deps(deps): bump the database group with 2 updates

[dependabot]

Bumps the database group with 2 updates: sqlalchemy and pymysql.

Updates sqlalchemy from 2.0.49 to 2.0.51

Release notes

Sourced from sqlalchemy's releases.

2.0.51

Released: June 15, 2026

orm

• [orm] [bug] Fixed issue where _orm.subqueryload() combined with PropComparator.of_type() and PropComparator.and_() would silently drop the additional filter criteria, causing all related objects to be loaded instead of only those matching the filter. The LoaderCriteriaOption was being constructed against the base entity rather than the effective entity indicated by PropComparator.of_type(). Pull request courtesy Arya Rizky.

  References: #13207

• [orm] [bug] Fixed bug where a failure during tpc_prepare() within _orm.Session.commit() for a two-phase session would raise IllegalStateChangeError instead of the original database exception. The internal _prepare_impl() method's error handler was unable to invoke _orm.SessionTransaction.rollback() due to a state-change guard, preventing proper cleanup and masking the underlying error.

  References: #13356

engine

• [engine] [bug] Fixed issue where Result.freeze() would lose track of ambiguous column names present in the original CursorResult, causing key-based access on the thawed result to silently return a value instead of raising InvalidRequestError. The SimpleResultMetaData now accepts and propagates ambiguous key information so that frozen, thawed, and pickled results raise consistently for duplicate column names. Pull request courtesy Saurabh Kohli.

  References: #9427

sql

• [sql] [bug] Fixed issue where _sql.StatementLambdaElement would proxy attribute access through the cached "expected" expression rather than the resolved expression, causing stale closure-bound parameter values to be used when a lambda statement was extended with non-lambda criteria such as an additional .where() clause. Courtesy cjc0013.

  References: #10827

... (truncated)

Commits

• See full diff in compare view

Updates pymysql from 1.1.3 to 1.2.0

Release notes

Sourced from pymysql's releases.

v1.2.0

What's Changed

• Bump the all-dependencies group with 2 updates by @​dependabot[bot] in PyMySQL/PyMySQL#1232
• Reorganize TLS options: implement PREFERRED/REQUIRED SSL mode behavior by @​Copilot in PyMySQL/PyMySQL#1234
• Support MySQL 8 row/column alias syntax in executemany INSERT regex by @​Copilot in PyMySQL/PyMySQL#1235
• Expose SQLSTATE on MySQL protocol exceptions without changing exception formatting by @​Copilot in PyMySQL/PyMySQL#1236
• Reject non-finite decimal.Decimal query parameters (NaN, sNaN, ±Infinity) by @​Copilot in PyMySQL/PyMySQL#1237
• docs: update outdated requirements and reference links by @​Copilot in PyMySQL/PyMySQL#1239
• Prepare CHANGELOG for v1.2.0 release from v1.1.3 changes by @​Copilot in PyMySQL/PyMySQL#1238
• deprecate db and passwd again by @​methane in PyMySQL/PyMySQL#1240
• deprecate reconnect in Connection.ping() by @​methane in PyMySQL/PyMySQL#1241
• Deprecate Connection.set_charset() at runtime and document warning behavior by @​Copilot in PyMySQL/PyMySQL#1243
• Release v1.2.0 by @​methane in PyMySQL/PyMySQL#1244

New Contributors

• @​Copilot made their first contribution in PyMySQL/PyMySQL#1234

Full Changelog: PyMySQL/PyMySQL@v1.1.3...v1.2.0

Changelog

Sourced from pymysql's changelog.

v1.2.0

Release date: 2026-05-19

Breaking changes

• Connection.ping() change the default to not reconnect and deprecate reconnect argument. Create a new connection if you want to reconnect. (#1241)

• Error classes in Cursor class are removed. (#1240)

• connect() arguments db and passwd now emit DeprecationWarning. Use database and password instead. (#1240)

• Reorganize TLS connection behavior.

  • PyMySQL uses TLS by default when server supports it. Use ssl_disabled=True to prohibit SSL. (#1213)

  • When ssl_verify_cert=True, ssl_verify_identity=True, an ssl.SSLContext is passed, or when any other SSL option is configured, the connection requires SSL and raises OperationalError (CR_SSL_CONNECTION_ERROR) if the server doesn't support it. (#1234)

Other changes

• Support MySQL 8 row/column alias syntax in executemany INSERT regex. (#1235)
• Expose SQLSTATE on MySQL protocol exceptions without changing exception formatting. (#1236)
• Reject non-finite decimal.Decimal query parameters (NaN, sNaN, ±Infinity). (#1237)
• Connection.set_charset(charset) now emits DeprecationWarning.

Commits

• 0f1c324 use ubuntu-latest for pypi publishing
• 53b16b2 Release v1.2.0 (#1244)
• 637fe7e Deprecate Connection.set_charset() at runtime and document warning behavior...
• 23ca04a add AGENTS.md
• 7349a44 deprecate reconnect in Connection.ping() (#1241)
• ad5c50c update CHANGELOG
• c963edb Deprecation and removals (#1240)
• af6b9b4 Prepare CHANGELOG for v1.2.0 release from v1.1.3 changes (#1238)
• c7bf73f docs: update outdated requirements and reference links (#1239)
• c532b8d Reject non-finite decimal.Decimal query parameters (NaN, sNaN, `±Infini...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions