You do, for anything from an external source. Snowflake's documentation says it "does not check or curate the security of Python packages from external sources" and that you are responsible for evaluating them. Anaconda channel packages are described as digitally signed and built on trusted infrastructure, but provided as is.
The two package sources
The Snowflake Python UDF documentation describes where packages come from.
- The Artifact Repository is a repository that installs packages from PyPI.
- The Anaconda channel is a curated set of packages built by Anaconda, available at no extra cost.
Packages are listed in the PACKAGES parameter. The docs give a pinned example in the form of a package name, two equals signs and a version. For PyPI packages, they recommend specifying version constraints "to ensure production stability". For Anaconda packages, list only the top-level packages the function uses directly, and the channel resolves the rest.
One more detail helps reviewers: version resolution happens once, at function creation time, and the result is then fixed for that function. A UDF does not drift on every call, but it also does not pick up fixes until you recreate it.
What the docs say about security
Three statements matter for review:
- Snowflake does not check or curate the security of packages from external sources, and may block or remove harmful or risky packages without notice.
- Anaconda packages are built on trusted infrastructure and digitally signed, but they are provided as is and not covered by Snowflake's warranty or SLA.
- Private repositories are not supported for this feature.
The docs also say other channels, such as conda-forge, are not covered.
What this means for your process
Treat every UDF package list as a dependency manifest, because it is one, even though it lives in SQL.
- Inventory. Search your SQL, scripts and dbt models for create function statements with a packages clause. Record each package and version.
- Pin. Use exact versions for production functions.
- Scan. Run the package list through the same advisory checks as your application code.
- Recreate on patch. Since resolution is fixed at creation, fixing a vulnerable package means recreating the function, which belongs in your release process.
- Control the list. The docs mention packages policies for allowlists and blocklists at account level. Ask your Snowflake administrator whether one is set.
Where the licenses come in
Each package keeps its own open source license, and the docs state you must follow it. Anaconda's terms also apply to its channel. Have your legal team read the terms, since this post does not give legal advice.
Common gaps
- Functions created by one person and forgotten.
- Package lists living only in a worksheet, never in version control.
- No owner for the question "which functions use the affected package?"
Keep UDF definitions in version control so a scanner can see them.
Safeguard's SBOM and dependency scanning can inventory packages declared in repositories, and its asset discovery helps find where projects live. The free scan at https://gold.safeguard.sh/scan is a quick starting point.
Quick check
Are Anaconda channel packages safe to use without review?
The docs describe them as signed and built on trusted infrastructure but provided as is. You should still pin and scan them.
Does a UDF update when a package releases a fix?
No. Resolution happens at creation, so you recreate the function to pick up a newer version.
Sources
Last reviewed: 19 October 2026.
