Upgrade snowflake-connector-python to 4.x to unblock cryptography 46.0.7 (CVE fixes)

[jaseemjaskp]

Summary

cryptography cannot be upgraded to 46.0.7 (which carries three security fixes) in the modules that depend on unstract-connectors, because snowflake-connector-python ~=3.14.0 pins cffi < 2.0.0 while cryptography 46.0.1+ requires cffi >= 2.0.0. The two are mutually exclusive, capping cryptography at 46.0.0 in those modules.

This surfaced during review of #2011 (Dependabot bumped cryptography to 46.0.7 only in platform-service/prompt-service, which have no snowflake dependency).

Affected modules (capped at cryptography 46.0.0, missing CVE fixes)

• backend (lock: 46.0.0)
• workers (lock: 45.0.7)
• unstract/connectors (lock: 41.0.7)
• root uv.lock (lock: 46.0.0)

Missing security fixes

cryptography	CVE	Issue
46.0.5	CVE-2026-26007	Binary elliptic-curve private-key leak
46.0.6	CVE-2026-34073	Name-constraint bypass with wildcard DNS SAN
46.0.7	CVE-2026-39892	Buffer overflow on non-contiguous buffers

Root cause

cryptography 46.0.1+              requires  cffi >= 2.0.0   (Python >= 3.9)
snowflake-connector-python ~=3.14 requires  cffi >= 1.9, < 2.0.0

unstract/connectors/pyproject.toml declares snowflake-connector-python[pandas]~=3.14.0. backend, workers, and the root project all depend on unstract-connectors, so cffi is forced < 2.0.0, which makes 46.0.0 the highest resolvable cryptography. Editing backend/pyproject.toml to cryptography>=46.0.7 makes the project unresolvable (uv lock fails).

Proposed fix

1. Upgrade snowflake-connector-python 3.14.x -> 4.x (4.x drops the cffi dependency entirely). Update the constraint in unstract/connectors/pyproject.toml.
2. Re-lock the affected modules with uv lock --upgrade-package cryptography --upgrade-package cffi.
3. Align backend/pyproject.toml cryptography floor to >=46.0.7 to match platform-service.
4. Test the Snowflake connector — this is a two-major-version jump and may have breaking API changes.

Scope note

Out of scope for the lock-only Dependabot PR #2011, which should merge as-is.