Bump dagster from 1.12.7 to 1.13.1 in /examples/data-quality-patterns

[dependabot]

Bumps dagster from 1.12.7 to 1.13.1.

Changelog

Sourced from dagster's changelog.

1.13.1 (core) / 0.29.1 (libraries)

New

• Added PipesCompositeMessageReader (preview) to support multiple concurrent message streams in a single Pipes session.
• Added sensor:, schedule:, and job: attribute support to the asset selection syntax (e.g., sensor:my_sensor, job:my_job).
• Added automation_type: attribute support to the asset selection syntax, allowing queries like automation_type:schedule or automation_type:sensor. (Thanks, @​bengotow!)
• State-backed integration components (e.g., AirbyteWorkspaceComponent, FivetranWorkspaceComponent) now default to LOCAL_FILESYSTEM state storage instead of legacy_code_server_snapshots.
• [dg] Added dg api issue create and dg api issue update commands.
• [dg] Added filter support to dg api issue list.
• [ui] Improved asset selection autocomplete performance.
• [dagster-dbt] DagsterDbtTranslatorSettings.enable_source_metadata now defaults to True, enabling upstream asset key remapping based on dbt source table names by default.

Bugfixes

• Fixed a possible SQL injection in a few IO managers when used with dynamic partition.
• Fixed an issue where runs executed via execute_in_process() would sometimes fail to display the step timeline in the Dagster UI.
• Fixed a bug where multi-asset definitions containing virtual assets would produce incorrect execution plans.
• [ui] Fixed the tick result button for sensors using dynamic partitions.
• [dagster-aws] PickledObjectS3IOManager now defaults the S3 key prefix to an empty string when none is provided. (Thanks, @​aksestok!)
• [dagster-databricks] PipesDatabricksClient.run_multi_task and PipesDatabricksServerlessClient.run_multi_task now give each submitted task its own message destination by default, fixing chunk-file collisions between concurrent tasks.
• [dagster-dbt] Fixed the dbt Cloud v2 polling sensor and adhoc job to use stable, ID-based identifiers, preventing naming conflicts.
• [dagster-dbt] Fixed the dbt Cloud v2 polling sensor to correctly filter out runs from adhoc jobs.

Documentation

• Added a guide for virtual assets.
• Added documentation for partitioned asset checks.
• Added documentation for the free_slots_after_run_end_seconds concurrency configuration option.
• Clarified SCIM provisioning and SSO permission requirements in the authentication documentation.
• Added a guide for migrating Dagster+ from the US to the EU control plane.

1.13.0 (core) / 0.29.0 (libraries)

Major Changes Since 1.12.0

• AI-assisted development: Released dagster-io/skills, a collection of Dagster-focused AI skills for coding agents like Claude Code, OpenAI Codex, and others. Expanded dg api commands for programmatic inspection of assets, runs, jobs, schedules, and more.
• Partitioned asset checks: Asset checks can now target specific partitions of an upstream asset, aligning data quality logic with how partitioned data is produced and monitored.
• State-backed components enabled by default: Integrations that depend on external metadata (dbt, Fivetran, Airbyte, Tableau, Looker, etc.) now use persisted local state by default, providing a more predictable code location loading experience.
• Virtual assets (preview): New is_virtual parameter on @asset and AssetSpec for modeling assets like database views that automatically reflect upstream changes without explicit materialization.
• 20+ new components: Added or expanded components for dbt Cloud, Spark, Azure (Blob Storage, ADLS2), GCP (BigQuery, GCS, Dataproc), Databricks, Tableau, Looker, Census, Polytomic, and more. Integrations gained richer observability, metadata, and operational support.
• Deeper integration support: dbt Cloud supports partitioned assets; Databricks gained job-level subsetting and auto-cancel on run termination; Fivetran added polling sensors, retry-on-reschedule, and resync support; BI integrations auto-enrich assets with table metadata for cross-system lineage.
• Dagster+ improvements: Organization-level timezone settings, service users for Pro accounts, more resilient code server redeploy behavior, improved agent failure recovery, and expanded insights and alerting workflows.

Breaking Changes

• Removed deprecated external_asset_from_spec and external_assets_from_specs. Use AssetSpec inputs directly to Definitions(...) or AssetsDefinition(specs=[...]) instead.
• Removed deprecated single-AssetKey deps argument support from asset dependencies. Use a sequence of AssetDep objects instead.
• Removed deprecated get_all_asset_specs from Definitions.
• Removed deprecated legacy_freshness_policy parameter from @observable_source_asset.

... (truncated)

Commits

• 00e2ef7 1.13.1
• 1c95173 Adds changelog for 1.13.1 (#22830)
• 2c86620 Add dynamic partition escaping to SnowflakePolarsTypeHandler (#22903)
• a428f90 Add serverside killswitch for legacy freshness policy resolvers (#22891)
• a2210de [perf] fast-path all partition subset for multi partition assets
• 5ca5f93 Add PipesCompositeMessageReader for multi-writer pipes sessions (#22819)
• 6ca4c26 [docs] add migration guide for 1.13.0 (#22800)
• d82cc48 Add lastObservationTimestamp to GraphQL schema [FE-1106] (#22776)
• dd45863 Revert "Add lastObservationTimestamp to asset health, expand catalog sort opt...
• c82656e Update Serverless job location info (#22752)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Greptile Summary

Routine dependabot bump of dagster and its ecosystem packages from 1.12.7 to 1.13.1 (libraries 0.28.7 → 0.29.1) within examples/data-quality-patterns. The minimum version constraint in pyproject.toml is also tightened from >=1.9.0 to >=1.13.1, which is appropriate given the breaking removals in 1.13.0 (external_asset_from_spec, get_all_asset_specs, etc.). A new transitive dependency dagster-rest-resources 0.29.1 is introduced (pulled in by dagster-dg-cli), setuptools is dropped from dagster's deps, and requests is bumped from 2.32.5 to 2.33.1.

Confidence Score: 5/5

Safe to merge — standard dependabot version bump with no code logic changes.

All changes are version number updates in pyproject.toml and the generated lock file. No application code is modified. The new transitive dependency (dagster-rest-resources) is an official dagster package. No P0/P1 findings.

No files require special attention.

Important Files Changed

Filename	Overview
examples/data-quality-patterns/pyproject.toml	Minimum dagster version constraint bumped from >=1.9.0 to >=1.13.1 to match the newly resolved version; dagster-dbt and dagster-duckdb lower bounds unchanged at 0.25.0
examples/data-quality-patterns/uv.lock	Lock file updated: dagster and related packages bumped to 1.13.1/0.29.1, new transitive dependency dagster-rest-resources 0.29.1 added, setuptools removed from dagster deps, requests bumped 2.32.5→2.33.1

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[data-quality-patterns] --> B[dagster 1.13.1]
    A --> C[dagster-dbt 0.29.1]
    A --> D[dagster-duckdb 0.29.1]
    B --> E[dagster-graphql 1.13.1]
    B --> F[dagster-pipes 1.13.1]
    B --> G[dagster-shared 1.13.1]
    B --> H[dagster-webserver 1.13.1]
    B --> I[dagster-dg-cli 1.13.1]
    I --> J[dagster-rest-resources 0.29.1 NEW]
    I --> K[dagster-cloud-cli 1.13.1]
    J --> L[gql requests]
    style J fill:#d4edda,stroke:#28a745

Loading

_{Reviews (1): Last reviewed commit: "Bump dagster from 1.12.7 to 1.13.1 in /e..." | Re-trigger Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​dagster@​1.12.7 ⏵ 1.13.1	+1	+16
	pypi/​dagster-webserver@​1.12.7 ⏵ 1.13.1
	pypi/​dagster-dg-cli@​1.12.7 ⏵ 1.13.1
	pypi/​dagster-dbt@​0.28.7 ⏵ 0.29.1	+1
	pypi/​requests@​2.33.1
	pypi/​dagster-duckdb@​0.28.7 ⏵ 0.29.1		+16

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Telemetry collection: pypi dagster Note: This module implements a background telemetry uploader that reads local Dagster log files and POSTs compressed contents to a remote telemetry endpoint, then deletes uploaded files. It does not contain obvious obfuscated or stealthy backdoor code, but it does perform potentially sensitive data exfiltration (logs -> remote server) and uses insecure defaults (plain HTTP, compression/header mismatch). There are correctness/robustness bugs (content-encoding mismatch, a typo in exception handling) that may hide failures. If you do not trust the receiving endpoint or if logs may contain sensitive data, treat this as a moderate supply-chain/privacy risk and either disable telemetry via DAGSTER_DISABLE_TELEMETRY or review/modify the uploader to use HTTPS, authentication/allowlist, and safer file handling. From: examples/data-quality-patterns/uv.lock → pypi/dagster@1.13.1 ℹ Read more on: This package | This alert | What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/dagster@1.13.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Telemetry collection: pypi dagster Note: This module implements a background telemetry uploader that reads local Dagster log files and POSTs compressed contents to a remote telemetry endpoint, then deletes uploaded files. It does not contain obvious obfuscated or stealthy backdoor code, but it does perform potentially sensitive data exfiltration (logs -> remote server) and uses insecure defaults (plain HTTP, compression/header mismatch). There are correctness/robustness bugs (content-encoding mismatch, a typo in exception handling) that may hide failures. If you do not trust the receiving endpoint or if logs may contain sensitive data, treat this as a moderate supply-chain/privacy risk and either disable telemetry via DAGSTER_DISABLE_TELEMETRY or review/modify the uploader to use HTTPS, authentication/allowlist, and safer file handling. From: examples/data-quality-patterns/uv.lock → pypi/dagster@1.13.1 ℹ Read more on: This package | This alert | What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/dagster@1.13.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report