;selectin&quot;`` loading and were not part of the base-most SELECT statement. .. change:: :tags: bug, orm :tickets: 8853, 9335 Continued the fix for :ticket:`8853`, allowing the :class:`_orm.Mapped` name to be fully qualified regardless of whether or not ``from __annotations__ import future`` were present. This issue first fixed in 2.0.0b3 confirmed that this case worked via the test suite, however the test suite apparently was not testing the behavior for the name :class:`_orm.Mapped` not being locally present at all; string resolution has been updated to ensure the :class:`_orm.Mapped` symbol is locatable as applies to how the ORM uses these functions. .. change:: :tags: bug, typing :tickets: 9340 Fixed typing issue where :func:`_orm.with_polymorphic` would not record the class type correctly. .. change:: :tags: bug, ext, regression :tickets: 9380 Fixed regression caused by typing added to ``sqlalchemy.ext.mutable`` for :ticket:`8667`, where the semantics of the ``.pop()`` method changed such that the method was non-working. Pull request courtesy Nils Philippsen. .. change:: :tags: bug, sql, regression :tickets: 9390 Restore the :func:`.nullslast` and :func:`.nullsfirst` legacy functions into the ``sqlalchemy`` import namespace. Previously, the newer :func:`.nulls_last` and :func:`.nulls_first` functions were available, but the legacy ones were inadvertently removed. .. change:: :tags: bug, postgresql :tickets: 9401 Fixed issue where the PostgreSQL :class:`_postgresql.ExcludeConstraint` construct would not be copyable within operations such as :meth:`_schema.Table.to_metadata` as well as within some Alembic scenarios, if the constraint contained textual expression elements. .. change:: :tags: bug, engine :tickets: 9423 Fixed bug where :class:`_engine.Row` objects could not be reliably unpickled across processes due to an accidental reliance on an unstable hash value. .. changelog:: ``` ### 2.0.4 ``` :released: February 17, 2023 .. change:: :tags: bug, orm, regression :tickets: 9273 Fixed regression introduced in version 2.0.2 due to :ticket:`9217` where using DML RETURNING statements, as well as :meth:`_sql.Select.from_statement` constructs as was &quot;fixed&quot; in :ticket:`9217`, in conjunction with ORM mapped classes that used expressions such as with :func:`_orm.column_property`, would lead to an internal error within Core where it would attempt to match the expression by name. The fix repairs the Core issue, and also adjusts the fix in :ticket:`9217` to not take effect for the DML RETURNING use case, where it adds unnecessary overhead. .. change:: :tags: usecase, typing :tickets: 9321 Improved the typing support for the :ref:`hybrids_toplevel` extension, updated all documentation to use ORM Annotated Declarative mappings, and added a new modifier called :attr:`.hybrid_property.inplace`. This modifier provides a way to alter the state of a :class:`.hybrid_property` **in place**, which is essentially what very early versions of hybrids did, before SQLAlchemy version 1.2.0 :ticket:`3912` changed this to remove in-place mutation. This in-place mutation is now restored on an **opt-in** basis to allow a single hybrid to have multiple methods set up, without the need to name all the methods the same and without the need to carefully &quot;chain&quot; differently-named methods in order to maintain the composition. Typing tools such as Mypy and Pyright do not allow same-named methods on a class, so with this change a succinct method of setting up hybrids with typing support is restored. .. seealso:: :ref:`hybrid_pep484_naming` .. change:: :tags: bug, orm Marked the internal ``EvaluatorCompiler`` module as private to the ORM, and renamed it to ``_EvaluatorCompiler``. For users that may have been relying upon this, the name ``EvaluatorCompiler`` is still present, however this use is not supported and will be removed in a future release. .. change:: :tags: orm, use_case :tickets: 9297 To accommodate a change in column ordering used by ORM Declarative in SQLAlchemy 2.0, a new parameter :paramref:`_orm.mapped_column.sort_order` has been added that can be used to control the order of the columns defined in the table by the ORM, for common use cases such as mixins with primary key columns that should appear first in tables. The change notes at :ref:`change_9297` illustrate the default change in ordering behavior (which is part of all SQLAlchemy 2.0 releases) as well as use of the :paramref:`_orm.mapped_column.sort_order` to control column ordering when using mixins and multiple classes (new in 2.0.4). .. seealso:: :ref:`change_9297` .. change:: :tags: sql :tickets: 9277 Added public property :attr:`_schema.Table.autoincrement_column` that returns the column identified as autoincrementing in the column. .. change:: :tags: oracle, bug :tickets: 9295 Adjusted the behavior of the ``thick_mode`` parameter for the :ref:`oracledb` dialect to correctly accept ``False`` as a value. Previously, only ``None`` would indicate that thick mode should be disabled. .. change:: :tags: usecase, orm :tickets: 9298 The :meth:`_orm.Session.refresh` method will now immediately load a relationship-bound attribute that is explicitly named within the :paramref:`_orm.Session.refresh.attribute_names` collection even if it is currently linked to the &quot;select&quot; loader, which normally is a &quot;lazy&quot; loader that does not fire off during a refresh. The &quot;lazy loader&quot; strategy will now detect that the operation is specifically a user-initiated :meth:`_orm.Session.refresh` operation which named this attribute explicitly, and will then call upon the &quot;immediateload&quot; strategy to actually emit SQL to load the attribute. This should be helpful in particular for some asyncio situations where the loading of an unloaded lazy-loaded attribute must be forced, without using the actual lazy-loading attribute pattern not supported in asyncio. .. change:: :tags: bug, sql :tickets: 9313 Fixed issue where element types of a tuple value would be hardcoded to take on the types from a compared-to tuple, when the comparison were using the :meth:`.ColumnOperators.in_` operator. This was inconsistent with the usual way that types are determined for a binary expression, which is that the actual element type on the right side is considered first before applying the left-hand-side type. .. change:: :tags: usecase, orm declarative :tickets: 9266 Added new parameter ``dataclasses_callable`` to both the :class:`_orm.MappedAsDataclass` class as well as the :meth:`_orm.registry.mapped_as_dataclass` method which allows an alternative callable to Python ``dataclasses.dataclass`` to be used in order to produce dataclasses. The use case here is to drop in Pydantic&#x27;s dataclass function instead. Adjustments have been made to the mixin support added for :ticket:`9179` in version 2.0.1 so that the ``__annotations__`` collection of the mixin is rewritten to not include the :class:`_orm.Mapped` container, in the same way as occurs with mapped classes, so that the Pydantic dataclasses constructor is not exposed to unknown types. .. seealso:: :ref:`dataclasses_pydantic` .. changelog:: ``` ### 2.0.3 ``` :released: February 9, 2023 .. change:: :tags: typing, bug :tickets: 9254 Remove ``typing.Self`` workaround, now using :pep:`673` for most methods that return ``Self``. As a consequence of this change ``mypy&gt;=1.0.0`` is now required to type check SQLAlchemy code. Pull request courtesy Yurii Karabas. .. change:: :tags: bug, sql, regression :tickets: 9271 Fixed critical regression in SQL expression formulation in the 2.0 series due to :ticket:`7744` which improved support for SQL expressions that contained many elements against the same operator repeatedly; parenthesis grouping would be lost with expression elements beyond the first two elements. .. changelog:: ``` ### 2.0.2 ``` :released: February 6, 2023 .. change:: :tags: bug, orm declarative :tickets: 9249 Fixed regression caused by the fix for :ticket:`9171`, which itself was fixing a regression, involving the mechanics of ``__init__()`` on classes that extend from :class:`_orm.DeclarativeBase`. The change made it such that ``__init__()`` was applied to the user-defined base if there were no ``__init__()`` method directly on the class. This has been adjusted so that ``__init__()`` is applied only if no other class in the hierarchy of the user-defined base has an ``__init__()`` method. This again allows user-defined base classes based on :class:`_orm.DeclarativeBase` to include mixins that themselves include a custom ``__init__()`` method. .. change:: :tags: bug, mysql, regression :tickets: 9251 Fixed regression caused by issue :ticket:`9058` which adjusted the MySQL dialect&#x27;s ``has_table()`` to again use &quot;DESCRIBE&quot;, where the specific error code raised by MySQL version 8 when using a non-existent schema name was unexpected and failed to be interpreted as a boolean result. .. change:: :tags: bug, sqlite :tickets: 9251 Fixed the SQLite dialect&#x27;s ``has_table()`` function to correctly report False for queries that include a non-None schema name for a schema that doesn&#x27;t exist; previously, a database error was raised. .. change:: :tags: bug, orm declarative :tickets: 9226 Fixed issue in ORM Declarative Dataclass mappings related to newly added support for mixins added in 2.0.1 via :ticket:`9179`, where a combination of using mixins plus ORM inheritance would mis-classify fields in some cases leading to field-level dataclass arguments such as ``init=False`` being lost. .. change:: :tags: bug, orm, ression :tickets: 9232 Fixed obscure ORM inheritance issue caused by :ticket:`8705` where some scenarios of inheriting mappers that indicated groups of columns from the local table and the inheriting table together under a :func:`_orm.column_property` would nonetheless warn that properties of the same name were being combined implicitly. .. change:: :tags: orm, bug, regression :tickets: 9228 Fixed regression where using the :paramref:`_orm.Mapper.version_id_col` feature with a regular Python-side incrementing column would fail to work for SQLite and other databases that don&#x27;t support &quot;rowcount&quot; with &quot;RETURNING&quot;, as &quot;RETURNING&quot; would be assumed for such columns even though that&#x27;s not what actually takes place. .. change:: :tags: bug, orm declarative :tickets: 9240 Repaired ORM Declarative mappings to allow for the :paramref:`_orm.Mapper.primary_key` parameter to be specified within ``__mapper_args__`` when using :func:`_orm.mapped_column`. Despite this usage being directly in the 2.0 documentation, the :class:`_orm.Mapper` was not accepting the :func:`_orm.mapped_column` construct in this context. Ths feature was already working for the :paramref:`_orm.Mapper.version_id_col` and :paramref:`_orm.Mapper.polymorphic_on` parameters. As part of this change, the ``__mapper_args__`` attribute may be specified without using :func:`_orm.declared_attr` on a non-mapped mixin class, including a ``&quot;primary_key&quot;`` entry that refers to :class:`_schema.Column` or :func:`_orm.mapped_column` objects locally present on the mixin; Declarative will also translate these columns into the correct ones for a particular mapped class. This again was working already for the :paramref:`_orm.Mapper.version_id_col` and :paramref:`_orm.Mapper.polymorphic_on` parameters. Additionally, elements within ``&quot;primary_key&quot;`` may be indicated as string names of existing mapped properties. .. change:: :tags: usecase, sql :tickets: 8780 Added a full suite of new SQL bitwise operators, for performing database-side bitwise expressions on appropriate data values such as integers, bit-strings, and similar. Pull request courtesy Yegor Statkevich. .. seealso:: :ref:`operators_bitwise` .. change:: :tags: bug, orm declarative :tickets: 9211 An explicit error is raised if a mapping attempts to mix the use of :class:`_orm.MappedAsDataclass` with :meth:`_orm.registry.mapped_as_dataclass` within the same class hierarchy, as this produces issues with the dataclass function being applied at the wrong time to the mapped class, leading to errors during the mapping process. .. change:: :tags: bug, orm, regression :tickets: 9217 Fixed regression when using :meth:`_sql.Select.from_statement` in an ORM context, where matching of columns to SQL labels based on name alone was disabled for ORM-statements that weren&#x27;t fully textual. This would prevent arbitrary SQL expressions with column-name labels from matching up to the entity to be loaded, which previously would work within the 1.4 and previous series, so the previous behavior has been restored. .. change:: :tags: bug, asyncio :tickets: 9237 Repaired a regression caused by the fix for :ticket:`8419` which caused asyncpg connections to be reset (i.e. transaction ``rollback()`` called) and returned to the pool normally in the case that the connection were not explicitly returned to the connection pool and was instead being --- _{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

kerem 2026-02-26 01:34:02 +03:00

• closed this issue
• added the
  pull-request
  label

kerem referenced this issue 2026-02-26 01:34:04 +03:00

[PR #325] [CLOSED] Scheduled weekly dependency update for week 24 #333

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

master

pyup-scheduled-update-2026-04-20

pyup-scheduled-update-2024-09-16

pyup-scheduled-update-2023-07-24

pyup-scheduled-update-2023-06-19

pyup-scheduled-update-2023-05-22

pyup-scheduled-update-2023-05-15

pyup-scheduled-update-2023-05-08

dependabot/pip/flask-2.3.2

pyup-scheduled-update-2023-05-01

pyup-scheduled-update-2023-04-03

dependabot/pip/werkzeug-2.2.3

pyup-scheduled-update-2022-11-14

pyup-scheduled-update-2022-10-03

pyup-scheduled-update-2022-08-01

pyup-scheduled-update-2022-06-13

pyup-scheduled-update-2022-05-30

pyup-scheduled-update-2022-03-07

pyup-scheduled-update-2022-01-10

pyup-scheduled-update-2021-11-01

pyup-scheduled-update-2020-10-05

pyup-scheduled-update-2019-09-30

pyup-scheduled-update-2019-07-29

pyup-scheduled-update-2019-07-22

pyup-scheduled-update-2019-05-27

pyup-scheduled-update-2019-03-11

marshmallow

pyup-scheduled-update-2019-02-25

pyup-scheduled-update-2019-02-18

pyup-scheduled-update-2019-01-28

pyup-scheduled-update-2019-01-14

docker

name-map-stupid

swagger

fix-pagination

doc-expansion

specify-schema

No results found.

Labels

Clear labels   

bug

  

duplicate

  

enhancement

  

help wanted

  

invalid

  

pull-request

Mirrored from GitHub Pull Request

  

question

  

refactoring

  

research

  

wontfix

No labels

bug

duplicate

enhancement

help wanted

invalid

pull-request

question

refactoring

research

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/sandman2-jeffknupp#325

No description provided.