build(deps): Bump net.snowflake:snowflake-jdbc from 4.3.2 to 4.3.3

[dependabot]

Bumps net.snowflake:snowflake-jdbc from 4.3.2 to 4.3.3.

Release notes

Sourced from net.snowflake:snowflake-jdbc's releases.

v4.3.3

• Please Refer to Release Notes at https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

Changelog

Sourced from net.snowflake:snowflake-jdbc's changelog.

For all official JDBC Release Notes please refer to https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

Changelog

• v4.3.4-SNAPSHOT

  • Fixed PreparedStatement.setObject(parameterIndex, byte[], Types.BINARY) (and Types.VARBINARY/Types.LONGVARBINARY) binding the array's object reference ([B@..) instead of its hex value, causing a server-side Invalid bind value ... for type (BINARY) error; byte[] is now hex-encoded as setBytessnowflakedb/snowflake-jdbc#2731

• v4.3.3

  • Fixed GCS stage uploads corrupting files on virtual-hosted-style GCP accounts (useVirtualUrl=truesnowflakedb/snowflake-jdbc#2716
  • Fixed SLF4JLogger performing expensive SecretDetector.maskSecrets() regex work even when the log level is disabled, added level guards to all (String, boolean) and (String, Throwable) overloads to match JDK14Loggersnowflakedb/snowflake-jdbc#2712
  • Fixed the self-contained JAR shipping the non-gRPC-shaded Netty native libraries (libnetty_transport_native_epoll_*, libnetty_transport_native_kqueue_*, libnetty_resolver_dns_native_macos_*) unshaded, which caused an UnsatisfiedLinkError when they conflicted with a user's own Netty on the classpath. These libraries are now relocated with the libnet_snowflake_client_jdbc_internal_netty_* prefix to match the relocated io.nettysnowflakedb/snowflake-jdbc#2705
  • snowflakedb/snowflake-jdbc#2708
  • Bumped the following dependencies:
    • google-cloud-storage from 2.44.1 to 2.69.0, with all required transitive dependency version updates (google-cloud-core, google-api-grpc, google-auth-library, google-http-client, gax, protobuf, guava, slf4jsnowflakedb/snowflake-jdbc#2691
    • snowflakedb/snowflake-jdbc#2707snowflakedb/snowflake-jdbc#2713).
    • snowflakedb/snowflake-jdbc#2718
    • snowflakedb/snowflake-jdbc#2719
    • snowflakedb/snowflake-jdbc#2721
    • snowflakedb/snowflake-jdbc#2722

• v4.3.2

  • Fixed RestRequest logging retryable, temporal non-200 responses as ERROR (now: WARN), and fixed SnowflakeChunkDownloader using flat, short jitter between retries (now uses DecorrelatedJitterBackoff(1 s, 16 s)snowflakedb/snowflake-jdbc#2693
  • Fixed GCS PUT operations not retrying on transient errors (e.g. HTTP 503) despite putGetMaxRetriessnowflakedb/snowflake-jdbc#2688
  • snowflakedb/snowflake-jdbc#2669snowflakedb/snowflake-jdbc#2690).
  • snowflakedb/snowflake-jdbc#2690
  • Fixed snowflake-jdbc writing a snowflake-minicore-* temp directory and loading the native library at driver class-load time even when the driver was never used (e.g. when present on the classpath only as a transitive dependency). Minicore now loads lazily when the first Snowflake connection is created (ConnectionFactory.createConnection) instead of during DriverInitializer.initialize()snowflakedb/snowflake-jdbc#2670
  • Restored GetCallerIdentity as the default AWS Workload Identity Federation attestation method to avoid breaking existing users who have not configured the ISSUER in their Snowflake WIF setup. The GetWebIdentityToken (outbound JWT) flow introduced in v4.3.0 is now opt-in via the new workloadIdentityAwsUseOutboundToken connection property.
  • Fixed flaky SnowflakeDriverIT.testDBMetadata: the SHOW-based getTables metadata lookup could transiently return no rows right after the test table was created (metadata cache lag on shared/loaded accounts), so the lookup is now retried until the table becomes visible, and on very slow CI runners where propagation exceeds the retry window the test is skipped rather than failed (the mapping is covered deterministically by DatabaseMetadataWiremockLatestITsnowflakedb/snowflake-jdbc#2673
  • Fixed flaky DatabaseMetaDataLatestIT.testUnderscoreInSchemaNamePatternForPrimaryAndForeignKeys[WithPatternSearchDisabled]: the SHOW-based getPrimaryKeys/getImportedKeyssnowflakedb/snowflake-jdbc#2673
  • Fixed flaky DatabaseMetaDataIT.testGetPrimarykeys and SnowflakeDriverIT.testConstraints (eventually-consistent PK/FK constraint metadata after DDL) by retrying the constraint metadata lookups until visible. Replaced the live, concurrent stress tests DatabaseMetaDataLatestIT.test[No]PatternSearchAllowedForPrimaryAndForeignKeys (which timed out on slow CI runners) with deterministic coverage in the new DatabaseMetadataWiremockLatestIT, which validates the getTables/getPrimaryKeys/getImportedKeys SHOW-result mapping and the enablePatternSearchsnowflakedb/snowflake-jdbc#2673
  • Fixed the Loader API (StreamLoader.setVectorColumns) throwing Loader$ConnectionError: ... Result set has been closed when the getColumns metadata lookup returned no rows. The result set returned by getColumns closes itself once next() runs out of matching rows, so the unchecked rs.next() followed by rs.getString(...) raised "Result set has been closed"; the result is now read only when rs.next() returns a row. This intermittently aborted concurrent loads (e.g. FlatfileReadMultithreadIT) when the SHOW COLUMNSsnowflakedb/snowflake-jdbc#2674
  • Fixed uploadStream/downloadStream failing with SQL compilation errors when the stage reference contains non-ASCII characters (e.g. Japanese schema names). Stage references in internally generated PUT/GET commands are now wrapped in single quotes when they contain characters that require quoting per Snowflake SQL syntax (SNOW-3713887).
  • Fixed authenticator=externalbrowser login crashing with StringIndexOutOfBoundsExceptionsnowflakedb/snowflake-jdbc#2687
  • Fixed a permanent HTTP connection pool slot leak in RestRequest.executeWithRetriessnowflakedb/snowflake-jdbc#2643
  • snowflakedb/snowflake-jdbc#2696

• v4.3.1

  • Fixed GCS-backed internal stage PUT failing with opaque invalid_gcs_credentials in SPCS pods on GCP: the GCS SDK's Application Default Credentials (ADC) probe was reaching out to metadata.google.internal which is unreachable inside SPCS; explicit credentials are now always set when a GCS_ACCESS_TOKEN is present, suppressing the ADC probe entirely. Also fixed GCSAccessStrategyAwsSdk rejecting custom GCS endpoints that lack an https:// scheme prefix (e.g. bare storage.me-central2.rep.googleapis.com), mirroring the existing handling in GCSDefaultAccessStrategy. The catch-all in setupGCSClientsnowflakedb/snowflake-jdbc#2664
  • Fixed Azure PUT memory leak where each PUT instantiated a fresh BlobServiceClient whose underlying reactor-netty stack the SDK exposes no API to release; the Azure SDK HttpClient and its ConnectionProvidersnowflakedb/snowflake-jdbc#2658
  • Fixed SFResultJsonParser2Failed: invalid escaped unicode character when a chunked JSON result contained UTF-16 surrogate-pair \u escapes (e.g. emoji) and the read buffer happened to split exactly 9 bytes after \u; the off-by-one boundary guard in ResultJsonParserV2snowflakedb/snowflake-jdbc#2660
  • Fixed (by removing) stale com.amazonaws.util.Base16/Base64 bytecode references from the shaded JAR by excluding dead SFBinary and SFBinaryFormat classes from the bundled snowflake-common artifact. Security scanners shold no longer flag snowflake-jdbc-thinsnowflakedb/snowflake-jdbc#2665
  • snowflakedb/snowflake-jdbc#2663

• v4.3.0

  • Bumped AWS SDK from 2.37.5 to 2.45.1, which transitively brings netty up to 4.1.133.Final and resolves a cluster of High/Medium netty CVEs (HTTP request smuggling, CRLF injection, data amplification, resource allocation) flagged by Snyk against netty-nio-client in thin_public_pom.xmlsnowflakedb/snowflake-jdbc#2654
  • Bumped jackson to 2.18.7 to address two High-severity resource-exhaustion CVEs in jackson-core 2.18.4.1, and added a .snyk policy file with justified ignores for the dual-licensed javax.servlet-api / javax.annotation-api findings and the tika-core XXE (SNYK-JAVA-ORGAPACHETIKA-14188255snowflakedb/snowflake-jdbc#2654
  • Fixed OAuth token requests sending scope=session:role:null when no scope is configured (or scope is empty/blank); the scopesnowflakedb/snowflake-jdbc#2646
  • Fixed Okta native SSO federated login sending malformed JSON to /api/v1/authn (HTTP 400 from Okta) when the username or password contained JSON-special characters such as double quotes or backslashes; the request body is now serialized with Jackson instead of string concatenation.
  • Added one in-band telemetry record per successful login describing which connection-identifier fields the user supplied (account_provided, account_with_region, account_org_provided, region_provided, host_provided). No hostname or account value is included. This is gated by the existing server-side CLIENT_TELEMETRY_ENABLED parameter and can additionally be disabled locally by setting SF_TELEMETRY_DISABLE_CONNECTION_SHAPE=true. The telemetry collection is time-boxed and will be removed in a future release.
  • Fixed SnowflakeChunkDownloader per-chunk metrics log misattributing the response body transfer to parseTime: getResultStreamProvider().getInputStream() returns once headers come back and streams the body lazily during the parser's read() calls, so the old code billed only HTTP/TLS setup to downloadTime and the entire body read+parse to parseTime. When the metrics logger is at FINE/debug level, the InputStream is now wrapped in a TimingInputStream that accumulates time blocked inside read(), so downloadTime reflects true network read time and parseTime reflects only CPU parse cost; at higher log levels the original stream is used unchanged to avoid the per-read()snowflakedb/snowflake-jdbc#2640

... (truncated)

Commits

• 967ad55 NO-SNOW: Bump version to 4.3.3 (#2727)
• 553b081 NO-SNOW: (doc only) document HikariCP key-pair auth caveat in README (#2723) ...
• ae459e5 NO-SNOW: Prevent unicode StreamLatestIT schemas from flaking DatabaseMetaData...
• dde2d23 NO-SNOW: bump jsoup to 1.23.1 from 1.15.3 (#2722)
• 31efe84 NO-SNOW: bump jackson-databind to 2.18.10 from 2.18.9 (#2721)
• db272e2 NO-SNOW: bump netty to 4.1.137.Final from 4.1.136.Final (#2719)
• fb57965 SNOW-3888537: Don't force a CRC32 checksum on the GCS S3-interop upload path ...
• 2bb7f2b SNOW-3887909 bump GitHub Actions to Node 24-compatible majors (#2715)
• b005dca NO-SNOW: bump BouncyCastle jars (#2718)
• a581ec4 NO-SNOW: grpc-java to 1.83.1 (#2713)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)