Repository navigation
Expand file tree
/
Copy pathpyproject.toml
More file actions
153 lines (141 loc) · 6.24 KB
/
Copy pathpyproject.toml
File metadata and controls
153 lines (141 loc) · 6.24 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
[tool.poetry]
name = "databricks-sql-connector"
version = "4.9.0"
description = "Databricks SQL Connector for Python"
authors = ["Databricks <databricks-sql-connector-maintainers@databricks.com>"]
license = "Apache-2.0"
readme = "README.md"
packages = [{ include = "databricks", from = "src" }]
include = ["CHANGELOG.md"]
[tool.poetry.dependencies]
python = "^3.10"
# Floor is 0.24.0 -- the first release that both clears the open Apache Thrift
# CVEs (CVE-2025-48431 + the CVE-2026-41602..41636 set, all fixed in 0.23.0)
# AND is safe to install on DBR LTS. History: 0.23.0 fixed the CVEs but ships
# sdist-only and its setup.py calls sys.exit(0) on the build-success path,
# killing the PEP 517 backend on the OLD setuptools bundled by DBR LTS -- the
# SEV0 ES-1960554 (4.2.7 widened to <0.24.0 and was yanked; PR #840), which is
# why we held at ~=0.22.0. thrift 0.24.0 (THRIFT-6067) resolves this: it ships
# prebuilt manylinux2014 wheels (cp310-cp314) + macOS/musl/Windows, so pip uses
# a wheel and never runs setup.py on DBR LTS -- the build-time break cannot
# trigger. The `DBR LTS Install` CI check (.github/workflows/dbr-lts-install.yml)
# installs the built artifact on real DBR LTS clusters and is the authoritative
# gate for this.
#
# Ceiling raised to <0.26.0 for 0.25.0 (released 2026-09-30, THRIFT-6067 series
# follow-up), which fixes 61 CVEs across language bindings, several affecting
# the Python binding this connector uses (see #969), e.g. CVE-2026-66858
# (skip() recursion-limit bypass in the Python accelerator) and CVE-2026-85494
# (framed transport / binary protocol size a read buffer from a peer-declared
# length with no effective maximum). 0.25.0 ships the same prebuilt wheel
# matrix as 0.24.0 (manylinux2014/macOS/musl/Windows, cp310-cp314), so the
# DBR LTS build-time risk above does not apply; the `DBR LTS Install` CI gate
# remains the authoritative check. thrift is pre-1.0, so keep this ceiling one
# minor ahead and bump deliberately once a newer minor ships and the DBR-LTS
# gate proves it safe -- do not use an open-ended `^`/`>=` constraint.
#
# NOTE: 0.25.0 also changes TBinaryProtocol's default `string_length_limit`
# from unbounded to ~15.6 MiB (see the explicit `string_length_limit=None` /
# `container_length_limit=None` passed in thrift_backend.py's protocol
# construction, which preserves the connector's pre-0.25 unbounded behavior
# for its own already-bounded, trusted-server result stream).
thrift = ">=0.24.0,<0.26.0"
pandas = [
{ version = ">=1.2.5,<4.0.0", python = ">=3.10,<3.13" },
{ version = ">=2.2.3,<4.0.0", python = ">=3.13" }
]
lz4 = [
{ version = "^4.0.2", python = ">=3.10,<3.14" },
{ version = "^4.4.5", python = ">=3.14" }
]
requests = "^2.18.1"
oauthlib = ">=3.1.0,<5.0.0"
openpyxl = "^3.0.10"
urllib3 = ">=1.26"
python-dateutil = "^2.8.0"
pyarrow = [
{ version = ">=14.0.1", python = ">=3.10,<3.13", optional=true },
{ version = ">=18.0.0", python = ">=3.13,<3.14", optional=true },
{ version = ">=22.0.0", python = ">=3.14", optional=true }
]
pyjwt = "^2.0.0"
pybreaker = "^1.0.0"
requests-kerberos = {version = "^0.15.0", optional = true}
# Optional Rust kernel backend for ``use_kernel=True`` (PyO3 wheel).
# Pulled in only via the ``[kernel]`` extra below. The published wheel
# is ``abi3`` with ``Requires-Python: >=3.9`` (built ``abi3-py39``); the
# dependency remains gated to the connector's Python >= 3.10 support floor.
#
# Floor is 1.4.0 (``^1.4.0`` == ``>=1.4.0,<2.0.0``), allowing compatible
# 1.x releases while keeping the next major upgrade deliberate. The kernel's
# pyarrow constraint remains >=23.0.1,<24.
databricks-sql-kernel = {version = "^1.4.0", optional = true, python = ">=3.10"}
[tool.poetry.extras]
pyarrow = ["pyarrow"]
# ``pip install databricks-sql-connector[kernel]`` adds the Rust kernel
# backend so ``use_kernel=True`` works.
#
# The kernel result path (``backend/kernel/result_set.py``) needs
# pyarrow, but it is NOT listed in this extra on purpose: the published
# kernel wheel declares ``pyarrow>=23.0.1,<24`` as a hard runtime
# dependency, so ``pip install ...[kernel]`` already pulls a compatible
# pyarrow transitively. Listing bare ``pyarrow`` here additionally
# forces poetry to co-resolve an unconstrained pyarrow against the
# kernel's ``>=23.0.1,<24``. The kernel's own dependency metadata is the
# single source of truth for the pyarrow floor.
kernel = ["databricks-sql-kernel"]
[tool.poetry.group.dev.dependencies]
pytest = "^9.0.3"
mypy = "^1.10.1"
pylint = ">=2.12.0"
black = "^26.3.1"
pytest-dotenv = "^0.5.2"
pytest-cov = "^4.0.0"
pytest-xdist = "^3.0.0"
# tests/unit/test_parameters.py imports pytz directly. It used to arrive
# transitively via pandas, but pandas 3.0 (resolved on Python >=3.11)
# dropped pytz as a required dependency -- it is now only a pandas extra.
# Declare it explicitly here so the test suite does not depend on pandas's
# transitive graph, which differs across the Python matrix.
pytz = ">=2020.1"
numpy = [
{ version = ">=1.16.6", python = ">=3.10,<3.11" },
{ version = ">=1.23.4", python = ">=3.11" },
]
[tool.poetry.urls]
"Homepage" = "https://github.com/databricks/databricks-sql-python"
"Bug Tracker" = "https://github.com/databricks/databricks-sql-python/issues"
[build-system]
requires = ["poetry-core>=1.0.0"]
build-backend = "poetry.core.masonry.api"
[tool.mypy]
ignore_missing_imports = "true"
exclude = ['ttypes\.py$', 'TCLIService\.py$']
[tool.black]
exclude = '/(\.eggs|\.git|\.hg|\.mypy_cache|\.nox|\.tox|\.venv|\.svn|_build|buck-out|build|dist|thrift_api)/'
[tool.pytest.ini_options]
markers = [
"reviewed: Test case has been reviewed by Databricks",
"serial: Tests that must run serially (not parallelized)",
"realkernel: Requires the real databricks-sql-kernel wheel and an unpolluted sys.modules (no fake kernel stub); must run in a separate pytest invocation from tests that fake databricks_sql_kernel (deselect with -m 'not realkernel', run alone with -m realkernel).",
]
minversion = "6.0"
log_cli = "false"
log_cli_level = "INFO"
testpaths = ["tests"]
env_files = ["test.env"]
[tool.coverage.run]
source = ["src"]
branch = true
omit = [
"*/tests/*",
"*/test_*",
"*/__pycache__/*",
"*/thrift_api/*",
]
[tool.coverage.report]
precision = 2
show_missing = true
skip_covered = false
[tool.coverage.xml]
output = "coverage.xml"