SNOW-874337: move from current version of urllib (v2)

[sfc-gh-dszmolka]

Raising this issue to give a more transparent way to track the internal effort of addressing the current challenges around urllib v2.

Background:
There already a couple of issues of various severity, stemming from urllib v2 (2.40.0) and its direct/indirect dependencies, which urllib version is currently in use by the Snowflake Node.JS driver, some examples:

• Buffer deprecation warning - Bump urllib to at least 3.0.0 #363
• Snyk: snowflake-connector-nodejs word-wrap 1.2.3 | Snyk ID - SNYK-JS-WORDWRAP-3149973 #454
• Snyk: vm2 Sandbox Bypass Vulnerability | SNYK-JS-VM2-5537100 #512
• CVE-2023-37466 - VM2 - Sandbox Escape Vulnerability #571
  (et al)

We cannot just take the urllib dependency and bump to the most recent (v3) versions, because urllib v3.0.0 introduced a breaking change as is't been rebased to undici and that version is incompatible with snowflake-sdk implementation today.

As urllib provides a core functionality to snowflake-sdk (sending HTTP requests to the Snowflake engine) , appropriate care needs to be taken in refactoring the solution.

This Issue is here to track the progress. Current aim is to implement and release the changes by end of Q3 2023

[StefanTobler]

Hey there, is there any target date for this fix?

[sfc-gh-dszmolka]

yes, apologies for missing it out from the original post. I now added it there, and adding it here too: latest target date is end of Q3 (October). Being a high priority item, we aim for a quicker implementation but that's the current timing.

[mootari]

Are you planning to replace urllib with Node-native APIs?

[sfc-gh-dszmolka]

as far as I know, there might be multiple approaches on the table still. I'll keep this Issue updated with the details as they become available to the public.

[sfc-gh-dszmolka]

after all, as a result of a long consideration and multiple internal discussions, we decided to go with axios instead of urllib v3 to replace urllib v2, and the change has been merged with #623 .

It will be part of the next upcoming release towards end of September.

[sfc-gh-dszmolka]

fix is now out with release 1.9.0 , available on npm as well