Bump the patch-updates group in /stats-entities with 2 updates

[dependabot]

Bumps the patch-updates group in /stats-entities with 2 updates: sqlalchemy and ruff.

Updates sqlalchemy from 2.0.49 to 2.0.51

Release notes

Sourced from sqlalchemy's releases.

2.0.51

Released: June 15, 2026

orm

• [orm] [bug] Fixed issue where _orm.subqueryload() combined with PropComparator.of_type() and PropComparator.and_() would silently drop the additional filter criteria, causing all related objects to be loaded instead of only those matching the filter. The LoaderCriteriaOption was being constructed against the base entity rather than the effective entity indicated by PropComparator.of_type(). Pull request courtesy Arya Rizky.

  References: #13207

• [orm] [bug] Fixed bug where a failure during tpc_prepare() within _orm.Session.commit() for a two-phase session would raise IllegalStateChangeError instead of the original database exception. The internal _prepare_impl() method's error handler was unable to invoke _orm.SessionTransaction.rollback() due to a state-change guard, preventing proper cleanup and masking the underlying error.

  References: #13356

engine

• [engine] [bug] Fixed issue where Result.freeze() would lose track of ambiguous column names present in the original CursorResult, causing key-based access on the thawed result to silently return a value instead of raising InvalidRequestError. The SimpleResultMetaData now accepts and propagates ambiguous key information so that frozen, thawed, and pickled results raise consistently for duplicate column names. Pull request courtesy Saurabh Kohli.

  References: #9427

sql

• [sql] [bug] Fixed issue where _sql.StatementLambdaElement would proxy attribute access through the cached "expected" expression rather than the resolved expression, causing stale closure-bound parameter values to be used when a lambda statement was extended with non-lambda criteria such as an additional .where() clause. Courtesy cjc0013.

  References: #10827

... (truncated)

Commits

• See full diff in compare view

Updates ruff from 0.15.11 to 0.15.22

Release notes

Sourced from ruff's releases.

0.15.22

Release Notes

Released on 2026-07-16.

Preview features

• [pycodestyle] Add an autofix for E402 (#22212)
• [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
• [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
• [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
• [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

• [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

• [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

• Avoid redundant lexer token bookkeeping (#26765)
• Avoid redundant pending-indentation writes (#26774)
• Avoid unnecessary identifier lookahead (#26525)
• Reuse parser scratch buffers (#26798)

Documentation

• Document argfile support (#26803)
• [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
• [pycodestyle] Document E731 fix safety (#26847)
• [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

• @​dwego
• @​MichaReiser
• @​Joosboy
• @​KaufmanDmitriy
• @​PeterJCLaw
• @​ntBre
• @​charliermarsh

Install ruff 0.15.22

Install prebuilt binaries via shell script

</tr></table> 

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.22

Released on 2026-07-16.

Preview features

• [pycodestyle] Add an autofix for E402 (#22212)
• [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
• [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
• [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
• [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

• [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

• [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

• Avoid redundant lexer token bookkeeping (#26765)
• Avoid redundant pending-indentation writes (#26774)
• Avoid unnecessary identifier lookahead (#26525)
• Reuse parser scratch buffers (#26798)

Documentation

• Document argfile support (#26803)
• [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
• [pycodestyle] Document E731 fix safety (#26847)
• [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

• @​dwego
• @​MichaReiser
• @​Joosboy
• @​KaufmanDmitriy
• @​PeterJCLaw
• @​ntBre
• @​charliermarsh

0.15.21

Released on 2026-07-09.

Preview features

... (truncated)

Commits

• 0177a7e Bump 0.15.22 (#26884)
• fe8ba85 [pycodestyle] Document E731 fix safety (#26847)
• f3cf7c8 [ruff] Add rule-codes-in-selectors (RUF201) (#26772)
• d244fd7 Document argfile support (#26803)
• f239758 [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)
• 54acbcd [ty] Support TypeVarTuple and Unpack (#25240)
• 87fc38c [ty] Parallelize subtype hierarchy search (#26875)
• e454f91 [ty] Share interned query keys across Salsa queries (#26794)
• 6f361a7 [ty] only collect expected types for files open in the editor (#25546)
• 6d6b2b3 [ty] Avoid allocations during Salsa interned lookups (#26877)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions