Chore(deps): Bump snowflake-sqlalchemy from 1.7.3 to 1.11.0 in /ingestion

[dependabot]

Bumps snowflake-sqlalchemy from 1.7.3 to 1.11.0.

Release notes

Sourced from snowflake-sqlalchemy's releases.

Release

• v1.11.0 (July 7, 2026)

• Sensitive connection parameters: We curated a set of connector kwargs (host, protocol, token_file_path, private_key_file, ocsp_response_cache_filename, connection_diag_log_path, crl_cache_dir, unsafe_file_write, unsafe_skip_file_permissions_check) that can no longer be supplied via the URL query string — pass them via connect_args= in create_engine() instead (applications already doing so are unaffected). If you encounter a possible behavioral change, set SNOWFLAKE_SQLALCHEMY_LEGACY_URL_PARAMS=1 and follow the instructions at Sensitive connection parameters.

• Improve _url() helper and create_connect_args connection-parameter handling:

  • account and region values are now validated against an allowlist of DNS-safe characters (alphanumeric, -, ., _) before being interpolated into the connection URL, preventing URL-authority corruption from unexpected characters.
  • user values are percent-encoded before being placed in the URL userinfo component, preserving the original value delivered to the connector while preventing @, ?, and # from being misinterpreted as URL delimiters.

• ClusterByOption now raises TypeError at DDL compile time when an expression element is neither a str nor a sqlalchemy.sql.expression.TextClause. Previously, such values were silently coerced via str(), which produced malformed DDL (e.g. bind-parameter placeholders like :id_1) for any expression beyond a bare column name. The accepted types match the documented constructor signature; code using only str or text(...) is unaffected.

• Improve identifier quoting and string-literal escaping for caller-supplied values across the DDL compiler so they are rendered consistently with the rest of the dialect. Column keys in MERGE INTO (both the WHEN NOT MATCHED … INSERT list and WHEN MATCHED … SET targets), stage namespaces/names, format_name, and file_format are now routed through the identifier preparer, and a quote=False schema or column label is quoted when it contains characters that would otherwise require quoting instead of being emitted verbatim. Cloud-storage URIs, CREDENTIALS, and ENCRYPTION clauses (shared by COPY INTO and CREATE STAGE) and FILES=(…) entries now apply the dialect's standard literal escaping ('→'', \→\\); CREATE STAGE builds its SQL from the container's fields rather than repr(container). Legal identifiers — including upper-case names that Snowflake folds — still render bare, so existing DDL is unchanged.

• Improve escaping in CopyIntoStorage / CreateStage / CreateFileFormat and add secret redaction (SNOW-3656048):

  • FILE_FORMAT option string values (e.g. CSVFormatter().date_format(...), file_extension, timestamp_format) are now escaped before being embedded in the compiled SQL, improving single-quote escaping (SNOW-3649888).
  • repr() of AWSBucket, AzureContainer, GCSBucket (and, transitively, CopyIntoStorage) now masks cloud secrets — AWS_SECRET_KEY, AWS_KEY_ID, AWS_TOKEN, AZURE_SAS_TOKEN, MASTER_KEY are rendered as '***' (SNOW-3649782). Compiled SQL is unchanged.
  • Added an opt-in logging redactor for engine logs that contain inline credentials: SnowflakeSecretRedactionFilter, add_secret_redaction_filter(), and redact_secrets(). Prefer STORAGE_INTEGRATION to avoid putting secrets in SQL at all (SNOW-3649850).

• Fix get_view_definition silently truncating or failing for view names that contain a single quote or backslash (e.g. o'brien). The name is now SQL-escaped (' → '', \ → \\) before being embedded in the SHOW VIEWS LIKE '...' literal, so such views are found correctly and no query manipulation is possible via a crafted view name.

• Optimise single-table reflection (SNOW-3720548): reflecting one table no longer scans the entire schema, reducing latency and Snowflake credit usage for targeted Inspector calls.

Release

• v1.10.2 (June 18, 2026)

Release

• v1.10.1 (June 15, 2026)
  • Fix regexp_match and regexp_replace flags rendered as bound parameters instead of literal strings (#SNOW-3573046). Flags passed to ColumnElement.regexp_match(..., flags=...) and ColumnElement.regexp_replace(..., flags=...) were processed through the standard parameter pipeline, producing incorrect SQL. Flags are now rendered as inline string literals, matching Snowflake's expected REGEXP_LIKE(col, pattern, 'i') / REGEXP_REPLACE(col, pattern, replacement, 'i') syntax.
  • Fix inconsistent identifier quoting in _StructuredTypeInfoManager.get_table_columns. The DESC TABLE fallback path used raw denormalised names in an f-string while all other reflection paths apply ip.quote(denormalize_name(...)) via _always_quote_join. Schema and table components are now consistently double-quoted before the statement is constructed, and the method delegates to get_table_columns_by_full_name to collapse the two previously divergent code paths.

Release

• v1.10.0 (May 20, 2026)
  • Fix with_loader_criteria silently dropping filters on non-Snowflake dialects (#676). Importing snowflake-sqlalchemy previously altered SQLAlchemy's ORM compilation for every dialect in the process, causing loader-criteria filters to be omitted inside sealed subqueries when using PostgreSQL, MySQL, SQLite, etc. Snowflake dialect behavior is unchanged; the BCR-1057 lateral-join workaround is now scoped to Snowflake connections only.
  • Map Snowflake UUID column type to sqlalchemy.sql.sqltypes.UUID for reflection on SQLAlchemy 2.x (#681). Previously reflected as NullType. Values are returned as plain strings (as_uuid=False) rather than uuid.UUID instances. No change on SQLAlchemy 1.4 where the generic UUID type does not exist.
  • Add GCS bucket support for CopyIntoStorage (SNOW-721174, #368).
  • Scope referred_schema=None normalization in foreign key reflection to the default schema only (#610, SNOW-2313675):
    • When reflecting the default schema, same-schema FKs (default → default) keep the established SQLAlchemy convention of referred_schema=None, preserving compatibility with the upstream reflection test suite and with applications that do not qualify default-schema FK targets.
    • When reflecting a non-default schema every FK keeps its actual referred_schema, which prevents SQLAlchemy's _reflect_fk from autoloading a non-default-schema target from the wrong place (the bug behind #610) and avoids the Alembic autogenerate mismatch that previously occurred when user metadata explicitly qualified a cross-schema FK that happened to target the default schema.
  • Add SnowflakeBase, snowflake_declarative_base(), and SnowflakeSession to enable efficient bulk inserts for ORM models with nullable optional columns (SNOW-893080, #441). When session.bulk_save_objects() is used with models that have randomly populated nullable columns, SQLAlchemy normally groups objects by their set of non-None column keys, producing O(N) separate INSERT statements. SnowflakeBase / snowflake_declarative_base() pre-populate all plain-nullable columns at construction time, and SnowflakeSession passes render_nulls=True so all objects share the same parameter-key set and are batched into a single executemany INSERT.
  • Fix case-sensitive identifier handling (SNOW-1232488). Always-active bug fixes with no behavioural change for default users:
    • _split_schema_by_dot now correctly parses SQL-escaped double-quotes ("") inside quoted schema/database identifiers (e.g. "my""schema" → my"schema), preventing silent truncation of identifiers containing literal quote characters.
    • denormalize_column_name now correctly double-quotes quoted_name("mycol", True) columns in CLUSTER BY clauses instead of silently dropping the case-sensitivity signal. The caller has already opted into case-sensitive semantics by constructing a quoted_name(..., True), so this is honoured independently of the dialect flag.
    • _has_object (used by has_table / has_sequence) now applies denormalize_name to both the schema and object name before building the DESC SQL, making it consistent with all other reflection methods.
    • Atomic _NameUtils swap in create_connect_args — when the URL's case_sensitive_identifiers value differs from the current dialect state, the name_utils instance is replaced rather than mutated in place, so concurrent readers on other threads observe either the old or the new instance but never a torn update.
  • Add case_sensitive_identifiers opt-in engine flag (kwarg or ?case_sensitive_identifiers=True URL param) governing three related behaviours. The default is False; existing applications are unaffected unless they explicitly opt in:
    • ALL-UPPERCASE reserved-word identifiers (e.g. TABLE) are normalised to quoted_name("table", True) instead of returning unchanged, preventing key-lookup mismatches between creation and reflection.
    • Mixed-case reflected identifiers (e.g. MyCol from a quoted Snowflake column) are returned as quoted_name("MyCol", True) instead of a plain str. Emitted SQL is identical in both modes (_requires_quotes force-quotes any name containing uppercase chars); the difference is only observable via isinstance(..., quoted_name) and .quote.
    • Schema strings with inner double-quotes — e.g. '"myschema"' or '"mydb"."myschema"' — have their extracted parts marked quote=True by _split_schema_by_dot, preserving case-sensitivity in emitted SQL. Without the flag, the extracted parts keep quote=None and the preparer's _requires_quotes heuristic decides per-part (stripping inner quotes for all-lowercase parts, which matches pre-PR behaviour). Use quoted_name("myschema", True) or MetaData(schema=quoted_name(..., True)) to opt into case-sensitivity on a per-value basis without enabling the flag.
  • Add create_snowflake_engine(url, schema=..., case_sensitive_schema=True) helper that URL-encodes case-sensitive schema names using %22 so the Snowflake connector receives the literal double-quoted form. Fix security vulnerability: schema names are now always URL-encoded regardless of case_sensitive_schema, preventing special characters (?, #, /) from being misinterpreted as URL delimiters by SQLAlchemy's URL parser.
  • Add snowflake.sqlalchemy.alembic_util.render_item — a drop-in Alembic render_item hook for env.py that serialises quoted_name columns with quote=True correctly in generated migration files, preventing Alembic autogenerate from silently converting case-sensitive column names to uppercase.
  • Emit SnowflakeWarning at DDL compile time when Identity() is used on a primary key column, alerting users that ORM flush operations will raise a FlushError. The warning is emitted once per unique (table, column) pair per Python process. Use Sequence() instead.
  • Add support for cross-database schema reflection using schema='database.schema' notation. This allows reflecting and joining tables from different databases in a single session without raw SQL. (#456)
  • Restored backward-compatible SQL generation for true division (/) when div_is_floordiv=True: the Snowflake compiler now correctly delegates to the SQLAlchemy base implementation, emitting CAST(col AS NUMERIC) for integer operands as it did before #545 introduced the override (#618).
  • Introduce composite key ordering, fixes #450
  • Optimise reflection performance (SNOW-689531, #656):
    • Add get_multi_columns, get_multi_pk_constraint, get_multi_unique_constraints, get_multi_foreign_keys for SQLAlchemy 2.x bulk reflection — each issues one schema-wide query per reflection pass instead of one query per table.

... (truncated)

Commits

• 5a6f87f chore/release-1.11.0: release notes and version bump (#715)
• d014de7 Snow 3720548 optimize reflection cache (#703)
• 41f8696 Post-refactor cleanup: name utilities, quoting internals, and identifier tests
• ed16ec5 Fix object type handling and repr object representation
• fe74171 Fix view show like single quote escaping
• e07ea74 Reflection name handling improvements
• 2c33792 SNOW-3656098: enhance connection param handling
• bf7d250 Snow 3656048 copy stage improvements
• a198ed2 SNOW-3656026 identifiers and literal quoting
• 35edf4d SNOW-3655930: improve escaping and rendering
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Hi there 👋 Thanks for your contribution!

The OpenMetadata team will review the PR shortly! Once it has been labeled as safe to test, the CI workflows
will start executing and we'll be able to make sure everything is working as expected.

Let us know if you need any help!