fix(deps): update dependency snowflake-sdk to v3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
snowflake-sdk	2.4.3 → 3.1.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

snowflakedb/snowflake-connector-nodejs (snowflake-sdk)

v3.1.0

Compare Source

New features:

• Added workloadIdentityAwsUseOutboundToken connection option (default false) that switches AWS Workload Identity attestation to STS GetWebIdentityToken JWTs. This method is recommended and may become the default in a future release (#​1437)
• Added a customLogger option to snowflake.configure() to route the driver's log messages through your own logger (e.g. winston, pino, OpenTelemetry) instead of the built-in file/console logging (#​1438)

Bugfixes:

• Fixed PrivateLink OCSP proxy requests failing with HTTP 405 Method Not Allowed for certificates whose AIA OCSP URI contains a path component (e.g. oneocsp.microsoft.com/ocsp). The driver now sends GET requests to the /retry/ proxy with the full AIA path preserved and the base64 OCSP request URL-encoded (#​1449)
• Reverted the unintentional breaking change from the 3.0.0 release (#​1415) that switched AWS Workload Identity attestation from SigV4 GetCallerIdentity to STS GetWebIdentityToken. AWS Workload Identity again defaults to GetCallerIdentity; the new method is now opt-in via workloadIdentityAwsUseOutboundToken (#​1437)
• Removed usage of deprecated util.isString to fix Node 24 compatibility. Added additional logging where this caused silent failure (#​1436)
• Fixed CRL validation failing with crl.tbsCertList.revokedCertificates is not iterable for CRLs that contain no revoked certificates, where the OPTIONAL revokedCertificates field (RFC 5280 §5.1) is absent (#​1448)
• Fixed an unnecessary second PUT (stage re-resolution) per file during GCS uploads when the server scopes upload credentials with an access token (#​1440)
• Fixed key-pair authentication ignoring privateKeyPass for an inline privateKey, so encrypted private keys can now be passed directly just like in privateKeyPath (#​1450)
• Fixed a race condition that could crash the Node process with Error: aborted when checking whether a file exists on an S3 stage (#​1453)

Internal:

• Replaced the global HTTP(S) agent cache with a per-connection cache and implemented cache cleanup when a connection is destroyed (#​1443)

v3.0.0

Compare Source

Breaking changes:

• Dropped official support for Node.js 18. The minimum supported Node.js version is now 20.x, and engines.node is set to >=20. This release may still run on Node.js 18 for now, but we no longer test against it and will not investigate or fix Node 18-only issues. Treat Node 18 as unsupported and migrate to a current Node.js LTS. See the v3.0 announcement (#​1398) for details and migration guidance.

New features:

• Added browserResponseRenderer connection option to customize the HTML response shown in the browser after EXTERNALBROWSER and OAUTH_AUTHORIZATION_CODE callbacks (#​1416)
• Added tokenFilePath connection option that reads the authentication token from a file when no token is provided (#​1421)
• Added serverSessionKeepAlive connection option that keeps the session alive on the server side when connection.destroy() is called. Useful when you want to close the local connection while keeping async queries running on the server (#​1426)
• Added experimental multipart/chunked stage upload for large files on AWS, Azure and GCS, enabled via the enableExperimentalMultipartUploads configuration flag (#​1427)

Bugfixes:

• Fixed global URL detection incorrectly truncating account names containing "global" (e.g. myorg-global) (#​1423)
• Fixed noProxy connection option and NO_PROXY environment variable not bypassing the proxy for PrivateLink connections (#​1422).
• Fixed interrupted streaming HTTP responses being treated as successful empty responses instead of errors, which could cause streamRows() to hang silently on large result sets (#​1420)
• Fixed LOCAL_FS stage download writing to the wrong path by using the destination file's base name, consistent with cloud stages (#​1431)
• Fixed OAUTH_AUTHORIZATION_CODE cold-connect lockout from a cached invalid refresh token; the bad token is now evicted and the full browser flow restarts (#​1435)

Internal:

• Switched AWS Workload Identity attestation to use STS GetWebIdentityToken JWTs; no longer uses SigV4 GetCallerIdentity envelopes. (#​1415)
• Reverted SESSION_ID_AS_STRING change from #​1384 (introduced in 2.4.1) due to compatibility issues with session sharing between drivers (#​1428)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for kongdeveloper ready!

Name	Link
🔨 Latest commit	2ca6464
🔍 Latest deploy log	https://app.netlify.com/projects/kongdeveloper/deploys/6a68a085f2d0610008c52dbe
😎 Deploy Preview	https://deploy-preview-5650--kongdeveloper.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.