Repository navigation
chore(security): remediate OSV findings - #1690
Merged
Merged
Conversation
peco-engineer-bot
Bot
added
skip-coverage
vuanhphung
marked this pull request as ready for review
September 22, 2026 20:14
![peco-review-bot[bot]](https://avatars.githubusercontent.com/in/3801177?s=60&v=4){kind=small}
peco-engineer-bot
Bot
force-pushed
the
ai/security-scan-remediation
branch
from
September 22, 2026 20:17
7aedbab to
cfdc128
Compare
Signed-off-by: peco-engineer-bot[bot] <287056288+peco-engineer-bot[bot]@users.noreply.github.com>
peco-engineer-bot
Bot
force-pushed
the
ai/security-scan-remediation
branch
from
September 22, 2026 20:21
cfdc128 to
e0ff28b
Compare
jay-xiao446
approved these changes
Sep 22, 2026
1 of 3 tasks
cathleeny
added a commit
that referenced
this pull request
Oct 7, 2026
## Description Syncs `jdk-8` with `main` at `a64ae0e0` (**3.4.3**) and applies the JDK 8 changes from `.claude/commands/sync-jdk8-branch.md`. I followed the updated version of that skill from `main` (#1298), which this merge also brings into `jdk-8`. Replaces #1717. - **Scope:** 173 commits from `main` since the last sync point, `3ef86030` (#1270, synced via #1275). That covers releases 3.3.1, 3.3.2, 3.3.3, 3.4.2 and 3.4.3. - **Merge base:** #1275 was squash-merged, so git's merge base for `jdk-8`/`main` is still #1150 (`23a0bbdc`). A plain `git merge origin/main` would re-conflict changes that were already synced. I merged with `3ef86030` as the base (using a temporary graft), so only changes since the last sync were merged. This is a real merge commit: its parents are the `jdk-8` tip and the `main` tip. ### JDK 8 changes **Root `pom.xml`** - Source/target stay at `1.8`. The JDK 8 pins stay: Arrow `13.0.0`, Mockito `4.11.0`, nimbus-jose-jwt `9.47`. - Spotless stays removed entirely. Main's spotless plugin block was not merged. - OWASP `dependency-check-maven` is removed (plugin, `pluginManagement` entry and version property). Version 12.x needs Java 11, so it breaks `mvn install` on JDK 8. On `main`, OSV replaced OWASP as the security gate (#1460). - Kept from `main`: the dependency bumps, the CycloneDX aggregate-SBOM plugin (works on JDK 8), and the `dependencyManagement` CVE overrides for commons-lang3 and gson. **`jdbc-core/pom.xml`** - No WireMock dependency and no `--add-opens`. - The `jdk17-NioNotOpen` and `jdk21-NioNotOpen` profiles, the Arrow-patch JaCoCo exclusions, and the `!Jvm17PlusAndArrowToNioReflectionDisabled` group filter are removed. - Surefire excludes the fakeservice and e2e tests. **Workflows** - `coverageReport.yml`: JDK 8, 80% threshold, and `mvn -pl jdbc-core clean test -Dspotless.skip=true jacoco:report`. - All other workflows match `main`. That fixes a duplicated "Compile" step the merge produced in `prCheckJDK8.yml`. **Java 9+ APIs in code added on `main` since the last sync** - `List.of`, `Set.of`, `Map.of` and `List.copyOf` became Guava `ImmutableList`/`ImmutableSet`/`ImmutableMap` in main code, and `Arrays.asList` or `Collections.empty*` in tests. - `String.isBlank()`/`strip()` became `trim().isEmpty()`/`trim()`. - `Objects.requireNonNullElse` became a null-check ternary. - `Optional.isEmpty()` became `!isPresent()`. - `Files.writeString` became `Files.write`. - An anonymous-class diamond became an explicit type. - JDBC 4.3: removed `supportsSharding()` again and dropped the `beginRequest`/`endRequest` test asserts. - Conflicts were resolved keeping the existing `jdk-8` rewrites and applying main's logic changes on top. **Removed** - The fakeservice and e2e tests, plus `IntegrationTestUtil` and `DatabricksDriverExamples` (which uses it). - All WireMock resources. That includes `sqlexecapi`, `thriftserverapi` and `cloudfetchapi`, plus leftover `sqlgatewayapi`, `cloudfetchsqlgatewayapi`, `cloudfetchthriftserverapi`, `jwttokenendpoint`, `__files` and the `*fakeservicetest.properties` files. Only the removed fakeservice tests used them. - The Arrow patch sources (#1243), their tests, and `src/test/resources/arrow`. ### Cleanup beyond the skill I removed 23 Java sources that exist only on `jdk-8`: they were never on `main`, or were deleted from it long ago. They came back in the 2025-09 "post merge" commit `de3efe43`. Nothing references them: - `api/IDatabricksConnectionContext` and `api/IDatabricksSession`, stale duplicates of the `api.internal` interfaces - `ChunkDownloadCallback` - `VolumeOperationProcessorDirect` - `OAuthEndpointResolver` - `ErrorCodes`, `ErrorTypes` - `DeviceInfoLogUtil` - 15 old Thrift-generated classes (`TDBSql*`, `TExpressionInfo`, `TSQLVariable`, etc.) Non-code leftovers (`release-notes/v1.0.x`, `.vscode/settings.json`, `runBenchmarks.yml`) are unchanged. ## Testing All runs were local on OpenJDK 1.8.0: - `mvn clean install -DskipTests -Dspotless.skip=true` (the `prCheckJDK8` "Compile" step): BUILD SUCCESS for all 6 modules. - `mvn -pl jdbc-core test -Dspotless.skip=true` (the `prCheckJDK8` unit-test step): 3,569 tests, 0 failures, 0 errors, 0 skipped. - The built core, thin and uber jars are all Java 8 bytecode (class-file major version 52; `javap` on `com.databricks.client.jdbc.Driver` reports 52). - Dependency audit: none of the 85 jars on jdbc-core's test classpath contains classes newer than Java 8 (multi-release `META-INF/versions` entries excluded). - `TestThinPackaging`/`TestUberPackaging`: the offline packaging checks pass. `executeLargeQuery` needs live workspace credentials, so it wasn't run. ## Telemetry Errors - [x] Not applicable — this PR does not add or change a telemetry-visible error. It only syncs changes already reviewed on `main`. - [ ] Applicable — the error uses `DatabricksDriverErrorCode` where appropriate, and any new code is uniquely numbered and tested. - [ ] Applicable — its driver/server/user classification is linked, or maintainer help is requested because the author cannot access the classification. ## Additional Notes to the Reviewer - The reviewable part is the JDK 8 delta against `main` (`git diff origin/main...` on this branch): the poms, `coverageReport.yml`, and the Java 8 rewrites listed above. Everything else is `main`'s code as already reviewed. - Spotless doesn't run on `jdk-8`. I formatted the lines I touched with google-java-format 1.18.1, the version `main` uses. <details><summary>Synced commits (173)</summary> - Honor Auth_Scope for OAuth M2M client credentials (#1707) - chore(security): remediate OSV findings (#1716) - Fix SEA UserAgentEntry attribution in Query History (#1709) - Fix M2M private-key integration test session stub (#1703) - Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4 (#1656) - Run Jira automation on protected runner (#1696) - Automate Jira tickets for new GitHub issues (#1694) - chore(security): remediate OSV findings (#1690) - Bump JDBC driver version to 3.4.3 (#1689) - Add session version exchange to SQL Exec API client (#1678) - Auto-recover Reyden Thrift rejection to SEA (KP001) (#1683) - fix(metadata): order getTypeInfo rows by DATA_TYPE (#1680) - Update Apache Thrift to 0.24.0 (#1682) - Fix logging when an OFF connection initializes first (#1670) - Enable native SEA metadata defaults behind server flag (#1672) - Fix NPE on materialising nested arrays or arrays of maps with `NULL` elements. (#1659) - Add Thrift-native metadata support (#1641) - Fix blocking security scan findings on main (#1663) - Fix NPE for incomplete JDBC URLs (#1646) - [2/7] Add native batching configuration and parameter model (#1621) - Fix duplicate JDBC connection parameters (#1652) - Add telemetry error classification guardrails (#1629) - [1/7] Isolate legacy prepared statement batch execution (#1620) - ci: wire merge_group triggers into required-check workflows (#1582) - feat(learning): add daily engineer-bot retrospective flow + bump engine to 654a31d0 (#1635) - Add Thrift V10 batch parameter wire model (#1602) - Update 3.4.1 metadata release notes (#1578) - ci: warm test deps for Engineer Bot's offline agent + bump timeout (#1588) - Improve SEA connection-failure error messages (#1587) - Fix invalid AuthMech crashing with Recursive update / StackOverflowError (#1586) - Throw SQLException for out-of-range column in Arrow getObject (#1557) - Use SHOW COLUMNS IN ALL CATALOGS for getColumns with null catalog (same-repo, integration-test verification) (#1580) - Fix PreparedStatement.getMetaData() returning null for CTE (WITH ...) queries [PECOBLR-3778] (#1581) - feat(bots): onboard reviewer + engineer bots to databricks-bot-engine (#1583) - ci: dispatch coverage-fanout on merged source PRs (#1575) - Fix NPE reading STRING COLLATE columns via Arrow (#1548) - Throw SQLException for wrong complex-type getter calls (#1561) - [test] Make nested timestamp assertions timezone-safe (#1565) - [connection] Guarantee resource cleanup during close (#1564) - Harden OSV security-scan gate (fail-closed) + drop SMTP email (#1563) - Fix IdleConnectionEvictor thread leak when connection.close() fails due to expired token (#1559) - Bump to version 3.4.2 (#1551) - Align Thrift statement-error vendor code with SEA (EXECUTE_STATEMENT_FAILED) (#1549) - Fix MAP with complex value type rendering as empty via Arrow (#1505) (#1546) - Stream CloudFetch chunk decompression to bound memory and prevent OOM on large results (#1509) - Add bounded SEA API support for CloudFetch (UseBoundedSeaApi) (#1468) - Preserve TIMESTAMP_NTZ type name in ResultSetMetaData (#1495) (#1519) - Bump anthropics/claude-code-action from 1.0.79 to 1.0.166 (#1538) - Bump actions/setup-java from 4.8.0 to 5.4.0 (#1542) - Bump peter-evans/create-pull-request from 7.0.11 to 8.1.1 (#1541) - Bump actions/cache/save from 4.3.0 to 6.1.0 (#1540) - Bump dawidd6/action-send-mail from 3.12.0 to 18 (#1539) - Fix JulLogger CPU burn from unconditional stack-trace walk (#1511) (#1515) - Fix telemetry misattribution across connections on the same thread (#1531) - Accept OAuth M2M client id/secret via JDBC user/password (#1132) (#1533) - Bump actions/checkout from 4.3.1 to 7.0.0 (#1484) - Bump dawidd6/action-send-mail from 3.11.0 to 3.12.0 (#1486) - Bump actions/github-script from 7.0.1 to 9.0.0 (#1488) - Bump softprops/action-gh-release from 1 to 3 (#1487) - Bump actions/stale from 8.0.0 to 10.3.0 (#1479) - Add release notes for v3.4.1 (#1522) - Harden OAuth U2M token cache encryption and file permissions (#1520) - Make Connection.setReadOnly a no-op instead of throwing (#1523) - Bump shaded jackson 2.18.7 to 2.18.8 to fix CVE-2026-54512 and CVE-2026-54513 in uber jar (#1507) - Use offline cache for Security Scan on fork PRs (#1514) - Fix Maven cache warmer to cache surefire-junit-platform provider (#1513) - Redact credentials in DatabaseMetaData.getURL() and parse errors (#1502) - Redact Azure and GCS presigned URL credentials in logs (#1501) - Redact access token before logging in setClientInfoProperty (#1498) - Bump Databricks SDK for Java from 0.106.0 to 0.118.0 (#1500) - Fix getColumns() flooding DriverManager log writer with stack traces (#1494) - Fix timezone-shifted TIMESTAMP in nested complex types (ES-1978662) (#1492) - Fix closeOnCompletion() infinite recursion on ResultSet/Statement close (ES-1978361) (#1493) - Harden binary parameter interpolation against SQL injection (#1497) - Fix supportsBatchUpdates() to honor EnableBatchedInserts (#1496) - Surface truncated flag from SEA result manifest (#1503) - Use async wait timeout for SEA when direct results disabled (fix hybrid-path truncation) (#1476) - Fix metadata identifiers containing backticks (#1474) - Fix chunk download failures mis-bucketed as CONNECTION_ERROR in telemetry (#1469) - Fix double backtick wrapping in setCatalog and setSchema (#1454) - v3.4.1 Bump (#1467) - Bump databricks-sdk-java from 0.69.0 to 0.106.0 (#1465) - Add debug logging for connector-service feature flags request and response (#1462) - [PECOBLR-2321] Result Set Heartbeat / Keep-Alive for Ongoing Query Executions (#1415) - Unify weekly + per-PR security scanning into a single workflow (#1460) - Fix PreparedStatement.getMetaData() crash for SQL type aliases (#1289) - Bump shaded bouncycastle and libthrift to clear remaining CVE findings (#1461) - Fix telemetry HTTP client socket leak preventing CRaC checkpoint (#1333) - Deprecate EnableArrow — Arrow always enabled except on AIX/IBM Power (#1450) - Fix DML misclassification for statements containing UNION/INTERSECT/EXCEPT (#1420) - Fix client-side maxRows enforcement in ResultSet.next() (#1448) - Bump shaded jackson, httpcore5-h2, netty, commons-configuration2, lz4 to address CVEs (#1456) - Proactive server-side statement close when results consumed (#1444) - Update NEXT_CHANGELOG with detailed breaking changes for 3.4.1 (#1449) - Fix getTables(types=[]) returning rows in Thrift mode (#1451) - Close server-side operation on Statement re-execution (#1422) - Fix SQLInterpolator treating ? in comments and literals as placeholders + shorten next_changelog (#1424) - Enable native geospatial type support by default (#1446) - Add MetadataOperationTimeout support for SHOW commands metadata path (#1417) - [ES-1884446] Classify transient/mis-categorized server errors with retryable SQL states (#1430) - Distinguish Arrow schema parsing failures from generic ResultSet errors (#1443) - Add server-side SAFE flag for UseQueryForMetadata rollout on DBSQL (#1437) - Decouple geospatial support from complex datatype flag (#1438) - Update release-notes.txt for 3.3.3 and mark 3.3.2 as DEPRECATED (#1441) - Cut new release 3.3.3 (#1434) - Fix unresolvable 3.3.2 Maven Central POM for uber jar (#1432) - Fix main CI: JFrog mirror bypass and Windows pwsh parse error (#1428) - Cut new release 3.3.2 (#1419) - Enable release freeze for 3.3.2 (#1427) - Fix cancel error handling: vendor code, telemetry level, SEA async path (#1425) - Improve error messages for transient HTTP failures during Thrift polling (#1426) - Fix SEA result expiry error handling — preserve server error message (#1302) - Fix ambiguous errors when statements are cancelled or connection closed (#1291) - Fix race condition between chunk release and download error handling (#1407) - Revert UseQueryForMetadata default to 0, make SHOW commands opt-in (#1421) - Force Thrift mode when metadata params require native RPCs (#1416) - [PECOBLR-2086] MST transaction tests — parameterized for SEA/Thrift (#1366) - Change UseQueryForMetadata default to 1 (SHOW commands) (#1413) - Fix statement close behavior for direct results in SEA (#1400) - Add SPOG support for ?o= routing in httpPath (#1316) - Fix batched insert regex to support backtick-quoted identifiers with special characters (#1403) - Fix getCrossReference case-insensitive parent matching (#1411) - [PECOBLR-2318] Unify EnableDirectResults and EnableSQLExecDirectResults params (#1409) - Fix IntervalConverter crash on CloudFetch interval columns (#1397) - [PECOBLR-1928] Add AI coding agent detection to User-Agent header (#1230) - [PECOBLR-2409] Add CallableStatement support with IN parameters (#1371) - Add VARIANT type to ColumnInfoTypeName for correct SEA metadata (#1388) - Fix GEOMETRY/GEOGRAPHY DATA_TYPE mapping in Thrift getColumns() (#1387) - SEA metadata: throw for invalid null/empty params (Thrift parity) (#1390) - Add vulnerability scan gate to release workflows (#1396) - Fix cache warmer: add Windows runner, timestamp-based cache keys (#1395) - Fix cache warmer: add clean to resolve maven-clean-plugin and exec-maven-plugin (#1394) - Fix: normalize _remote.repositories repo ID for offline mode (#1393) - Fix: non-fork cache path must be restore-only (#1392) - Remove _remote.repositories from cache + use offline mode for forked PRs (#1391) - Fix fork Maven config: set updatePolicy=never to prevent 401 on cached artifacts (#1389) - Fix cache warmer: run real test to resolve surefire provider (#1385) - Revert Windows git install, restore original Enable long paths step (#1383) - Fix cache warmer: use install only, drop dependency:resolve (#1382) - Fix cache warmer: use install for inter-module SNAPSHOT resolution (#1381) - Fix cache warmer: Linux-only, OS-agnostic cache key (#1380) - Bump version to 3.3.2-SNAPSHOT (#1292) - Bump netty.version from 4.2.6.Final to 4.2.12.Final (#1347) - Use Databricks protected runner group for CI actions (#1369) - Resolve null catalog/schema in SEA key-based metadata operations (#1370) - Fix getSchemas returning JDBC-escaped catalog name in SEA mode (#1365) - Fix IllegalFormatConversionException in JulLogger error logging with Throwable (#1372) - Simplify SEA disposition: use connection parameters instead of statement type (#1322) - Fix CI failures: replace gh API calls blocked by IP allow list (#1363) - Fix SEA metadata JDBC spec compliance: catalog handling, empty types, non-existent objects (#1308) - Fix SEA volume operations failing with Statement is closed (#1323) - Address open supply chain security action items (#1359) - Disable publishing workflows per third-party package freeze (#1354) - Migrate all CI workflows from Databricks runners to GitHub-hosted runners (#1350) - Pin all GitHub Actions to commit SHAs (#1324) - Harden CI/CD supply chain security across all workflows (#1328) - Migrate dco-check and vulnerabilityCatcher to Databricks runners (#1327) - Prevent script injection in coverageReport workflow (#1295) - Improve instructions for jdk8 branch update (#1298) - Use version property for jts-core dependency (#1297) - Add OWASP suppression for CVE-2026-25087 and re-enable dependency check in release (#1296) - Add Claude GitHub Actions workflows (#1288) - Move dependencyManagement to parent pom to fix CVE-2025-48924 in uber jar (#1294) - Fix backtick quoting for column names in batched INSERT reconstruction (#1285) - Fix primitive type parsing in complex types for Arrow-serialized formats (#1250) - Skip OWASP dependency check in release build step (#1286) - Cut new release 3.3.1 (#1281) - [PECOBLR-1746] Implementing support for listing procedures (#1238) - Fix IdleConnectionEvictor thread leak in long-running services (#1271) - [ES-1717770] Fix TIMEDOUT_STATE not recognized as error on interactive clusters (#1244) - [ES-1765150] Coalesce concurrent expired-link refreshes into single batch RPC (#1277) - [ES-1774740] Fix Thrift polling infinite loop on invalid operation handle (#1273) - Add /sync-jdk8-branch slash command + update the jdk8 action workflow (#1274) </details> NO_CHANGELOG=true This pull request and its description were written by Isaac. [PECOBLR-3778]: https://databricks.atlassian.net/browse/PECOBLR-3778?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ --------- Signed-off-by: Vikrant Puppala <vikrant.puppala@databricks.com> Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: samikshya-chand_data <samikshya.chand@databricks.com> Signed-off-by: Sreekanth Vadigi <sreekanth.vadigi@databricks.com> Signed-off-by: Nikhil Suri <nikhil.suri@databricks.com> Signed-off-by: Gopal Lal <gopal.lal@databricks.com> Signed-off-by: rileythomp <rileythompson99@gmail.com> Signed-off-by: Samikshya Chand <samikshya.chand@databricks.com> Signed-off-by: Madhavendra Rathore <madhavendra.rathore@databricks.com> Signed-off-by: Oleksandr Shevchenko <oleksandr.shevchenko@datarobot.com> Signed-off-by: Shivam Raj <shivam.raj@databricks.com> Signed-off-by: Madhavendra Rathore Signed-off-by: Dan Homola <dan.homola@hotmail.cz> Signed-off-by: Matthieu Sprunck <msprunck@cisco.com> Signed-off-by: Matthieu Sprunck <matthieu@sprunck.com> Signed-off-by: Eric Wang <e.wang@databricks.com> Signed-off-by: eric-wang-1990 <e.wang@databricks.com> Signed-off-by: Prathamesh Baviskar <prathamesh.baviskar@databricks.com> Signed-off-by: Cathleen Yan <cathleen.yan@databricks.com> Signed-off-by: Vu Anh Phung <vu.phung@databricks.com> Signed-off-by: Michael Simons <michael@simons.ac> Signed-off-by: Cathleen Yan <58714163+cathleeny@users.noreply.github.com> Signed-off-by: Rahul Singhal <rahul.singhal@databricks.com> Signed-off-by: Aakash Saravanan <aakash.saravanan@databricks.com> Signed-off-by: peco-engineer-bot[bot] <287056288+peco-engineer-bot[bot]@users.noreply.github.com> Co-authored-by: Gopal Lal <135012033+gopalldb@users.noreply.github.com> Co-authored-by: Samikshya Chand <148681192+samikshya-db@users.noreply.github.com> Co-authored-by: Madhavendra Rathore <madhavendra.rathore@databricks.com> Co-authored-by: Vikrant Puppala <vikrant.puppala@databricks.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: tejassp-db <241722411+tejassp-db@users.noreply.github.com> Co-authored-by: jayant <167047871+jayantsing-db@users.noreply.github.com> Co-authored-by: Sreekanth <sreekanth.vadigi@databricks.com> Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com> Co-authored-by: Jothi Prakash <jothi.prakash@databricks.com> Co-authored-by: Shivam Raj <171748731+shivam2680@users.noreply.github.com> Co-authored-by: nikhilsuri-db <nikhil.suri@databricks.com> Co-authored-by: Riley Thompson <rileythompson99@gmail.com> Co-authored-by: Oleksandr Shevchenko <shevchenko.olexandr96@gmail.com> Co-authored-by: Oleksandr Shevchenko <oleksandr.shevchenko@datarobot.com> Co-authored-by: Madhav Sainanee <madhav.sainanee@databricks.com> Co-authored-by: Dan Homola <dan.homola@hotmail.cz> Co-authored-by: Thomas Powell <tom-s-powell@users.noreply.github.com> Co-authored-by: Matthieu Sprunck <matthieu@sprunck.com> Co-authored-by: eric-wang-1990 <115501094+eric-wang-1990@users.noreply.github.com> Co-authored-by: Prathamesh Baviskar <prathamesh.baviskar@databricks.com> Co-authored-by: vuanhphung <vuanhphung1997@gmail.com> Co-authored-by: Michael Simons <michael@simons.ac> Co-authored-by: vuanhphung <vu.phung@databricks.com> Co-authored-by: Rahul Singhal <126218237+rahuls-db@users.noreply.github.com> Co-authored-by: Isaac <no-reply@databricks.com> Co-authored-by: aakash-saravanan-db <aakash.saravanan@databricks.com> Co-authored-by: peco-engineer-bot[bot] <287056288+peco-engineer-bot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Automated remediation for findings from the weekly OSS driver security scan.
Updates:
The repository's Security Scan check is the authoritative validation. This PR is draft until that check and the normal driver CI pass.
NO_CHANGELOG=true
Source: https://github.com/databricks/databricks-driver-test/actions/runs/35779611394