[jtroup]

ENG-9235

what

Remove snowflake-connector-python from the all_ds group. The
Snowflake runner stays in the code, and disables itself when its
driver is missing. The runner registration test now expects it to be
disabled.

Move protobuf from 3.20 to 6.x. The old phoenixdb and pydgraph
releases ship generated protobuf code that fails to load on protobuf
4 or later. A failure there stops redash from importing at all, not
only the one runner. So phoenixdb moves to 1.2 and pydgraph moves to
25.2, and the runners need no code change. pydgraph 25.2 needs
protobuf 6.31.1 or later. A minimum on grpcio-tools keeps the
resolver from falling back to a release that has no wheel.

phoenixdb 1.x also brings in gssapi and requests-gssapi for
Kerberos support.

why

Clear the remaining High and Critical findings in data source
drivers. Every Snowflake 3.x release caps pyopenssl below 26, which
blocks the pyopenssl fix. Snowflake 4.x needs code changes that we
cannot test, and no deployment uses this data source. The protobuf
findings need protobuf 4.25.8 or later, which the old drivers do not
support.

testing

This relies on the unit suite and the runner registration test, which
fails if a driver no longer imports. We compared the driver calls in
the Phoenix, Dgraph and e6data runners with the new driver APIs. We
did not test against live Phoenix, Dgraph or e6data servers.

• grype scan of the CI image for this branch shows no
  snowflake-connector-python or protobuf findings

docs

No docs needed.

---

🤖 Generated with Claude Code

[jtroup]

@cubic-ai

[cubic-dev-ai]

@cubic-ai

@jtroup I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Architecture diagram

sequenceDiagram
    participant CI as CI Image Build
    participant PyPI as PyPI / Package Resolver
    participant RunnerReg as Runner Registration
    participant Redash as Redash Importer
    participant Phoenix as Phoenix Runner
    participant Dgraph as Dgraph Runner
    participant Snowflake as Snowflake Runner
    participant Grype as Grype Scanner

    Note over CI,PyPI: Dependency Resolution at Build Time

    CI->>PyPI: Resolve all_ds group dependencies
    PyPI-->>CI: protobuf >=6.31.1 (transitive via pydgraph 25.2)

    CI->>PyPI: Install phoenixdb 1.2.2
    PyPI-->>CI: phoenixdb + gssapi + requests-gssapi

    CI->>PyPI: Install pydgraph 25.2.0
    PyPI-->>CI: pydgraph + protobuf + grpcio-tools

    Note over CI,Grype: CVE Scan
    CI->>Grype: Scan installed packages
    Grype-->>CI: No snowflake-connector-python or protobuf findings

    Note over RunnerReg,Redash: Runtime Registration Check

    Redash->>RunnerReg: Import all query runner modules
    RunnerReg->>Redash: Discover available runners

    alt Snowflake runner (driver missing)
        Redash->>Snowflake: Attempt import
        Snowflake-->>Redash: Module absent (not installed)
        RunnerReg-->>Redash: Mark snowflake as disabled
    end

    alt Phoenix runner (driver present)
        Redash->>Phoenix: Import with phoenixdb 1.2.2
        Phoenix-->>Redash: Registration successful
        RunnerReg-->>Redash: Mark phoenix as enabled
    end

    alt Dgraph runner (driver present)
        Redash->>Dgraph: Import with pydgraph 25.2.0
        Dgraph-->>Redash: Registration successful (protobuf 6.x compatible)
        RunnerReg-->>Redash: Mark dgraph as enabled
    end

    RunnerReg-->>Redash: Return final enabled/disabled runner set

Loading

_{Re-trigger cubic}

[kevin-birkett]

thanks @jtroup