chore(deps): bump net.snowflake:snowflake-jdbc from 3.23.1 to 4.3.4 in /app/server

[dependabot]

Bumps net.snowflake:snowflake-jdbc from 3.23.1 to 4.3.4.

Release notes

Sourced from net.snowflake:snowflake-jdbc's releases.

v4.3.4

• Please Refer to Release Notes at https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

v4.3.3

• Please Refer to Release Notes at https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

v4.3.2

• Please Refer to Release Notes at https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

v4.3.1

• Please Refer to Release Notes at https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

v4.3.0

• Please Refer to Release Notes at https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

v4.2.0

• Please Refer to Release Notes at https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

v4.1.0

• Please Refer to Release Notes at https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

v4.0.2

• Please Refer to Release Notes at https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

v4.0.1

• Please Refer to Release Notes at https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

v4.0.0

• Please Refer to Release Notes at https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

v3.28.0

• Please Refer to Release Notes at https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

v3.27.1

• Please Refer to Release Notes at https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

v3.27.0

• Please Refer to Release Notes at https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

v3.26.1

• Please Refer to Release Notes at https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

v3.26.0

• Please Refer to Release Notes at https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

v3.25.1

• Please Refer to Release Notes at https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

v3.25.0

• Please Refer to Release Notes at https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

... (truncated)

Changelog

Sourced from net.snowflake:snowflake-jdbc's changelog.

For all official JDBC Release Notes please refer to https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc

Changelog

• v4.3.5-SNAPSHOT

  • Added ci/scripts/generate_sbom.sh, which generates a CycloneDX SBOM (target/bom.json) covering both the driver and FIPS JAR dependency trees; not part of the release artifacts.
  • Removed the unused Conscrypt library (org.conscrypt:conscrypt-openjdk-uber) from the self-contained (fat) and FIPS JARs. It was only transitive weight from google-cloud-storage and is never used by the driver (SNOW-4071987).
  • Fixed the platformDetectionTimeoutMs connection property having no effect: platform detection always ran with the hardcoded 200 ms default, so the documented platformDetectionTimeoutMs=0snowflakedb/snowflake-jdbc#9
  • Added JVM-wide fallbacks for both platform-detection settings, so air-gapped deployments can suppress instance-metadata probes for the whole process instead of per connection: disablePlatformDetection now also reads the net.snowflake.jdbc.disablePlatformDetection system property and the SNOWFLAKE_DISABLE_PLATFORM_DETECTION environment variable (both accepting only a case-insensitive true), and platformDetectionTimeoutMs reads net.snowflake.jdbc.platformDetectionTimeoutMs / SNOWFLAKE_PLATFORM_DETECTION_TIMEOUT_MS; the connection property takes precedence over the system property, which takes precedence over the environment variable. A negative timeout is now treated as 0 instead of still issuing the requests, and a timeout above 5000 ms is clamped to that maximum, since detection holds a process-wide lock and an unbounded value would stall every other connection attempt for its full duration. When detection is disabled the driver reports PLATFORM=["disabled"]snowflakedb/snowflake-jdbc#9
  • Deprecated the MIN_TLS_VERSION and MAX_TLS_VERSION connection properties in favour of the JVM-wide jdk.tls.client.protocolssnowflakedb/snowflake-jdbc#10
  • Fixed the TLS version settings being held in process-global static fields and omitted from the HTTP client cache key, so a connection could silently inherit another connection's enabled TLS protocols; they are now part of HttpClientSettingsKey and scoped per connection. As a consequence they no longer reach HTTP clients built outside a session (Workload Identity platform detection, the sessionless SnowflakeFileTransfer entry point, and result sets rebuilt from a serialized form), which use the driver defaults of TLS 1.2-1.3; use jdk.tls.client.protocolssnowflakedb/snowflake-jdbc#10
  • Fixed invalid MIN_TLS_VERSION/MAX_TLS_VERSION values and an inverted version range surfacing as an unwrapped IllegalArgumentException from socket factory construction instead of a SnowflakeSQLException when the property is set, and fixed TLS version availability being resolved from the protocols the JSSE provider implements rather than the ones it will actually enable, so a version banned through the jdk.tls.disabledAlgorithmssnowflakedb/snowflake-jdbc#10
  • Bumped the following dependencies:
    • netty to 4.1.138.Final from 4.1.137.Final.

• v4.3.4

  • Added validation of account, port and protocol in the auto-configuration (connections.toml) path, where the connect string's host is synthesized from account, so that none of the interpolated components can alter the resulting URL authority. Each dot-separated label of account may contain only letters, digits, underscores and hyphens (mirroring the Python connector), port must be a number in 1-65535, and protocol must be http or https. Absent or empty values keep their existing "not specified" meaning. As defense in depth, the ACCOUNTsnowflakedb/snowflake-jdbc#2752
  • Reduced sensitive detail in debug and response logging: the chunk result-master key is logged as a presence flag instead of its value, HTTP response header values are no longer logged (only header names), and chunk-download responses are rendered as a status line plus header names instead of HttpResponse.toString(), which would render every header value. SecretDetector additionally masks the X-Amz-Credential and X-Amz-Security-Token URL parameters, qrmksnowflakedb/snowflake-jdbc#2751
  • Restricted WORKLOAD_IDENTITY authentication to recognized Snowflake hosts: the attestation flow now verifies the target host before any ambient cloud credential is fetched and otherwise fails with WORKLOAD_IDENTITY_FLOW_ERROR naming the rejected host. Additional host suffixes can be permitted for local or test setups through the SNOWFLAKE_WIF_ALLOWED_HOST_SUFFIXESsnowflakedb/snowflake-jdbc#2750
  • Improved robustness of OCSP revocation checking: a definitive revocation result is now authoritative regardless of OCSP mode instead of being downgraded to a tolerable failure under the default FAIL_OPEN mode, each OCSP response entry is verified to describe the certificate being validated (issuer name hash, issuer key hash and serial number), and the cache entry is evicted on a definitive failure so it is not retained indefinitely. Recognized Snowflake host suffixes are now an explicit list (snowflakecomputing.com, snowflakecomputing.cn, snowflakecomputing.mil) matched on a label boundary, so a host on any other top-level domain is no longer detected as PrivateLink (SNOW-3649698).
  • Fixed PrivateLinkDetector.isPrivateLink() accepting any hostname that merely contained .privatelink.snowflakecomputing. as a substring, so a host such as evil.privatelink.snowflakecomputing.attacker.com was classified as a PrivateLink Snowflake host; a hostname must now actually end with .snowflakecomputing.<tld>. The OCSP response cache server URL, which is held in a JVM-wide static field, is now rejected when its host is not a Snowflake host (SNOW-3649698).
  • Fixed DecorrelatedJitterBackoff.nextSleepTime throwing IllegalArgumentException: bound must be greater than originsnowflakedb/snowflake-jdbc#2744
  • Fixed DatabaseMetaData.getTablePrivileges() concatenating unescaped table and schema names into SQL string literals, which allowed a quote character to break out of the query (SNOW-3236395).
  • Fixed DECFLOAT ResultSet.getString() using engineering notation (120E+198) instead of normalized scientific notation (1.2e200); values whose unsigned plain form fits in 38 characters stay in plain decimal (SNOW-3229469).
  • Fixed null nested structured-type fields throwing NullPointerException in JsonSqlOutput when binding via SQLOutput reference writers such as writeObject, writeBigDecimal, writeBytes, writeDate, and writeTimestamp (SNOW-1449489).
  • snowflakedb/snowflake-jdbc#2377
  • Fixed SnowflakeBasicDataSourcesnowflakedb/snowflake-jdbc#2621
  • Fixed SFFormatter omitting the associated stack trace when a log record has a thrown exception (SNOW-466174).
  • Fixed Linux credential cache parsing checking the root JSON node type a second time instead of the tokens child, which could fail the cache load when tokens was present but not an object (SNOW-4009235).
  • Fixed DatabaseMetaData.getColumns() discarding trim() on column default values and throwing NullPointerException when SHOW COLUMNS returns a SQL NULL default (SNOW-4009234).
  • Fixed PreparedStatement.setObject(parameterIndex, byte[], Types.BINARY) (and Types.VARBINARY/Types.LONGVARBINARY) binding the array's object reference ([B@..) instead of its hex value, causing a server-side Invalid bind value ... for type (BINARY) error; byte[] is now hex-encoded as setBytessnowflakedb/snowflake-jdbc#2731
  • Fixed slow PUT uploads to client-side-encrypted (internal/temporary) stages on the AWS SDK v2 async upload path — S3, and the GCS GCSAccessStrategyAwsSdk strategy (useVirtualUrl); the default GCP path (GCSDefaultAccessStrategy) is unchanged — where the CipherInputStreamsnowflakedb/snowflake-jdbc#2746
  • Bumped the following dependencies:
    • snowflakedb/snowflake-jdbc#2747
    • snowflakedb/snowflake-jdbc#2735
  • Fixed CertificateDiagnosticCheck completing its TLS probe without SNI for allowlist hosts containing underscores (Snowflake account names): such hosts are rejected by SNIHostName per the RFC 952 Letter-Digit-Hyphen rule, causing the JDK to silently send no server_name extension and the check to report on a default certificate rather than the one a real client would be served. The check now probes the hyphenated host variant that Snowflake also serves. Host normalization is unified across the diagnostic checks and connect-string parsing in a single SnowflakeUtil.normalizeSnowflakeHost helper and is scoped to Snowflake hosts, so third-party allowlist hosts (cloud storage, OCSP responders, Duo, ...) are left unchanged. The allowUnderscoresInHostsnowflakedb/snowflake-jdbc#2729

• v4.3.3

  • Fixed GCS stage uploads corrupting files on virtual-hosted-style GCP accounts (useVirtualUrl=truesnowflakedb/snowflake-jdbc#2716
  • Fixed SLF4JLogger performing expensive SecretDetector.maskSecrets() regex work even when the log level is disabled, added level guards to all (String, boolean) and (String, Throwable) overloads to match JDK14Loggersnowflakedb/snowflake-jdbc#2712
  • Fixed the self-contained JAR shipping the non-gRPC-shaded Netty native libraries (libnetty_transport_native_epoll_*, libnetty_transport_native_kqueue_*, libnetty_resolver_dns_native_macos_*) unshaded, which caused an UnsatisfiedLinkError when they conflicted with a user's own Netty on the classpath. These libraries are now relocated with the libnet_snowflake_client_jdbc_internal_netty_* prefix to match the relocated io.nettysnowflakedb/snowflake-jdbc#2705
  • snowflakedb/snowflake-jdbc#2708
  • Bumped the following dependencies:
    • google-cloud-storage from 2.44.1 to 2.69.0, with all required transitive dependency version updates (google-cloud-core, google-api-grpc, google-auth-library, google-http-client, gax, protobuf, guava, slf4jsnowflakedb/snowflake-jdbc#2691
    • snowflakedb/snowflake-jdbc#2707snowflakedb/snowflake-jdbc#2713).
    • snowflakedb/snowflake-jdbc#2718
    • snowflakedb/snowflake-jdbc#2719
    • snowflakedb/snowflake-jdbc#2721
    • snowflakedb/snowflake-jdbc#2722

• v4.3.2

... (truncated)

Commits

• 43731ae NO-SNOW: Bump version to 4.3.4 (#2753)
• 08e48c3 NO-SNOW: Validate account, port and protocol before synthesizing the JDBC URL...
• 0760449 SNOW-3954279: Trim sensitive detail from response logging and extend secret m...
• 2b579f5 NO-SNOW: Restrict WORKLOAD_IDENTITY authentication to recognized Snowflake ho...
• b409c29 SNOW-3649698: Treat definitive OCSP results as authoritative and bind respons...
• e9c7a0c SNOW-3649698: Validate PrivateLink and OCSP cache server hosts against the Sn...
• 6893424 Bump grpc-java to 1.84.0 from 1.83.1 (#2747)
• bd013fb SNOW-4039899: fix slow PUT to client-side-encrypted stages (#2746)
• a59169a SNOW-4036693: Clamp DecorrelatedJitterBackoff previous sleep to base (#2744)
• 56e500b SNOW-3236395: Escape quotes in getTablePrivileges SQL literals (#2742)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Warning

Tests have not run on the HEAD 86b229d yet

---

Mon, 14 Sep 2026 23:34:08 UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 9d721ea9-4ec1-4478-9af2-2a734b6976fc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}