Bump snowflake-connector-python to 4.7.3 (CVE-2026-15925) and add query runner tests

[madmuffin1]

What type of PR is this?

• Other — security dependency bump, plus test coverage

Description

snowflake-connector-python is currently pinned to 4.5.0, which is affected by CVE-2026-15925 (CRITICAL). This bumps the pin to 4.7.3 — past the 4.7.1 fixed version, and the current release at time of writing.

Compatible versions: the query runner uses only the DB-API surface of snowflake.connector (connect, cursor, execute, description, close), which is unchanged across 4.5.0 → 4.7.3.

The Snowflake query runner had no test coverage at all, so this also adds tests/query_runner/test_snowflake.py covering the logic a connector upgrade could plausibly affect:

• determine_type / TYPES_MAP, including the scale > 0 → float rule
• connection parameters — the us-west region special case, region-in-host derivation, explicit host override, password auth and key pair auth (plain and password-encrypted), and the missing-credentials error
• run_query — column and row parsing, the USE WAREHOUSE / USE <db> preamble, lower_case_columns, and cursor/connection cleanup when execute raises
• get_schema — grouping by schema.table, skipping non-COLUMN rows, and SHOW COLUMNS vs SHOW COLUMNS IN DATABASE

The tests patch snowflake.connector.connect and drive the runner through fake cursor/connection objects, following the existing style in tests/query_runner/test_athena.py. No new dependencies.

Note on the lockfile: re-running uv lock also picks up the redash version change from the 26.09.0-dev snapshot, which the committed lockfile had not caught up with yet. That line is unrelated to this change.

How is this tested?

• Unit tests (pytest, jest)
• Manually

17 new tests, all passing against 4.7.3. They also pass against the old 4.5.0, confirming the bump is not a behaviour change on these paths.

Additionally, the type-code mapping was verified out-of-tree against a real connector 4.7.3 talking the actual Snowflake wire protocol to a fakesnow server, feeding the resulting cursor to the runner's own _parse_results. Every code still maps as TYPES_MAP expects:

INT→0/scale 0→integer     NUMBER(10,2)→0/scale 2→float    FLOAT→1→float
VARCHAR→2→string          DATE→3→date                     BOOLEAN→13→boolean
TIMESTAMP_NTZ→8→datetime  TIMESTAMP_LTZ/TZ→7→datetime

That check is not included in the test suite: fakesnow requires duckdb~=1.5.5 while this repo pins duckdb==1.3.2 for the DuckDB runner, so the two cannot currently coexist. It also does not implement USE WAREHOUSE, bare USE <db>, or SHOW COLUMNS IN DATABASE, so it cannot drive run_query / get_schema end to end regardless.

Related Tickets & Documents

CVE-2026-15925

Mobile & Desktop Screenshots/Recordings (if there are UI changes)

N/A — no UI changes.

[greptile-apps]

Greptile Summary

The PR upgrades snowflake-connector-python from 4.5.0 to 4.7.3 to address CVE-2026-15925 and adds focused Snowflake query-runner coverage.

• Updates the dependency declaration and lockfile artifacts for connector 4.7.3.
• Adds tests for type mapping, authentication parameters, query parsing and cleanup, column casing, and schema discovery.
• Refreshes the lockfile’s Redash project version metadata.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or independently actionable non-blocking issues identified.

The upgraded connector matches the repository’s supported runtime and existing DB-API usage, resolves the targeted vulnerability, and the new tests are collected in CI with the required optional dependency installed.

Important Files Changed

Filename	Overview
pyproject.toml	Updates the pinned Snowflake connector to a Python 3.13-compatible version beyond the stated security fix.
tests/query_runner/test_snowflake.py	Adds well-scoped unit coverage whose fakes match the query runner’s exercised cursor and connection contracts.
uv.lock	Resolves connector 4.7.3 with matching artifacts and updates the project version metadata without changing other dependency versions.

_{Reviews (1): Last reviewed commit: "Bump snowflake-connector-python to 4.7.3..." | Re-trigger Greptile}

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}