Update module github.com/snowflakedb/gosnowflake to v1.13.3 [SECURITY] (open-telemetry#39705)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
|
[github.com/snowflakedb/gosnowflake](https://redirect.github.com/snowflakedb/gosnowflake)
| `v1.12.0` -> `v1.13.3` |
[![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fsnowflakedb%2fgosnowflake/v1.13.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/go/github.com%2fsnowflakedb%2fgosnowflake/v1.13.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/go/github.com%2fsnowflakedb%2fgosnowflake/v1.12.0/v1.13.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fsnowflakedb%2fgosnowflake/v1.12.0/v1.13.3?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

### GitHub Vulnerability Alerts

####
[CVE-2025-46327](https://redirect.github.com/snowflakedb/gosnowflake/security/advisories/GHSA-6jgm-j7h2-2fqg)

# Issue
Snowflake discovered and remediated a vulnerability in the Go Snowflake
Driver (“Driver”). When using the Easy Logging feature on Linux and
macOS, the Driver didn’t correctly verify the permissions of the logging
configuration file, potentially allowing an attacker with local access
to overwrite the configuration and gain control over logging level and
output location.

This vulnerability affects Driver versions from 1.7.0 up to, but not
including, 1.13.3. Snowflake fixed the issue in version 1.13.3.

# Vulnerability Details
When using the Easy Logging feature on Linux and macOS, the Driver reads
logging configuration from a user-provided file. On Linux and macOS the
Driver verifies that the configuration file can be written to only by
its owner. That check was vulnerable to a Time-of-Check to Time-of-Use
(TOCTOU) race condition and failed to verify that the file owner matches
the user running the Driver. This could allow a local attacker with
write access to the configuration file or the directory containing it to
overwrite the configuration and gain control over logging level and
output location.

# Solution
Snowflake released version 1.13.3 of the Go Snowflake Driver, which
fixes this issue. We recommend users upgrade to version 1.13.3.

# Additional Information
If you discover a security vulnerability in one of our products or
websites, please report the issue to Snowflake through our Vulnerability
Disclosure Program hosted at HackerOne. For more information, please see
our [Vulnerability Disclosure
Policy](https://hackerone.com/snowflake?type=team).

---

### Release Notes

<details>
<summary>snowflakedb/gosnowflake
(github.com/snowflakedb/gosnowflake)</summary>

###
[`v1.13.3`](https://redirect.github.com/snowflakedb/gosnowflake/releases/tag/v1.13.3):
Release

[Compare
Source](https://redirect.github.com/snowflakedb/gosnowflake/compare/v1.13.2...v1.13.3)

- Please check Snowflake [Go Snowflake for release
notes](https://docs.snowflake.com/en/release-notes/clients-drivers/golang).

###
[`v1.13.2`](https://redirect.github.com/snowflakedb/gosnowflake/releases/tag/v1.13.2):
Release

[Compare
Source](https://redirect.github.com/snowflakedb/gosnowflake/compare/v1.13.1...v1.13.2)

- Please check Snowflake [Go Snowflake for release
notes](https://docs.snowflake.com/en/release-notes/clients-drivers/golang).

###
[`v1.13.1`](https://redirect.github.com/snowflakedb/gosnowflake/releases/tag/v1.13.1):
Release

[Compare
Source](https://redirect.github.com/snowflakedb/gosnowflake/compare/v1.13.0...v1.13.1)

- Please check Snowflake [Go Snowflake for release
notes](https://docs.snowflake.com/en/release-notes/clients-drivers/golang).

###
[`v1.13.0`](https://redirect.github.com/snowflakedb/gosnowflake/releases/tag/v1.13.0):
Release

[Compare
Source](https://redirect.github.com/snowflakedb/gosnowflake/compare/v1.12.1...v1.13.0)

- Please check Snowflake [Go Snowflake for release
notes](https://docs.snowflake.com/en/release-notes/clients-drivers/golang).

###
[`v1.12.1`](https://redirect.github.com/snowflakedb/gosnowflake/releases/tag/v1.12.1):
Release

[Compare
Source](https://redirect.github.com/snowflakedb/gosnowflake/compare/v1.12.0...v1.12.1)

- Please check Snowflake [Go Snowflake for release
notes](https://docs.snowflake.com/en/release-notes/clients-drivers/golang).

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/open-telemetry/opentelemetry-collector-contrib).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNTcuMyIsInVwZGF0ZWRJblZlciI6IjM5LjI1Ny4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJyZW5vdmF0ZWJvdCJdfQ==-->

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: opentelemetrybot <[email protected]>
Co-authored-by: Curtis Robert <[email protected]>

Author: 3 people

internal/sqlquery/go.mod

@@ -8,7 +8,7 @@ require (
 	github.com/lib/pq v1.10.9
 	github.com/microsoft/go-mssqldb v1.8.0
 	github.com/sijms/go-ora/v2 v2.8.24
-	github.com/snowflakedb/gosnowflake v1.12.0
+	github.com/snowflakedb/gosnowflake v1.13.3
 	github.com/stretchr/testify v1.10.0
 	github.com/thda/tds v0.1.7
 	go.opentelemetry.io/collector/component v1.31.0
@@ -29,7 +29,7 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.0.0 // indirect
 	github.com/BurntSushi/toml v1.4.0 // indirect
 	github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c // indirect
-	github.com/apache/arrow/go/v15 v15.0.0 // indirect
+	github.com/apache/arrow-go/v18 v18.0.0 // indirect
 	github.com/aws/aws-sdk-go-v2 v1.26.1 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2 // indirect
 	github.com/aws/aws-sdk-go-v2/credentials v1.17.11 // indirect
@@ -43,19 +43,19 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.5 // indirect
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.53.1 // indirect
 	github.com/aws/smithy-go v1.20.2 // indirect
-	github.com/danieljoos/wincred v1.1.2 // indirect
+	github.com/danieljoos/wincred v1.2.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dvsekhvalnov/jose2go v1.6.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.2 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.7 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/goccy/go-json v0.10.2 // indirect
+	github.com/goccy/go-json v0.10.4 // indirect
 	github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
 	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
 	github.com/golang-sql/sqlexp v0.1.0 // indirect
-	github.com/google/flatbuffers v23.5.26+incompatible // indirect
+	github.com/google/flatbuffers v24.12.23+incompatible // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
@@ -68,12 +68,12 @@ require (
 	github.com/jcmturner/rpc/v2 v2.0.3 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/compress v1.17.9 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.5 // indirect
+	github.com/klauspost/compress v1.17.11 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.9 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/mtibben/percent v0.2.1 // indirect
-	github.com/pierrec/lz4/v4 v4.1.18 // indirect
+	github.com/pierrec/lz4/v4 v4.1.22 // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
@@ -93,15 +93,16 @@ require (
 	go.opentelemetry.io/otel/sdk/metric v1.35.0 // indirect
 	go.opentelemetry.io/otel/trace v1.35.0 // indirect
 	golang.org/x/crypto v0.37.0 // indirect
-	golang.org/x/exp v0.0.0-20240205201215-2c58cdc269a3 // indirect
-	golang.org/x/mod v0.17.0 // indirect
+	golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect
+	golang.org/x/mod v0.22.0 // indirect
 	golang.org/x/net v0.39.0 // indirect
+	golang.org/x/oauth2 v0.26.0 // indirect
 	golang.org/x/sync v0.13.0 // indirect
 	golang.org/x/sys v0.32.0 // indirect
 	golang.org/x/term v0.31.0 // indirect
 	golang.org/x/text v0.24.0 // indirect
-	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
-	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
+	golang.org/x/tools v0.29.0 // indirect
+	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a // indirect
 	google.golang.org/grpc v1.72.0 // indirect
 	google.golang.org/protobuf v1.36.6 // indirect