[karakanb]

Summary

Fixes the 19 Dependabot alerts still open after #9 (1 critical, 3 high, 12 medium, 3 low). 13 of them (#63–#75) come from advisories published on 2026-10-28.

Package	Before → After	Alerts
certifi	2026.1.4 (py3.10 entry) → 2026.10.23	1 critical
fsspec	2026.2.0 → 2026.9.0	1 high
oauthlib	3.3.1 → 4.0.0	1 high, 2 medium
filelock	3.24.3 → 4.2.4	1 high, 6 medium, 2 low
opentelemetry-api	1.39.1 → 1.45.1	1 medium
idna	3.11 → 3.20	1 medium
requests	2.32.5 → 2.34.2	1 medium
pytest	9.0.2 → 9.2.0	1 medium
pygments	2.19.2 → 2.21.0	1 low

Dropping Python 3.10 (breaking)

filelock's fixes only exist in 4.2.1+, which requires Python 3.11. To clear those alerts:

• requires-python → >=3.11, 3.10 classifier removed
• ruff target-version → py311
• CI test matrix: 3.10 → 3.11 (now 3.11, 3.12, 3.13)
• Version bumped 0.5.2 → 0.6.0

Side effect: snowflake-connector-python is now 4.8.1 everywhere (4.8.0 was only for 3.10).

Notes

• oauthlib 4.0's breaking changes are in its OAuth provider (server) side; databricks-sql-connector and requests-oauthlib (via pygsheets) only use the client side.
• Publishing 0.6.0 to PyPI requires creating a GitHub release after merge.

Test plan

• uv run ruff check . and uv run ruff format --check .
• uv run python -m pytest tests/ -q on Python 3.14 (230 passed, 13 skipped)
• Unit tests on Python 3.11 and 3.13 (219 passed)
• CI

🤖 Generated with Claude Code