dependabot[bot] opened a new pull request, #59391: URL: https://github.com/apache/spark/pull/59391
Bumps [net.snowflake:snowflake-jdbc-thin](https://github.com/snowflakedb/snowflake-jdbc) from 4.1.0 to 4.3.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/snowflakedb/snowflake-jdbc/releases";>net.snowflake:snowflake-jdbc-thin's releases</a>.</em></p> <blockquote> <h2>v4.3.4</h2> <ul> <li>Please Refer to Release Notes at <a href="https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc";>https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc</a></li> </ul> <h2>v4.3.3</h2> <ul> <li>Please Refer to Release Notes at <a href="https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc";>https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc</a></li> </ul> <h2>v4.3.2</h2> <ul> <li>Please Refer to Release Notes at <a href="https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc";>https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Please Refer to Release Notes at <a href="https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc";>https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>Please Refer to Release Notes at <a href="https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc";>https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc</a></li> </ul> <h2>v4.2.0</h2> <ul> <li>Please Refer to Release Notes at <a href="https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc";>https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/snowflakedb/snowflake-jdbc/blob/master/CHANGELOG.md";>net.snowflake:snowflake-jdbc-thin's changelog</a>.</em></p> <blockquote> <h4>For all official JDBC Release Notes please refer to <a href="https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc";>https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc</a></h4> <h1>Changelog</h1> <ul> <li> <p>v4.4.1-SNAPSHOT</p> <ul> <li>Fixed pooled HTTP connections being checked for closure after 30 milliseconds by default, because the idle-connection timeout in seconds was passed to an API that expects milliseconds. Connections are now checked after 2 seconds, matching JDBC 3.28.0. <code>net.snowflake.jdbc.idle_connection_timeout</code> still controls only how long an idle connection stays in the pool (SNOW-4242824, <a href="https://redirect.github.com/snowflakedb/snowflake-jdbc/issues/39";>snowflakedb/snowflake-jdbc#39</a>).</li> <li>Added an agent skill that walks an application from JDBC 3.x to 4.x, including the public API move and the 4.0 behavior that later releases repaired (<code>.claude/skills/jdbc-3-to-4-migration/</code>). Not part of the release artifacts.</li> </ul> </li> <li> <p>v4.4.0</p> <ul> <li>Hardened external-browser callback handling by checking the <code>Origin</code><code>snowflakedb/snowflake-jdbc#27</code></li> <li>OCSP revocation checking is now off by default. Enable it by setting <code>ocspFailOpen</code> (<code>true</code> = fail-open, <code>false</code> = fail-closed). <code>disableOCSPChecks=false</code> and <code>insecureMode=false</code> are the old default values and do not opt in. <code>disableOCSPChecks=true</code> and the deprecated <code>insecureMode=true</code> always turn OCSP off, including when <code>ocspFailOpen</code> is set; the ignored fail-open is logged at warn. The deprecated <code>insecureMode</code> property no longer selects the OCSP mode and no longer throws when it disagrees with <code>disableOCSPChecks</code>; leftover OCSP cache/server settings are logged at warn as ignored while OCSP is off.</li> <li>Removed the SSE-S3 (<code>AES256</code>) header from PUT to unencrypted S3 stages so objects inherit the bucket default encryption instead of overriding it; client-side-encrypted stages are unchanged (SNOW-3701700).</li> <li>Added <code>workloadIdentityHost</code> connection property that overrides the STS host used by AWS Workload Identity Federation, for endpoints the driver cannot derive from the region (such as an interface VPC endpoint). The default STS host is now resolved via the AWS SDK so partitions that do not use <code>amazonaws.com</code> (ISO, European Sovereign Cloud, ...) get the correct hostname. A privately routed host cannot be reached by Snowflake on the default GetCallerIdentity path, so a VPC or PrivateLink STS endpoint also requires <code>workloadIdentityAwsUseOutboundToken=true</code> (SNOW-4017201).</li> <li>Added <code>ci/scripts/generate_sbom.sh</code>, which generates a CycloneDX SBOM (<code>target/bom.json</code>) covering both the driver and FIPS JAR dependency trees; not part of the release artifacts.</li> <li>Removed the unused Conscrypt library (<code>org.conscrypt:conscrypt-openjdk-uber</code>) from the self-contained (fat) and FIPS JARs. It was only transitive weight from <code>google-cloud-storage</code> and is never used by the driver (SNOW-4071987).</li> <li>Fixed the <code>platformDetectionTimeoutMs</code> connection property having no effect: platform detection always ran with the hardcoded 200 ms default, so the documented <code>platformDetectionTimeoutMs=0</code><code>snowflakedb/snowflake-jdbc#9</code></li> <li>Added JVM-wide fallbacks for both platform-detection settings, so air-gapped deployments can suppress instance-metadata probes for the whole process instead of per connection: <code>disablePlatformDetection</code> now also reads the <code>net.snowflake.jdbc.disablePlatformDetection</code> system property and the <code>SNOWFLAKE_DISABLE_PLATFORM_DETECTION</code> environment variable (both accepting only a case-insensitive <code>true</code>), and <code>platformDetectionTimeoutMs</code> reads <code>net.snowflake.jdbc.platformDetectionTimeoutMs</code> / <code>SNOWFLAKE_PLATFORM_DETECTION_TIMEOUT_MS</code>; the connection property takes precedence over the system property, which takes precedence over the environment variable. A negative timeout is now treated as <code>0</code> instead of still issuing the requests, and a timeout above 5000 ms is clamped to that maximum, since detection holds a process-wide lock and an unbounded value would stall every other connection attempt for i ts full duration. When detection is disabled the driver reports <code>PLATFORM=["disabled"]</code><code>snowflakedb/snowflake-jdbc#9</code></li> <li>Deprecated the <code>MIN_TLS_VERSION</code> and <code>MAX_TLS_VERSION</code> connection properties in favour of the JVM-wide <code>jdk.tls.client.protocols</code><code>snowflakedb/snowflake-jdbc#10</code></li> <li>Fixed the TLS version settings being held in process-global static fields and omitted from the HTTP client cache key, so a connection could silently inherit another connection's enabled TLS protocols; they are now part of <code>HttpClientSettingsKey</code> and scoped per connection. As a consequence they no longer reach HTTP clients built outside a session (Workload Identity platform detection, the sessionless <code>SnowflakeFileTransfer</code> entry point, and result sets rebuilt from a serialized form), which use the driver defaults of TLS 1.2-1.3; use <code>jdk.tls.client.protocols</code><code>snowflakedb/snowflake-jdbc#10</code></li> <li>Fixed invalid <code>MIN_TLS_VERSION</code>/<code>MAX_TLS_VERSION</code> values and an inverted version range surfacing as an unwrapped <code>IllegalArgumentException</code> from socket factory construction instead of a <code>SnowflakeSQLException</code> when the property is set, and fixed TLS version availability being resolved from the protocols the JSSE provider implements rather than the ones it will actually enable, so a version banned through the <code>jdk.tls.disabledAlgorithms</code><code>snowflakedb/snowflake-jdbc#10</code></li> <li>Fixed cipher suite selection using <code>SSLServerSocketFactory</code>'s server-side default suites for the driver's client connections, which both discarded the JVM-wide <code>jdk.tls.client.cipherSuites</code> and <code>jdk.tls.disabledAlgorithms</code> settings and bypassed Apache HttpClient's weak-suite filtering. Selection is now left to JSSE unless <code>https.cipherSuites</code> is set, whose value is also trimmed. This covers the Snowflake connection and result-set chunk downloads only; PUT/GET stage transfers go through cloud storage SDKs that supply their own cipher list, where <code>jdk.tls.disabledAlgorithms</code><code>snowflakedb/snowflake-jdbc#14</code></li> <li>Fixed GET from a client-side-encrypted GCS stage on the <code>GCSAccessStrategyAwsSdk</code> strategy (<code>useVirtualUrl</code>) writing ciphertext and reporting success: encryption metadata returned as <code>x-goog-meta-*</code> is now read from the raw response headers instead of the empty S3 metadata map.</li> <li>Fixed the GCS <code>GCSAccessStrategyAwsSdk</code> strategy (<code>useVirtualUrl</code>) leaking a thread pool on every PUT and GET; the per-call executor passed to <code>S3TransferManager</code> is now shut down in a <code>finally</code> on both the upload and download paths, mirroring the earlier S3 fix in <a href="https://redirect.github.com/snowflakedb/snowflake-jdbc/issues/2602";>snowflakedb/snowflake-jdbc#2602</a> (SNOW-4098951).</li> <li>Bumped the following dependencies: <ul> <li>netty to 4.1.138.Final from 4.1.137.Final.</li> <li>zstd-jni to 1.5.7-16 from 1.5.6-5.</li> <li>BouncyCastle to 1.86 from 1.85.</li> <li>jackson-databind to 2.18.11 from 2.18.10.</li> </ul> </li> </ul> </li> <li> <p>v4.3.4</p> <ul> <li>Added validation of <code>account</code>, <code>port</code> and <code>protocol</code> in the auto-configuration (<code>connections.toml</code>) path, where the connect string's host is synthesized from <code>account</code>, so that none of the interpolated components can alter the resulting URL authority. Each dot-separated label of <code>account</code> may contain only letters, digits, underscores and hyphens (mirroring the Python connector), <code>port</code> must be a number in 1-65535, and <code>protocol</code> must be <code>http</code> or <code>https</code>. Absent or empty values keep their existing "not specified" meaning. As defense in depth, the <code>ACCOUNT</code><code>snowflakedb/snowflake-jdbc#2752</code></li> <li>Reduced sensitive detail in debug and response logging: the chunk result-master key is logged as a presence flag instead of its value, HTTP response header values are no longer logged (only header names), and chunk-download responses are rendered as a status line plus header names instead of <code>HttpResponse.toString()</code>, which would render every header value. <code>SecretDetector</code> additionally masks the <code>X-Amz-Credential</code> and <code>X-Amz-Security-Token</code> URL parameters, <code>qrmk</code><code>snowflakedb/snowflake-jdbc#2751</code></li> <li>Restricted <code>WORKLOAD_IDENTITY</code> authentication to recognized Snowflake hosts: the attestation flow now verifies the target host before any ambient cloud credential is fetched and otherwise fails with <code>WORKLOAD_IDENTITY_FLOW_ERROR</code> naming the rejected host. Additional host suffixes can be permitted for local or test setups through the <code>SNOWFLAKE_WIF_ALLOWED_HOST_SUFFIXES</code><code>snowflakedb/snowflake-jdbc#2750</code></li> <li>Improved robustness of OCSP revocation checking: a definitive revocation result is now authoritative regardless of OCSP mode instead of being downgraded to a tolerable failure under the default <code>FAIL_OPEN</code> mode, each OCSP response entry is verified to describe the certificate being validated (issuer name hash, issuer key hash and serial number), and the cache entry is evicted on a definitive failure so it is not retained indefinitely. Recognized Snowflake host suffixes are now an explicit list (<code>snowflakecomputing.com</code>, <code>snowflakecomputing.cn</code>, <code>snowflakecomputing.mil</code>) matched on a label boundary, so a host on any other top-level domain is no longer detected as PrivateLink (SNOW-3649698).</li> <li>Fixed <code>PrivateLinkDetector.isPrivateLink()</code> accepting any hostname that merely contained <code>.privatelink.snowflakecomputing.</code> as a substring, so a host such as <code>evil.privatelink.snowflakecomputing.attacker.com</code> was classified as a PrivateLink Snowflake host; a hostname must now actually end with <code>.snowflakecomputing.<tld></code>. The OCSP response cache server URL, which is held in a JVM-wide static field, is now rejected when its host is not a Snowflake host (SNOW-3649698).</li> <li>Fixed <code>DecorrelatedJitterBackoff.nextSleepTime</code> throwing <code>IllegalArgumentException: bound must be greater than origin</code><code>snowflakedb/snowflake-jdbc#2744</code></li> <li>Fixed <code>DatabaseMetaData.getTablePrivileges()</code> concatenating unescaped table and schema names into SQL string literals, which allowed a quote character to break out of the query (SNOW-3236395).</li> <li>Fixed DECFLOAT <code>ResultSet.getString()</code> using engineering notation (<code>120E+198</code>) instead of normalized scientific notation (<code>1.2e200</code>); values whose unsigned plain form fits in 38 characters stay in plain decimal (SNOW-3229469).</li> <li>Fixed null nested structured-type fields throwing <code>NullPointerException</code> in <code>JsonSqlOutput</code> when binding via <code>SQLOutput</code> reference writers such as <code>writeObject</code>, <code>writeBigDecimal</code>, <code>writeBytes</code>, <code>writeDate</code>, and <code>writeTimestamp</code> (SNOW-1449489).</li> <li><code>snowflakedb/snowflake-jdbc#2377</code></li> <li>Fixed <code>SnowflakeBasicDataSource</code><code>snowflakedb/snowflake-jdbc#2621</code></li> <li>Fixed <code>SFFormatter</code> omitting the associated stack trace when a log record has a thrown exception (SNOW-466174).</li> <li>Fixed Linux credential cache parsing checking the root JSON node type a second time instead of the <code>tokens</code> child, which could fail the cache load when <code>tokens</code> was present but not an object (SNOW-4009235).</li> <li>Fixed <code>DatabaseMetaData.getColumns()</code> discarding <code>trim()</code> on column default values and throwing <code>NullPointerException</code> when SHOW COLUMNS returns a SQL NULL default (SNOW-4009234).</li> <li>Fixed <code>PreparedStatement.setObject(parameterIndex, byte[], Types.BINARY)</code> (and <code>Types.VARBINARY</code>/<code>Types.LONGVARBINARY</code>) binding the array's object reference (<code>[B@..</code>) instead of its hex value, causing a server-side <code>Invalid bind value ... for type (BINARY)</code> error; <code>byte[]</code> is now hex-encoded as <code>setBytes</code><code>snowflakedb/snowflake-jdbc#2731</code></li> <li>Fixed slow PUT uploads to client-side-encrypted (internal/temporary) stages on the AWS SDK v2 async upload path — S3, and the GCS <code>GCSAccessStrategyAwsSdk</code> strategy (<code>useVirtualUrl</code>); the default GCP path (<code>GCSDefaultAccessStrategy</code>) is unchanged — where the <code>CipherInputStream</code><code>snowflakedb/snowflake-jdbc#2746</code></li> <li>Bumped the following dependencies: <ul> <li><code>snowflakedb/snowflake-jdbc#2747</code></li> <li><code>snowflakedb/snowflake-jdbc#2735</code></li> </ul> </li> <li>Fixed <code>CertificateDiagnosticCheck</code> completing its TLS probe without SNI for allowlist hosts containing underscores (Snowflake account names): such hosts are rejected by <code>SNIHostName</code> per the RFC 952 Letter-Digit-Hyphen rule, causing the JDK to silently send no <code>server_name</code> extension and the check to report on a default certificate rather than the one a real client would be served. The check now probes the hyphenated host variant that Snowflake also serves. Host normalization is unified across the diagnostic checks and connect-string parsing in a single <code>SnowflakeUtil.normalizeSnowflakeHost</code> helper and is scoped to Snowflake hosts, so third-party allowlist hosts (cloud storage, OCSP responders, Duo, ...) are left unchanged. The <code>allowUnderscoresInHost</code><code>snowflakedb/snowflake-jdbc#2729</code></li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/snowflakedb/snowflake-jdbc/commit/43731aeb32f1a8e766b38322963611da2c5c019e";><code>43731ae</code></a> NO-SNOW: Bump version to 4.3.4 (<a href="https://redirect.github.com/snowflakedb/snowflake-jdbc/issues/2753";>#2753</a>)</li> <li><a href="https://github.com/snowflakedb/snowflake-jdbc/commit/08e48c3bd092e82b8f64c179788bee1a641af99d";><code>08e48c3</code></a> NO-SNOW: Validate account, port and protocol before synthesizing the JDBC URL...</li> <li><a href="https://github.com/snowflakedb/snowflake-jdbc/commit/0760449e6612d8748cee0e87869afca44a8a9891";><code>0760449</code></a> SNOW-3954279: Trim sensitive detail from response logging and extend secret m...</li> <li><a href="https://github.com/snowflakedb/snowflake-jdbc/commit/2b579f5d0e7ded033262323bfd716fc1cd87d50d";><code>2b579f5</code></a> NO-SNOW: Restrict WORKLOAD_IDENTITY authentication to recognized Snowflake ho...</li> <li><a href="https://github.com/snowflakedb/snowflake-jdbc/commit/b409c29e6e04a1ee8c00c5ef88f5f4a4fffe40de";><code>b409c29</code></a> SNOW-3649698: Treat definitive OCSP results as authoritative and bind respons...</li> <li><a href="https://github.com/snowflakedb/snowflake-jdbc/commit/e9c7a0cc563cb93bd4122a7d65c2560fca0f28b2";><code>e9c7a0c</code></a> SNOW-3649698: Validate PrivateLink and OCSP cache server hosts against the Sn...</li> <li><a href="https://github.com/snowflakedb/snowflake-jdbc/commit/6893424a9f871833ca3f6b2a335a5ce87108271d";><code>6893424</code></a> Bump grpc-java to 1.84.0 from 1.83.1 (<a href="https://redirect.github.com/snowflakedb/snowflake-jdbc/issues/2747";>#2747</a>)</li> <li><a href="https://github.com/snowflakedb/snowflake-jdbc/commit/bd013fb8f10d4ef5ff6fe6d45ba62f7983af6496";><code>bd013fb</code></a> SNOW-4039899: fix slow PUT to client-side-encrypted stages (<a href="https://redirect.github.com/snowflakedb/snowflake-jdbc/issues/2746";>#2746</a>)</li> <li><a href="https://github.com/snowflakedb/snowflake-jdbc/commit/a59169ad3975d89221d0c406a153b8b543cb6796";><code>a59169a</code></a> SNOW-4036693: Clamp DecorrelatedJitterBackoff previous sleep to base (<a href="https://redirect.github.com/snowflakedb/snowflake-jdbc/issues/2744";>#2744</a>)</li> <li><a href="https://github.com/snowflakedb/snowflake-jdbc/commit/56e500b5e791ebbc9c17733a0b951abfa86a89b8";><code>56e500b</code></a> SNOW-3236395: Escape quotes in getTablePrivileges SQL literals (<a href="https://redirect.github.com/snowflakedb/snowflake-jdbc/issues/2742";>#2742</a>)</li> <li>Additional commits viewable in <a href="https://github.com/snowflakedb/snowflake-jdbc/compare/v4.1.0...v4.3.4";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/spark/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
