[dependabot]

Updates the requirements on sqlalchemy to permit the latest version.

Release notes

Sourced from sqlalchemy's releases.

2.1.5

Released: October 16, 2026

orm

• [orm] [feature] Added the _orm.Unmapped annotation and the _orm.unmapped_column() construct, providing a declarative-compatible approach to having "excluded" columns in a Declarative model, that is, columns that are part of the _schema.Table but are not mapped, replacing the use of _orm.Mapper.exclude_properties for this purpose when using a Declarative mapping.

  References: #13650

• [orm] [bug] [regression] Fixed regression caused by #11917 in version 2.0.36 where an ORM enabled _sql.update() using WHERE criteria which matched more than one object present in the _orm.Session would expire server-side onupdate columns, as well as columns that were SET to a SQL expression, on only one of the matched objects, leaving the remaining objects with stale values for those attributes. The columns are now expired for all matched objects.

  This change is also backported to: 2.0.55

  References: #13675

• [orm] [deprecated] Using the _orm.Mapper.exclude_properties or _orm.Mapper.include_properties parameters on a Declarative mapping to exclude attributes that are declared on the class, such as with _orm.mapped_column(), is deprecated and now emits a deprecation warning. This use was never supported, and depending on the arguments passed to _orm.mapped_column(), the attribute could remain mapped regardless; in particular, as of 2.1 this includes ORM mapped dataclasses where _orm.mapped_column.default is present. The new _orm.unmapped_column() construct should be used instead. Excluding columns that are present only in the _schema.Table, such as those from __table__, __table_args__ or table reflection, is not affected.

  References: #13650

schema

• [schema] [bug] Fixed issue where dialect-specific keyword arguments established on a ForeignKeyConstraint, ForeignKey or CheckConstraint, such as postgresql_not_valid, were not carried along to the copy of the constraint produced by

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
regengine	Ignored	Preview	Oct 28, 2026 4:31am UTC

[github-actions]

Regenerated requirements.lock with CI's toolchain (pip 24.3.1, pip-tools 7.5.2, Python 3.11), pinned to the versions this PR proposes. Backend CI and security were re-dispatched on the new head — wait for them to go green before merging.

[github-actions]

PR Blocker Checklist

Head SHA: bcd45196f09c8d1896d45517e0021297e154ebdc

Status: Ready

• All review threads resolved
• No reviews requesting changes
• No blocked review engines

[PetrefiedThunder]

The exact SQLAlchemy patch update is preserved in replacement #3655 at fe2c075, on a supported codex/ author branch. The engine-review policy is unchanged. All 72 hashes match PyPI, 17 focused tests pass using actual 2.1.5, and independent Muse PASS is recorded there. This original PR remains open until replacement CI and merge complete.

[PetrefiedThunder]

REVIEW: PASS hermes bcd4519

Read the full diff at this head: sqlalchemy 2.1.4 to 2.1.5 plus the authlib>=1.9.1 / dnspython>=2.9.0 CVE floor bump, with requirements.lock regenerated and hashed. All CI checks pass except Engine Review Pass (fails on the Dependabot branch prefix, not code) and the Head SHA Check Guard / PR Blocker Checklist runs, which were cancelled by workflow concurrency rather than failing a step.

• SQLAlchemy 2.1.5 (released 2026-10-16): a new Unmapped / unmapped_column() feature, a fix for an ORM bulk update() regression that left stale onupdate values on matched objects, and a deprecation of Mapper.exclude_properties / include_properties on Declarative mappings. Code search finds no use of exclude_properties or include_properties in the repo, so there's no new warning or behavior change for us. Tenant isolation, RLS and the seeded migration rehearsals are all green.
• authlib 1.9.x: security hardening (JOSE key/scope/audience, nonce/JAR validation). It's declared in requirements.in with no direct imports found. dnspython 2.9.0 fixes GHSA-45c3-73f7-pv4m and needs Python >= 3.11, which matches the lock's Python 3.11.