rb_snowflake_client 1.5.0 → 1.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ddf76c34f14ea4b7192e5bd3dbdb18b7d176e66c6327fab97ef8d4352138d964
-  data.tar.gz: 20223663cc72100e28b22a4ea572611d2b2bc8291519d1cde9f2b536c02865f1
+  metadata.gz: 57d979564fce1cdc8fb8b92043e89b631f4f1ca35db2cc2d4601a1739506e89a
+  data.tar.gz: ecfd25eb94ae8e5767e49c7b3b5dd33f02905e09c839ba0bd59be81f629f1390
 SHA512:
-  metadata.gz: 266de51be70f28c748b703fc55787b0a495404a62226fba151c44dfe00ce31465c3aae5e516ba362cdfa8a22a0d597514d86fd6644f263a046cb275b0a3e3f46
-  data.tar.gz: b0e90b538d9b6557d7de1b58f085570097036df3a9d1ea6be500babb6b56fafb50f21a4d905f1c50e8a274df7ffdd58b6268d65f9dc2220c7e9f70680662479c
+  metadata.gz: 906470b3b67d6a102bbe25bc02e42c2178a4a9fc7a1eb6785398a1bfc45d6e47e9b5dc392aebc4dc35dbd0c6a2263c30c39c3ce522396a6584629f8d8e7ad43e
+  data.tar.gz: d767e9956def03c80dd8eb66d24649c54c987f37dc07870a319a55ac9455821b330e4d5a59e89246282899f40d76222c6a07b90dc6882a5e89ba3c410a6c1f95

data/CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+## [1.6.1] - 2026-08-18
+### Security
+- Bumped `json` to patch a format-string injection CVE (#169)
+- Bumped `concurrent-ruby` and `jwt` to patch CVEs (#182)
+### Changed
+- `Gemfile.lock` is no longer shipped inside the published gem. It has no function in a
+  consumer's dependency resolution, but image scanners read it as a manifest and reported our
+  development pins as CRITICAL findings against every consumer (#186)
+
+## [1.6.0] - 2026-04-13
+### Added
+- Support for passing a passphrase when using an encrypted private key for JWT authentication (#166)
+### Security
+- Bumped `activesupport` to patch CVEs (#167)
+
 ## [1.5.0] - 2025-10-14
 ### Added
 - Instrumentation feature added for Active Support users

data/Gemfile

@@ -9,7 +9,7 @@ gem "bundler"
 gem "rake"
 
 group :development, :test do
-  gem "activesupport"
+  gem "activesupport", "~> 8.0.4", ">= 8.0.4.1"
 end
 
 group :development do

data/README.md

@@ -48,6 +48,8 @@ Available ENV variables (see below in the config section for details)
 - `SNOWFLAKE_URI`
 - `SNOWFLAKE_PRIVATE_KEY_PATH` or `SNOWFLAKE_PRIVATE_KEY`
   - Use either the key or the path. Key takes precedence if both are provided.
+- `SNOWFLAKE_PRIVATE_KEY_PASSPHRASE`
+  - Optional, if you are using an encrypted private key
 - `SNOWFLAKE_ORGANIZATION`
   - Optional, if you leave it off, the library will authenticate with an account name of only SNOWFLAKE_ACCOUNT
 - `SNOWFLAKE_ACCOUNT`
@@ -265,6 +267,7 @@ or alternatively, use the client to verify:
 client = RubySnowflake::Client.new(
   "https://yourinstance.region.snowflakecomputing.com", # insert your URL here
   File.read("secrets/my_key.pem"),                      # path to your private key
+  "private-key-passphrase",                             # your private key passphrase, if it has one (defaults to nil)
   "snowflake-organization",                             # your account name (doesn't match your URL), using nil may be required depending on your snowflake account
   "snowflake-account",                                  # typically your subdomain
   "snowflake-user",                                     # Your snowflake user

data/lib/ruby_snowflake/client/key_pair_jwt_auth_manager.rb

@@ -8,12 +8,13 @@ module RubySnowflake
   class Client
     class KeyPairJwtAuthManager
       # requires text of a PEM formatted RSA private key
-      def initialize(organization, account, user, private_key, jwt_token_ttl)
+      def initialize(organization, account, user, private_key, jwt_token_ttl, private_key_passphrase = nil)
         @organization = organization
         @account = account
         @user = user
         @private_key_pem = private_key
         @jwt_token_ttl = jwt_token_ttl
+        @private_key_passphrase = private_key_passphrase
 
         # start with an expired value to force creation
         @token_expires_at = Time.now.to_i - 1
@@ -26,8 +27,7 @@ module RubySnowflake
         @token_semaphore.acquire do
           now = Time.now.to_i
           @token_expires_at = now + @jwt_token_ttl
-
-          private_key = OpenSSL::PKey.read(@private_key_pem)
+          private_key = OpenSSL::PKey.read(@private_key_pem, @private_key_passphrase)
 
           payload = {
             :iss => "#{account_name}.#{@user.upcase}.#{public_key_fingerprint}",
@@ -56,7 +56,7 @@ module RubySnowflake
         def public_key_fingerprint
           return @public_key_fingerprint unless @public_key_fingerprint.nil?
 
-          public_key_der = OpenSSL::PKey::RSA.new(@private_key_pem).public_key.to_der
+          public_key_der = OpenSSL::PKey::RSA.new(@private_key_pem, @private_key_passphrase).public_key.to_der
           digest = OpenSSL::Digest::SHA256.new.digest(public_key_der)
           fingerprint = Base64.strict_encode64(digest)
 

data/lib/ruby_snowflake/client.rb

@@ -97,6 +97,7 @@ module RubySnowflake
       new(
         ENV.fetch("SNOWFLAKE_URI"),
         private_key,
+        ENV["SNOWFLAKE_PRIVATE_KEY_PASSPHRASE"],
         ENV.fetch("SNOWFLAKE_ORGANIZATION"),
         ENV.fetch("SNOWFLAKE_ACCOUNT"),
         ENV.fetch("SNOWFLAKE_USER"),
@@ -116,7 +117,7 @@ module RubySnowflake
     end
 
     def initialize(
-      uri, private_key, organization, account, user, default_warehouse, default_database,
+      uri, private_key, private_key_passphrase = nil, organization, account, user, default_warehouse, default_database,
       default_role: nil,
       logger: DEFAULT_LOGGER,
       log_level: DEFAULT_LOG_LEVEL,
@@ -130,7 +131,7 @@ module RubySnowflake
     )
       @base_uri = uri
       @key_pair_jwt_auth_manager =
-        KeyPairJwtAuthManager.new(organization, account, user, private_key, jwt_token_ttl)
+        KeyPairJwtAuthManager.new(organization, account, user, private_key, jwt_token_ttl, private_key_passphrase)
       @default_warehouse = default_warehouse
       @default_database = default_database
       @default_role = default_role

data/lib/ruby_snowflake/version.rb

@@ -1,3 +1,3 @@
 module RubySnowflake
-  VERSION = "1.5.0"
+  VERSION = "1.6.1"
 end

data/rb_snowflake_client.gemspec

@@ -14,8 +14,23 @@ Gem::Specification.new do |s|
   s.homepage = "https://github.com/rinsed-org/rb-snowflake-client"
   s.license = "MIT"
 
+  # Gemfile.lock is excluded deliberately, and it is a security fix rather than tidiness.
+  #
+  # A lockfile has no function inside a published gem -- Bundler resolves a consumer's tree from the
+  # dependency constraints below, never from a lockfile shipped in a dependency -- but container image
+  # scanners read any Gemfile.lock they find on disk as a manifest of what is installed. So our
+  # DEVELOPMENT lock became a vulnerability report against every consumer: an image that installs this
+  # gem gets .../gems/rb_snowflake_client-1.6.0/Gemfile.lock scanned, and the pinned
+  # concurrent-ruby 1.3.6, jwt 3.1.2 and json 2.15.1 are reported as CRITICAL findings on the consumer.
+  #
+  # That is all three CRITICAL findings on the DataExtract Lambda image, and they are unfixable there:
+  # the versions are ours, in our published artifact, and no bump on the consumer's side can move them.
+  # The runtime constraints (concurrent-ruby >= 1.2, json >= 2.1.0, jwt >= 2.7) are open-ended, so
+  # consumers already resolve their own versions and lose nothing by not receiving this file.
   s.files = Dir.chdir(File.expand_path(__dir__)) do
-    `git ls-files -z`.split("\x0").reject { |f| f.match(%r{\A(?:test|spec|features|vendor)/}) }
+    `git ls-files -z`.split("\x0").reject do |f|
+      f.match(%r{\A(?:test|spec|features|vendor)/}) || f == "Gemfile.lock"
+    end
   end
 
   s.require_paths = ["lib"]

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rb_snowflake_client
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.6.1
 platform: ruby
 authors:
 - Rinsed
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-10-14 00:00:00.000000000 Z
+date: 2026-08-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bigdecimal
@@ -127,7 +127,6 @@ files:
 - CHANGELOG.md
 - CODE_OF_CONDUCT.md
 - Gemfile
-- Gemfile.lock
 - LICENSE.txt
 - README.md
 - Rakefile

data/Gemfile.lock

@@ -1,84 +0,0 @@
-PATH
-  remote: .
-  specs:
-    rb_snowflake_client (1.5.0)
-      bigdecimal (>= 3.0)
-      concurrent-ruby (>= 1.2)
-      connection_pool (>= 2.4)
-      dotenv (>= 2.8)
-      json (>= 2.1.0)
-      jwt (>= 2.7)
-      retryable (>= 3.0)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    activesupport (8.0.3)
-      base64
-      benchmark (>= 0.3)
-      bigdecimal
-      concurrent-ruby (~> 1.0, >= 1.3.1)
-      connection_pool (>= 2.2.5)
-      drb
-      i18n (>= 1.6, < 2)
-      logger (>= 1.4.2)
-      minitest (>= 5.1)
-      securerandom (>= 0.3)
-      tzinfo (~> 2.0, >= 2.0.5)
-      uri (>= 0.13.1)
-    base64 (0.3.0)
-    benchmark (0.4.1)
-    bigdecimal (3.3.1)
-    coderay (1.1.3)
-    concurrent-ruby (1.3.5)
-    connection_pool (2.5.4)
-    diff-lcs (1.6.2)
-    dotenv (3.1.8)
-    drb (2.2.3)
-    i18n (1.14.7)
-      concurrent-ruby (~> 1.0)
-    json (2.15.1)
-    jwt (3.1.2)
-      base64
-    logger (1.7.0)
-    method_source (1.1.0)
-    minitest (5.26.0)
-    parallel (1.27.0)
-    pry (0.15.2)
-      coderay (~> 1.1)
-      method_source (~> 1.0)
-    rake (13.3.0)
-    retryable (3.0.5)
-    rspec (3.13.1)
-      rspec-core (~> 3.13.0)
-      rspec-expectations (~> 3.13.0)
-      rspec-mocks (~> 3.13.0)
-    rspec-core (3.13.5)
-      rspec-support (~> 3.13.0)
-    rspec-expectations (3.13.5)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.5)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.13.0)
-    rspec-support (3.13.6)
-    securerandom (0.4.1)
-    tzinfo (2.0.6)
-      concurrent-ruby (~> 1.0)
-    uri (1.0.4)
-
-PLATFORMS
-  arm64-darwin-22
-  ruby
-
-DEPENDENCIES
-  activesupport
-  bundler
-  parallel
-  pry
-  rake
-  rb_snowflake_client!
-  rspec
-
-BUNDLED WITH
-   2.5.10