Snowflake-Labs/schemachange v4.4.0

v4.4.0

Repository: Snowflake-Labs/schemachange

Tag: v4.4.0

Published: 2026-10-23T11:07:58Z

Prerelease: no

Release notes:

Added

• BEGIN/END-aware SQL statement splitter (#444 by @sfc-gh-swalia): Stored procedures, tasks, and anonymous blocks with BEGIN...END now execute correctly without needing $$...$$ workarounds. The new splitter respects block nesting, DECLARE...BEGIN patterns, dollar-quoted blocks, string literals, and comments. Resolves #421 and 11 related issues (#29, #124, #135, #138, #171, #203, #212, #253, #262, #270, #393).

Fixed

• BEGIN...END blocks (stored procedures, tasks, DECLARE blocks) failed with a syntax error because the connector split them a second time (#421, #444)
• R scripts with trailing comments re-applied on every deploy (#435, #437 by @sfc-gh-swalia)
• Lowercase change history table config caused re-application (#432, #440 by @sfc-gh-swalia)
• Scripts ending in a comment after the final ; failed with Empty SQL statement, including same-line comments that worked in 4.3.3 (#258, #406)

Security

• SQL injection (CWE-89) in `reset_query_tag` (#448 by @sfc-gh-swalia): ALTER SESSION SET QUERY_TAG interpolated user-controlled config/filename values without escaping. Single quotes are now escaped before interpolation.
• SQL injection (CWE-89) in `record_change_history` (#449 by @sfc-gh-swalia): The change history INSERT used f-string interpolation for script metadata (name, description, version), allowing a crafted filename to inject arbitrary SQL. Replaced with parameterized bind queries. Resolves #450.
• Critical: `snowflake-connector-python` TLS hostname verification bypass (#456): Bumped snowflake-connector-python from 4.4.0 to 4.7.5, resolving a hostname verification vulnerability (GHSA, Dependabot #30) that could allow a man-in-the-middle attack against Snowflake connections.
• `cryptography` dependency vulnerabilities (#456): Bumped cryptography from 48.0.1 to 50.0.1, resolving a PKCS#7 EnvelopedData Bleichenbacher oracle (Dependabot #29), a certificate path-building denial-of-service via duplicate self-signed intermediates (Dependabot #32), and a wildcard DNS name permittedSubtrees escape (Dependabot #31).

Upgrade Notes

• R scripts with trailing comments: If deployed under v4.3.x, stored checksums used post-transformation content. On the first deploy after upgrading, those scripts will re-apply once. Idempotent scripts are unaffected; review non-idempotent R scripts before upgrading.

Maintenance

• Added --create-change-history-table to all Quick Start examples and new "Staying Current" section (#439 by @sfc-gh-swalia)
• Removed non-existent --snowflake-password from demo CLI examples, corrected --schemachange-vars (#442 by @sfc-gh-swalia)
• Fixed typos and standardised "environment variable" wording throughout (#438 by @sfc-gh-swalia)
• Bumped urllib3 from 2.6.3 to 2.7.0 (#436)
• Optimised GitHub Actions CI workflows (#419)
• Added CODEOWNERS, converted README links to absolute GitHub URLs for correct PyPI rendering, expanded pyproject.toml project URLs and authors (#445)
• Updated maintainer listing in README, pyproject.toml, and setup.cfg (#452 by @sfc-gh-swalia)
• Bumped GitHub Actions to org allow-listed versions: actions/checkout v6→v7.0.0, astral-sh/setup-uv v8.1.0→v8.3.0, actions/github-script v7→v9, actions/labeler v5→v7, actions/dependency-review-action v4→v5 (#455 by @sfc-gh-swalia)
• Fixed issue template links pointing to main instead of master (#451 by @sfc-gh-swalia)
• Updated uv.lock with latest dependency versions
• Replaced pypa/gh-action-pypi-publish with uv publish to comply with the org Actions allow-list; publish runs only on release or manual dispatch