Merge branch 'main' into chore/release-3.17.0

Author: kukushking

.github/workflows/bandit.yml

@@ -16,7 +16,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Set up Python
         uses: actions/setup-python@v6
         with:

.github/workflows/cfn-nag.yml

@@ -24,7 +24,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Use Node.js
         uses: actions/setup-node@v6
         with:
@@ -41,7 +41,7 @@ jobs:
         run: |
           npm install -g aws-cdk
           cdk --version
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Set up Python
         uses: actions/setup-python@v6
         with:

.github/workflows/check-pytest-xfails.yml

@@ -15,6 +15,6 @@ jobs:
   Check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: check xfails
         run: if grep -ro "@pytest.mark.xfail()" tests/; then echo "xfails must catch a specific error, e.g. '@pytest.mark.xfail(raises=NotImplementedError)'" && exit 1; else echo "success" && exit 0; fi

.github/workflows/minimal-tests.yml

@@ -33,7 +33,7 @@ jobs:
     runs-on: ${{ matrix.platform }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v6
         with:

.github/workflows/publish.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - uses: hynek/build-and-inspect-python-package@v2
 
 

.github/workflows/snyk.yml

@@ -14,7 +14,7 @@ jobs:
   security:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Run Snyk to check for vulnerabilities
         uses: snyk/actions/python-3.12@master
         continue-on-error: true  # To make sure that SARIF upload gets called

.github/workflows/static-checking.yml

@@ -21,7 +21,7 @@ jobs:
         python-version: ["3.10"]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v6
         with:

awswrangler/athena/_write_iceberg.py

@@ -24,6 +24,21 @@
 _logger: logging.Logger = logging.getLogger(__name__)
 
 
+def _escape_athena_string_literal(value: Any) -> str:
+    # Used for caller-supplied values spliced inside SQL string literals, e.g.
+    # COMMENT '<value>' or TBLPROPERTIES ('<key>'='<value>').
+    #
+    # The wrapping single quotes around the splice site are *delimiters* — they tell
+    # Athena "this is a string literal" and are part of the DDL grammar, not escaping.
+    # A naive splice f"'{value}'" lets a value containing ' close the literal and
+    # append arbitrary DDL (e.g. LOCATION '...').
+    #
+    # Athena/Trino string literals have exactly one escape mechanism: a single quote
+    # inside the literal must be doubled. Pre-doubling caller quotes here means the
+    # whole value parses as one literal regardless of what it contains.
+    return str(value).replace("'", "''")
+
+
 def _create_iceberg_table(
     df: pd.DataFrame,
     database: str,
@@ -50,13 +65,19 @@ def _create_iceberg_table(
         [
             f"{k} {v}"
             if (columns_comments is None or columns_comments.get(k) is None)
-            else f"{k} {v} COMMENT '{columns_comments[k]}'"
+            else f"{k} {v} COMMENT '{_escape_athena_string_literal(columns_comments[k])}'"
             for k, v in columns_types.items()
         ]
     )
     partition_cols_str: str = f"PARTITIONED BY ({', '.join([col for col in partition_cols])})" if partition_cols else ""
     table_properties_str: str = (
-        ", " + ", ".join([f"'{key}'='{value}'" for key, value in additional_table_properties.items()])
+        ", "
+        + ", ".join(
+            [
+                f"'{_escape_athena_string_literal(key)}'='{_escape_athena_string_literal(value)}'"
+                for key, value in additional_table_properties.items()
+            ]
+        )
         if additional_table_properties
         else ""
     )

awswrangler/neptune/_gremlin_init.py

@@ -8,9 +8,15 @@
     from gremlin_python.process.anonymous_traversal import traversal
     from gremlin_python.process.graph_traversal import GraphTraversalSource, __
     from gremlin_python.process.translator import Translator
-    from gremlin_python.process.traversal import Cardinality, T
+    from gremlin_python.process.traversal import Cardinality, T, TraversalStrategies
     from gremlin_python.structure.graph import Edge, Graph, Path, Property, Vertex, VertexProperty
 
+    def local_traversal_source() -> "GraphTraversalSource":
+        # gremlinpython 3.8 removed Graph().traversal() and traversal().withGraph(Graph()).
+        # We only need a traversal source to build bytecode that the Translator turns into
+        # a query string — no remote connection or strategies are needed.
+        return GraphTraversalSource(Graph(), TraversalStrategies())
+
     __all__ = [
         "__",
         "Cardinality",
@@ -22,6 +28,8 @@
         "Property",
         "T",
         "Translator",
+        "TraversalStrategies",
+        "local_traversal_source",
         "traversal",
         "Vertex",
         "VertexProperty",

awswrangler/neptune/_neptune.py

@@ -170,7 +170,7 @@ def to_property_graph(
     ... )
     """
     # check if ~id and ~label column exist and if not throw error
-    g = gremlin.Graph().traversal()
+    g = gremlin.local_traversal_source()
     is_edge_df = False
     is_update_df = True
     if "~id" in df.columns:
@@ -198,7 +198,7 @@ def to_property_graph(
         if index > 0 and index + 1 % batch_size == 0:
             res = _run_gremlin_insert(client, g)
             if res:
-                g = gremlin.Graph().traversal()
+                g = gremlin.local_traversal_source()
 
     return _run_gremlin_insert(client, g)