Merge main into fix-row-iteration-performance

Signed-off-by: Maha Rana Yadavalli <271375718+maharanay22@users.noreply.github.com>

Author: maharanay22

.claude/knowledge/learning-log.md

@@ -150,7 +150,8 @@ jobs:
           PR_TITLE: ${{ github.event.pull_request.title }}
           PR_URL: ${{ github.event.pull_request.html_url }}
           TRIGGER_COMMENT_ID: ${{ github.event.comment.id }}
-          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-4-8/invocations
+          ENGINEER_BOT_MODEL_OVERRIDE: databricks-claude-opus-5-5
+          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-5-5/invocations
           DATABRICKS_TOKEN: ${{ secrets.DATABRICKS_TOKEN }}
           # NOTE: no live-warehouse connection env (DATABRICKS_SERVER_HOSTNAME /
           # DATABRICKS_HTTP_PATH / DATABRICKS_CATALOG / DATABRICKS_USER) is wired

.github/workflows/engineer-bot-followup.yml

@@ -106,8 +106,9 @@ jobs:
           # translate_endpoint's already-v2 early-return, which keeps the trailing
           # `invocations`, so the CLI appends `/v1/messages` →
           # `.../anthropic/invocations/v1/messages` → HTTP 400 (unsupported path).
-          # The effective model is set by the engine default (no retrospective.model).
-          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-4-8/invocations
+          # The engine adds the [1m] context suffix to the override.
+          ENGINEER_BOT_MODEL_OVERRIDE: databricks-claude-opus-5-5
+          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-5-5/invocations
           DATABRICKS_TOKEN: ${{ secrets.DATABRICKS_TOKEN }}
           RUNNER_TEMP: ${{ runner.temp }}
           SINCE: ${{ inputs.since }}

.github/workflows/engineer-bot-learning.yml

@@ -219,7 +219,8 @@ jobs:
         # .bot/config.yaml `flow:` default (no/other type, or type-set-late case).
         working-directory: ${{ runner.temp }}
         env:
-          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-4-8/invocations
+          ENGINEER_BOT_MODEL_OVERRIDE: databricks-claude-opus-5-5
+          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-5-5/invocations
           DATABRICKS_TOKEN: ${{ secrets.DATABRICKS_TOKEN }}
           # Live-warehouse connection env for the agent's REQUIRED E2E repro test
           # (see .bot/prompts/engineer/system.md — the bug-fix flow reproduces the

.github/workflows/engineer-bot.yml

@@ -89,7 +89,8 @@ jobs:
           TRIGGER_COMMENT_ID: ${{ github.event.comment.id }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-4-8/invocations
+          REVIEWER_BOT_MODEL_OVERRIDE: databricks-claude-opus-5-5
+          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-5-5/invocations
           DATABRICKS_TOKEN: ${{ secrets.DATABRICKS_TOKEN }}
           DRY_RUN: 'false'
           RUNNER_TEMP: ${{ runner.temp }}

.github/workflows/reviewer-bot-followup.yml

@@ -116,7 +116,8 @@ jobs:
           PR_NUMBER: ${{ steps.inputs.outputs.pr_number }}
           HEAD_SHA: ${{ steps.inputs.outputs.head_sha }}
           DRY_RUN: ${{ steps.inputs.outputs.dry_run }}
-          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-4-8/invocations
+          REVIEWER_BOT_MODEL_OVERRIDE: databricks-claude-opus-5-5
+          MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/databricks-claude-opus-5-5/invocations
           DATABRICKS_TOKEN: ${{ secrets.DATABRICKS_TOKEN }}
           RUNNER_TEMP: ${{ runner.temp }}
           # The reviewer's repo-specific ADDITIVE guidance, read from the TRUSTED

.github/workflows/reviewer-bot.yml

@@ -17,7 +17,7 @@ name: Security Scan
 #
 #   - workflow_dispatch: behaves like the cron run (full reporting).
 #
-# Scanner: OSV-Scanner v2.3.8 (purl-based via OSV.dev; federates GHSA,
+# Scanner: OSV-Scanner v2.7.0 (purl-based via OSV.dev; federates GHSA,
 # NVD, PyPA, RustSec, Go vuln DB). Reads `poetry.lock` natively --
 # no separate SBOM tool needed.
 #
@@ -27,7 +27,7 @@ name: Security Scan
 # justification ("dev-only, not shipped in the wheel").
 #
 # Suppressions live in `osv-scanner.toml` as [[IgnoredVulns]] entries
-# (CVE-id global; OSV-Scanner v2.3.8 doesn't support per-package CVE
+# (CVE-id global; OSV-Scanner v2.7.0 doesn't support per-package CVE
 # scoping). Each entry has a justification comment and an `ignoreUntil`
 # expiry so suppressions re-surface for re-review rather than lingering.
 
@@ -67,7 +67,7 @@ jobs:
         run: |
           set -euo pipefail
           curl -fsSL -o /tmp/osv-scanner \
-            https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64
+            https://github.com/google/osv-scanner/releases/download/v2.7.0/osv-scanner_linux_amd64
           chmod +x /tmp/osv-scanner
           /tmp/osv-scanner --version
 

.github/workflows/securityScan.yml

@@ -2,6 +2,9 @@
 
 # Unreleased
 - Fix: iterating a cursor (`for row in cursor`) and calling `fetchone()` in a loop are now about as fast as `fetchall()`. They previously converted each row through pandas on its own, costing around 1 ms per row, which made SQLAlchemy result iteration very slow. Rows are now converted `arraysize` at a time and served from an internal buffer.
+
+# 4.9.0 (2026-11-04)
+- Upgrade Databricks SQL Kernel to 1.4.0, which keeps Lakehouse Real-Time session affinity and flushes shared telemetry only after the final session closes.
 - Preserve the originating session when re-fetching or concurrently polling async statements on the kernel backend.
 
 # 4.8.0 (2026-10-24)

CHANGELOG.md

@@ -1 +1 @@
-cb5b11c1e6991e0b1a61f6ae67f7c7dcecfd8a23
+c58f62c95f3651488f6270c0b45686614486d351

KERNEL_REV

@@ -8,7 +8,7 @@
 # just the artifact we have in mind. The alternative
 # ([[PackageOverrides]] with `vulnerability.ignore = true`) is
 # per-package but blanket-ignores ALL vulnerabilities on that package,
-# which is much worse. OSV-Scanner v2.3.8 does NOT support an
+# which is much worse. OSV-Scanner v2.7.0 does NOT support an
 # intersection ("this CVE on this package only").
 #
 # See google.github.io/osv-scanner/configuration/ for the schema.