snowflake-connector-python 4.0.0__tar.gz → 4.1.1__tar.gz

{snowflake_connector_python-4.0.0 → snowflake_connector_python-4.1.1}/DESCRIPTION.md

@@ -7,7 +7,21 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v4.1.0(TBD)
+- v4.1.1(TBD)
+  - Relaxed pandas dependency requirements for Python below 3.12.
+  - Changed CRL cache cleanup background task to daemon to avoid blocking main thread.
+  - Fixed NO_PROXY issues with PUT operations
+
+- v4.1.0(November 18,2025)
+  - Added the `SNOWFLAKE_AUTH_FORCE_SERVER` environment variable to force the use of the local-listening server when using the `externalbrowser` auth method.
+    - This allows headless environments (like Docker or Airflow) running locally to auth via a browser URL.
+  - Fix compilation error when building from sources with libc++.
+  - Pin lower versions of dependencies to oldest version without vulnerabilities.
+  - Added no_proxy parameter for proxy configuration without using environmental variables.
+  - Added OAUTH_AUTHORIZATION_CODE and OAUTH_CLIENT_CREDENTIALS to list of authenticators that don't require user to be set
+  - Added `oauth_socket_uri` connection parameter allowing to separate server and redirect URIs for local OAuth server.
+  - Made platform_detection logs silent and improved its timeout handling. Added support for ENV_VAR_DISABLE_PLATFORM_DETECTION environment variable.
+  - Fixed FIPS environments md5 hash issues with multipart upload on Azure.
 
 - v4.0.0(October 09,2025)
   - Added support for checking certificates revocation using revocation lists (CRLs)

{snowflake_connector_python-4.0.0 → snowflake_connector_python-4.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.0.0
+Version: 4.1.1
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -39,16 +39,16 @@ Description-Content-Type: text/markdown
 License-File: LICENSE.txt
 License-File: NOTICE
 Requires-Dist: asn1crypto<2.0.0,>0.24.0
-Requires-Dist: cryptography>=3.1.0
-Requires-Dist: pyOpenSSL<26.0.0,>=22.0.0
-Requires-Dist: pyjwt<3.0.0
+Requires-Dist: cryptography>=44.0.1
+Requires-Dist: pyOpenSSL<26.0.0,>=24.0.0
+Requires-Dist: pyjwt<3.0.0,>=2.10.1
 Requires-Dist: pytz
-Requires-Dist: requests<3.0.0
+Requires-Dist: requests<3.0.0,>=2.32.4
 Requires-Dist: packaging
 Requires-Dist: charset_normalizer<4,>=2
-Requires-Dist: idna<4,>=2.5
-Requires-Dist: urllib3<2.0.0,>=1.21.1; python_version < "3.10"
-Requires-Dist: certifi>=2017.4.17
+Requires-Dist: idna<4,>=3.7
+Requires-Dist: urllib3<2.0.0,>=1.26.5; python_version < "3.10"
+Requires-Dist: certifi>=2024.7.4
 Requires-Dist: typing_extensions<5,>=4.3
 Requires-Dist: filelock<4,>=3.5
 Requires-Dist: sortedcontainers>=2.4.0
@@ -62,6 +62,7 @@ Requires-Dist: botocore>=1.24; extra == "boto"
 Provides-Extra: development
 Requires-Dist: Cython; extra == "development"
 Requires-Dist: coverage; extra == "development"
+Requires-Dist: mitmproxy>=6.0.0; python_version >= "3.10" and extra == "development"
 Requires-Dist: more-itertools; extra == "development"
 Requires-Dist: numpy<=2.2.4; extra == "development"
 Requires-Dist: pendulum!=2.1.1; extra == "development"
@@ -74,8 +75,9 @@ Requires-Dist: pytest-xdist; extra == "development"
 Requires-Dist: pytzdata; extra == "development"
 Requires-Dist: responses; extra == "development"
 Provides-Extra: pandas
-Requires-Dist: pandas<3.0.0,>=2.1.2; extra == "pandas"
-Requires-Dist: pyarrow; extra == "pandas"
+Requires-Dist: pandas<3.0.0,>=1.0.0; python_version < "3.13" and extra == "pandas"
+Requires-Dist: pandas<3.0.0,>=2.1.2; python_version >= "3.13" and extra == "pandas"
+Requires-Dist: pyarrow>=14.0.1; extra == "pandas"
 Provides-Extra: secure-local-storage
 Requires-Dist: keyring<26.0.0,>=23.1.0; extra == "secure-local-storage"
 Dynamic: license-file
@@ -90,7 +92,21 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v4.1.0(TBD)
+- v4.1.1(TBD)
+  - Relaxed pandas dependency requirements for Python below 3.12.
+  - Changed CRL cache cleanup background task to daemon to avoid blocking main thread.
+  - Fixed NO_PROXY issues with PUT operations
+
+- v4.1.0(November 18,2025)
+  - Added the `SNOWFLAKE_AUTH_FORCE_SERVER` environment variable to force the use of the local-listening server when using the `externalbrowser` auth method.
+    - This allows headless environments (like Docker or Airflow) running locally to auth via a browser URL.
+  - Fix compilation error when building from sources with libc++.
+  - Pin lower versions of dependencies to oldest version without vulnerabilities.
+  - Added no_proxy parameter for proxy configuration without using environmental variables.
+  - Added OAUTH_AUTHORIZATION_CODE and OAUTH_CLIENT_CREDENTIALS to list of authenticators that don't require user to be set
+  - Added `oauth_socket_uri` connection parameter allowing to separate server and redirect URIs for local OAuth server.
+  - Made platform_detection logs silent and improved its timeout handling. Added support for ENV_VAR_DISABLE_PLATFORM_DETECTION environment variable.
+  - Fixed FIPS environments md5 hash issues with multipart upload on Azure.
 
 - v4.0.0(October 09,2025)
   - Added support for checking certificates revocation using revocation lists (CRLs)

{snowflake_connector_python-4.0.0 → snowflake_connector_python-4.1.1}/setup.cfg

@@ -44,16 +44,16 @@ python_requires = >=3.9
 packages = find_namespace:
 install_requires = 
 	asn1crypto>0.24.0,<2.0.0
-	cryptography>=3.1.0
-	pyOpenSSL>=22.0.0,<26.0.0
-	pyjwt<3.0.0
+	cryptography>=44.0.1
+	pyOpenSSL>=24.0.0,<26.0.0
+	pyjwt>=2.10.1,<3.0.0
 	pytz
-	requests<3.0.0
+	requests>=2.32.4,<3.0.0
 	packaging
 	charset_normalizer>=2,<4
-	idna>=2.5,<4
-	urllib3>=1.21.1,<2.0.0; python_version < '3.10'
-	certifi>=2017.4.17
+	idna>=3.7,<4
+	urllib3>=1.26.5,<2.0.0; python_version < '3.10'
+	certifi>=2024.7.4
 	typing_extensions>=4.3,<5
 	filelock>=3.5,<4
 	sortedcontainers>=2.4.0
@@ -82,6 +82,7 @@ boto =
 development = 
 	Cython
 	coverage
+	mitmproxy>=6.0.0; python_version >= '3.10'
 	more-itertools
 	numpy<=2.2.4
 	pendulum!=2.1.1
@@ -94,8 +95,9 @@ development =
 	pytzdata
 	responses
 pandas = 
-	pandas>=2.1.2,<3.0.0
-	pyarrow
+	pandas>=1.0.0,<3.0.0; python_version < '3.13'
+	pandas>=2.1.2,<3.0.0; python_version >= '3.13'
+	pyarrow>=14.0.1
 secure-local-storage = 
 	keyring>=23.1.0,<26.0.0
 

{snowflake_connector_python-4.0.0 → snowflake_connector_python-4.1.1}/src/snowflake/connector/auth/_auth.py

@@ -53,7 +53,9 @@ from ..network import (
     ReauthenticationRequest,
 )
 from ..platform_detection import detect_platforms
-from ..session_manager import SessionManager
+from ..session_manager import BaseHttpConfig, HttpConfig
+from ..session_manager import SessionManager as SyncSessionManager
+from ..session_manager import SessionManagerFactory
 from ..sqlstate import SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED
 from ..token_cache import TokenCache, TokenKey, TokenType
 from ..version import VERSION
@@ -106,8 +108,17 @@ class Auth:
         network_timeout: int | None = None,
         socket_timeout: int | None = None,
         platform_detection_timeout_seconds: float | None = None,
-        session_manager: SessionManager | None = None,
+        session_manager: SyncSessionManager | None = None,
+        http_config: BaseHttpConfig | None = None,
     ):
+        # Create sync SessionManager for platform detection if config is provided
+        # Platform detection runs in threads and uses sync SessionManager
+        if http_config is not None and session_manager is None:
+            # Extract base fields (automatically excludes subclass-specific fields)
+            # Note: It won't be possible to pass adapter_factory from outer async-code to this part of code
+            sync_config = HttpConfig(**http_config.to_base_dict())
+            session_manager = SessionManagerFactory.get_manager(config=sync_config)
+
         return {
             "data": {
                 "CLIENT_APP_ID": internal_application_name,
@@ -503,6 +514,16 @@ class Auth:
         user: str,
         session_parameters: dict[str, Any],
     ) -> None:
+        """Attempt to load cached credentials to skip interactive authentication.
+
+        SSO (ID_TOKEN): If present, avoids opening browser for external authentication.
+            Controlled by client_store_temporary_credential parameter.
+
+        MFA (MFA_TOKEN): If present, skips MFA prompt on next connection.
+            Controlled by client_request_mfa_token parameter.
+
+        If cached tokens are expired/invalid, they're deleted and normal auth proceeds.
+        """
         if session_parameters.get(PARAMETER_CLIENT_STORE_TEMPORARY_CREDENTIAL, False):
             self._rest.id_token = self._read_temporary_credential(
                 host,
@@ -538,6 +559,13 @@ class Auth:
         session_parameters: dict[str, Any],
         response: dict[str, Any],
     ) -> None:
+        """Cache credentials received from successful authentication for future use.
+
+        Tokens are only cached if:
+        1. Server returned the token in response (server-side caching must be enabled)
+        2. Client has caching enabled via session parameters
+        3. User consented to caching (consent_cache_id_token for ID tokens)
+        """
         if (
             self._rest._connection.auth_class.consent_cache_id_token
             and session_parameters.get(

{snowflake_connector_python-4.0.0 → snowflake_connector_python-4.1.1}/src/snowflake/connector/auth/_http_server.py

@@ -70,8 +70,10 @@ class AuthHttpServer:
         self,
         uri: str,
         buf_size: int = 16384,
+        redirect_uri: str | None = None,
     ) -> None:
         parsed_uri = urllib.parse.urlparse(uri)
+        parsed_redirect = urllib.parse.urlparse(redirect_uri) if redirect_uri else None
         self._socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
         self.buf_size = buf_size
         if os.getenv("SNOWFLAKE_AUTH_SOCKET_REUSE_PORT", "False").lower() == "true":
@@ -82,30 +84,34 @@ class AuthHttpServer:
             else:
                 self._socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEPORT, 1)
 
-        port = parsed_uri.port or 0
+        if parsed_redirect and self._is_local_uri(parsed_redirect):
+            server_port = parsed_redirect.port or 0
+        else:
+            server_port = parsed_uri.port or 0
+
         for attempt in range(1, self.DEFAULT_MAX_ATTEMPTS + 1):
             try:
                 self._socket.bind(
                     (
                         parsed_uri.hostname,
-                        port,
+                        server_port,
                     )
                 )
                 break
             except socket.gaierror as ex:
                 logger.error(
-                    f"Failed to bind authorization callback server to port {port}: {ex}"
+                    f"Failed to bind authorization callback server to port {server_port}: {ex}"
                 )
                 raise
             except OSError as ex:
                 if attempt == self.DEFAULT_MAX_ATTEMPTS:
                     logger.error(
-                        f"Failed to bind authorization callback server to port {port}: {ex}"
+                        f"Failed to bind authorization callback server to port {server_port}: {ex}"
                     )
                     raise
                 logger.warning(
                     f"Attempt {attempt}/{self.DEFAULT_MAX_ATTEMPTS}. "
-                    f"Failed to bind authorization callback server to port {port}: {ex}"
+                    f"Failed to bind authorization callback server to port {server_port}: {ex}"
                 )
                 time.sleep(self.PORT_BIND_TIMEOUT / self.PORT_BIND_MAX_ATTEMPTS)
         try:
@@ -114,16 +120,47 @@ class AuthHttpServer:
             logger.error(f"Failed to start listening for auth callback: {ex}")
             self.close()
             raise
-        port = self._socket.getsockname()[1]
+
+        server_port = self._socket.getsockname()[1]
         self._uri = urllib.parse.ParseResult(
             scheme=parsed_uri.scheme,
-            netloc=parsed_uri.hostname + ":" + str(port),
+            netloc=parsed_uri.hostname + ":" + str(server_port),
             path=parsed_uri.path,
             params=parsed_uri.params,
             query=parsed_uri.query,
             fragment=parsed_uri.fragment,
         )
 
+        if parsed_redirect:
+            if (
+                self._is_local_uri(parsed_redirect)
+                and server_port != parsed_redirect.port
+            ):
+                logger.debug(
+                    f"Updating redirect port {parsed_redirect.port} to match the server port {server_port}."
+                )
+                self._redirect_uri = urllib.parse.ParseResult(
+                    scheme=parsed_redirect.scheme,
+                    netloc=parsed_redirect.hostname + ":" + str(server_port),
+                    path=parsed_redirect.path,
+                    params=parsed_redirect.params,
+                    query=parsed_redirect.query,
+                    fragment=parsed_redirect.fragment,
+                )
+            else:
+                self._redirect_uri = parsed_redirect
+        else:
+            # For backwards compatibility
+            self._redirect_uri = self._uri
+
+    @staticmethod
+    def _is_local_uri(uri):
+        return uri.hostname in ("localhost", "127.0.0.1")
+
+    @property
+    def redirect_uri(self) -> str | None:
+        return self._redirect_uri.geturl()
+
     @property
     def url(self) -> str:
         return self._uri.geturl()

{snowflake_connector_python-4.0.0 → snowflake_connector_python-4.1.1}/src/snowflake/connector/auth/_oauth_base.py

@@ -35,6 +35,14 @@ logger = logging.getLogger(__name__)
 
 
 class _OAuthTokensMixin:
+    """Manages OAuth token caching to avoid repeated browser authentication flows.
+
+    Access tokens: Short-lived (typically 10 minutes), cached to avoid immediate re-auth.
+    Refresh tokens: Long-lived (hours/days), used to obtain new access tokens silently.
+
+    Tokens are cached per (user, IDP host) to support multiple OAuth providers/accounts.
+    """
+
     def __init__(
         self,
         token_cache: TokenCache | None,
@@ -77,12 +85,18 @@ class _OAuthTokensMixin:
         return self._token_cache.retrieve(key)
 
     def _pop_cached_access_token(self) -> bool:
-        """Retrieves OAuth access token from the token cache if enabled"""
+        """Retrieves OAuth access token from the token cache if enabled, available and still valid.
+
+        Returns True if cached token found, allowing authentication to skip OAuth flow.
+        """
         self._access_token = self._pop_cached_token(self._get_access_token_cache_key())
         return self._access_token is not None
 
     def _pop_cached_refresh_token(self) -> bool:
-        """Retrieves OAuth refresh token from the token cache if enabled"""
+        """Retrieves OAuth refresh token from the token cache (if enabled) to silently obtain new access token.
+
+        Returns True if refresh token found, enabling automatic token renewal without user interaction.
+        """
         if self._refresh_token_enabled:
             self._refresh_token = self._pop_cached_token(
                 self._get_refresh_token_cache_key()

{snowflake_connector_python-4.0.0 → snowflake_connector_python-4.1.1}/src/snowflake/connector/auth/oauth_code.py

@@ -65,6 +65,7 @@ class AuthByOauthCode(AuthByOAuthBase):
         external_browser_timeout: int | None = None,
         enable_single_use_refresh_tokens: bool = False,
         connection: SnowflakeConnection | None = None,
+        uri: str | None = None,
         **kwargs,
     ) -> None:
         authentication_url, redirect_uri = self._validate_oauth_code_uris(
@@ -92,6 +93,7 @@ class AuthByOauthCode(AuthByOAuthBase):
         self._origin: str | None = None
         self._authentication_url = authentication_url
         self._redirect_uri = redirect_uri
+        self._uri = uri
         self._state = secrets.token_urlsafe(43)
         logger.debug("chose oauth state: %s", "".join("*" for _ in self._state))
         self._protocol = "http"
@@ -117,7 +119,10 @@ class AuthByOauthCode(AuthByOAuthBase):
     ) -> (str | None, str | None):
         """Web Browser based Authentication."""
         logger.debug("authenticating with OAuth authorization code flow")
-        with AuthHttpServer(self._redirect_uri) as callback_server:
+        with AuthHttpServer(
+            redirect_uri=self._redirect_uri,
+            uri=self._uri or self._redirect_uri,  # for backward compatibility
+        ) as callback_server:
             code = self._do_authorization_request(callback_server, conn)
             return self._do_token_request(code, callback_server, conn)
 
@@ -260,7 +265,7 @@ You can close this window now and go back where you started from.
         connection: SnowflakeConnection,
     ) -> str | None:
         authorization_request = self._construct_authorization_request(
-            callback_server.url
+            callback_server.redirect_uri
         )
         logger.debug("step 1: going to open authorization URL")
         print(
@@ -315,7 +320,7 @@ You can close this window now and go back where you started from.
         fields = {
             "grant_type": "authorization_code",
             "code": code,
-            "redirect_uri": callback_server.url,
+            "redirect_uri": callback_server.redirect_uri,
         }
         if self._enable_single_use_refresh_tokens:
             fields["enable_single_use_refresh_tokens"] = "true"

{snowflake_connector_python-4.0.0 → snowflake_connector_python-4.1.1}/src/snowflake/connector/auth/webbrowser.py

@@ -165,15 +165,26 @@ class AuthByWebBrowser(AuthByPlugin):
                 return
 
             print(
-                "Initiating login request with your identity provider. A "
-                "browser window should have opened for you to complete the "
-                "login. If you can't see it, check existing browser windows, "
-                "or your OS settings. Press CTRL+C to abort and try again..."
+                "Initiating login request with your identity provider. Press CTRL+C to abort and try again..."
             )
 
             logger.debug("step 2: open a browser")
             print(f"Going to open: {sso_url} to authenticate...")
-            if not self._webbrowser.open_new(sso_url):
+            browser_opened = self._webbrowser.open_new(sso_url)
+            if browser_opened:
+                print(
+                    "A browser window should have opened for you to complete the "
+                    "login. If you can't see it, check existing browser windows, "
+                    "or your OS settings."
+                )
+
+            if (
+                browser_opened
+                or os.getenv("SNOWFLAKE_AUTH_FORCE_SERVER", "False").lower() == "true"
+            ):
+                logger.debug("step 3: accept SAML token")
+                self._receive_saml_token(conn, socket_connection)
+            else:
                 print(
                     "We were unable to open a browser window for you, "
                     "please open the url above manually then paste the "
@@ -195,9 +206,6 @@ class AuthByWebBrowser(AuthByPlugin):
                         },
                     )
                     return
-            else:
-                logger.debug("step 3: accept SAML token")
-                self._receive_saml_token(conn, socket_connection)
         finally:
             socket_connection.close()
 

{snowflake_connector_python-4.0.0 → snowflake_connector_python-4.1.1}/src/snowflake/connector/azure_storage_client.py

@@ -14,7 +14,7 @@ from .compat import quote
 from .constants import FileHeader, ResultStatus
 from .encryption_util import EncryptionMetadata
 from .storage_client import SnowflakeStorageClient
-from .util_text import get_md5
+from .util_text import get_md5_for_integrity
 from .vendored import requests
 
 if TYPE_CHECKING:  # pragma: no cover
@@ -241,9 +241,9 @@ class SnowflakeAzureRestClient(SnowflakeStorageClient):
                 fd.close()
         headers = {
             "x-ms-blob-content-encoding": "utf-8",
-            "x-ms-blob-content-md5": base64.b64encode(get_md5(file_content)).decode(
-                "utf-8"
-            ),
+            "x-ms-blob-content-md5": base64.b64encode(
+                get_md5_for_integrity(file_content)
+            ).decode("utf-8"),
         }
         azure_metadata = self._prepare_file_metadata()
         headers.update(azure_metadata)