Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.gitleaksignore:
- Around line 6-9: Extend the .gitleaksignore entries for
tests/main/filesystem/test_remote_read.py to include the generic-api-key finding
at line 59, or adjust the fake credential fixture so it no longer matches the
rule while preserving the test’s behavior.

In `@docs/changelog.md`:
- Around line 6-7: Update the Filesystem changelog entry to include Databricks
Files, Google Drive, and WebHDFS, or revise its wording to clearly indicate the
list is non-exhaustive while preserving the existing connector entries.

In `@docs/conf.py`:
- Line 98: Update the Medium URL entry in the link-check ignore configuration to
match only the specific in-repo article URL, replacing the broad domain pattern
while preserving other ignore entries.

In `@docs/supported-sources/azure-storage.md`:
- Around line 121-124: The format-hint documentation is incomplete and
inconsistent across the Azure Storage and S3 source guides. Update the
format-hint sections in docs/supported-sources/azure-storage.md lines 121-124
and docs/supported-sources/s3.md lines 94-99 to include CBOR and every currently
supported hint, or clearly mark the examples as illustrative and link to the
canonical complete format list; keep both source pages consistent.
- Around line 81-84: Clarify the SAS token encoding in the example near the
ingest command: make the `sig` value unambiguous and consistent with the
documented rule that embedded `=` is encoded as `%3D`. Remove the extra `%25`
encoding unless the example explicitly identifies the value as a raw token
requiring it, and align the surrounding prose with the chosen representation.

In `@docs/supported-sources/dropbox.md`:
- Around line 13-15: Replace the Dropbox URI’s real-looking token with an
explicit synthetic placeholder and add warnings about credential exposure and
the supported secure credential mechanism. In docs/supported-sources/dropbox.md
lines 13-15, update the URI and warning; in lines 30-33, retain a non-secret CLI
example and warn against passing real tokens as arguments. In
docs/supported-sources/ftp.md lines 14-16 and 75-78, add equivalent warnings
that copied username/password command values must not be real credentials.

In `@docs/supported-sources/ftp.md`:
- Around line 63-71: Update the FTP Authentication and Examples documentation to
consistently state that username/password credentials are required only when
connecting to an authenticated server, while servers permitting anonymous access
can be used without them.
- Around line 51-61: Update the :tls: documentation to present secure FTP-TLS as
the expected configuration, recommend auto-negotiated TLS or TLS 1.2+, and
remove TLS 1.0/1.1 from normal accepted options. Revise the FTP URI/CLI examples
to use secure transport and avoid embedding plaintext credentials, while
preserving the documented option syntax.

In `@docs/supported-sources/onedrive.md`:
- Around line 16-34: Standardize credential guidance across all four
documentation sites: in docs/supported-sources/onedrive.md lines 16-34, remove
client_secret from URI examples and avoid presenting per-connection environment
variables as the general credential mechanism; in
docs/supported-sources/google-drive.md lines 37-45, replace base64-encoded
service-account JSON credentials with file- or ADC-backed authentication and
warn against private keys in URIs; in docs/supported-sources/nextcloud.md lines
13-19, remove the real-password URL and direct users to generated app
credentials or passwordless authentication; in docs/supported-sources/oss.md
lines 23-29, remove key, secret, and token query-string examples in favor of
credential-file or environment-backed authentication. Add a concise warning that
credential-bearing URIs must not be logged or committed.

In `@docs/supported-sources/s3.md`:
- Around line 160-171: Replace the real-looking S3 credential values in the
examples at docs/supported-sources/s3.md lines 160-171, including the upload
example, with the declared YOUR_ACCESS_KEY_ID and YOUR_SECRET_ACCESS_KEY
placeholders. Also replace the UUIDs and secret-shaped value in the credential
examples at docs/supported-sources/sharepoint.md lines 16-18, including the
command example, with <CLIENT_ID>, <TENANT_ID>, and <CLIENT_SECRET>; ensure all
credential-bearing URI examples use unmistakable documentation-only
placeholders.

In `@docs/supported-sources/webdav.md`:
- Around line 20-22: Update the retry parameter documentation in the WebDAV
source reference to describe it as enabling or disabling HTTP client retries,
with true enabling retries by default. Remove the misleading wording that leads
with disabling retry while preserving the type and default details.

In `@docs/supported-sources/webhdfs.md`:
- Around line 100-103: Update the WebHDFS example heading or description around
the DuckDB copy command to replace “OSS location” with “WebHDFS location,”
leaving the rest of the example unchanged.

In `@src/dlt_filesystem/source/core.py`:
- Around line 52-82: Preserve the filesystem_incremental option through
infer_resource and FilesystemReference by reading it from locator options and
passing it as the reference field, while removing it from connector fs_kwargs
before fsspec construction. Update the affected connector paths to pop the flag
from fs_kwargs and forward it only to FilesystemReference, allowing optional
mtime-based incremental loading without sending the option to fsspec
constructors.

In `@src/dlt_filesystem/source/fsspec/ftp.py`:
- Around line 34-38: Update the tls normalization block to reject invalid values
rather than swallowing ValueError and retaining the original input. Ensure only
values successfully converted by asbool are assigned to fs_kwargs["tls"], and
propagate a clear validation error for malformed tls values before FTPFileSystem
receives them.

In `@src/dlt_filesystem/source/fsspec/gdrive.py`:
- Around line 40-48: Update the filesystem option normalization in the source
flow around fs_kwargs and GoogleDriveFileSystem construction: remove the
top-level use_local_webserver boolean cast and ensure that option is handled
within auth_kwargs, while preserving the existing token, creds, and auth_kwargs
mappings before self.fs_class is instantiated.

In `@src/dlt_filesystem/source/fsspec/oci.py`:
- Around line 37-47: Update the option decoding near cast_to_dict and
cast_to_int so cast_to_dict only JSON-decodes config_kwargs and
oci_additional_kwargs. Preserve config values as either filepath strings or
already-parsed dictionaries for OCIFileSystem.

In `@src/dlt_filesystem/source/fsspec/smb.py`:
- Around line 1-8: Validate that the required SMB host option is present before
constructing the filesystem in the SMB source flow. Add the same missing-option
guard used by the FTP/HDFS connectors, returning the established error or
validation result for a hostless URI before calling SMBFileSystem with
fs_kwargs.

In `@src/dlt_filesystem/source/fsspec/webdav.py`:
- Around line 1-8: Update the WebDAV endpoint construction to parse the URI,
normalize only its scheme from +dav to dav, and rebuild base_url without query
parameters or fragments. Preserve the path unchanged, while passing parsed query
options separately through fs_kwargs so credentials and other options are not
retained in the endpoint URL.

In `@tests/dlt_filesystem/test_util.py`:
- Around line 10-15: Extend test_asbool with assertions that invalid strings
such as "", "enabled", and "2" raise ValueError, while preserving the existing
true and false cases.

---

Nitpick comments:
In `@src/dlt_filesystem/source/router.py`:
- Around line 177-196: Narrow the first fallback handler in determine_endpoint
to the specific parse_endpoint failure types that legitimately indicate the
table endpoint is invalid, such as UnsupportedEndpointError, ValueError, and
IndexError. Preserve the table-to-path retry and final error propagation
behavior, while allowing unrelated programming errors like AttributeError or
TypeError to surface immediately.

In `@src/dlt_filesystem/util/python.py`:
- Around line 92-102: Consolidate the boolean parsing in asbool and _cast_value
so both use the same established _TRUE_VALUES and _FALSE_VALUES vocabulary.
Remove the duplicate token lists and preserve the existing invalid-string
ValueError behavior while keeping non-string values converted via bool.
- Around line 145-149: Update apply_alias to detect when both name and
effective_name already exist in data before moving the alias, and raise the
established conflict error or otherwise reject the operation instead of
overwriting effective_name’s value. Preserve the current rename behavior when
only name is present and return unchanged data when name is absent.
- Around line 129-142: Update cast_to_dict and cast_to_list to call json.loads
only for string-encoded field values, passing already-parsed dict or list values
through unchanged. Preserve the current conversion behavior for JSON strings and
return the modified data as before.

In `@tests/main/filesystem/test_remote_read.py`:
- Around line 52-56: Resolve the FTP mocking limitation in
tests/main/filesystem/test_remote_read.py by updating the shared FTP mock setup
so both disabled coverage paths work, then restore the URI-with-separate-table
Item case at lines 52-56 and the FTP unknown-extension failure case at lines
107-111. Preserve the existing test structure and assertions for the other
connectors.