[karakanb]

Summary

Fixes all 29 open critical and high Dependabot alerts by upgrading the affected packages in uv.lock.

Package	Before → After	Alerts
snowflake-connector-python	4.3.0 → 4.8.0 (py3.10) / 4.8.1	1 critical
pyjwt	2.11.0 → 2.15.1	1 critical, 4 high
urllib3	1.26.20 / 2.6.3 → 2.8.0	7 high
cryptography	46.0.5 → 50.0.2	3 high
pyasn1	0.6.2 → 0.6.5	4 high
sqlparse	0.5.5 → 0.6.0	3 high
thrift	0.20.0 → 0.25.0 (via databricks-sql-connector 4.2.5 → 4.8.0)	2 high
httplib2	0.31.2 → 0.32.1	1 high
pyarrow	21.0.0 / 23.0.1 → 23.0.1 (py3.14) / 25.0.1 / 26.0.0	1 high
pyopenssl	25.3.0 → 26.4.0	1 high
orjson	3.11.5 / 3.11.7 → 3.13.0	1 high

Also:

• grpcio / grpcio-status 1.78.1 → 1.85.0 (1.78.1 was yanked).
• The lock was stale relative to pyproject.toml (still resolved for Python 3.9, missing the fabric extra deps, bruin-sdk 0.3.2). Re-locking cleans that up, hence the large diff.

Lock constraints ([tool.uv] constraint-dependencies)

These only affect uv.lock, not the published package metadata.

• snowflake-connector-python<5: 5.x removes the region connection parameter (it is ignored with a warning), which _create_snowflake passes. Moving to 5.x should be a separate change.
• pyarrow<24 on Python 3.14: required by snowflake-connector-python 4.x's pandas support there.

Notes

• cryptography 50 no longer ships x86_64 macOS / 32-bit Windows wheels; contributors on those platforms would build from source.
• Snowflake and Databricks connections are not exercised against real warehouses by the test suite.

Test plan

• uv run ruff format --check .
• uv run python -m pytest tests/ -q (230 passed, 13 skipped, Python 3.14)
• CI

🤖 Generated with Claude Code