do-not-merge: chore(deps): allow snowflake-connector-python 4.x - #1114
do-not-merge: chore(deps): allow snowflake-connector-python 4.x#1114Aaron ("AJ") Steers (aaronsteers) wants to merge 3 commits into
Conversation
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Included review availability: Your plan includes up to 2 reviews per rolling hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe project now permits ChangesSnowflake connector dependency
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This PR widens the Snowflake connector dependency range and updates the lockfile; no actionable merge-blocking risk remains after normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
👋 Greetings, Airbyte Team Member!Here are some helpful tips and reminders for your convenience. 💡 Show Tips and TricksTesting This PyAirbyte VersionYou can test this version of PyAirbyte using the following: # Run PyAirbyte CLI from this branch:
uvx --from 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1787019843-snowflake-connector-4x' pyairbyte --help
# Install PyAirbyte from this branch for development:
pip install 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1787019843-snowflake-connector-4x'PR Slash CommandsAirbyte Maintainers can execute the following slash commands on your PR:
📚 Show Repo GuidanceHelpful ResourcesCommunity SupportQuestions? Join the #pyairbyte channel in our Slack workspace. |
…o 4.7.2 Widening the specifier alone left the lock pinned at 3.18.0, so nothing actually moved off the old cryptography/OpenSSL builds. Co-Authored-By: AJ Steers <aj@airbyte.io>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
This PR widens PyAirbyte’s snowflake-connector-python dependency constraint to allow the 4.x series (up to <5.0) and refreshes the uv.lock resolution accordingly, enabling newer Snowflake connector releases and their updated transitive dependency set.
Changes:
- Updated
snowflake-connector-pythonversion constraint from<4.0to<5.0inpyproject.toml. - Updated
uv.lockto reflect the new allowed Snowflake connector version (now resolvingsnowflake-connector-python4.7.2) and associated transitive upgrades (notablycryptography,pyopenssl, andcffi).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
pyproject.toml |
Expands the allowed Snowflake connector range to include 4.x (<5.0). |
uv.lock |
Updates the resolved dependency set for the widened connector range (including the Snowflake connector and related crypto stack packages). |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Code Coverage OverviewLanguages: Python Python / code-coverage/pytest-fastThe overall coverage in commit 4a0c1f1 in the Show a code coverage summary of the most impacted files.
Python / code-coverage/pytest-no-credsThe overall coverage in commit 4a0c1f1 in the Show a code coverage summary of the most impacted files.
Python / code-coverage/pytestThe overall coverage in commit 4a0c1f1 in the Show a code coverage summary of the most impacted files.
Updated |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
|
Devin, the body of the PR should name exactly how to version resolved in the updated lock file |
|
Done — the body now names the exact resolved versions: |
devin-ai-integration
Bot
changed the title
Replaces: #1067
Summary
This PR extends the contribution from ohadmata (thank you! 🙏), cherry-picked from #1067 so the original commit authorship is preserved. Requested by Aaron ("AJ") Steers (@aaronsteers).
The contributor commits widen the
snowflake-connector-pythonbound from>=3.12.2,<4.0to>=3.12.2,<5.0. My follow-up commit re-locks, because the contributor's lock update only synced the specifier text and still resolved 3.18.0 — so the original PR had no actual security effect.Exact resolved versions in
uv.lockmainsnowflake-connector-pythoncryptographypyopensslcffisnowflake-sqlalchemystays at 1.8.2, which already declaressnowflake-connector-python<5.0.0, so the wider bound does not conflict with our other Snowflake dependency.Why the connector bump is required for the security fix
snowflake-connector-python3.18.0 pinscffi<2.0.0andpyOpenSSL<26.0.0, and everycryptography>=46.0.5requirescffi>=2.0.0. Onmain,uv lock --upgrade-package cryptography --upgrade-package pyopenssltherefore tops out atcryptography46.0.0 /pyopenssl25.3.0 — both below the fixed versions. 4.7.2 requirescryptography>=46.0.5and drops thecffiandpyOpenSSLcaps.Advisories cleared by the new resolution (OSV, base lock vs. this lock):
cryptography, fixed in 46.0.6cryptography, fixed in 46.0.5pyOpenSSL, fixed in 26.0.0pyOpenSSL, fixed in 26.0.0Not resolved here: GHSA-537c-gmf6-5ccf (vulnerable OpenSSL in
cryptographywheels, fixed in 48.0.1) and CVE-2026-69247/69248/69249 (fixed in 49.0.0–50.0.0) are out of reach of our owncryptography>=44.0.0,!=45.0.0,!=45.0.1,<47.0.0cap, not of Snowflake's bounds. Widening that cap is a separate decision.Verification
ruff format --check,ruff check,pyrefly check(this repo uses Pyrefly, not MyPy), 489 unit tests — all clean against 4.7.2.test_faker_read[Snowflake],test_replace_strategy[Snowflake],test_merge_strategy[Snowflake],test_auto_add_columns[Snowflake],test_cache_create_source_tables[Snowflake],test_sync_to_snowflake[uv_enabled|uv_disabled].Link to Devin session: https://app.devin.ai/sessions/1cb3b05bcaf9423a8d3a5a87310c277f