chore(deps-dev): update clickhouse-connect requirement from <2.0,>=1.6.0 to >=1.7.1,<2.0

[dependabot]

Updates the requirements on clickhouse-connect to permit the latest version.

Release notes

Sourced from clickhouse-connect's releases.

v1.7.1

clickhouse-connect v1.7.1

This is a patch release with two SQLAlchemy compatibility fixes.

What's Changed

Bug Fixes

• SQLAlchemy 2.1 compatibility: Identifier quoting forwarded the deprecated force argument to IdentifierPreparer.quote, which SQLAlchemy 2.1 removed, causing any dialect use to raise TypeError on 2.1.0b3. The parent call now passes only the identifier. The optional force parameter remains available on the ClickHouse preparer for direct callers. Closes #954.
• SQLAlchemy 1.4 compatibility: Column DDL using the clickhouse_materialized, clickhouse_alias, or clickhouse_ttl options raised AttributeError on SQLAlchemy 1.4 because it called a rendering helper that only exists in 2.0. The helper is now implemented locally. This appears to have been broken since 1.1.0.

Full Changelog: ClickHouse/clickhouse-connect@v1.7.0...v1.7.1

Installation

pip install clickhouse-connect

Changelog

Sourced from clickhouse-connect's changelog.

1.7.1, 2026-08-12

Bug Fixes

• SQLAlchemy 2.1 compatibility. Identifier quoting forwarded the deprecated force argument to IdentifierPreparer.quote, which SQLAlchemy 2.1 removed, so any dialect use raised TypeError on 2.1.0b3. The parent call now passes only the identifier. The optional force parameter stays on the ClickHouse preparer for direct callers. Closes #954.
• SQLAlchemy 1.4 compatibility. Column DDL using the clickhouse_materialized, clickhouse_alias, or clickhouse_ttl options raised AttributeError on SQLAlchemy 1.4 because it called a rendering helper that only exists in 2.0. The helper is now implemented locally. This appears to have been broken since 1.1.0.

1.7.0, 2026-08-11

Improvements

• SQLAlchemy JSON columns now support storage-backed subcolumn access with column["segment"], column.subcolumn("segment", type_=...), and the statically typed json_subcolumn(...) helper. Nested paths compile as independently quoted dotted identifiers, and typed access uses CAST. Closes #899.
• show_clickhouse_errors now accepts "scrub" in addition to True/False. Scrub mode keeps the SQL exception text and symbolic name (for example UNKNOWN_TABLE) while stripping the server URL and trailing (version ...) trailer from client exception messages. Transport errors and mid-stream StreamFailureError messages honor the same setting. When error detail is disabled (False), the displayed exception string is generic. The chDB backend now uses the same generic text as HTTP, without its former trailing period. This setting governs str(exc) only. Transport errors remain attached as __cause__, so tracebacks can still contain the original host, URL, or library error text. Historical string booleans still work, but non-boolean values such as integers and unrecognized strings now raise ProgrammingError. Addresses the middle ground requested in #344.
• SQLAlchemy: added support for materialized common table expressions. cc_sqlalchemy.select(...).cte("name", materialized=True) emits WITH name AS MATERIALIZED (...), so a CTE referenced more than once is computed once instead of being inlined and re-executed at each reference. A module-level cc_sqlalchemy.cte(statement, "name", materialized=True) does the same for a statement built with the standard sqlalchemy.select. The keyword renders only on the ClickHouse dialect. The server materializes the CTE only when the experimental enable_materialized_cte setting is also enabled for the query and the analyzer is enabled. Materialized CTEs require ClickHouse 26.3 or later. The SQLAlchemy helpers reject recursive=True with materialized=True because ClickHouse does not support recursive materialized CTEs. Closes #900.
• Added the global naive_datetime_insert setting for Python object inserts, including naive ISO strings accepted by DateTime64. Set it to "server" to interpret a naive datetime in the timezone declared by the DateTime or DateTime64 column, or in the server timezone when the column has no timezone. The default remains "local" in 1.x and preserves the existing host-local conversion. This setting does not change datetime64-dtype NumPy and Pandas columns. Use naive_datetime_binding to control naive datetime query parameters. See #938.

Behavior Changes

• Removed runtime compatibility branches for unsupported ClickHouse server versions older than 25.8. Client initialization no longer substitutes the common.readonly value for servers older than 19.17 and always attempts guarded Native protocol negotiation, retaining the existing proxy-safe fallback. JSON inserts no longer fall back to String serialization for 24.8 and 24.9 servers. The module attribute clickhouse_connect.datatypes.dynamic.json_serialization_format remains importable for compatibility but assigning it no longer changes insert behavior. The generated cast_string_to_dynamic_use_inference default no longer depends on the obsolete allow_experimental_json_type setting. The global common.readonly option is deprecated and retained as a no-op. The default local Docker server is now ClickHouse 25.8.
• datetime.time and datetime.timedelta query parameters are now rendered as quoted literals. A time value was previously rendered without quotes and the server rejected it, so some queries added the quotes in the query text as a workaround, for example WHERE t = '%(t)s'. Those queries now produce a doubled quote and fail. Remove the manual quotes and bind the value normally. See #919.
• Naive datetime query parameters now bind as wall time instead of being interpreted in the client host timezone. Previously a naive value passed through astimezone for server-side {name:DateTime} parameters and DT64Param values, so the same query could match different rows depending on the timezone of the machine running it. Only workloads that bind naive datetime parameters with a non-UTC host timezone or a non-UTC target timezone are affected. Environments where both the host and the bind target are UTC see no change, and client-side % parameters against a UTC server were already sent verbatim. Two changes are observable. First, on a non-UTC host with a UTC target, server-side parameters and DT64Param values no longer shift, which corrects silently wrong results. Second, when the bind target is a non-UTC timezone, a naive value now means wall time in that timezone instead of the instant implied by the client local timezone, which can change matched rows for code that relied on the old conversion. A related consequence is that inserting a naive datetime and then filtering with the same naive value no longer matches on a non-UTC host, because the insert path still interprets naive values as host local time. #938 tracks unifying insert semantics. Timezone-aware datetimes are unchanged and still convert to the target bind timezone. Set common.set_setting("naive_datetime_binding", "legacy") to restore the previous behavior exactly. To make a naive value represent a specific instant under either mode, attach the intended tzinfo before binding.

Bug Fixes

• SQLAlchemy identifiers containing % now compile safely in statements with bound parameters. The DB-API bulk INSERT path also restores escaped percent signs in table and column names, so executemany keeps using one bulk insert instead of falling back to row-by-row execution or sending the wrong identifier. This includes %2E JSON key encodings used with json_type_escape_dots_in_keys.
• datetime.time and datetime.timedelta query parameters now bind as a quoted HH:MM:SS[.ffffff] literal for Time and Time64 columns. This fixes client-side %(name)s binding, timezone-aware time values, timedelta values, and values nested in arrays and tuples. A naive scalar time at the top level of a server-side {name:Time} bind already worked and is unchanged. A timedelta may be negative and may exceed 24 hours, and a pandas Timedelta with sub-microsecond nanoseconds formats a nine digit fraction. Plain Time accepts only whole seconds. Addresses the Time parameter failure in #919.
• SQLAlchemy: Time and Time64 columns now accept datetime.time and datetime.timedelta values in inserts and comparisons, and render correctly with literal_binds. The types inherit from the SQLAlchemy Interval type, which converted every bound value to an epoch datetime that the server rejected and coerced comparison values to its DateTime implementation. Reads still return timedelta. Part of #919.
• DB API module now provides the PEP 249 type constructors Binary, Date, Time, Timestamp, DateFromTicks, TimeFromTicks, and TimestampFromTicks. SQLAlchemy LargeBinary inserts no longer raise AttributeError. Addresses the Binary constructor failure in #919.
• Fractional DateTime64 values before the Unix epoch now serialize with the correct second. The serializer truncated negative timestamps toward zero before adding the fractional component, which shifted affected values forward by one second. This affected Python datetime values and accepted ISO strings in both naive datetime insert modes. See #938.
• Parsing a nested Variant, Tuple, Nested, or typed JSON column type whose element is an Enum with an escaped single quote in a value name no longer corrupts the escape sequence and fails while re-parsing the element type. Closes #878.
• None nested inside an Array or Tuple, or inside a Map when dict_parameter_format="map", now renders as the SQL NULL keyword instead of the \N sentinel used for top-level values. Top-level scalar None binds are unchanged. Closes #879.
• Inserting empty bytes b"" into a non-nullable FixedString(N) column now zero-pads to N bytes instead of raising DataError, matching the existing string and nullable-bytes write paths. Closes #880.
• Per-query and client settings that are not present in system.settings for the current user (including custom settings declared CHANGEABLE_IN_READONLY on a role) are now forwarded to ClickHouse instead of raising ProgrammingError: Setting ... is unknown or readonly. The client cannot discover those settings without extra privileges, so the server is treated as authoritative. Setting invalid_setting_action to drop still drops them, so a single settings dict stays portable across server versions. Known readonly settings still honor invalid_setting_action, and reserved HTTP request parameter names such as query, user, default_format, and the param_ bound-parameter namespace still raise a client-side ProgrammingError because they are not settings. Closes #530.
• SQLAlchemy reflection and metadata queries now force internal String decoding, so set_default_formats("String", "bytes") no longer turns reflected database, table, or column names into bytes. The Alembic startup current database lookup uses the same internal format. Alembic version table queries do not use the internal override and remain affected by a global String bytes format. Closes #920.
• Removing a block comment for query type detection no longer joins the tokens around it. The server lexer treats a comment as a token separator, but remove_sql_comments replaced it with nothing, so SELECT/*c*/number FROM numbers(9) became the single token SELECTnumber, stopped looking like a SELECT, and the client side query_limit was silently dropped, while SELECT number FROM numbers(9)/*c*/LIMIT 1 became numbers(9)LIMIT 1, hid the real LIMIT, and the client appended a second one that the server rejected with Code: 62. A removed block comment now leaves a single space behind, and the trailing LIMIT 0 check that routes a query to the columns only metadata probe accepts any whitespace between LIMIT and 0 instead of exactly one space, so LIMIT /*c*/0 keeps reaching that probe. A -- line comment is unchanged, its terminating newline was already kept. Closes #928.
• The native streaming response buffer again detects mid-stream server exceptions proactively. Its in-band exception scan built the markers as __exception__<tag> and <tag>__exception__, but the server separates __exception__ from the tag with a CRLF on both markers (__exception__\r\n<tag> ... <tag>\r\n__exception__), so the scan never matched and the exception block was only recovered by the last-chunk fallback in NativeTransform.parse_response. When the block spanned a transport-chunk boundary that fallback saw just a fragment and surfaced a truncated or garbled error instead of the real ClickHouse exception. Both the pure Python and compiled Cython buffers are corrected. Closes #915.
• DB-API Cursor.description now reports the result type's top-level nullability instead of hardcoding null_ok=True, including the implicit null values supported by Variant, Dynamic, and SimpleAggregateFunction over a nullable element type. Existing type_code values are unchanged, and types whose nullability is unknown report None. The empty-result metadata probe also recognizes leading ClickHouse comments, including nested block comments, and is best effort, so a failed probe leaves description empty instead of raising after the original query succeeded. Closes #902, #907, and #909.
• Compound values stored in JSON shared data, such as arrays of objects, heterogeneous arrays, and nested arrays, are now decoded to Python objects instead of being returned as raw bytes. Date, DateTime, and DateTime64 values in shared data, both as scalars and inside arrays, now decode as well. Closes #897.
• AsyncClient no longer tears down the aiohttp response from the parser's executor thread when a query fails mid-stream. The synchronous cleanup cancelled the producer task and closed the response directly, which raced with the event loop handling the server's connection abort and could surface an AttributeError from asyncio's SSL shutdown on TLS connections instead of the real StreamFailureError. Cleanup is now scheduled onto the event loop with call_soon_threadsafe.

1.6.0, 2026-07-23

Bug Fixes

• AsyncClient initialization no longer overwrites user-supplied session settings with generated defaults. A client created with settings={'date_time_input_format': 'basic'} previously had that value replaced by the generated best_effort default. User settings now always win, matching the sync client.
• An AsyncClient created with both client certificates and an access token now sends the mutual TLS authentication headers and the Authorization: Bearer header together, matching the sync client. The certificates previously suppressed the token at construction, while the token_provider option re-added its token right after initialization, so the two async token paths disagreed with each other. The server resolves the credential precedence.
• Dict-valued settings such as additional_table_filters no longer crash with DB::Exception: Cannot parse quoted string when passed through query()'s settings parameter. The value was rendered with Python's own str()/repr() of the dict, which mixes single and double quotes and is not valid ClickHouse map-literal syntax; it is now rendered as a properly single-quoted, escaped ClickHouse map literal. Closes #501.

Improvements

• Async clients now emit URL query parameters in the same order as the sync client on every request. The parameter names and values are unchanged, so this is only visible to systems that match or sign the exact request URL.
• Client creation no longer fails when the client_protocol_version capability probe errors on the sync client. The client falls back to running without the newer native protocol features and logs the probe failure at debug level, matching the async client.

... (truncated)

Commits

• d479216 release prep v1.7.1 (#957)
• 6d63e37 fix SQLAlchemy 2.1 identifier quoting and broken 1.4 column ddl (#956)
• 1503bea add publish_core workflow for clickhouse-connect-core wheels (#955)
• f25bb0d release prep for v1.7.0 (#953)
• 948d460 Remove old server version checks (#945)
• c81f3bd add SQLAlchemy JSON subcolumn access (#944)
• 6446994 fix bind time and timedelta parameters as Time literals (#943)
• a114c62 Add show_clickhouse_errors="scrub" to hide host and version (#937)
• 55e1051 fix: protect SQLAlchemy reflection from String bytes format (#935)
• 32c93d8 add PEP 249 DB API constructors (#940)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[bito-code-review]

Code Review Agent Run #433db2

Actionable Suggestions - 0

Review Details

• Files reviewed - 1 · Commit Range: 5c81e28..5c81e28

  • pyproject.toml
• Files skipped - 0
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers an incremental AI Review.

• /review full - Manually triggers a full AI Review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.84%. Comparing base (f2610e9) to head (5c81e28).

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #43419      +/-   ##
==========================================
- Coverage   78.85%   78.84%   -0.02%     
==========================================
  Files        2876     2876              
  Lines      164581   164581              
  Branches    38011    38011              
==========================================
- Hits       129786   129760      -26     
- Misses      32348    32376      +28     
+ Partials     2447     2445       -2     

Flag	Coverage Δ
hive	?
mysql	57.77% <ø> (ø)
postgres	57.80% <ø> (-0.01%)	⬇️
presto	40.01% <ø> (ø)
python	83.51% <ø> (-0.04%)	⬇️
sqlite	57.49% <ø> (ø)
unit	73.56% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.