Bump sqlalchemy from 2.0.36 to 2.0.37

[dependabot]

Bumps sqlalchemy from 2.0.36 to 2.0.37.

Release notes

Sourced from sqlalchemy's releases.

2.0.37

Released: January 9, 2025

orm

• [orm] [bug] Fixed issue regarding Union types that would be present in the _orm.registry.type_annotation_map of a _orm.registry or declarative base class, where a Mapped element that included one of the subtypes present in that Union would be matched to that entry, potentially ignoring other entries that matched exactly. The correct behavior now takes place such that an entry should only match in _orm.registry.type_annotation_map exactly, as a Union type is a self-contained type. For example, an attribute with Mapped[float] would previously match to a _orm.registry.type_annotation_map entry Union[float, Decimal]; this will no longer match and will now only match to an entry that states float. Pull request courtesy Frazer McLean.

  References: #11370

• [orm] [bug] Fixed bug in how type unions were handled within _orm.registry.type_annotation_map as well as _orm.Mapped that made the lookup behavior of a | b different from that of Union[a, b].

  References: #11944

• [orm] [bug] Consistently handle TypeAliasType (defined in PEP 695) obtained with the type X = int syntax introduced in python 3.12. Now in all cases one such alias must be explicitly added to the type map for it to be usable inside Mapped. This change also revises the approach added in #11305, now requiring the TypeAliasType to be added to the type map. Documentation on how unions and type alias types are handled by SQLAlchemy has been added in the orm_declarative_mapped_column_type_map section of the documentation.

  References: #11955

• [orm] [bug] Fixed regression caused by an internal code change in response to recent Mypy releases that caused the very unusual case of a list of ORM-mapped attribute expressions passed to ColumnOperators.in_() to no longer be accepted.

  References: #12019

• [orm] [bug] Fixed issues in type handling within the _orm.registry.type_annotation_map feature which prevented the use of unions, using either pep-604 or Union syntaxes under future

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dryrunsecurity]

DryRun Security Summary

The code change involves updating the SQLAlchemy dependency from version 2.0.36 to 2.0.37 in the DefectDojo application's requirements.txt file, which is crucial for maintaining the application's security and dependency management.

Expand for full summary

Summary:

The provided code change is an update to the requirements.txt file for the DefectDojo application, which is a security tool for tracking and managing software vulnerabilities. The key change is a minor version update to the sqlalchemy dependency, from version 2.0.36 to 2.0.37. This type of update is likely to address bug fixes or minor improvements to the library.

The requirements.txt file is an important part of the application's security posture, as it defines the external dependencies and their versions used by the application. Keeping these dependencies up-to-date is crucial to ensure that known security vulnerabilities in the dependencies are addressed. The contents of the requirements.txt file also provide insight into the technologies and libraries used by the DefectDojo application, which include security-related features like audit logging, database backup, and cryptography. It's important to ensure that all of these dependencies are kept up-to-date and that any known security vulnerabilities are addressed in a timely manner.

Files Changed:

• requirements.txt: The requirements.txt file has been updated to include a minor version update to the sqlalchemy dependency, from version 2.0.36 to 2.0.37. This file defines the external dependencies and their versions used by the DefectDojo application, and it's an important part of the application's security posture.

Code Analysis

We ran 9 analyzers against 1 file and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding

View PR in the DryRun Dashboard.