Merge branch 'master' into docs/oss-vs-cloud-comparison-update

Author: lakshay-nasa

metadata-ingestion/constraints.txt

@@ -1371,7 +1371,7 @@ stopit==1.1.2
     # via acryl-datahub
 strictyaml==1.7.3
     # via pyiceberg
-tableauserverclient==0.25
+tableauserverclient==0.40
     # via acryl-datahub
 tableschema==1.21.0
     # via acryl-datahub
@@ -1538,6 +1538,7 @@ typing-extensions==4.15.0
     #   snowflake-connector-python
     #   sqlalchemy2-stubs
     #   starlette
+    #   tableauserverclient
     #   textual
     #   typeguard
     #   typing-inspect
@@ -1579,7 +1580,7 @@ unstructured-client==0.42.10
     # via unstructured
 unstructured-ingest==0.7.2
     # via acryl-datahub
-urllib3==1.26.20
+urllib3==2.7.0
     # via
     #   acryl-datahub
     #   botocore

metadata-ingestion/pyproject.toml

@@ -69,6 +69,7 @@ dependencies = [
     "toml>=0.10.0,<=0.10.2",
     "typing-inspect<0.10.0",
     "typing_extensions>=4.8.0,<5.0.0",
+    "urllib3>=2.5.0,<3.0",
 ]
 
 [project.urls]
@@ -138,7 +139,6 @@ aws-secret-manager = [
     "boto3>=1.35.0,<2.0.0",
     "botocore!=1.23.0,<2.0.0",
     "cachetools<6.0.0",
-    "urllib3>=1.26,<3.0",
 ]
 
 azure-ad = []
@@ -242,7 +242,6 @@ cockroachdb = [
     "sqlalchemy>=1.4.39,<2",
     "sqlglot[c]==30.12.0",
     "sqlparse<0.6.0",
-    "urllib3>=1.26,<3.0",
 ]
 
 confluence = [
@@ -256,7 +255,6 @@ confluence = [
     "nltk<3.10.1",
     "unstructured-ingest[confluence]==0.7.2",
     "unstructured[md]==0.18.24",
-    "urllib3>=1.26,<3.0",
 ]
 
 cube = [
@@ -302,7 +300,6 @@ datahub-documents = [
     "nltk<3.10.1",
     "unstructured-ingest==0.7.2",
     "unstructured[md]==0.18.24",
-    "urllib3>=1.26,<3.0",
 ]
 
 datahub-gc = []
@@ -326,7 +323,6 @@ datahub-pg-queue = [
     "confluent_kafka[schemaregistry,avro]>=1.9.0,!= 2.8.1,<3.0.0",
     "fastavro>=1.2.0,<2.0.0",
     "psycopg2-binary<3.0.0",
-    "urllib3>=1.26,<3.0",
 ]
 
 datahub-rest = [
@@ -359,7 +355,6 @@ dbt = [
     "more-itertools<11.0.0",
     "requests<3.0.0",
     "sqlglot[c]==30.12.0",
-    "urllib3>=1.26,<3.0",
 ]
 
 dbt-cloud = [
@@ -390,7 +385,6 @@ delta-lake = [
     "smart-open[azure,s3]>=5.2.1,<8.0.0",
     "tableschema>=1.20.2,<2.0.0",
     "ujson>=5.12.1,<6.0.0",
-    "urllib3>=1.26,<3.0",
     "wcmatch<11.0.0",
 ]
 
@@ -407,7 +401,6 @@ doris = [
     "sqlalchemy>=1.4.39,<2",
     "sqlglot[c]==30.12.0",
     "sqlparse<0.6.0",
-    "urllib3>=1.26,<3.0",
 ]
 
 dremio = [
@@ -431,7 +424,6 @@ druid = [
 dynamodb = [
     "boto3>=1.35.0,<2.0.0",
     "botocore!=1.23.0,<2.0.0",
-    "urllib3>=1.26,<3.0",
 ]
 
 elasticsearch = [
@@ -455,7 +447,6 @@ excel = [
     "smart-open[azure]>=5.2.1,<8.0.0",
     "tableschema>=1.20.2,<2.0.0",
     "ujson>=5.12.1,<6.0.0",
-    "urllib3>=1.26,<3.0",
     "wcmatch<11.0.0",
 ]
 
@@ -525,7 +516,6 @@ gcs = [
     "smart-open[gcs,s3]>=5.2.1,<8.0.0",
     "tableschema>=1.20.2,<2.0.0",
     "ujson>=5.12.1,<6.0.0",
-    "urllib3>=1.26,<3.0",
     "wcmatch<11.0.0",
 ]
 
@@ -540,7 +530,6 @@ gcs-slim = [
     "smart-open[gcs,s3]>=5.2.1,<8.0.0",
     "tableschema>=1.20.2,<2.0.0",
     "ujson>=5.12.1,<6.0.0",
-    "urllib3>=1.26,<3.0",
     "wcmatch<11.0.0",
 ]
 
@@ -552,7 +541,6 @@ glue = [
     "cachetools<6.0.0",
     "sqlglot[c]==30.12.0",
     "sqlparse<0.6.0",
-    "urllib3>=1.26,<3.0",
 ]
 
 grafana = [
@@ -609,7 +597,6 @@ iceberg = [
 iceberg-catalog = [
     "boto3>=1.35.0,<2.0.0",
     "botocore!=1.23.0,<2.0.0",
-    "urllib3>=1.26,<3.0",
 ]
 
 informatica = [
@@ -646,7 +633,6 @@ kinesis = [
     "grpcio-tools>=1.44.0,<2.0.0",
     "grpcio>=1.44.0,<2.0.0",
     "networkx>=2.6.2,<4.0.0",
-    "urllib3>=1.26,<3.0",
 ]
 
 ldap = [
@@ -680,7 +666,6 @@ mariadb = [
     "sqlalchemy>=1.4.39,<2",
     "sqlglot[c]==30.12.0",
     "sqlparse<0.6.0",
-    "urllib3>=1.26,<3.0",
 ]
 
 matillion-dpc = [
@@ -746,7 +731,6 @@ mysql = [
     "sqlalchemy>=1.4.39,<2",
     "sqlglot[c]==30.12.0",
     "sqlparse<0.6.0",
-    "urllib3>=1.26,<3.0",
 ]
 
 neo4j = [
@@ -768,14 +752,12 @@ notion = [
     "nltk<3.10.1",
     "unstructured-ingest[notion]==0.7.2",
     "unstructured[md]==0.18.24",
-    "urllib3>=1.26,<3.0",
 ]
 
 odcs = [
     "boto3>=1.35.0,<2.0.0",
     "botocore!=1.23.0,<2.0.0",
     "GitPython>2,<4.0.0",
-    "urllib3>=1.26,<3.0",
 ]
 
 okta = [
@@ -812,7 +794,6 @@ postgres = [
     "sqlalchemy>=1.4.39,<2",
     "sqlglot[c]==30.12.0",
     "sqlparse<0.6.0",
-    "urllib3>=1.26,<3.0",
 ]
 
 powerbi = [
@@ -873,7 +854,6 @@ quicksight = [
     "boto3>=1.35.0,<2.0.0",
     "botocore!=1.23.0,<2.0.0",
     "sqlglot[c]==30.12.0",
-    "urllib3>=1.26,<3.0",
 ]
 
 rdf = [
@@ -925,7 +905,6 @@ s3 = [
     "smart-open[s3]>=5.2.1,<8.0.0",
     "tableschema>=1.20.2,<2.0.0",
     "ujson>=5.12.1,<6.0.0",
-    "urllib3>=1.26,<3.0",
     "wcmatch<11.0.0",
 ]
 
@@ -940,7 +919,6 @@ s3-slim = [
     "smart-open[s3]>=5.2.1,<8.0.0",
     "tableschema>=1.20.2,<2.0.0",
     "ujson>=5.12.1,<6.0.0",
-    "urllib3>=1.26,<3.0",
     "wcmatch<11.0.0",
 ]
 
@@ -952,7 +930,6 @@ sac = [
 sagemaker = [
     "boto3>=1.35.0,<2.0.0",
     "botocore!=1.23.0,<2.0.0",
-    "urllib3>=1.26,<3.0",
 ]
 
 salesforce = [
@@ -1045,7 +1022,6 @@ sql-queries = [
     "smart-open[s3]>=5.2.1,<8.0.0",
     "sqlglot[c]==30.12.0",
     "sqlparse<0.6.0",
-    "urllib3>=1.26,<3.0",
 ]
 
 sqlalchemy = [
@@ -1086,7 +1062,7 @@ sync-file-emitter = [
 
 tableau = [
     "sqlglot[c]==30.12.0",
-    "tableauserverclient>=0.24.0,<=0.40",
+    "tableauserverclient>=0.34,<=0.40",
 ]
 
 teradata = [
@@ -1112,7 +1088,6 @@ tidb = [
     "sqlalchemy>=1.4.39,<2",
     "sqlglot[c]==30.12.0",
     "sqlparse<0.6.0",
-    "urllib3>=1.26,<3.0",
 ]
 
 timescaledb = [
@@ -1125,7 +1100,6 @@ timescaledb = [
     "sqlalchemy>=1.4.39,<2",
     "sqlglot[c]==30.12.0",
     "sqlparse<0.6.0",
-    "urllib3>=1.26,<3.0",
 ]
 
 trino = [
@@ -1157,7 +1131,6 @@ unstructured = [
     "nltk<3.10.1",
     "unstructured-ingest==0.7.2",
     "unstructured[md]==0.18.24",
-    "urllib3>=1.26,<3.0",
 ]
 
 vertexai = [
@@ -1286,7 +1259,7 @@ all = [
     "sqlparse<0.6.0",
     "starrocks>=1.3.3,<2.0",
     "stopit==1.1.2",
-    "tableauserverclient>=0.24.0,<=0.40",
+    "tableauserverclient>=0.34,<=0.40",
     "tableschema>=1.20.2,<2.0.0",
     "tenacity>=8.0.1,!=8.4.0,<9.0.0",
     "teradatasqlalchemy>=17.20.0.0,<=20.0.0.2",
@@ -1295,7 +1268,6 @@ all = [
     "ujson>=5.12.1,<6.0.0",
     "unstructured-ingest[confluence,notion]==0.7.2",
     "unstructured[md]==0.18.24",
-    "urllib3>=1.26,<3.0",
     "vertica-sqlalchemy-dialect[vertica-python]==0.0.8.2",
     "wcmatch<11.0.0",
     "websocket-client<2.0.0",
@@ -1457,7 +1429,7 @@ dev = [
     "sqlglot[c]==30.12.0",
     "sqlparse<0.6.0",
     "stopit==1.1.2",
-    "tableauserverclient>=0.24.0,<=0.40",
+    "tableauserverclient>=0.34,<=0.40",
     "tableschema>=1.20.2,<2.0.0",
     "tabulate<0.11.0",
     "tenacity>=8.0.1,!=8.4.0,<9.0.0",
@@ -1488,7 +1460,7 @@ dev = [
     "ujson>=5.12.1,<6.0.0",
     "unstructured-ingest[confluence,notion]==0.7.2",
     "unstructured[md]==0.18.24",
-    "urllib3>=1.26,<3.0",
+    "urllib3>=2.5.0,<3.0",
     "uvicorn<0.41.0",
     "vertica-sqlalchemy-dialect[vertica-python]==0.0.8.2",
     "wcmatch<11.0.0",
@@ -1649,7 +1621,7 @@ docs = [
     "sqlglot[c]==30.12.0",
     "sqlparse<0.6.0",
     "stopit==1.1.2",
-    "tableauserverclient>=0.24.0,<=0.40",
+    "tableauserverclient>=0.34,<=0.40",
     "tableschema>=1.20.2,<2.0.0",
     "tabulate<0.11.0",
     "tenacity>=8.0.1,!=8.4.0,<9.0.0",
@@ -1680,7 +1652,7 @@ docs = [
     "ujson>=5.12.1,<6.0.0",
     "unstructured-ingest[confluence,notion]==0.7.2",
     "unstructured[md]==0.18.24",
-    "urllib3>=1.26,<3.0",
+    "urllib3>=2.5.0,<3.0",
     "uvicorn<0.41.0",
     "vertica-sqlalchemy-dialect[vertica-python]==0.0.8.2",
     "wcmatch<11.0.0",
@@ -1764,7 +1736,6 @@ integration-tests = [
     "tableschema>=1.20.2,<2.0.0",
     "tenacity>=8.0.1,!=8.4.0,<9.0.0",
     "ujson>=5.12.1,<6.0.0",
-    "urllib3>=1.26,<3.0",
     "vcrpy>=8.0.0,<9.0",
     "vertica-sqlalchemy-dialect[vertica-python]==0.0.8.2",
     "wcmatch<11.0.0",
@@ -2003,6 +1974,10 @@ constraint-dependencies = [
     # Not in setup.py: Airflow constraints pin PyJWT to older versions (e.g. 2.10.1, 2.12.1).
     # Enforced for Docker via docker/snippets/ingestion/constraints.txt.
     "PyJWT>=2.13.0,<3.0.0",
+    # urllib3: CVE-2025-66418, CVE-2025-66471, CVE-2026-21441 (fixed 2.6.3), CVE-2026-44431 (2.7.0).
+    # setup.py floors urllib3 at >=2.5.0 (Airflow ceiling); >=2.7.0 is enforced here at lock time
+    # only, since Airflow constraints pin urllib3 below 2.7.
+    "urllib3>=2.7.0,<3.0.0",
 ]
 
 [tool.ruff]

metadata-ingestion/setup.py

@@ -43,6 +43,11 @@
     # docker/snippets/ingestion/constraints.txt only — avoid a lower bound here so
     # installs alongside Airflow constraints remain satisfiable.
     "setuptools<82.0.0",
+    # Floor at 2.5.0 — the highest the airflow-plugin CI
+    # tolerates (Airflow 3.0.x/3.1.x pin urllib3==2.5.0, 3.2.x pins 2.6.3). The stronger
+    # >=2.7.0 floor for the remaining CVEs is applied at lock time via pyproject
+    # [tool.uv] constraint-dependencies, keeping this bound Airflow-satisfiable.
+    "urllib3>=2.5.0,<3.0",
 }
 
 gcp_sm_common = {
@@ -198,12 +203,6 @@
     # Deal with a version incompatibility between botocore (used by boto3) and urllib3.
     # See https://github.com/boto/botocore/pull/2563.
     "botocore!=1.23.0",
-    # urllib3 2.x carries security fixes (CVE-2025-66418, CVE-2025-66471, CVE-2026-21441,
-    # CVE-2026-44431), but a 2.x floor is NOT satisfiable for acryl-datahub[all]: the elasticsearch
-    # source extra pins elasticsearch==7.13.4 (held for OpenSearch compat), which requires
-    # urllib3<2. Keep the bound loose here; the 2.x floor is enforced for elasticsearch-free Docker
-    # venvs via docker/snippets/ingestion/constraints.txt.
-    "urllib3>=1.26,<3.0",
     "botocore!=1.23.0,<2.0.0",
 }
 
@@ -770,7 +769,7 @@
     "slack": slack,
     "superset": superset_common,
     "preset": superset_common,
-    "tableau": {"tableauserverclient>=0.24.0,<=0.40"} | sqlglot_lib,
+    "tableau": {"tableauserverclient>=0.34,<=0.40"} | sqlglot_lib,
     "thoughtspot": {"thoughtspot_rest_api>=2.0.0,<3.0.0"} | sqlglot_lib,
     "teradata": sql_common
     | usage_common