Repository navigation
Conversation
certifi 2026.10.23 drops the emSign roots (GHSA-6q48-6c7w-9gw2) and setuptools 84.2.1 fixes the namespace_packages.txt path escape (GHSA-xmj3-9gf7-h52w). The lock on main predates the relational engine's <3.15 bound from #42, so relocking also adds the Python 3.14 resolution. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Manush Murali <manushm@nvidia.com>
oauthlib 4.0.0 fixes the device flow bearer token leak (GHSA-3jp2-3mrg-2vxc). databricks-sql-connector 4.6.0 caps oauthlib below 4, so it moves to 4.8.0, which allows it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Manush Murali <manushm@nvidia.com>
Manushpm8
changed the title
JGagacheva
left a comment
JGagacheva
left a comment
There was a problem hiding this comment.
The lock change itself looks right: only certifi (2026.7.22 → 2026.10.23) and setuptools (84.0.0 → 84.2.1) change version, both past the patched versions in GHSA-6q48-6c7w-9gw2 and GHSA-xmj3-9gf7-h52w. Everything else in the diff is Python 3.14 wheel metadata and marker splits that follow from the relational engine's <3.15 bound. Fine to merge once the description is corrected on two points.
Alert count. This clears two alerts (certifi and setuptools), not three. Five were open when the PR was written; a sixth (oauthlib, high) opened later the same day.
Why filelock stays open. The description says snowflake-connector-python 4.8.0 is the latest release and requires filelock<4. 4.8.0 does, but it is not the latest: 5.0.0 (2026-10-15) and 5.1.0 (2026-10-21) drop the filelock constraint entirely. The actual blockers are in this repo: the connectors package's snowflake extra pins >=4.8,<5, and the 5.x line requires Python ≥3.11 while the workspace supports 3.10. The conclusion for this PR is unchanged, but the follow-up is to lift the <5 pin behind a python_version >= "3.11" marker (or drop 3.10), not to wait on an upstream release.
Suggested wording: "Clears two of the six open alerts. The three filelock alerts need snowflake-connector-python 5.x, which this repo pins out with <5 and which requires Python 3.11."
Separately, the new oauthlib alert (locked 3.3.1, fixed in 4.0.0) is worth its own PR; two earlier oauthlib alerts were dismissed on 2026-10-10, so check that history first.
adi-kumo
left a comment
adi-kumo
left a comment
There was a problem hiding this comment.
.gitlab-ci.yml:428
P2: Remove the obsolete guard so dependency audits can run
Question: could this refresh also retire the old OAuthlib audit exception? If the installed Databricks driver permits OAuthlib 4, the existing guard stops the job before it scans for vulnerabilities. Confirm the new driver’s requirement, then remove both the guard and its vulnerability exception so auditing can resume.
Clears four of the six open Dependabot alerts on
uv.lock.The lock on main predates the relational engine's
<3.15bound from #42, so relocking also adds the Python 3.14 resolution.uv lock --checkpasses. This supersedes #53 and #59.The three filelock alerts stay open: the fix is 4.2.1, but
snowflake-connector-python4.8.0, its latest release, requiresfilelock<4.🤖 Generated with Claude Code