snowflake-connector-python 3.16.0__tar.gz → 3.17.0__tar.gz

{snowflake_connector_python-3.16.0 → snowflake_connector_python-3.17.0}/DESCRIPTION.md

@@ -7,6 +7,29 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v3.17.0(August 16,2025)
+  - Added in-band HTTP exception telemetry.
+  - Added an `unsafe_skip_file_permissions_check` flag to skip file permission checks on the cache and configuration.
+  - Added `APPLICATION_PATH` within `CLIENT_ENVIRONMENT` to distinguish between multiple scripts using the Python Connector in the same environment.
+  - Added basic JSON support for Interval types.
+  - Added in-band OCSP exception telemetry.
+  - Added support for new authentication methods with Workload Identity Federation (WIF).
+    - Added the `WORKLOAD_IDENTITY` value for the authenticator type.
+    - Added the `workload_identity_provider` and `workload_identity_entra_resource` parameters.
+  - Added support for the `use_vectorized_scanner` parameter in the write_pandas function.
+  - Added support of proxy setup using connection parameters without emitting environment variables.
+  - Added populating of `type_code` in `ResultMetadata` for interval types.
+  - Introduced the `snowflake_version` property to the connection.
+  - Moved `OAUTH_TYPE` to `CLIENT_ENVIROMENT`.
+  - Relaxed the `pyarrow` version constrain; versions >= 19 can now be used.
+  - Disabled token caching for OAuth Client Credentials authentication.
+  - Fixed OAuth authenticator values.
+  - Fixed a bug where a PAT with an external session authenticator was used while `external_session_id` was not provided in `SnowflakeRestful.fetch`.
+  - Fixed the case-sensitivity of `Oauth` and `programmatic_access_token` authenticator values.
+  - Fixed unclear error messages for incorrect `authenticator` values.
+  - Fixed GCS staging by ensuring the endpoint has a scheme.
+  - Fixed a bug where time-zoned timestamps fetched as a `pandas.DataFrame` or `pyarrow.Table` would overflow due to unnecessary precision. A clear error will now be raised if an overflow cannot be prevented.
+
 - v3.16.0(July 04,2025)
   - Bumped numpy dependency from <2.1.0 to <=2.2.4.
   - Added Windows support for Python 3.13.

{snowflake_connector_python-3.16.0 → snowflake_connector_python-3.17.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 3.16.0
+Version: 3.17.0
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -72,7 +72,7 @@ Requires-Dist: pytest-xdist; extra == "development"
 Requires-Dist: pytzdata; extra == "development"
 Provides-Extra: pandas
 Requires-Dist: pandas<3.0.0,>=2.1.2; extra == "pandas"
-Requires-Dist: pyarrow<19.0.0; extra == "pandas"
+Requires-Dist: pyarrow; extra == "pandas"
 Provides-Extra: secure-local-storage
 Requires-Dist: keyring<26.0.0,>=23.1.0; extra == "secure-local-storage"
 Dynamic: license-file
@@ -86,6 +86,29 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v3.17.0(August 16,2025)
+  - Added in-band HTTP exception telemetry.
+  - Added an `unsafe_skip_file_permissions_check` flag to skip file permission checks on the cache and configuration.
+  - Added `APPLICATION_PATH` within `CLIENT_ENVIRONMENT` to distinguish between multiple scripts using the Python Connector in the same environment.
+  - Added basic JSON support for Interval types.
+  - Added in-band OCSP exception telemetry.
+  - Added support for new authentication methods with Workload Identity Federation (WIF).
+    - Added the `WORKLOAD_IDENTITY` value for the authenticator type.
+    - Added the `workload_identity_provider` and `workload_identity_entra_resource` parameters.
+  - Added support for the `use_vectorized_scanner` parameter in the write_pandas function.
+  - Added support of proxy setup using connection parameters without emitting environment variables.
+  - Added populating of `type_code` in `ResultMetadata` for interval types.
+  - Introduced the `snowflake_version` property to the connection.
+  - Moved `OAUTH_TYPE` to `CLIENT_ENVIROMENT`.
+  - Relaxed the `pyarrow` version constrain; versions >= 19 can now be used.
+  - Disabled token caching for OAuth Client Credentials authentication.
+  - Fixed OAuth authenticator values.
+  - Fixed a bug where a PAT with an external session authenticator was used while `external_session_id` was not provided in `SnowflakeRestful.fetch`.
+  - Fixed the case-sensitivity of `Oauth` and `programmatic_access_token` authenticator values.
+  - Fixed unclear error messages for incorrect `authenticator` values.
+  - Fixed GCS staging by ensuring the endpoint has a scheme.
+  - Fixed a bug where time-zoned timestamps fetched as a `pandas.DataFrame` or `pyarrow.Table` would overflow due to unnecessary precision. A clear error will now be raised if an overflow cannot be prevented.
+
 - v3.16.0(July 04,2025)
   - Bumped numpy dependency from <2.1.0 to <=2.2.4.
   - Added Windows support for Python 3.13.

{snowflake_connector_python-3.16.0 → snowflake_connector_python-3.17.0}/setup.cfg

@@ -94,7 +94,7 @@ development =
 	pytzdata
 pandas = 
 	pandas>=2.1.2,<3.0.0
-	pyarrow<19.0.0
+	pyarrow
 secure-local-storage = 
 	keyring>=23.1.0,<26.0.0
 

{snowflake_connector_python-3.16.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/_utils.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import string
 from enum import Enum
+from inspect import stack
 from random import choice
 from threading import Timer
 from uuid import UUID
@@ -32,6 +33,15 @@ _PYTHON_SNOWPARK_USE_SCOPED_TEMP_OBJECTS_STRING = (
 
 REQUEST_ID_STATEMENT_PARAM_NAME = "requestId"
 
+# Default server side cap on Degree of Parallelism for file transfer
+# This default value is set to 2^30 (~ 10^9), such that it will not
+# throttle regular sessions.
+_DEFAULT_VALUE_SERVER_DOP_CAP_FOR_FILE_TRANSFER = 1 << 30
+# Variable name of server DoP cap for file transfer
+_VARIABLE_NAME_SERVER_DOP_CAP_FOR_FILE_TRANSFER = (
+    "snowflake_server_dop_cap_for_file_transfer"
+)
+
 
 def generate_random_alphanumeric(length: int = 10) -> str:
     return "".join(choice(ALPHANUMERIC) for _ in range(length))
@@ -60,6 +70,15 @@ def is_uuid4(str_or_uuid: str | UUID) -> bool:
     return uuid_str == str_or_uuid
 
 
+def _snowflake_max_parallelism_for_file_transfer(connection):
+    """Returns the server side cap on max parallelism for file transfer for the given connection."""
+    return getattr(
+        connection,
+        f"_{_VARIABLE_NAME_SERVER_DOP_CAP_FOR_FILE_TRANSFER}",
+        _DEFAULT_VALUE_SERVER_DOP_CAP_FOR_FILE_TRANSFER,
+    )
+
+
 class _TrackedQueryCancellationTimer(Timer):
     def __init__(self, interval, function, args=None, kwargs=None):
         super().__init__(interval, function, args, kwargs)
@@ -68,3 +87,12 @@ class _TrackedQueryCancellationTimer(Timer):
     def run(self):
         super().run()
         self.executed = True
+
+
+def get_application_path() -> str:
+    """Get the path of the application script using the connector."""
+    try:
+        outermost_frame = stack()[-1]
+        return outermost_frame.filename
+    except Exception:
+        return "unknown"

{snowflake_connector_python-3.16.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/arrow_context.py

@@ -13,6 +13,7 @@ from pytz import UTC
 
 from .constants import PARAMETER_TIMEZONE
 from .converter import _generate_tzinfo_from_tzoffset
+from .interval_util import interval_year_month_to_string
 
 if TYPE_CHECKING:
     from numpy import datetime64, float64, int64, timedelta64
@@ -164,6 +165,9 @@ class ArrowConverterContext:
     def DECFLOAT_to_numpy_float64(self, exponent: int, significand: bytes) -> float64:
         return numpy.float64(self.DECFLOAT_to_decimal(exponent, significand))
 
+    def INTERVAL_YEAR_MONTH_to_str(self, months: int) -> str:
+        return interval_year_month_to_string(months)
+
     def INTERVAL_YEAR_MONTH_to_numpy_timedelta(self, months: int) -> timedelta64:
         return numpy.timedelta64(months, "M")
 

{snowflake_connector_python-3.16.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/auth/_auth.py

@@ -17,6 +17,7 @@ from cryptography.hazmat.primitives.serialization import (
     load_pem_private_key,
 )
 
+from .._utils import get_application_path
 from ..compat import urlencode
 from ..constants import (
     DAY_IN_SECONDS,
@@ -51,6 +52,8 @@ from ..network import (
     PYTHON_CONNECTOR_USER_AGENT,
     ReauthenticationRequest,
 )
+from ..platform_detection import detect_platforms
+from ..session_manager import SessionManager
 from ..sqlstate import SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED
 from ..token_cache import TokenCache, TokenKey, TokenType
 from ..version import VERSION
@@ -100,6 +103,8 @@ class Auth:
         login_timeout: int | None = None,
         network_timeout: int | None = None,
         socket_timeout: int | None = None,
+        platform_detection_timeout_seconds: float | None = None,
+        session_manager: SessionManager | None = None,
     ):
         return {
             "data": {
@@ -110,6 +115,7 @@ class Auth:
                 "LOGIN_NAME": user,
                 "CLIENT_ENVIRONMENT": {
                     "APPLICATION": application,
+                    "APPLICATION_PATH": get_application_path(),
                     "OS": OPERATING_SYSTEM,
                     "OS_VERSION": PLATFORM,
                     "PYTHON_VERSION": PYTHON_VERSION,
@@ -120,6 +126,10 @@ class Auth:
                     "LOGIN_TIMEOUT": login_timeout,
                     "NETWORK_TIMEOUT": network_timeout,
                     "SOCKET_TIMEOUT": socket_timeout,
+                    "PLATFORM": detect_platforms(
+                        platform_detection_timeout_seconds=platform_detection_timeout_seconds,
+                        session_manager=session_manager,
+                    ),
                 },
             },
         }
@@ -175,6 +185,8 @@ class Auth:
             self._rest._connection.login_timeout,
             self._rest._connection._network_timeout,
             self._rest._connection._socket_timeout,
+            self._rest._connection._platform_detection_timeout_seconds,
+            session_manager=self._rest.session_manager.clone(use_pooling=False),
         )
 
         body = copy.deepcopy(body_template)
@@ -540,7 +552,9 @@ class Auth:
 
     def get_token_cache(self) -> TokenCache:
         if self._token_cache is None:
-            self._token_cache = TokenCache.make()
+            self._token_cache = TokenCache.make(
+                skip_file_permissions_check=self._rest._connection._unsafe_skip_file_permissions_check
+            )
         return self._token_cache
 
 

{snowflake_connector_python-3.16.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/auth/_oauth_base.py

@@ -20,9 +20,12 @@ from ..errorcode import (
 )
 from ..errors import Error, ProgrammingError
 from ..network import OAUTH_AUTHENTICATOR
+from ..proxy import get_proxy_url
 from ..secret_detector import SecretDetector
 from ..token_cache import TokenCache, TokenKey, TokenType
 from ..vendored import urllib3
+from ..vendored.requests.utils import get_environ_proxies, select_proxy
+from ..vendored.urllib3.poolmanager import ProxyManager
 from .by_plugin import AuthByPlugin, AuthType
 
 if TYPE_CHECKING:
@@ -270,7 +273,9 @@ class AuthByOAuthBase(AuthByPlugin, _OAuthTokensMixin, ABC):
         """
         body["data"]["AUTHENTICATOR"] = OAUTH_AUTHENTICATOR
         body["data"]["TOKEN"] = self._access_token
-        body["data"]["OAUTH_TYPE"] = self._get_oauth_type_id()
+        if "CLIENT_ENVIRONMENT" not in body["data"]:
+            body["data"]["CLIENT_ENVIRONMENT"] = {}
+        body["data"]["CLIENT_ENVIRONMENT"]["OAUTH_TYPE"] = self._get_oauth_type_id()
 
     def _do_refresh_token(self, conn: SnowflakeConnection) -> None:
         """If a refresh token is available exchanges it with a new access token.
@@ -316,8 +321,14 @@ class AuthByOAuthBase(AuthByPlugin, _OAuthTokensMixin, ABC):
         if self._scope:
             fields["scope"] = self._scope
         try:
-            return urllib3.PoolManager().request_encode_body(
-                # TODO: use network pool to gain use of proxy settings and so on
+            # TODO(SNOW-2229411) Session manager should be used here. It may require additional security validation (since we would transition from PoolManager to requests.Session) and some parameters would be passed implicitly. OAuth token exchange must NOT reuse pooled HTTP sessions. We should create a fresh SessionManager with use_pooling=False for each call.
+            proxy_url = self._resolve_proxy_url(conn, self._token_request_url)
+            http_client = (
+                ProxyManager(proxy_url=proxy_url)
+                if proxy_url
+                else urllib3.PoolManager()
+            )
+            return http_client.request_encode_body(
                 "POST",
                 self._token_request_url,
                 encode_multipart=False,
@@ -356,8 +367,12 @@ class AuthByOAuthBase(AuthByPlugin, _OAuthTokensMixin, ABC):
         connection: SnowflakeConnection,
         fields: dict[str, str],
     ) -> (str | None, str | None):
-        resp = urllib3.PoolManager().request_encode_body(
-            # TODO: use network pool to gain use of proxy settings and so on
+        # TODO(SNOW-2229411) Session manager should be used here. It may require additional security validation (since we would transition from PoolManager to requests.Session) and some parameters would be passed implicitly. Token request must bypass HTTP connection pools.
+        proxy_url = self._resolve_proxy_url(connection, self._token_request_url)
+        http_client = (
+            ProxyManager(proxy_url=proxy_url) if proxy_url else urllib3.PoolManager()
+        )
+        resp = http_client.request_encode_body(
             "POST",
             self._token_request_url,
             headers=self._create_token_request_headers(),
@@ -398,3 +413,25 @@ class AuthByOAuthBase(AuthByPlugin, _OAuthTokensMixin, ABC):
             "Accept": "application/json",
             "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
         }
+
+    @staticmethod
+    def _resolve_proxy_url(
+        connection: SnowflakeConnection, request_url: str
+    ) -> str | None:
+        # TODO(SNOW-2229411) Session manager should be used instead. It may require additional security validation.
+        """Resolve proxy URL from explicit config first, then environment variables."""
+        # First try explicit proxy configuration from connection parameters
+        proxy_url = get_proxy_url(
+            connection.proxy_host,
+            connection.proxy_port,
+            connection.proxy_user,
+            connection.proxy_password,
+        )
+
+        if proxy_url:
+            return proxy_url
+
+        # Fall back to environment variables (HTTP_PROXY, HTTPS_PROXY)
+        # Use proper proxy selection that considers the URL scheme
+        proxies = get_environ_proxies(request_url)
+        return select_proxy(request_url, proxies)

{snowflake_connector_python-3.16.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/auth/by_plugin.py

@@ -50,7 +50,7 @@ class AuthType(Enum):
     ID_TOKEN = "ID_TOKEN"
     USR_PWD_MFA = "USERNAME_PASSWORD_MFA"
     OKTA = "OKTA"
-    PAT = "PROGRAMMATIC_ACCESS_TOKEN'"
+    PAT = "PROGRAMMATIC_ACCESS_TOKEN"
     NO_AUTH = "NO_AUTH"
     WORKLOAD_IDENTITY = "WORKLOAD_IDENTITY"
     PAT_WITH_EXTERNAL_SESSION = "PAT_WITH_EXTERNAL_SESSION"

{snowflake_connector_python-3.16.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/auth/oauth_code.py

@@ -269,6 +269,7 @@ You can close this window now and go back where you started from.
             "login. If you can't see it, check existing browser windows, "
             "or your OS settings. Press CTRL+C to abort and try again..."
         )
+        # TODO(SNOW-2229411) Investigate if Session manager / Http Config should be used here.
         code, state = (
             self._receive_authorization_callback(callback_server, connection)
             if webbrowser.open(authorization_request)

{snowflake_connector_python-3.16.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/auth/oauth_credentials.py

@@ -8,7 +8,6 @@ import logging
 from typing import TYPE_CHECKING, Any
 
 from ..constants import OAUTH_TYPE_CLIENT_CREDENTIALS
-from ..token_cache import TokenCache
 from ._oauth_base import AuthByOAuthBase
 
 if TYPE_CHECKING:
@@ -27,8 +26,6 @@ class AuthByOauthCredentials(AuthByOAuthBase):
         client_secret: str,
         token_request_url: str,
         scope: str,
-        token_cache: TokenCache | None = None,
-        refresh_token_enabled: bool = False,
         connection: SnowflakeConnection | None = None,
         **kwargs,
     ) -> None:
@@ -38,8 +35,8 @@ class AuthByOauthCredentials(AuthByOAuthBase):
             client_secret=client_secret,
             token_request_url=token_request_url,
             scope=scope,
-            token_cache=token_cache,
-            refresh_token_enabled=refresh_token_enabled,
+            token_cache=None,
+            refresh_token_enabled=False,
             **kwargs,
         )
         self._application = application

{snowflake_connector_python-3.16.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/auth/okta.py

@@ -168,6 +168,7 @@ class AuthByOkta(AuthByPlugin):
             conn._ocsp_mode(),
             conn.login_timeout,
             conn._network_timeout,
+            session_manager=conn._session_manager.clone(use_pooling=False),
         )
 
         body["data"]["AUTHENTICATOR"] = authenticator
@@ -235,7 +236,7 @@ class AuthByOkta(AuthByPlugin):
             "username": user,
             "password": password,
         }
-        ret = conn._rest.fetch(
+        ret = conn.rest.fetch(
             "post",
             token_url,
             headers,
@@ -285,7 +286,7 @@ class AuthByOkta(AuthByPlugin):
                     HTTP_HEADER_ACCEPT: "*/*",
                 }
                 remaining_timeout = timeout_time - time.time() if timeout_time else None
-                response_html = conn._rest.fetch(
+                response_html = conn.rest.fetch(
                     "get",
                     sso_url,
                     headers,

{snowflake_connector_python-3.16.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/auth/pat.py

@@ -13,6 +13,7 @@ class AuthByPAT(AuthByPlugin):
         super().__init__(**kwargs)
         self._pat_token: str | None = pat_token
 
+    @property
     def type_(self) -> AuthType:
         return AuthType.PAT
 

{snowflake_connector_python-3.16.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/auth/webbrowser.py

@@ -462,6 +462,7 @@ You can close this window now and go back where you started from.
             conn._rest._connection._ocsp_mode(),
             conn._rest._connection.login_timeout,
             conn._rest._connection._network_timeout,
+            session_manager=conn.rest.session_manager.clone(use_pooling=False),
         )
 
         body["data"]["AUTHENTICATOR"] = authenticator

{snowflake_connector_python-3.16.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/auth/workload_identity.py

@@ -4,6 +4,9 @@ import json
 import typing
 from enum import Enum, unique
 
+if typing.TYPE_CHECKING:
+    from snowflake.connector.connection import SnowflakeConnection
+
 from ..network import WORKLOAD_IDENTITY_AUTHENTICATOR
 from ..wif_util import (
     AttestationProvider,
@@ -74,10 +77,15 @@ class AuthByWorkloadIdentity(AuthByPlugin):
         ).value
         body["data"]["TOKEN"] = self.attestation.credential
 
-    def prepare(self, **kwargs: typing.Any) -> None:
+    def prepare(
+        self, *, conn: SnowflakeConnection | None, **kwargs: typing.Any
+    ) -> None:
         """Fetch the token."""
         self.attestation = create_attestation(
-            self.provider, self.entra_resource, self.token
+            self.provider,
+            self.entra_resource,
+            self.token,
+            session_manager=conn._session_manager.clone() if conn else None,
         )
 
     def reauthenticate(self, **kwargs: typing.Any) -> dict[str, bool]:

{snowflake_connector_python-3.16.0 → snowflake_connector_python-3.17.0}/src/snowflake/connector/config_manager.py

@@ -295,6 +295,7 @@ class ConfigManager:
 
     def read_config(
         self,
+        skip_file_permissions_check: bool = False,
     ) -> None:
         """Read and cache config file contents.
 
@@ -310,8 +311,11 @@ class ConfigManager:
         read_config_file = tomlkit.TOMLDocument()
 
         # Read in all of the config slices
+        config_slice_options = ConfigSliceOptions(
+            check_permissions=not skip_file_permissions_check
+        )
         for filep, sliceoptions, section in itertools.chain(
-            ((self.file_path, ConfigSliceOptions(), None),),
+            ((self.file_path, config_slice_options, None),),
             self._slices,
         ):
             if sliceoptions.only_in_slice: