Fix: [Snyk] bump ingestion security dependencies to clear high/critical CVEs (#28623)

* bump ingestion security dependencies to clear Snyk high/critical CVEs

* pin tableauserverclient==0.40 for urllib3 2.x alignment

* floor cryptography>=46.0.5 to make CVE-2026-26007 fix mandatory

* fix: resolve basedpyright errors from urllib3 2.x and tableauserverclient 0.40 stubs

(cherry picked from commit 8a106c8)

Author: mohittilala

ingestion/setup.py

@@ -55,11 +55,10 @@
     "spacy": "spacy<3.8",
     "looker-sdk": "looker-sdk>=22.20.0,!=24.18.0",
     "lkml": "lkml~=1.3",
-    "tableau": "tableauserverclient==0.25",  # higher versions require urllib3>2.0 which conflicts other libs
+    "tableau": "tableauserverclient==0.40",  # pre-0.37 pins urllib3<2, which conflicts with collate-data-diff's urllib3>=2.7
     "pyhive": "pyhive[hive_pure_sasl]~=0.7",
     "mongo": "pymongo~=4.3",
-    "snowflake": "snowflake-sqlalchemy>=1.6.1",
-    "snowflake-connector": "snowflake-connector-python~=3.18.0",
+    "snowflake": "snowflake-sqlalchemy>=1.8.0",  # <1.8 caps snowflake-connector-python at <4, but we need 4.x for pyOpenSSL 26 (CVE-2026-27459)
     "elasticsearch8": "elasticsearch8~=8.9.0",
     "giturlparse": "giturlparse",
     "validators": "validators~=0.22.0",
@@ -113,7 +112,9 @@
         "fastavro>=1.2.0",
         # Due to https://github.com/grpc/grpc/issues/30843#issuecomment-1303816925
         # use >= v1.47.2 https://github.com/grpc/grpc/blob/v1.47.2/tools/distrib/python/grpcio_tools/grpc_version.py#L17
-        VERSIONS["grpc-tools"],  # grpcio-tools already depends on grpcio. No need to add separately
+        VERSIONS[
+            "grpc-tools"
+        ],  # grpcio-tools already depends on grpcio. No need to add separately
         "protobuf>=5.29.6",  # CVE-2026-0994 JSON recursion depth bypass
     },
     "postgres": {
@@ -153,7 +154,7 @@
     "cached-property==1.5.2",  # LineageParser
     "cachetools",  # Used to cache masked queries in ingestion/src/metadata/ingestion/lineage/masker.py
     "chardet==4.0.0",  # Used in the profiler
-    "cryptography>=42.0.0",
+    "cryptography>=46.0.5",  # CVE-2026-26007
     "google-cloud-secret-manager==2.24.0",
     "google-crc32c",
     "email-validator>=2.0",  # For the pydantic generated models for Email
@@ -177,24 +178,20 @@
     "requests>=2.23",
     "requests-aws4auth~=1.1",  # Only depends on requests as external package. Leaving as base.
     "sqlalchemy>=2.0.0,<3",
-    "collate-sqllineage>=2.0.2",
+    "collate-sqllineage>=2.1.3",
     "tabulate==0.9.0",
     "tenacity>=8.0,<10",
     "typing-inspect",
     "packaging",  # For version parsing
     "setuptools>=78.1.1",
     "shapely",
-    "collate-data-diff>=0.11.9",
+    "collate-data-diff>=0.11.11",
     # Floor on dbt-extractor (transitive via collate-data-diff -> dbt-core).
     # Pre-0.5 versions ship no cp310-manylinux_2_17_aarch64 wheel, forcing a
     # Rust/Cargo source build on ARM runners. 0.5+ uses cp38-abi3 wheels.
     "dbt-extractor>=0.5.0",
     "jaraco.functools<4.2.0",  # above 4.2 breaks the build
     "jaraco.context>=6.1.0",
-    # TODO: Remove one once we have updated datadiff version
-    VERSIONS["snowflake-connector"],
-    "mysql-connector-python>=8.0.29;python_version<'3.9'",
-    "mysql-connector-python>=9.1;python_version>='3.9'",
     "httpx~=0.28.0",
 }
 
@@ -264,10 +261,7 @@
         VERSIONS["databricks-sdk"],
         VERSIONS["databricks-sql-connector"],
         "ndg-httpsclient~=0.5.1",
-        # CVE-2026-27459 (DTLS cookie callback BoF) wants pyOpenSSL>=26.0.0, but
-        # snowflake-connector-python 3.18 (forced via base_requirements) pins
-        # pyOpenSSL<26.0.0. Dismiss until snowflake stack supports connector 4.x.
-        "pyOpenSSL>=24.3.0",
+        "pyOpenSSL>=26.0.0",  # CVE-2026-27459 DTLS cookie callback BoF
         "pyasn1>=0.6.3",  # CVE-2026-30922 DoS via unbounded recursion
     },
     "datalake-azure": {

ingestion/src/metadata/ingestion/ometa/http_adapter.py

@@ -14,6 +14,7 @@
 """
 
 import socket
+from typing import Any
 
 import requests
 from requests.adapters import DEFAULT_POOLBLOCK, HTTPAdapter
@@ -31,7 +32,7 @@ def _socket_optname(name: str) -> int:
     return getattr(socket, name, -1)
 
 
-def build_keepalive_socket_options() -> list[tuple[int, int, int]]:
+def build_keepalive_socket_options() -> list[tuple[int, int, int | bytes]]:
     """TCP keepalive socket options, guarded for platform differences."""
     options = list(HTTPConnection.default_socket_options) + [(socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1)]
 
@@ -62,14 +63,14 @@ def build_transport_retry() -> Retry:
     )
 
 
-_KEEPALIVE_SOCKET_OPTIONS: list[tuple[int, int, int]] = build_keepalive_socket_options()
+_KEEPALIVE_SOCKET_OPTIONS: list[tuple[int, int, int | bytes]] = build_keepalive_socket_options()
 
 
 class KeepAliveRetryAdapter(HTTPAdapter):
     """HTTPAdapter that enables TCP keepalive on every pooled connection."""
 
     def init_poolmanager(
-        self, connections: int, maxsize: int, block: bool = DEFAULT_POOLBLOCK, **pool_kwargs: object
+        self, connections: int, maxsize: int, block: bool = DEFAULT_POOLBLOCK, **pool_kwargs: Any
     ) -> None:
         """Build the pool manager with keepalive socket options applied."""
         pool_kwargs["socket_options"] = _KEEPALIVE_SOCKET_OPTIONS

ingestion/src/metadata/ingestion/source/dashboard/tableau/client.py

@@ -11,6 +11,7 @@
 """
 Wrapper module of TableauServerConnection client
 """
+
 import math
 import traceback
 from typing import Callable, Dict, Iterable, List, Optional, Tuple, Union
@@ -107,17 +108,17 @@ def site_id(self) -> str:
         return self.tableau_server.site_id
 
     def get_tableau_owner(
-        self, owner_id: str, include_owners: bool = True
-    ) -> Optional[TableauOwner]:
+        self, owner_id: Optional[str], include_owners: bool = True
+    ) -> Optional[TableauOwner]:  # noqa: UP045
         """
         Get tableau owner with optional include_owners flag
         """
         try:
-            if not include_owners:
+            if not include_owners or not owner_id:
                 return None
             if owner_id in self.owner_cache:
                 return self.owner_cache[owner_id]
-            owner = self.tableau_server.users.get_by_id(owner_id) if owner_id else None
+            owner = self.tableau_server.users.get_by_id(owner_id)
             if owner:
                 owner_obj = TableauOwner(
                     id=str(owner.id), name=owner.name, email=owner.email
@@ -283,13 +284,11 @@ def test_site_url(self):
         """
         validation = validators.url(self.config.siteName)
         if validation:
-            raise ValueError(
-                f"""
+            raise ValueError(f"""
             The site url "{self.config.siteName}" is in incorrect format.
             If "https://xxx.tableau.com/#/site/MarketingTeam/home" represents the homepage url for your tableau site,
             the "MarketingTeam" from the url should be entered in the Site Name and Site Url fields.
-            """
-            )
+            """)
         return True
 
     def test_get_datamodels(self):