dependabot[bot] opened a new pull request, #44197: URL: https://github.com/apache/superset/pull/44197
Updates the requirements on [snowflake-sqlalchemy](https://github.com/snowflakedb/snowflake-sqlalchemy) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/snowflakedb/snowflake-sqlalchemy/releases";>snowflake-sqlalchemy's releases</a>.</em></p> <blockquote> <h2>Release</h2> <ul> <li> <p>v1.11.1 (Sep 3, 2026)</p> </li> <li> <p>Fix <code>/</code> operator to always emit true division (<code>left / right</code>). The flag gates a deprecation warning. The <code>//</code> operator continues to always emit <code>FLOOR(left / right)</code> (GH <a href="https://redirect.github.com/snowflakedb/snowflake-sqlalchemy/issues/756";>#756</a>).</p> </li> <li> <p>v1.11.0 (July 7, 2026)</p> </li> <li> <p><strong><a href="https://github.com/snowflakedb/snowflake-sqlalchemy#sensitive-connection-parameters";>Sensitive connection parameters</a>:</strong> We curated a set of connector kwargs (<code>host</code>, <code>protocol</code>, <code>token_file_path</code>, <code>private_key_file</code>, <code>ocsp_response_cache_filename</code>, <code>connection_diag_log_path</code>, <code>crl_cache_dir</code>, <code>unsafe_file_write</code>, <code>unsafe_skip_file_permissions_check</code>) that can no longer be supplied via the URL query string — pass them via <code>connect_args=</code> in <code>create_engine()</code> instead (applications already doing so are unaffected). If you encounter a possible behavioral change, set <code>SNOWFLAKE_SQLALCHEMY_LEGACY_URL_PARAMS=1</code> and follow the instructions at <a href="https://github.com/snowflakedb/snowflake-sqlalchemy#sensitive-connection-parameters";>Sensitive connection parameters</a>.</p> </li> <li> <p>Improve <code>_url()</code> helper and <code>create_connect_args</code> connection-parameter handling:</p> <ul> <li><code>account</code> and <code>region</code> values are now validated against an allowlist of DNS-safe characters (alphanumeric, <code>-</code>, <code>.</code>, <code>_</code>) before being interpolated into the connection URL, preventing URL-authority corruption from unexpected characters.</li> <li><code>user</code> values are percent-encoded before being placed in the URL userinfo component, preserving the original value delivered to the connector while preventing <code>@</code>, <code>?</code>, and <code>#</code> from being misinterpreted as URL delimiters.</li> </ul> </li> <li> <p><code>ClusterByOption</code> now raises <code>TypeError</code> at DDL compile time when an expression element is neither a <code>str</code> nor a <code>sqlalchemy.sql.expression.TextClause</code>. Previously, such values were silently coerced via <code>str()</code>, which produced malformed DDL (e.g. bind-parameter placeholders like <code>:id_1</code>) for any expression beyond a bare column name. The accepted types match the documented constructor signature; code using only <code>str</code> or <code>text(...)</code> is unaffected.</p> </li> <li> <p>Improve identifier quoting and string-literal escaping for caller-supplied values across the DDL compiler so they are rendered consistently with the rest of the dialect. Column keys in <code>MERGE INTO</code> (both the <code>WHEN NOT MATCHED … INSERT</code> list and <code>WHEN MATCHED … SET</code> targets), stage namespaces/names, <code>format_name</code>, and <code>file_format</code> are now routed through the identifier preparer, and a <code>quote=False</code> schema or column label is quoted when it contains characters that would otherwise require quoting instead of being emitted verbatim. Cloud-storage URIs, <code>CREDENTIALS</code>, and <code>ENCRYPTION</code> clauses (shared by <code>COPY INTO</code> and <code>CREATE STAGE</code>) and <code>FILES=(…)</code> entries now apply the dialect's standard literal escaping (<code>'</code>→<code>''</code>, <code>\</code>→<code>\\</code>); <code>CREATE STAGE</code> builds its SQL from the container's fields rather than <co de>repr(container)</code>. Legal identifiers — including upper-case names that Snowflake folds — still render bare, so existing DDL is unchanged.</p> </li> <li> <p>Improve escaping in <code>CopyIntoStorage</code> / <code>CreateStage</code> / <code>CreateFileFormat</code> and add secret redaction (SNOW-3656048):</p> <ul> <li><code>FILE_FORMAT</code> option string values (e.g. <code>CSVFormatter().date_format(...)</code>, <code>file_extension</code>, <code>timestamp_format</code>) are now escaped before being embedded in the compiled SQL, improving single-quote escaping (SNOW-3649888).</li> <li><code>repr()</code> of <code>AWSBucket</code>, <code>AzureContainer</code>, <code>GCSBucket</code> (and, transitively, <code>CopyIntoStorage</code>) now masks cloud secrets — <code>AWS_SECRET_KEY</code>, <code>AWS_KEY_ID</code>, <code>AWS_TOKEN</code>, <code>AZURE_SAS_TOKEN</code>, <code>MASTER_KEY</code> are rendered as <code>'***'</code> (SNOW-3649782). Compiled SQL is unchanged.</li> <li>Added an opt-in logging redactor for engine logs that contain inline credentials: <code>SnowflakeSecretRedactionFilter</code>, <code>add_secret_redaction_filter()</code>, and <code>redact_secrets()</code>. Prefer <code>STORAGE_INTEGRATION</code> to avoid putting secrets in SQL at all (SNOW-3649850).</li> </ul> </li> <li> <p>Fix <code>get_view_definition</code> silently truncating or failing for view names that contain a single quote or backslash (e.g. <code>o'brien</code>). The name is now SQL-escaped (<code>'</code> → <code>''</code>, <code>\</code> → <code>\\</code>) before being embedded in the <code>SHOW VIEWS LIKE '...'</code> literal, so such views are found correctly and no query manipulation is possible via a crafted view name.</p> </li> <li> <p>Optimise single-table reflection (SNOW-3720548): reflecting one table no longer scans the entire schema, reducing latency and Snowflake credit usage for targeted <code>Inspector</code> calls.</p> </li> <li> <p>v1.10.2 (June 18, 2026)</p> </li> <li> <p>Fix double-escaped identifier quoting for database-qualified schemas in <code>_StructuredTypeInfoManager.get_table_columns</code>. Since v1.10.1 the schema was quoted as a single identifier, so a qualified schema such as <code>"MYDB"."MYSCHEMA"</code> became <code>"""MYDB"".""MYSCHEMA"""</code> and the <code>DESC TABLE</code> fallback failed (emitting a <code>Failed to reflect table ... sqlalchemy:_get_schema_columns</code> warning) for every structured-typed table when reflecting a non-default <code>database.schema</code>. The schema is now split on the dot and each component is double-quoted individually, preserving the SNOW-3480955 injection guard while correctly handling qualified schemas.</p> </li> <li> <p>v1.10.1 (June 15, 2026)</p> <ul> <li>Fix <code>regexp_match</code> and <code>regexp_replace</code> flags rendered as bound parameters instead of literal strings (<a href="https://github.com/snowflakedb/snowflake-sqlalchemy";>#SNOW-3573046</a>). Flags passed to <code>ColumnElement.regexp_match(..., flags=...)</code> and <code>ColumnElement.regexp_replace(..., flags=...)</code> were processed through the standard parameter pipeline, producing incorrect SQL. Flags are now rendered as inline string literals, matching Snowflake's expected <code>REGEXP_LIKE(col, pattern, 'i')</code> / <code>REGEXP_REPLACE(col, pattern, replacement, 'i')</code> syntax.</li> <li>Fix inconsistent identifier quoting in <code>_StructuredTypeInfoManager.get_table_columns</code>. The <code>DESC TABLE</code> fallback path used raw denormalised names in an f-string while all other reflection paths apply <code>ip.quote(denormalize_name(...))</code> via <code>_always_quote_join</code>. Schema and table components are now consistently double-quoted before the statement is constructed, and the method delegates to <code>get_table_columns_by_full_name</code> to collapse the two previously divergent code paths.</li> </ul> </li> <li> <p>v1.10.0 (May 20, 2026)</p> <ul> <li>Fix <code>with_loader_criteria</code> silently dropping filters on non-Snowflake dialects (<a href="https://redirect.github.com/snowflakedb/snowflake-sqlalchemy/issues/676";>#676</a>). Importing <code>snowflake-sqlalchemy</code> previously altered SQLAlchemy's ORM compilation for every dialect in the process, causing loader-criteria filters to be omitted inside sealed subqueries when using PostgreSQL, MySQL, SQLite, etc. Snowflake dialect behavior is unchanged; the BCR-1057 lateral-join workaround is now scoped to Snowflake connections only.</li> <li>Map Snowflake <code>UUID</code> column type to <code>sqlalchemy.sql.sqltypes.UUID</code> for reflection on SQLAlchemy 2.x (<a href="https://redirect.github.com/snowflakedb/snowflake-sqlalchemy/issues/681";>#681</a>). Previously reflected as <code>NullType</code>. Values are returned as plain strings (<code>as_uuid=False</code>) rather than <code>uuid.UUID</code> instances. No change on SQLAlchemy 1.4 where the generic <code>UUID</code> type does not exist.</li> <li>Add GCS bucket support for <code>CopyIntoStorage</code> (SNOW-721174, <a href="https://redirect.github.com/snowflakedb/snowflake-sqlalchemy/issues/368";>#368</a>).</li> <li>Scope <code>referred_schema=None</code> normalization in foreign key reflection to the default schema only (<a href="https://redirect.github.com/snowflakedb/snowflake-sqlalchemy/issues/610";>#610</a>, SNOW-2313675): <ul> <li>When reflecting the default schema, same-schema FKs (default → default) keep the established SQLAlchemy convention of <code>referred_schema=None</code>, preserving compatibility with the upstream reflection test suite and with applications that do not qualify default-schema FK targets.</li> <li>When reflecting a non-default schema every FK keeps its actual <code>referred_schema</code>, which prevents SQLAlchemy's <code>_reflect_fk</code> from autoloading a non-default-schema target from the wrong place (the bug behind <a href="https://redirect.github.com/snowflakedb/snowflake-sqlalchemy/issues/610";>#610</a>) and avoids the Alembic autogenerate mismatch that previously occurred when user metadata explicitly qualified a cross-schema FK that happened to target the default schema.</li> </ul> </li> <li>Add <code>SnowflakeBase</code>, <code>snowflake_declarative_base()</code>, and <code>SnowflakeSession</code> to enable efficient bulk inserts for ORM models with nullable optional columns (SNOW-893080, <a href="https://redirect.github.com/snowflakedb/snowflake-sqlalchemy/issues/441";>#441</a>). When <code>session.bulk_save_objects()</code> is used with models that have randomly populated nullable columns, SQLAlchemy normally groups objects by their set of non-None column keys, producing O(N) separate INSERT statements. <code>SnowflakeBase</code> / <code>snowflake_declarative_base()</code> pre-populate all plain-nullable columns at construction time, and <code>SnowflakeSession</code> passes <code>render_nulls=True</code> so all objects share the same parameter-key set and are batched into a single <code>executemany</code> INSERT.</li> <li>Fix case-sensitive identifier handling (SNOW-1232488). Always-active bug fixes with no behavioural change for default users: <ul> <li><code>_split_schema_by_dot</code> now correctly parses SQL-escaped double-quotes (<code>""</code>) inside quoted schema/database identifiers (e.g. <code>"my""schema"</code> → <code>my"schema</code>), preventing silent truncation of identifiers containing literal quote characters.</li> <li><code>denormalize_column_name</code> now correctly double-quotes <code>quoted_name("mycol", True)</code> columns in <code>CLUSTER BY</code> clauses instead of silently dropping the case-sensitivity signal. The caller has already opted into case-sensitive semantics by constructing a <code>quoted_name(..., True)</code>, so this is honoured independently of the dialect flag.</li> <li><code>_has_object</code> (used by <code>has_table</code> / <code>has_sequence</code>) now applies <code>denormalize_name</code> to both the schema and object name before building the <code>DESC</code> SQL, making it consistent with all other reflection methods.</li> <li>Atomic <code>_NameUtils</code> swap in <code>create_connect_args</code> — when the URL's <code>case_sensitive_identifiers</code> value differs from the current dialect state, the <code>name_utils</code> instance is replaced rather than mutated in place, so concurrent readers on other threads observe either the old or the new instance but never a torn update.</li> </ul> </li> <li>Add <code>case_sensitive_identifiers</code> opt-in engine flag (kwarg or <code>?case_sensitive_identifiers=True</code> URL param) governing three related behaviours. The default is <code>False</code>; existing applications are unaffected unless they explicitly opt in: <ul> <li>ALL-UPPERCASE reserved-word identifiers (e.g. <code>TABLE</code>) are normalised to <code>quoted_name("table", True)</code> instead of returning unchanged, preventing key-lookup mismatches between creation and reflection.</li> <li>Mixed-case reflected identifiers (e.g. <code>MyCol</code> from a quoted Snowflake column) are returned as <code>quoted_name("MyCol", True)</code> instead of a plain <code>str</code>. Emitted SQL is identical in both modes (<code>_requires_quotes</code> force-quotes any name containing uppercase chars); the difference is only observable via <code>isinstance(..., quoted_name)</code> and <code>.quote</code>.</li> <li>Schema strings with inner double-quotes — e.g. <code>'"myschema"'</code> or <code>'"mydb"."myschema"'</code> — have their extracted parts marked <code>quote=True</code> by <code>_split_schema_by_dot</code>, preserving case-sensitivity in emitted SQL. Without the flag, the extracted parts keep <code>quote=None</code> and the preparer's <code>_requires_quotes</code> heuristic decides per-part (stripping inner quotes for all-lowercase parts, which matches pre-PR behaviour). Use <code>quoted_name("myschema", True)</code> or <code>MetaData(schema=quoted_name(..., True))</code> to opt into case-sensitivity on a per-value basis without enabling the flag.</li> </ul> </li> <li>Add <code>create_snowflake_engine(url, schema=..., case_sensitive_schema=True)</code> helper that URL-encodes case-sensitive schema names using <code>%22</code> so the Snowflake connector receives the literal double-quoted form. Fix security vulnerability: schema names are now always URL-encoded regardless of <code>case_sensitive_schema</code>, preventing special characters (<code>?</code>, <code>#</code>, <code>/</code>) from being misinterpreted as URL delimiters by SQLAlchemy's URL parser.</li> <li>Add <code>snowflake.sqlalchemy.alembic_util.render_item</code> — a drop-in Alembic <code>render_item</code> hook for <code>env.py</code> that serialises <code>quoted_name</code> columns with <code>quote=True</code> correctly in generated migration files, preventing Alembic autogenerate from silently converting case-sensitive column names to uppercase.</li> <li>Emit <code>SnowflakeWarning</code> at DDL compile time when <code>Identity()</code> is used on a primary key column, alerting users that ORM flush operations will raise a <code>FlushError</code>. The warning is emitted once per unique <code>(table, column)</code> pair per Python process. Use <code>Sequence()</code> instead.</li> <li>Add support for cross-database schema reflection using <code>schema='database.schema'</code> notation. This allows reflecting and joining tables from different databases in a single session without raw SQL. (<a href="https://redirect.github.com/snowflakedb/snowflake-sqlalchemy/issues/456";>#456</a>)</li> <li>Restored backward-compatible SQL generation for true division (<code>/</code>) when <code>div_is_floordiv=True</code>: the Snowflake compiler now correctly delegates to the SQLAlchemy base implementation, emitting <code>CAST(col AS NUMERIC)</code> for integer operands as it did before <a href="https://redirect.github.com/snowflakedb/snowflake-sqlalchemy/pull/545";>#545</a> introduced the override (<a href="https://redirect.github.com/snowflakedb/snowflake-sqlalchemy/issues/618";>#618</a>).</li> <li>Introduce composite key ordering, fixes <a href="https://redirect.github.com/snowflakedb/snowflake-sqlalchemy/issues/450";>#450</a></li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/snowflakedb/snowflake-sqlalchemy/commit/5a5cb28573213fd73de797936312016e2d0f2bdd";><code>5a5cb28</code></a> fix release notes (<a href="https://redirect.github.com/snowflakedb/snowflake-sqlalchemy/issues/36";>#36</a>)</li> <li><a href="https://github.com/snowflakedb/snowflake-sqlalchemy/commit/e3cd8ed8ffce10a6c474d77ad4ca91bb8c9d1d50";><code>e3cd8ed</code></a> release-1.11.1 (<a href="https://redirect.github.com/snowflakedb/snowflake-sqlalchemy/issues/35";>#35</a>)</li> <li><a href="https://github.com/snowflakedb/snowflake-sqlalchemy/commit/965191a01fc62e6676dcd46384a39df8c2925319";><code>965191a</code></a> Make / always true division regardless of force_div_is_floordiv (<a href="https://redirect.github.com/snowflakedb/snowflake-sqlalchemy/issues/33";>#33</a>)</li> <li><a href="https://github.com/snowflakedb/snowflake-sqlalchemy/commit/bd08d58046606aedb460f89291fb1cdf0c4099d4";><code>bd08d58</code></a> Fix incorrect SQL for force_div_is_floordiv=True on SA 2.x (GH <a href="https://redirect.github.com/snowflakedb/snowflake-sqlalchemy/issues/756";>#756</a>) (<a href="https://redirect.github.com/snowflakedb/snowflake-sqlalchemy/issues/32";>#32</a>)</li> <li><a href="https://github.com/snowflakedb/snowflake-sqlalchemy/commit/4dbf59445bfe4b80b09b4a53f150b1cb02bf0042";><code>4dbf594</code></a> Copybara import baseline</li> <li><a href="https://github.com/snowflakedb/snowflake-sqlalchemy/commit/ac3f62831df00fcf15431c6661e14c054f508ced";><code>ac3f628</code></a> SNOW-3630984 migrate CI to WIF and consolidate per-cloud workflows (1.x) (<a href="https://redirect.github.com/snowflakedb/snowflake-sqlalchemy/issues/725";>#725</a>)</li> <li><a href="https://github.com/snowflakedb/snowflake-sqlalchemy/commit/21b3f683965cbe4674845f9dbf93cafcb2ee6a3a";><code>21b3f68</code></a> chore/fix-connection-args-test-compatibility: clr_cache_dir not present in 3....</li> <li><a href="https://github.com/snowflakedb/snowflake-sqlalchemy/commit/bf147aef3d2ab3ba7bf6f314ad357172656ecd2b";><code>bf147ae</code></a> chore/workflows-release-1.x (<a href="https://redirect.github.com/snowflakedb/snowflake-sqlalchemy/issues/720";>#720</a>)</li> <li>See full diff in <a href="https://github.com/snowflakedb/snowflake-sqlalchemy/compare/v1.11.0...v1.11.1";>compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
