@malloydata/db-snowflake 0.0.414 → 0.0.416
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CONTEXT.md +23 -0
- package/package.json +2 -2
package/CONTEXT.md
ADDED
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
# Malloy Snowflake connector — CONTEXT.md
|
|
2
|
+
|
|
3
|
+
Non-obvious things; the code and `package.json` say the rest.
|
|
4
|
+
|
|
5
|
+
## `snowflake-sdk` is pinned exactly at `2.3.1` — deliberate, do not float it
|
|
6
|
+
|
|
7
|
+
`package.json` pins `"snowflake-sdk": "2.3.1"` with **no caret**. This is
|
|
8
|
+
intentional, not a stale lockfile: the SDK pulls platform-specific native bits and
|
|
9
|
+
a large transitive tree, and floating it thrashes that native connector chain.
|
|
10
|
+
Bumps are made deliberately and verified against the live Snowflake CI env
|
|
11
|
+
(`db-snowflake.yaml`), never by a Dependabot range.
|
|
12
|
+
|
|
13
|
+
**What the pin costs** — visible on Security → Dependabot alerts, never as a
|
|
14
|
+
mergeable PR: the held SDK keeps open transitive advisories in `fast-xml-parser`
|
|
15
|
+
(including critical/high), `axios`, and `bn.js`. Some of those leaves are *also*
|
|
16
|
+
pulled by other connectors (e.g. `fast-xml-parser` via BigQuery's
|
|
17
|
+
`@google-cloud/storage`), so bumping Snowflake alone won't zero them — they clear
|
|
18
|
+
only when every owner moves.
|
|
19
|
+
|
|
20
|
+
**Revisit** when doing a deliberate `snowflake-sdk` upgrade: move the exact pin,
|
|
21
|
+
run the live Snowflake suite, confirm the native chain still builds on every
|
|
22
|
+
platform. The cross-cutting pin ledger is [`.github/dependabot-pins.md`](../../.github/dependabot-pins.md);
|
|
23
|
+
the Dependabot flow is in [`.github/CONTEXT.md`](../../.github/CONTEXT.md).
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@malloydata/db-snowflake",
|
|
3
|
-
"version": "0.0.
|
|
3
|
+
"version": "0.0.416",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -23,7 +23,7 @@
|
|
|
23
23
|
"prepublishOnly": "npm run build"
|
|
24
24
|
},
|
|
25
25
|
"dependencies": {
|
|
26
|
-
"@malloydata/malloy": "0.0.
|
|
26
|
+
"@malloydata/malloy": "0.0.416",
|
|
27
27
|
"generic-pool": "^3.9.0",
|
|
28
28
|
"snowflake-sdk": "2.3.1",
|
|
29
29
|
"toml": "^3.0.0"
|