Release 2026-09-24

[vdelacruzb]

Part of the September release — epic sc-569774, release story sc-569775. Merges first, before AT #1200 and docs #403.

Changelog

• chore(sf): remove the broken h3_fromlonglat JS library entry [sc-569993] (chore(sf): remove the broken h3_fromlonglat JS library entry [sc-569993] #647)
• chore(sf): connect lazily in the Snowflake test harness [sc-570150] (chore(sf): connect lazily in the Snowflake test harness [sc-570150] #648)
• chore(sf): ship JavaScript source maps in the native app package [sc-571986] (chore(sf): ship JavaScript source maps in the native app package [sc-571986] #649)
• fix(sf,pg,ora,bq): insert every replacement literally when building SQL [sc-572077] (fix(sf,pg,ora,bq): insert every replacement literally when building SQL [sc-572077] #650)
• fix(db): renew the Databricks token instead of minting it once per job (fix(db): renew the Databricks token instead of minting it once per job #652)
• chore(deps): bump sqlparse from 0.5.4 to 0.6.0 (chore(deps): bump sqlparse from 0.5.4 to 0.6.0 in /clouds/postgres/common #642, chore(deps): bump sqlparse from 0.5.4 to 0.6.0 in /clouds/databricks/common #643, chore(deps): bump sqlparse from 0.5.4 to 0.6.0 in /clouds/redshift/common #644)
• refactor: migrate gsutil to gcloud storage [sc-574714] (refactor: ♻️ migrate gsutil to gcloud storage [sc-574714] #651)
• chore(ci): migrate GitHub Actions auth to WIF (chore(ci): 🔒 migrate GitHub Actions auth to WIF #641)

Version — nothing publishes this cycle

No provider version moves. Every commit here is build, CI or test-harness work, so no
package content changes and publish-release.yml publishes nothing. This release exists to
sync stable with main and record the changelog.

The judgement call worth checking is #650. It is typed fix, and an earlier draft of this PR
bumped bigquery, snowflake, postgres and oracle on that basis. It shouldn't: the change is
entirely in the builders — build_modules.js, run-script.js, list_libraries.js,
build_share.js, build_native_app_setup_script.js — swapping text.replace(pattern, value) for
text.replace(pattern, () => value). That only changes the emitted SQL when a replacement value
contains a $ pattern ($&, $1, $`), and the production dataset and schema names used for
the published builds contain none, so the built artifacts are byte-identical. The user-facing half
of sc-572077 is on the AT side — #1193,
where Snowflake's Native App substitutes the customer's schema at install time — and that does bump
AT snowflake.

This follows the audit August recorded on its own release: fix-typed but tooling-only, so no bump
— the treatment Core #630, #635, #636 and #640 got there.

Per-provider changelogs therefore get no entry, matching how August left bigquery, snowflake,
postgres, databricks and oracle untouched while only redshift bumped.

Agent rules

Per RELEASING.md, .claude/rules/ was reviewed against this release. databricks.md documented
DB_TOKEN as the only credential; #652 adds a service-principal path, so the env block now lists
DB_CLIENT_ID / DB_CLIENT_SECRET and states that DB_TOKEN wins when set. Nothing else was
stale — no rule mentions gsutil, WIF or the removed Snowflake libraries.

Notes

stable was merged with --strategy ours per RELEASING.md. The only stable-only commit it drops is
a925c85 (Node pinned in the BigQuery production deploy jobs); that content is on main already —
deploy and deploy-internal both pin setup-node to the same SHA — so nothing regresses.

🤖 Generated with Claude Code