dataaaaa!

Snowflake DCM Projects provide native declarative infrastructure-as-code using SQL syntax. Users define objects using DEFINE instead of CREATE, following a plan-and-deploy loop where state is tracked in Snowflake. It pairs with inherited grants to replace complex future grant configurations.

Snowflake announced general availability for inherited grants and container-level MANAGE GRANTS privileges. This update simplifies access control architectures by streamlining permission inheritance across data containers. Other features include dbt project Slim CI and Iceberg Scan Plan API.

Snowflake launched Data Connectivity Proxy (DCP) for Openflow, allowing secure ingestion from private databases and Kafka brokers. Delivered as a Docker agent, it uses outbound TLS on port 443 with mTLS tunnels to bypass inbound firewall rules without inspecting data or storing source credentials.

The piece outlines escalations in AI safety and governance around frontier models. Amid concerns about autonomous behavior and cybersecurity risks, major tech leaders are responding, with OpenAI reportedly canceling its IPO over safety issues as the industry debates control mechanisms.

Snowflake introduced external secret providers in preview for managing credentials. Additionally, dbt Projects on Snowflake now supports Slim CI and defer to production using dbt artifacts. Data engineers can also manage hybrid table constraints online and leverage external lineage features.

Customer reporting requires robust data modeling, standardized metrics, and query-level multi-tenant isolation. Instead of relying on vulnerable UI filters, data teams must implement row-level security at the query layer via runtime identity tokens to prevent multi-tenant data exposure.

Snowflake published updates for Snowflake Data Clean Rooms alongside several data engineering features. Key platform enhancements include general availability for online modification of hybrid table constraints, external lineage tracking, and second generation Openflow runtimes and deployments.

Salesforce launched Enterprise AI Harness, integrating Data 360, Informatica, and MuleSoft into a unified control plane to halt siloed data. It unifies context, API orchestration, and governance across batch and real-time pipelines, letting teams deploy only the integrations they need.

Snowflake introduced a secure by default approach for scanner package enablement in Trust Center. This release enhances security automation for data engineers and platform administrators managing Snowflake accounts. Related updates include online constraint modifications for hybrid tables.

Snowflake launched Intent-Driven Governance, a spec-driven workflow in Snowflake CoCo. It converts plain-English intent into tags, classification profiles, and masking DDL through stage-gated approvals. It features version-controlled artifacts, non-mutating prechecks, and scheduled drift detection.

Dagster+ Hybrid isolates control from execution: Dagster hosts the control plane, while users run agents, code servers, and pipelines on AKS. Platform teams manage cluster infrastructure, ArgoCD GitOps, and Azure identities, letting data teams ship pipeline code through simple PRs.

RavenDB launched Quill, a context layer enabling production AI agents over legacy SQL databases without migrating data. Supporting PostgreSQL, MySQL, and SQL Server, it includes search, retrieval, and access controls to securely expose data to agents without building custom data pipelines.

Multi-tenant embedded analytics requires query-time row-level security and server-issued signed JWTs to isolate data. Enforcing RLS inside the query engine on shared schemas ensures queries return zero rows if tenant context is missing, preventing IDOR and client tampering.

Embedded analytics requires query-layer RLS over UI filtering to secure tenant boundaries. Toucan uses JWT tokens before data leaves databases, Looker applies Access Filters, and Power BI uses dynamic DAX roles to prevent data leaks across exports, caches, and APIs.

Snowflake expanded its LLM security architecture by launching prompt injection guardrails across the AWSEU, AWSJP, and AWS_APJ regions. This update allows data engineers to deploy secure Cortex LLM pipelines and agent workflows with localized protection against adversarial prompt attacks.

Snowflake is replacing CORTEXMODELSALLOWLIST with model RBAC, automatically granting all models to SNOWFLAKE.PUBLIC. Because regional availability varies, an automated metadata table and procedure probe SHOW MODELS with AI_COMPLETE to track and restrict callable LLMs.

Snowflake announced the general availability of Restricted Session Scope for agents, alongside external lineage updates. The release also includes driver updates across Go, JDBC, Node.js, ODBC, and the Python Connector.

Registering SPARQL queries as named RDF resources turns raw graph access into a governed, ACL-protected API. Treating queries as managed metadata eliminates inline query risks and lets services safely discover and execute data patterns against triple stores.

Snowflake deployed Data Clean Rooms updates alongside external lineage support and data lineage for Cortex Agents. Releases also delivered an increased file limit for deployed dbt project objects, new Iceberg REST integrations, and CDC via Openflow Connector for SQL Server.

LinkedIn fingerprints Chrome users by probing about 5000 extension IDs via asset fetches and scanning DOM text nodes for "chrome-extension://" strings. This discovery pipeline tracks installed scrapers, CRM tools, and general add-ons on every page load.

ClickHouse acquired RunReveal to enhance its platform for security workloads. The move targets continuous high-throughput ingest, years-long retention, and fast analytics across cloud audit logs and telemetry, providing better guidance on ClickHouse schema and retention design.

Snowflake released Snowflake-provided tags in public preview, expanding built-in metadata management. Recent platform updates also introduced multi-value tags and Apache Iceberg REST catalog integrations, streamlining data governance and cataloging across data engineering pipelines.

Kestra 2.0 rewrote its orchestration engine to decouple workers from the database via a new Controller service over gRPC. It unbundles the queue and repository, letting engineers choose backends like Kafka, Redis, or JDBC independently to eliminate database bottlenecks.

Mismatched timestamp and timestamptz types prevented Postgres from using composite btree indexes under Row Level Security because cross-type comparisons are not marked leakproof. Explicitly casting NOW() to timestamp fixed index filtering, speeding up query execution by up to 1000x.

Snowflake announced preview support for stable egress IP addresses on Azure, simplifying network security rules for external integrations. Other recent data platform updates include dynamic Apache Iceberg tables with CREATE OR ALTER support and S3 Tables REST catalog integration.