Merge upstream main and preserve both unreleased changelog entries

Signed-off-by: Ali Abouelazm <aliazm419@gmail.com>

Author: AliAbouelazm

.github/workflows/engineer-bot-followup.yml

@@ -150,7 +150,8 @@ jobs:
           PR_TITLE: ${{ github.event.pull_request.title }}
           PR_URL: ${{ github.event.pull_request.html_url }}
           TRIGGER_COMMENT_ID: ${{ github.event.comment.id }}
-          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-4-8/invocations
+          ENGINEER_BOT_MODEL_OVERRIDE: databricks-claude-opus-5-5
+          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-5-5/invocations
           DATABRICKS_TOKEN: ${{ secrets.DATABRICKS_TOKEN }}
           # NOTE: no live-warehouse connection env (DATABRICKS_SERVER_HOSTNAME /
           # DATABRICKS_HTTP_PATH / DATABRICKS_CATALOG / DATABRICKS_USER) is wired

.github/workflows/engineer-bot-learning.yml

@@ -106,8 +106,9 @@ jobs:
           # translate_endpoint's already-v2 early-return, which keeps the trailing
           # `invocations`, so the CLI appends `/v1/messages` →
           # `.../anthropic/invocations/v1/messages` → HTTP 400 (unsupported path).
-          # The effective model is set by the engine default (no retrospective.model).
-          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-4-8/invocations
+          # The engine adds the [1m] context suffix to the override.
+          ENGINEER_BOT_MODEL_OVERRIDE: databricks-claude-opus-5-5
+          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-5-5/invocations
           DATABRICKS_TOKEN: ${{ secrets.DATABRICKS_TOKEN }}
           RUNNER_TEMP: ${{ runner.temp }}
           SINCE: ${{ inputs.since }}

.github/workflows/engineer-bot.yml

@@ -219,7 +219,8 @@ jobs:
         # .bot/config.yaml `flow:` default (no/other type, or type-set-late case).
         working-directory: ${{ runner.temp }}
         env:
-          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-4-8/invocations
+          ENGINEER_BOT_MODEL_OVERRIDE: databricks-claude-opus-5-5
+          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-5-5/invocations
           DATABRICKS_TOKEN: ${{ secrets.DATABRICKS_TOKEN }}
           # Live-warehouse connection env for the agent's REQUIRED E2E repro test
           # (see .bot/prompts/engineer/system.md — the bug-fix flow reproduces the

.github/workflows/kernel-e2e.yml

@@ -332,6 +332,9 @@ jobs:
         run: |
           $CONNECTOR_VENV_PY -c "import databricks_sql_kernel as k; assert k.__file__, 'kernel module has no __file__ — wheel install failed'; print('kernel ok:', k.__file__)"
 
+      - name: Run async reader routing tests
+        run: $CONNECTOR_VENV_PY -m pytest tests/unit/test_kernel_async_readers.py -m realkernel -v
+
       - name: Run kernel e2e tests
         run: poetry run pytest tests/e2e/test_kernel_backend.py -v
 

.github/workflows/reviewer-bot-followup.yml

@@ -89,7 +89,8 @@ jobs:
           TRIGGER_COMMENT_ID: ${{ github.event.comment.id }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-4-8/invocations
+          REVIEWER_BOT_MODEL_OVERRIDE: databricks-claude-opus-5-5
+          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-5-5/invocations
           DATABRICKS_TOKEN: ${{ secrets.DATABRICKS_TOKEN }}
           DRY_RUN: 'false'
           RUNNER_TEMP: ${{ runner.temp }}

.github/workflows/reviewer-bot.yml

@@ -116,7 +116,8 @@ jobs:
           PR_NUMBER: ${{ steps.inputs.outputs.pr_number }}
           HEAD_SHA: ${{ steps.inputs.outputs.head_sha }}
           DRY_RUN: ${{ steps.inputs.outputs.dry_run }}
-          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-4-8/invocations
+          REVIEWER_BOT_MODEL_OVERRIDE: databricks-claude-opus-5-5
+          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-5-5/invocations
           DATABRICKS_TOKEN: ${{ secrets.DATABRICKS_TOKEN }}
           RUNNER_TEMP: ${{ runner.temp }}
           # The reviewer's repo-specific ADDITIVE guidance, read from the TRUSTED

.github/workflows/securityScan.yml

@@ -17,7 +17,7 @@ name: Security Scan
 #
 #   - workflow_dispatch: behaves like the cron run (full reporting).
 #
-# Scanner: OSV-Scanner v2.3.8 (purl-based via OSV.dev; federates GHSA,
+# Scanner: OSV-Scanner v2.7.0 (purl-based via OSV.dev; federates GHSA,
 # NVD, PyPA, RustSec, Go vuln DB). Reads `poetry.lock` natively --
 # no separate SBOM tool needed.
 #
@@ -27,7 +27,7 @@ name: Security Scan
 # justification ("dev-only, not shipped in the wheel").
 #
 # Suppressions live in `osv-scanner.toml` as [[IgnoredVulns]] entries
-# (CVE-id global; OSV-Scanner v2.3.8 doesn't support per-package CVE
+# (CVE-id global; OSV-Scanner v2.7.0 doesn't support per-package CVE
 # scoping). Each entry has a justification comment and an `ignoreUntil`
 # expiry so suppressions re-surface for re-review rather than lingering.
 
@@ -67,7 +67,7 @@ jobs:
         run: |
           set -euo pipefail
           curl -fsSL -o /tmp/osv-scanner \
-            https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64
+            https://github.com/google/osv-scanner/releases/download/v2.7.0/osv-scanner_linux_amd64
           chmod +x /tmp/osv-scanner
           /tmp/osv-scanner --version
 

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 # Unreleased
 - Include the available SQL statement ID in Thrift failure telemetry so errors can be correlated with the failed statement.
+- Preserve the originating session when re-fetching or concurrently polling async statements on the kernel backend.
 
 # 4.8.0 (2026-10-24)
 - Upgrade Databricks SQL Kernel to 1.3.0 to address security findings.

KERNEL_REV

@@ -1 +1 @@
-d72c26492ad2fe2385b10eccd02e4ab462eec465
+b5e545adf70cb6fc7e9911e3d38fabd12f140f71

README.md

@@ -59,6 +59,11 @@ Notes:
 - Authentication supports PAT (`access_token`), OAuth M2M/U2M, and SP-wide
   workload identity federation (`identity_federation_client_id`).
 
+For Lakehouse Real-Time, submit asynchronous statements and poll or fetch results
+through the submitting connection. Re-fetching and concurrent status polling on
+that connection are supported. Submitting on one connection and polling or
+fetching through another connection is unsupported.
+
 
 ```bash
 export DATABRICKS_HOST=********.databricks.com