@@ -31,7 +31,7 @@ inputs:
     # value to move every bot to a new engine commit; never @main.
     description: 'Engine commit SHA (full 40-char) to install.'
     required: false
-    default: '654a31d0d26d2b77bcb58e84f1e4abe018f9fd5a'
+    default: 'ac3b08eab993ef14bf997a9bf4c776fa5acb16d8'
   engine-repo:
     description: 'owner/name of the engine repo.'
     required: false
@@ -84,7 +84,7 @@ runs:
     - name: Setup Node (for the Claude Code CLI the SDK spawns)
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
       with:
-        node-version: '20'
+        node-version: '22'
 
     - name: Install engine + Claude SDK/CLI
       uses: ./.github/actions/install-bot-engine
 
@@ -34,11 +34,11 @@ inputs:
   sdk-version:
     description: 'claude-agent-sdk version. Keep in sync with the engine at the pinned SHA.'
     required: false
-    default: '0.2.102'
+    default: '0.2.167'
   cli-version:
     description: '@anthropic-ai/claude-code version. Keep in sync with the engine at the pinned SHA.'
     required: false
-    default: '2.1.61'
+    default: '2.1.300'
 
 runs:
   using: composite
 
@@ -2,7 +2,18 @@
 
 # Unreleased
 - Include the available SQL statement ID in Thrift failure telemetry so errors can be correlated with the failed statement.
-- Add the `escape_catalog_name` connection parameter (default `False`) to opt in to escaping unescaped `_` in metadata catalog names on Thrift and kernel connections. Existing escapes and `%` wildcards are preserved.
+
+# 4.8.0 (2026-10-24)
+- Upgrade Databricks SQL Kernel to 1.3.0 to address security findings.
+- Update locked Black and certifi dependencies to address security findings.
+- Fix Arrow result fetching for queries that return duplicate column names.
+
+# 4.7.0 (2026-10-20)
+- Upgrade Databricks SQL Kernel to 1.2.0.
+- Add the kernel-only `enable_geospatial_support` option (default `False`) to return GEOMETRY / GEOGRAPHY values as SRID/WKB objects instead of WKT/EWKT strings.
+- Add opt-in `escape_catalog_name` support (default `False`) for metadata queries on Thrift and kernel connections.
+- Share feature-flag values across connections to the same workspace, with typed reads and coordinated refreshes.
+- Allow Apache Thrift 0.25.x and OAuthlib 4.x, including security fixes while preserving support for large Thrift results.
 
 # 4.6.0 (2026-09-24)
 - Upgrade Databricks SQL Kernel to 1.1.0; the kernel dependency is now stable and no longer experimental.
 
@@ -153,6 +153,7 @@ to change without notice.
 | `max_download_threads`                | `int`  |   ✅   |   ❌   | `10`          | Worker threads for cloud-fetch downloads. Not forwarded to the kernel.                                        |
 | `enable_query_result_lz4_compression` | `bool` |   ✅   |   ❌   | `True`        | LZ4-compress result payloads. Not forwarded; the kernel handles compression internally.                       |
 | `_disable_pandas`                     | `bool` |   ✅   |   ✅   | `False`       | Skip the pandas-based Arrow→row deserialization and materialize rows directly with PyArrow. This is a **Python-side** result-conversion toggle, not a wire option: the kernel returns results as Arrow (`RecordBatch`es) and the connector runs the *same* `_convert_arrow_table` for both backends, so the flag is honored on the kernel path too. Affects only row fetches (`fetchone`/`fetchmany`/`fetchall`); the `fetch*_arrow` methods return the Arrow table unchanged regardless of this flag. |
+| `enable_geospatial_support`           | `bool` |   ❌   |   ✅   | `False` | Return GEOMETRY / GEOGRAPHY as `{"srid": int, "wkb": bytes}` values when `True`, or as WKT / EWKT strings when `False`. This is a local result conversion and is never forwarded to SEA. |
 | `_use_arrow_native_complex_types`     | `bool` |   ✅   |   ✅   | `True`        | Return `ARRAY`/`MAP`/`STRUCT` as native Arrow types instead of JSON strings. Forwarded to the kernel.         |
 | `_use_arrow_native_decimals`          | `bool` |   ✅   |   ❌   | `True`        | Thrift wire encoding for `DECIMAL`: `True` → native Arrow `decimal128`, `False` → Arrow string. **No value-level effect**, though: the connector unconditionally re-casts the column back to `decimal128` (`convert_decimals_in_arrow_table`, `thrift_backend.py`), so both `fetchall()` and `fetchall_arrow()` yield `Decimal` / `decimal128(p,s)` either way (verified live). Not forwarded to the kernel, which always returns native Arrow decimals. |
 | `_use_arrow_native_timestamps`        | `bool` |   ✅   |   ❌   | `True`        | Thrift wire encoding for `TIMESTAMP`: `True` → native Arrow timestamp (→ Python `datetime`), `False` → Arrow string (→ Python **`str`**). **Unlike decimals there is no re-cast**, so `False` genuinely surfaces strings — and `cursor.description` still reports the type code as `'timestamp'`, a mismatch to watch for (verified live). Note the connector always also sends the `spark.thriftserver.arrowBasedRowSet.timestampAsString=false` conf, but the `timestampAsArrow=False` flag wins. Not forwarded to the kernel, which always returns native Arrow timestamps. |
 
@@ -1 +1 @@
-ab1e6a707e4a15a3a7a8c78d8fdd12c752c51102
+d72c26492ad2fe2385b10eccd02e4ab462eec465
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "databricks-sql-connector"
-version = "4.6.0"
+version = "4.8.0"
 description = "Databricks SQL Connector for Python"
 authors = ["Databricks <databricks-sql-connector-maintainers@databricks.com>"]
 license = "Apache-2.0"
@@ -67,10 +67,10 @@ requests-kerberos = {version = "^0.15.0", optional = true}
 # is ``abi3`` with ``Requires-Python: >=3.9`` (built ``abi3-py39``); the
 # dependency remains gated to the connector's Python >= 3.10 support floor.
 #
-# Floor is 1.1.0 (``^1.1.0`` == ``>=1.1.0,<2.0.0``), allowing compatible
+# Floor is 1.3.0 (``^1.3.0`` == ``>=1.3.0,<2.0.0``), allowing compatible
 # 1.x releases while keeping the next major upgrade deliberate. The kernel's
 # pyarrow constraint remains >=23.0.1,<24.
-databricks-sql-kernel = {version = "^1.1.0", optional = true, python = ">=3.10"}
+databricks-sql-kernel = {version = "^1.3.0", optional = true, python = ">=3.10"}
 
 
 [tool.poetry.extras]
 
@@ -71,7 +71,7 @@ def __repr__(self):
 DATE = DBAPITypeObject("date")
 ROWID = DBAPITypeObject()
 
-__version__ = "4.6.0"
+__version__ = "4.8.0"
 USER_AGENT_NAME = "PyDatabricksSqlConnector"
 
 # These two functions are pyhive legacy
Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-ab1e6a707e4a15a3a7a8c78d8fdd12c752c51102`
	`1`	`+d72c26492ad2fe2385b10eccd02e4ab462eec465`