snowflake-connector-python 3.17.3__tar.gz → 3.18.0__tar.gz

{snowflake_connector_python-3.17.3 → snowflake_connector_python-3.18.0}/DESCRIPTION.md

@@ -7,6 +7,16 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v3.19.0(TBD)
+  - N/A
+
+- v3.18.0(October 03,2025)
+  - Added support for pandas conversion for Day-time and Year-Month Interval types
+
+- v3.17.4(September 22,2025)
+  - Added support for intermediate certificates as roots when they are stored in the trust store
+  - Bumped up vendored `urllib3` to `2.5.0` and `requests` to `v2.32.5`
+
 - v3.17.3(September 02,2025)
   - Enhanced configuration file permission warning messages.
     - Improved warning messages for readable permission issues to include clear instructions on how to skip warnings using the `SF_SKIP_WARNING_FOR_READ_PERMISSIONS_ON_CONFIG_FILE` environment variable.

{snowflake_connector_python-3.17.3 → snowflake_connector_python-3.18.0}/MANIFEST.in

@@ -4,7 +4,7 @@ include LICENSE.txt
 include NOTICE
 include pyproject.toml
 include src/snowflake/connector/nanoarrow_cpp/ArrowIterator/LICENSE.txt
-recursive-include src/snowflake/connector py.typed *.py *.pyx
+recursive-include src/snowflake/connector py.typed *.py *.pyx *.js
 recursive-include src/snowflake/connector/vendored LICENSE*
 
 recursive-include src/snowflake/connector/nanoarrow_cpp *.cpp *.hpp

{snowflake_connector_python-3.17.3 → snowflake_connector_python-3.18.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 3.17.3
+Version: 3.18.0
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -86,6 +86,16 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v3.19.0(TBD)
+  - N/A
+
+- v3.18.0(October 03,2025)
+  - Added support for pandas conversion for Day-time and Year-Month Interval types
+
+- v3.17.4(September 22,2025)
+  - Added support for intermediate certificates as roots when they are stored in the trust store
+  - Bumped up vendored `urllib3` to `2.5.0` and `requests` to `v2.32.5`
+
 - v3.17.3(September 02,2025)
   - Enhanced configuration file permission warning messages.
     - Improved warning messages for readable permission issues to include clear instructions on how to skip warnings using the `SF_SKIP_WARNING_FOR_READ_PERMISSIONS_ON_CONFIG_FILE` environment variable.

{snowflake_connector_python-3.17.3 → snowflake_connector_python-3.18.0}/src/snowflake/connector/connection_diagnostic.py

@@ -240,6 +240,10 @@ class ConnectionDiagnostic:
 
                 context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
                 context.load_verify_locations(certifi.where())
+                # Best-effort: enable partial-chain when supported
+                _partial_flag = getattr(ssl, "VERIFY_X509_PARTIAL_CHAIN", 0)
+                if _partial_flag and hasattr(context, "verify_flags"):
+                    context.verify_flags |= _partial_flag
                 sock = context.wrap_socket(conn, server_hostname=host)
                 certificate = ssl.DER_cert_to_PEM_cert(sock.getpeercert(True))
                 http_request = f"""GET / {host}:{port} HTTP/1.1\r\n

{snowflake_connector_python-3.17.3 → snowflake_connector_python-3.18.0}/src/snowflake/connector/nanoarrow_cpp/ArrowIterator/CArrowTableIterator.cpp

@@ -68,6 +68,7 @@ void CArrowTableIterator::convertIfNeeded(ArrowSchema* columnSchema,
     case SnowflakeType::Type::DATE:
     case SnowflakeType::Type::REAL:
     case SnowflakeType::Type::TEXT:
+    case SnowflakeType::Type::INTERVAL_YEAR_MONTH:
     case SnowflakeType::Type::VARIANT:
     case SnowflakeType::Type::VECTOR: {
       // Do not need to convert
@@ -174,6 +175,24 @@ void CArrowTableIterator::convertIfNeeded(ArrowSchema* columnSchema,
       break;
     }
 
+    case SnowflakeType::Type::INTERVAL_DAY_TIME: {
+      int scale = 9;
+      if (metadata != nullptr) {
+        struct ArrowStringView scaleString = ArrowCharView(nullptr);
+        returnCode = ArrowMetadataGetValue(metadata, ArrowCharView("scale"),
+                                           &scaleString);
+        SF_CHECK_ARROW_RC(returnCode,
+                          "[Snowflake Exception] error getting 'scale' "
+                          "from Arrow metadata, error code: %d",
+                          returnCode);
+        scale =
+            std::stoi(std::string(scaleString.data, scaleString.size_bytes));
+      }
+      convertIntervalDayTimeColumn_nanoarrow(&columnSchemaView, columnArray,
+                                             scale);
+      break;
+    }
+
     case SnowflakeType::Type::TIME: {
       int scale = 9;
       if (metadata != nullptr) {
@@ -503,6 +522,76 @@ void CArrowTableIterator::
   ArrowArrayMove(newArray, columnArray->array);
 }
 
+void CArrowTableIterator::convertIntervalDayTimeColumn_nanoarrow(
+    ArrowSchemaView* field, ArrowArrayView* columnArray, const int scale) {
+  int returnCode = 0;
+  nanoarrow::UniqueSchema newUniqueField;
+  nanoarrow::UniqueArray newUniqueArray;
+  ArrowSchema* newSchema = newUniqueField.get();
+  ArrowArray* newArray = newUniqueArray.get();
+  ArrowError error;
+
+  // create new schema
+  ArrowSchemaInit(newSchema);
+  newSchema->flags &=
+      (field->schema->flags & ARROW_FLAG_NULLABLE);  // map to nullable()
+
+  returnCode = ArrowSchemaSetTypeDateTime(newSchema, NANOARROW_TYPE_DURATION,
+                                          NANOARROW_TIME_UNIT_NANO, NULL);
+  SF_CHECK_ARROW_RC(returnCode,
+                    "[Snowflake Exception] error setting arrow schema type "
+                    "DateTime, error code: %d",
+                    returnCode);
+
+  returnCode = ArrowSchemaSetName(newSchema, field->schema->name);
+  SF_CHECK_ARROW_RC(
+      returnCode,
+      "[Snowflake Exception] error setting schema name, error code: %d",
+      returnCode);
+
+  returnCode = ArrowArrayInitFromSchema(newArray, newSchema, &error);
+  SF_CHECK_ARROW_RC(returnCode,
+                    "[Snowflake Exception] error initializing ArrowArrayView "
+                    "from schema : %s, error code: %d",
+                    ArrowErrorMessage(&error), returnCode);
+
+  returnCode = ArrowArrayStartAppending(newArray);
+  SF_CHECK_ARROW_RC(
+      returnCode,
+      "[Snowflake Exception] error appending arrow array, error code: %d",
+      returnCode);
+
+  for (int64_t rowIdx = 0; rowIdx < columnArray->array->length; rowIdx++) {
+    if (ArrowArrayViewIsNull(columnArray, rowIdx)) {
+      returnCode = ArrowArrayAppendNull(newArray, 1);
+      SF_CHECK_ARROW_RC(returnCode,
+                        "[Snowflake Exception] error appending null to arrow "
+                        "array, error code: %d",
+                        returnCode);
+    } else {
+      ArrowDecimal arrowDecimal;
+      ArrowDecimalInit(&arrowDecimal, 128, 38, 0);
+      ArrowArrayViewGetDecimalUnsafe(columnArray, rowIdx, &arrowDecimal);
+      auto originalVal = ArrowDecimalGetIntUnsafe(&arrowDecimal);
+      returnCode = ArrowArrayAppendInt(newArray, originalVal);
+      SF_CHECK_ARROW_RC(returnCode,
+                        "[Snowflake Exception] error appending int to arrow "
+                        "array, error code: %d",
+                        returnCode);
+    }
+  }
+
+  returnCode = ArrowArrayFinishBuildingDefault(newArray, &error);
+  SF_CHECK_ARROW_RC(returnCode,
+                    "[Snowflake Exception] error finishing building arrow "
+                    "array: %s, error code: %d",
+                    ArrowErrorMessage(&error), returnCode);
+  field->schema->release(field->schema);
+  ArrowSchemaMove(newSchema, field->schema);
+  columnArray->array->release(columnArray->array);
+  ArrowArrayMove(newArray, columnArray->array);
+}
+
 void CArrowTableIterator::convertTimeColumn_nanoarrow(
     ArrowSchemaView* field, ArrowArrayView* columnArray, const int scale) {
   int returnCode = 0;

{snowflake_connector_python-3.17.3 → snowflake_connector_python-3.18.0}/src/snowflake/connector/nanoarrow_cpp/ArrowIterator/CArrowTableIterator.hpp

@@ -94,6 +94,14 @@ class CArrowTableIterator : public CArrowIterator {
                                    ArrowArrayView* columnArray,
                                    const int scale);
 
+  /**
+   * convert Snowflake Interval Day-Time column (Arrow int64/decimal128) to
+   * Arrow Duration column
+   */
+  void convertIntervalDayTimeColumn_nanoarrow(ArrowSchemaView* field,
+                                              ArrowArrayView* columnArray,
+                                              const int scale);
+
   /**
    * convert Snowflake TimestampNTZ/TimestampLTZ column to Arrow Timestamp
    * column

{snowflake_connector_python-3.17.3 → snowflake_connector_python-3.18.0}/src/snowflake/connector/session_manager.py

@@ -14,7 +14,7 @@ from .proxy import get_proxy_url
 from .vendored import requests
 from .vendored.requests import Response, Session
 from .vendored.requests.adapters import BaseAdapter, HTTPAdapter
-from .vendored.requests.exceptions import InvalidProxyURL
+from .vendored.requests.exceptions import InvalidProxyURL, InvalidURL
 from .vendored.requests.utils import prepend_scheme_if_needed, select_proxy
 from .vendored.urllib3 import PoolManager, Retry
 from .vendored.urllib3.poolmanager import ProxyManager
@@ -23,7 +23,6 @@ from .vendored.urllib3.util.url import parse_url
 if TYPE_CHECKING:
     from .vendored.urllib3.connectionpool import HTTPConnectionPool, HTTPSConnectionPool
 
-
 logger = logging.getLogger(__name__)
 REQUESTS_RETRY = 1  # requests library builtin retry
 
@@ -60,19 +59,25 @@ def _propagate_session_manager_to_ocsp(generator_func):
 class ProxySupportAdapter(HTTPAdapter):
     """This Adapter creates proper headers for Proxy CONNECT messages."""
 
-    def get_connection(
-        self, url: str, proxies: dict | None = None
+    def get_connection_with_tls_context(
+        self, request, verify, proxies=None, cert=None
     ) -> HTTPConnectionPool | HTTPSConnectionPool:
-        proxy = select_proxy(url, proxies)
-        parsed_url = urlparse(url)
-
+        proxy = select_proxy(request.url, proxies)
+        try:
+            host_params, pool_kwargs = self.build_connection_pool_key_attributes(
+                request,
+                verify,
+                cert,
+            )
+        except ValueError as e:
+            raise InvalidURL(e, request=request)
         if proxy:
             proxy = prepend_scheme_if_needed(proxy, "http")
             proxy_url = parse_url(proxy)
             if not proxy_url.host:
                 raise InvalidProxyURL(
-                    "Please check proxy URL. It is malformed"
-                    " and could be missing the host."
+                    "Please check proxy URL. It is malformed "
+                    "and could be missing the host."
                 )
             proxy_manager = self.proxy_manager_for(proxy)
 
@@ -85,17 +90,22 @@ class ProxySupportAdapter(HTTPAdapter):
                 # Note: netloc also keeps user-info (user:pass@host) if present in URL. The driver never sends
                 # URLs with embedded credentials, so we leave them unhandled — for full support
                 # we’d need to manually concatenate hostname with optional port and IPv6 brackets.
+                parsed_url = urlparse(request.url)
                 proxy_manager.proxy_headers["Host"] = parsed_url.netloc
             else:
                 logger.debug(
                     f"Unable to set 'Host' to proxy manager of type {type(proxy_manager)} as"
                     f" it does not have attribute 'proxy_headers'."
                 )
-            conn = proxy_manager.connection_from_url(url)
+
+            conn = proxy_manager.connection_from_host(
+                **host_params, pool_kwargs=pool_kwargs
+            )
         else:
             # Only scheme should be lower case
-            url = parsed_url.geturl()
-            conn = self.poolmanager.connection_from_url(url)
+            conn = self.poolmanager.connection_from_host(
+                **host_params, pool_kwargs=pool_kwargs
+            )
 
         return conn
 

{snowflake_connector_python-3.17.3 → snowflake_connector_python-3.18.0}/src/snowflake/connector/ssl_wrap_socket.py

@@ -8,11 +8,13 @@ from __future__ import annotations
 #
 # and added OCSP validator on the top.
 import logging
+import os
+import ssl
 import time
 import weakref
 from contextvars import ContextVar
 from functools import wraps
-from inspect import getfullargspec as get_args
+from inspect import signature as _sig
 from socket import socket
 from typing import Any
 
@@ -38,9 +40,57 @@ FEATURE_OCSP_RESPONSE_CACHE_FILE_NAME: str | None = None
 log = logging.getLogger(__name__)
 
 
+# Helper utilities (private)
+def _resolve_cafile(kwargs: dict[str, Any]) -> str | None:
+    """Resolve CA bundle path from kwargs or standard environment variables.
+
+    Precedence:
+      1) kwargs['ca_certs'] if provided by caller
+      2) REQUESTS_CA_BUNDLE
+      3) SSL_CERT_FILE
+    """
+    caf = kwargs.get("ca_certs")
+    if caf:
+        return caf
+    return os.environ.get("REQUESTS_CA_BUNDLE") or os.environ.get("SSL_CERT_FILE")
+
+
+def _ensure_partial_chain_on_context(ctx: PyOpenSSLContext, cafile: str | None) -> None:
+    """Load CA bundle (when provided) and enable OpenSSL partial-chain support on ctx."""
+    if cafile:
+        try:
+            ctx.load_verify_locations(cafile=cafile, capath=None)
+        except (ssl.SSLError, OSError, ValueError):
+            # Leave context unchanged; handshake/validation surfaces failures
+            pass
+    try:
+        store = ctx._ctx.get_cert_store()
+        from OpenSSL import crypto as _crypto
+
+        if hasattr(_crypto, "X509StoreFlags") and hasattr(
+            _crypto.X509StoreFlags, "PARTIAL_CHAIN"
+        ):
+            store.set_flags(_crypto.X509StoreFlags.PARTIAL_CHAIN)
+    except (AttributeError, ImportError, OpenSSL.SSL.Error, OSError, ValueError):
+        # Best-effort; if not available, default chain building applies
+        pass
+
+
+def _build_context_with_partial_chain(cafile: str | None) -> PyOpenSSLContext:
+    """Create PyOpenSSL context configured for CERT_REQUIRED and partial-chain trust."""
+    ctx = PyOpenSSLContext(ssl_.PROTOCOL_TLS_CLIENT)
+    try:
+        ctx.verify_mode = ssl.CERT_REQUIRED
+    except Exception:
+        pass
+    _ensure_partial_chain_on_context(ctx, cafile)
+    return ctx
+
+
 # Store a *weak* reference so that the context variable doesn’t prolong the
 # lifetime of the SessionManager. Once all owning connections are GC-ed the
-# weakref goes dead and OCSP will fall back to its local manager (but most likely won't be used ever again anyway).
+# weakref goes dead and OCSP will fall back to its local manager (but most
+# likely won't be used ever again anyway).
 _CURRENT_SESSION_MANAGER: ContextVar[weakref.ref[SessionManager] | None] = ContextVar(
     "_CURRENT_SESSION_MANAGER",
     default=None,
@@ -71,7 +121,10 @@ def set_current_session_manager(sm: SessionManager | None) -> Any:
     Called from SnowflakeConnection so that OCSP downloads
     use the same proxy / header configuration as the initiating connection.
 
-    Alternative approach would be moving method inject_into_urllib3() inside connection initialization, but in case this delay (from module import time to connection initialization time) would cause some code to break we stayed with this approach, having in mind soon OCSP deprecation.
+    Alternative approach would be moving method inject_into_urllib3() inside
+    connection initialization, but in case this delay (from module import time
+    to connection initialization time) would cause some code to break we stayed
+    with this approach, having in mind soon OCSP deprecation.
     """
     return _CURRENT_SESSION_MANAGER.set(weakref.ref(sm) if sm is not None else None)
 
@@ -93,37 +146,29 @@ def inject_into_urllib3() -> None:
 
 @wraps(ssl_.ssl_wrap_socket)
 def ssl_wrap_socket_with_ocsp(*args: Any, **kwargs: Any) -> WrappedSocket:
-    # Extract host_name
-    hostname_index = get_args(ssl_.ssl_wrap_socket).args.index("server_hostname")
-    server_hostname = (
-        args[hostname_index]
-        if len(args) > hostname_index
-        else kwargs.get("server_hostname", None)
-    )
-    # Remove context if present
-    ssl_context_index = get_args(ssl_.ssl_wrap_socket).args.index("ssl_context")
-    context_in_args = len(args) > ssl_context_index
-    ssl_context = (
-        args[hostname_index] if context_in_args else kwargs.get("ssl_context", None)
-    )
-    if not isinstance(ssl_context, PyOpenSSLContext):
-        # Create new default context
-        if context_in_args:
-            new_args = list(args)
-            new_args[ssl_context_index] = None
-            args = tuple(new_args)
-        else:
-            del kwargs["ssl_context"]
-    # Fix ca certs location
-    ca_certs_index = get_args(ssl_.ssl_wrap_socket).args.index("ca_certs")
-    ca_certs_in_args = len(args) > ca_certs_index
-    if not ca_certs_in_args and not kwargs.get("ca_certs"):
-        kwargs["ca_certs"] = certifi.where()
-
-    ret = ssl_.ssl_wrap_socket(*args, **kwargs)
+    # Bind passed args/kwargs to the underlying signature to support both positional and keyword calls
+    bound = _sig(ssl_.ssl_wrap_socket).bind_partial(*args, **kwargs)
+    params = bound.arguments
+
+    server_hostname = params.get("server_hostname")
+
+    # Ensure CA bundle default if not provided
+    if not params.get("ca_certs"):
+        params["ca_certs"] = certifi.where()
+
+    # Ensure PyOpenSSL context with partial-chain is used if none or wrong type provided
+    provided_ctx = params.get("ssl_context")
+    if not isinstance(provided_ctx, PyOpenSSLContext):
+        cafile_for_ctx = _resolve_cafile(params)
+        params["ssl_context"] = _build_context_with_partial_chain(cafile_for_ctx)
+    else:
+        # If a PyOpenSSLContext is provided, ensure it trusts the provided CA and partial-chain is enabled
+        _ensure_partial_chain_on_context(provided_ctx, _resolve_cafile(params))
+
+    ret = ssl_.ssl_wrap_socket(**params)
 
     log.debug(
-        "OCSP Mode: %s, " "OCSP response cache file name: %s",
+        "OCSP Mode: %s, OCSP response cache file name: %s",
         FEATURE_OCSP_MODE.name,
         FEATURE_OCSP_RESPONSE_CACHE_FILE_NAME,
     )
@@ -137,10 +182,7 @@ def ssl_wrap_socket_with_ocsp(*args: Any, **kwargs: Any) -> WrappedSocket:
         ).validate(server_hostname, ret.connection)
         if not v:
             raise OperationalError(
-                msg=(
-                    "The certificate is revoked or "
-                    "could not be validated: hostname={}".format(server_hostname)
-                ),
+                msg=f"The certificate is revoked or could not be validated: hostname={server_hostname}",
                 errno=ER_OCSP_RESPONSE_CERT_STATUS_REVOKED,
             )
     else:

{snowflake_connector_python-3.17.3 → snowflake_connector_python-3.18.0}/src/snowflake/connector/vendored/requests/__init__.py

@@ -41,6 +41,7 @@ is at <https://requests.readthedocs.io>.
 import warnings
 
 from .. import urllib3
+
 from .exceptions import RequestsDependencyWarning
 
 try:
@@ -82,7 +83,11 @@ def check_compatibility(urllib3_version, chardet_version, charset_normalizer_ver
         # charset_normalizer >= 2.0.0 < 4.0.0
         assert (2, 0, 0) <= (major, minor, patch) < (4, 0, 0)
     else:
-        raise Exception("You need either charset_normalizer or chardet installed")
+        warnings.warn(
+            "Unable to find acceptable character detection dependency "
+            "(chardet or charset_normalizer).",
+            RequestsDependencyWarning,
+        )
 
 
 def _check_cryptography(cryptography_version):
@@ -113,14 +118,24 @@ except (AssertionError, ValueError):
         RequestsDependencyWarning,
     )
 
-# Attempt to enable urllib3's SNI support, if possible
+# Attempt to enable urllib3's fallback for SNI support
+# if the standard library doesn't support SNI or the
+# 'ssl' library isn't available.
 try:
-    from ..urllib3.contrib import pyopenssl
-    pyopenssl.inject_into_urllib3()
+    try:
+        import ssl
+    except ImportError:
+        ssl = None
+
+    if not getattr(ssl, "HAS_SNI", False):
+        from ..urllib3.contrib import pyopenssl
+
+        pyopenssl.inject_into_urllib3()
+
+        # Check cryptography version
+        from cryptography import __version__ as cryptography_version
 
-    # Check cryptography version
-    from cryptography import __version__ as cryptography_version
-    _check_cryptography(cryptography_version)
+        _check_cryptography(cryptography_version)
 except ImportError:
     pass
 
@@ -133,7 +148,7 @@ warnings.simplefilter("ignore", DependencyWarning)
 import logging
 from logging import NullHandler
 
-from . import utils
+from . import packages, utils
 from .__version__ import (
     __author__,
     __author_email__,

{snowflake_connector_python-3.17.3 → snowflake_connector_python-3.18.0}/src/snowflake/connector/vendored/requests/__version__.py

@@ -5,10 +5,10 @@
 __title__ = "requests"
 __description__ = "Python HTTP for Humans."
 __url__ = "https://requests.readthedocs.io"
-__version__ = "2.31.0"
-__build__ = 0x023100
+__version__ = "2.32.5"
+__build__ = 0x023205
 __author__ = "Kenneth Reitz"
 __author_email__ = "me@kennethreitz.org"
-__license__ = "Apache 2.0"
+__license__ = "Apache-2.0"
 __copyright__ = "Copyright Kenneth Reitz"
 __cake__ = "\u2728 \U0001f370 \u2728"