snowflake-connector-python 4.2.0__tar.gz → 4.4.0__tar.gz

{snowflake_connector_python-4.2.0 → snowflake_connector_python-4.4.0}/CONTRIBUTING.md

@@ -30,8 +30,8 @@ dependencies installed with `snowflake-connector-python` installed as an editabl
 Setting up a development environment is super easy with this [one simple tox command](https://tox.wiki/en/latest/example/devenv.html).
 
 ```shell
-tox --devenv venv37 -e py37
-. venv37/bin/activate
+tox --devenv venv39 -e py39
+. venv39/bin/activate
 ```
 
 Note: we suggest using the lowest supported Python version for development.

{snowflake_connector_python-4.2.0 → snowflake_connector_python-4.4.0}/DESCRIPTION.md

@@ -7,10 +7,34 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.4.0(March 24,2026)
+  - Bump the lower boundary of cryptography to 46.0.5 due to CVE-2026-26007.
+  - Added support for Python 3.14.
+  - Removed pyOpenSSL upper bound dependency constraint to allow installation of pyOpenSSL 26.0.0+, which includes a fix for GHSA-vp96-hxj8-p424.
+  - Fixed Azure IMDS `Metadata` header to use lowercase `"true"` instead of `"True"`, which caused 400 errors during Azure Workload Identity Federation authentication.
+  - Fixed default `crl_download_max_size` to be 20MB instead of 200MB, as the previous value was set too high and could cause out-of-memory issues.
+  - Fixed a bug where Azure GET commands would incorrectly set the file status to UPLOADED instead of preserving the DOWNLOADED status during metadata retrieval.
+  - Renamed the environment variable for skipping config file permission warnings from `SF_SKIP_WARNING_FOR_READ_PERMISSIONS_ON_CONFIG_FILE` to `SF_SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION`. The old variable is still supported but emits a deprecation warning.
+  - Fixed `unsafe_skip_file_permissions_check` flag not being respected when reading `connections.toml`.
+  - Fixed JSONDecodeError in result_batch._load() when fetching large result sets
+
+- v4.3.0(February 12,2026)
+  - Ensured proper list conversion - the converter runs to_snowflake on all list elements.
+  - Made the parameter `server_session_keep_alive` in `SnowflakeConnection` skip checking for pending async queries, providing faster connection close times especially when many async queries are executed.
+  - Fix string representation of INTERVAL YEAR and INTERVAL MONTH types.
+  - Log a warning when using http protocol for OAuth urls.
+  - Deprecated support for custom revocation error classes in OCSP response cache deserialization. By default, only `RevocationCheckError` exceptions are deserialized from OCSP cache. Custom exception classes can be temporarily enabled by setting the `SNOWFLAKE_ENABLE_CUSTOM_REVOCATION_ERRORS` environment variable to `true` or `1`, but this support will be removed in a future release.
+  - Bumped up vendored `urllib3` to `2.6.3`
+  - Added `force_microseconds_precision` to `cursor.fetch_arrow_all` and `cursor.fetch_pandas_all` to avoid PyArrow schema inconsistency between batches.
+  - Fixed a bug where tilde in path to `private_key_file` specified in the connection was not properly expanded
+  - Added `secondary_roles` connection parameter to control secondary role activation at session creation. Supports `ALL` or `NONE` or no value.
+
+
 - v4.2.0(January 07,2026)
   - Added `SnowflakeCursor.stats` property to expose granular DML statistics (rows inserted, deleted, updated, and duplicates) for operations like CTAS where `rowcount` is insufficient.
   - Added support for injecting SPCS service identifier token (`SPCS_TOKEN`) into login requests when present in SPCS containers.
-  - Introduced shared library for extended telemetry to identify and prepare testing platform for native rust extensions.
+  - Introduced shared library([source code](https://github.com/snowflakedb/universal-driver/tree/main/sf_mini_core)) for extended telemetry to identify and prepare testing platform for native rust extensions.
+  - Added `private_key_passphrase` connection parameter for key pair authentication with encrypted private keys.
 
 - v4.1.1(December 12,2025)
   - Relaxed pandas dependency requirements for Python below 3.12.

{snowflake_connector_python-4.2.0 → snowflake_connector_python-4.4.0}/MANIFEST.in

@@ -4,6 +4,7 @@ include LICENSE.txt
 include NOTICE
 include pyproject.toml
 include src/snowflake/connector/nanoarrow_cpp/ArrowIterator/LICENSE.txt
+include src/snowflake/connector/aio/README.md
 recursive-include src/snowflake/connector py.typed *.py *.pyx *.js
 recursive-include src/snowflake/connector/vendored LICENSE*
 

{snowflake_connector_python-4.2.0 → snowflake_connector_python-4.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.2.0
+Version: 4.4.0
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -27,6 +27,7 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: SQL
 Classifier: Topic :: Database
 Classifier: Topic :: Scientific/Engineering :: Information Analysis
@@ -39,8 +40,8 @@ Description-Content-Type: text/markdown
 License-File: LICENSE.txt
 License-File: NOTICE
 Requires-Dist: asn1crypto<2.0.0,>0.24.0
-Requires-Dist: cryptography>=44.0.1
-Requires-Dist: pyOpenSSL<26.0.0,>=24.0.0
+Requires-Dist: cryptography>=46.0.5
+Requires-Dist: pyOpenSSL>=24.0.0
 Requires-Dist: pyjwt<3.0.0,>=2.10.1
 Requires-Dist: pytz
 Requires-Dist: requests<3.0.0,>=2.32.4
@@ -62,9 +63,9 @@ Requires-Dist: botocore>=1.24; extra == "boto"
 Provides-Extra: development
 Requires-Dist: Cython; extra == "development"
 Requires-Dist: coverage; extra == "development"
-Requires-Dist: mitmproxy>=6.0.0; python_version >= "3.10" and extra == "development"
+Requires-Dist: mitmproxy>=12.0.0; python_version >= "3.12" and extra == "development"
 Requires-Dist: more-itertools; extra == "development"
-Requires-Dist: numpy<=2.2.4; extra == "development"
+Requires-Dist: numpy<=2.4.3; extra == "development"
 Requires-Dist: pendulum!=2.1.1; extra == "development"
 Requires-Dist: pexpect; extra == "development"
 Requires-Dist: pytest<7.5.0; extra == "development"
@@ -93,10 +94,34 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.4.0(March 24,2026)
+  - Bump the lower boundary of cryptography to 46.0.5 due to CVE-2026-26007.
+  - Added support for Python 3.14.
+  - Removed pyOpenSSL upper bound dependency constraint to allow installation of pyOpenSSL 26.0.0+, which includes a fix for GHSA-vp96-hxj8-p424.
+  - Fixed Azure IMDS `Metadata` header to use lowercase `"true"` instead of `"True"`, which caused 400 errors during Azure Workload Identity Federation authentication.
+  - Fixed default `crl_download_max_size` to be 20MB instead of 200MB, as the previous value was set too high and could cause out-of-memory issues.
+  - Fixed a bug where Azure GET commands would incorrectly set the file status to UPLOADED instead of preserving the DOWNLOADED status during metadata retrieval.
+  - Renamed the environment variable for skipping config file permission warnings from `SF_SKIP_WARNING_FOR_READ_PERMISSIONS_ON_CONFIG_FILE` to `SF_SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION`. The old variable is still supported but emits a deprecation warning.
+  - Fixed `unsafe_skip_file_permissions_check` flag not being respected when reading `connections.toml`.
+  - Fixed JSONDecodeError in result_batch._load() when fetching large result sets
+
+- v4.3.0(February 12,2026)
+  - Ensured proper list conversion - the converter runs to_snowflake on all list elements.
+  - Made the parameter `server_session_keep_alive` in `SnowflakeConnection` skip checking for pending async queries, providing faster connection close times especially when many async queries are executed.
+  - Fix string representation of INTERVAL YEAR and INTERVAL MONTH types.
+  - Log a warning when using http protocol for OAuth urls.
+  - Deprecated support for custom revocation error classes in OCSP response cache deserialization. By default, only `RevocationCheckError` exceptions are deserialized from OCSP cache. Custom exception classes can be temporarily enabled by setting the `SNOWFLAKE_ENABLE_CUSTOM_REVOCATION_ERRORS` environment variable to `true` or `1`, but this support will be removed in a future release.
+  - Bumped up vendored `urllib3` to `2.6.3`
+  - Added `force_microseconds_precision` to `cursor.fetch_arrow_all` and `cursor.fetch_pandas_all` to avoid PyArrow schema inconsistency between batches.
+  - Fixed a bug where tilde in path to `private_key_file` specified in the connection was not properly expanded
+  - Added `secondary_roles` connection parameter to control secondary role activation at session creation. Supports `ALL` or `NONE` or no value.
+
+
 - v4.2.0(January 07,2026)
   - Added `SnowflakeCursor.stats` property to expose granular DML statistics (rows inserted, deleted, updated, and duplicates) for operations like CTAS where `rowcount` is insufficient.
   - Added support for injecting SPCS service identifier token (`SPCS_TOKEN`) into login requests when present in SPCS containers.
-  - Introduced shared library for extended telemetry to identify and prepare testing platform for native rust extensions.
+  - Introduced shared library([source code](https://github.com/snowflakedb/universal-driver/tree/main/sf_mini_core)) for extended telemetry to identify and prepare testing platform for native rust extensions.
+  - Added `private_key_passphrase` connection parameter for key pair authentication with encrypted private keys.
 
 - v4.1.1(December 12,2025)
   - Relaxed pandas dependency requirements for Python below 3.12.

{snowflake_connector_python-4.2.0 → snowflake_connector_python-4.4.0}/README.md

@@ -103,6 +103,8 @@ To ensure the authenticity and integrity of the Python package, follow the steps
   Verified OK
   ````
 
-## NOTE
+## Notes
 
 This library currently does not support GCP regional endpoints.  Please ensure that any workloads using through this library do not require support for regional endpoints on GCP.  If you have questions about this, please contact [Snowflake Support](https://community.snowflake.com/s/article/How-To-Submit-a-Support-Case-in-Snowflake-Lodge).
+
+The driver uses Rust library called sf_mini_core, you can find its source code [here](https://github.com/snowflakedb/universal-driver/tree/main/sf_mini_core)

{snowflake_connector_python-4.2.0 → snowflake_connector_python-4.4.0}/setup.cfg

@@ -25,6 +25,7 @@ classifiers =
 	Programming Language :: Python :: 3.11
 	Programming Language :: Python :: 3.12
 	Programming Language :: Python :: 3.13
+	Programming Language :: Python :: 3.14
 	Programming Language :: SQL
 	Topic :: Database
 	Topic :: Scientific/Engineering :: Information Analysis
@@ -44,8 +45,8 @@ python_requires = >=3.9
 packages = find_namespace:
 install_requires = 
 	asn1crypto>0.24.0,<2.0.0
-	cryptography>=44.0.1
-	pyOpenSSL>=24.0.0,<26.0.0
+	cryptography>=46.0.5
+	pyOpenSSL>=24.0.0
 	pyjwt>=2.10.1,<3.0.0
 	pytz
 	requests>=2.32.4,<3.0.0
@@ -89,9 +90,9 @@ boto =
 development = 
 	Cython
 	coverage
-	mitmproxy>=6.0.0; python_version >= '3.10'
+	mitmproxy>=12.0.0; python_version >= '3.12'
 	more-itertools
-	numpy<=2.2.4
+	numpy<=2.4.3
 	pendulum!=2.1.1
 	pexpect
 	pytest<7.5.0

{snowflake_connector_python-4.2.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/_utils.py

@@ -7,9 +7,9 @@ import os
 import platform
 import string
 import threading
+import time
 from enum import Enum
 from inspect import stack
-from pathlib import Path
 from random import choice
 from threading import Timer
 from uuid import UUID
@@ -136,11 +136,23 @@ def get_spcs_token() -> str | None:
         return None
 
 
+class _NanoarrowLoader:
+    def __init__(self):
+        self._error: Exception | None = None
+
+    def set_load_error(self, err: Exception):
+        self._error = err
+
+    def get_load_error(self) -> str:
+        return str(self._error)
+
+
 class _CoreLoader:
     def __init__(self):
         self._version: bytes | None = None
         self._error: Exception | None = None
         self._path: str | None = None
+        self._load_time: float | None = None
 
     @staticmethod
     def _detect_os() -> str:
@@ -175,26 +187,10 @@ class _CoreLoader:
     @staticmethod
     def _detect_libc() -> str:
         """Detect libc type on Linux (glibc vs musl)."""
-        # Check if we're on Alpine/musl
-        if Path("/etc/alpine-release").exists():
-            return "musl"
-
-        # Check for musl by looking at the libc library
-        try:
-            import subprocess
-
-            result = subprocess.run(
-                ["ldd", "--version"],
-                capture_output=True,
-                text=True,
-            )
-            if "musl" in result.stdout.lower() or "musl" in result.stderr.lower():
-                return "musl"
-        except Exception:
-            pass
-
-        # Default to glibc
-        return "glibc"
+        lib, _ = platform.libc_ver()
+        if lib == "glibc":
+            return "glibc"
+        return "musl"
 
     @staticmethod
     def _get_platform_subdir() -> str:
@@ -229,7 +225,7 @@ class _CoreLoader:
             return "libsf_mini_core.so"
 
     @staticmethod
-    def _get_core_path() -> Path:
+    def _get_core_path():
         """Get the path to the minicore library for the current platform."""
         subdir = _CoreLoader._get_platform_subdir()
         lib_name = _CoreLoader._get_lib_name()
@@ -253,20 +249,49 @@ class _CoreLoader:
             core = ctypes.CDLL(str(lib_path))
         return core
 
+    def get_present_binaries(self) -> str:
+        present_binaries = []
+        try:
+            minicore_files = importlib.resources.files("snowflake.connector.minicore")
+            # Iterate through all items in the minicore module
+            for item in minicore_files.iterdir():
+                # Skip non-platform directories like __pycache__
+                if item.is_dir() and not item.name.startswith("__"):
+                    # This is a platform subdirectory
+                    platform_name = item.name
+                    try:
+                        # List all files in this subdirectory
+                        for binary_file in item.iterdir():
+                            if binary_file.is_file():
+                                # Store as "platform/filename"
+                                present_binaries.append(
+                                    f"{platform_name}/{binary_file.name}"
+                                )
+                    except Exception as e:
+                        logger.debug(f"Error listing binaries in {platform_name}: {e}")
+        except Exception as e:
+            logger.debug(f"Error populating present binaries: {e}")
+
+        return ",".join(present_binaries)
+
     def _is_core_disabled(self) -> bool:
         value = str(os.getenv("SNOWFLAKE_DISABLE_MINICORE", None)).lower()
         return value in ["1", "true"]
 
     def _load(self) -> None:
+        start_time = time.perf_counter()
         try:
             path = self._get_core_path()
+            self._path = str(path)
             core = self._load_minicore(path)
             self._register_functions(core)
             self._version = core.sf_core_full_version()
             self._error = None
-            self._path = str(path)
         except Exception as err:
             self._error = err
+        end_time = time.perf_counter()
+        # Store load time in milliseconds (with sub-millisecond precision)
+        self._load_time = (end_time - start_time) * 1000
 
     def load(self):
         """Spawn a separate thread to load the minicore library (non-blocking)."""
@@ -291,8 +316,13 @@ class _CoreLoader:
     def get_file_name(self) -> str:
         return self._path
 
+    def get_load_time(self) -> float | None:
+        """Return the time it took to load the minicore binary in milliseconds."""
+        return self._load_time
+
 
 _core_loader = _CoreLoader()
+_nanoarrow_loader = _NanoarrowLoader()
 
 
 def build_minicore_usage_for_session() -> dict[str, str | None]:
@@ -308,5 +338,16 @@ def build_minicore_usage_for_telemetry() -> dict[str, str | None]:
         "OS": OPERATING_SYSTEM,
         "OS_VERSION": OS_VERSION,
         "CORE_LOAD_ERROR": _core_loader.get_load_error(),
+        "CORE_BINARIES_PRESENT": _core_loader.get_present_binaries(),
+        "CORE_LOAD_TIME": _core_loader.get_load_time(),
         **build_minicore_usage_for_session(),
     }
+
+
+def build_nanoarrow_usage_for_telemetry() -> dict[str, str | None]:
+    return {
+        "OS": OPERATING_SYSTEM,
+        "OS_VERSION": OS_VERSION,
+        "NANOARROW_LOAD_ERROR": _nanoarrow_loader.get_load_error(),
+        "ISA": ISA,
+    }

snowflake_connector_python-4.4.0/src/snowflake/connector/aio/README.md

@@ -0,0 +1,88 @@
+# Notice
+
+**This component is a Preview feature provided for experimental purposes only.
+It is provided "AS IS" and without warranty of any kind. This module is not
+supported by Snowflake Support. Use of this code is at your own risk and it
+is not intended for production environments.**
+
+## Features NOT Supported
+
+
+- ❌ `conn.errorhandler` (get/set) - no support for async errorhandlers
+- ❌ `enable_connection_diag=True` - no connection diagnostic
+- ❌ `authenticator='PAT_WITH_EXTERNAL_SESSION'` - not supported
+- ❌ `mfa_callback` / `password_callback` - not supported
+- ❌ `_probe_connection=True` - no connection diagnostic
+- ❌ Raw binary response handling - not supported
+- ❌ CRL (Certificate Revocation List) - not supported (only OCSP is supported)
+
+## Installation & Import
+
+Using aio version requires additional installation of `aiohttp` dependency.
+
+```python
+# Same package, different import
+from snowflake.connector.aio import connect, SnowflakeConnection, DictCursor
+```
+
+
+## Connection Patterns
+
+
+```python
+# Pattern 1: Async context manager (recommended)
+async with connect(user='...', password='...', account='...') as conn:
+   # Use connection
+   pass
+
+
+# Pattern 2: Direct await
+conn = await connect(user='...', password='...', account='...')
+await conn.close()
+
+
+# Pattern 3: Manual
+conn = SnowflakeConnection(user='...', password='...', account='...')
+await conn.connect()
+await conn.close()
+```
+
+
+## Basic Operations Comparison
+
+
+| Operation | Sync | Async |
+|-----------|------|-------|
+| **Connect** | `conn = connect(...)` | `conn = await connect(...)` |
+| **Create cursor** | `cur = conn.cursor()` | `cur = conn.cursor()` *(same)* |
+| **Execute** | `cur.execute(sql)` | `await cur.execute(sql)` |
+| **Fetch one** | `cur.fetchone()` | `await cur.fetchone()` |
+| **Fetch many** | `cur.fetchmany(n)` | `await cur.fetchmany(n)` |
+| **Fetch all** | `cur.fetchall()` | `await cur.fetchall()` |
+| **Iterate** | `for row in cur:` | `async for row in cur:` |
+| **Commit** | `conn.commit()` | `await conn.commit()` |
+| **Rollback** | `conn.rollback()` | `await conn.rollback()` |
+| **Close** | `conn.close()` | `await conn.close()` |
+
+
+## Quick Examples
+
+
+### Simple Query
+
+
+```python
+import asyncio
+from snowflake.connector.aio import connect
+
+
+async def query_data():
+   async with connect(user='...', password='...', account='...') as conn:
+       async with conn.cursor() as cur:
+           await cur.execute("SELECT * FROM table WHERE id < %s", (100,))
+           async for row in cur:
+               print(row)
+
+
+asyncio.run(query_data())
+```

{snowflake_connector_python-4.2.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/aio/__init__.py

@@ -1,9 +1,5 @@
 from __future__ import annotations
 
-# temporarily disable aio - SNOW-2905263
-raise ImportError("aio is not supported in this version of the connector")
-
-
 from functools import wraps
 from typing import Any, Coroutine, Generator, Protocol, TypeVar, runtime_checkable
 

{snowflake_connector_python-4.2.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/aio/_connection.py

@@ -343,6 +343,7 @@ class SnowflakeConnection(SnowflakeConnectionSync):
 
             elif self._authenticator == KEY_PAIR_AUTHENTICATOR:
                 private_key = self._private_key
+                private_key_passphrase = self._private_key_passphrase
 
                 if self._private_key_file:
                     private_key = _get_private_bytes_from_file(
@@ -352,6 +353,7 @@ class SnowflakeConnection(SnowflakeConnectionSync):
 
                 self.auth_class = AuthByKeyPair(
                     private_key=private_key,
+                    private_key_passphrase=private_key_passphrase,
                     timeout=self.login_timeout,
                     backoff_generator=self._backoff_generator,
                 )
@@ -930,22 +932,32 @@ class SnowflakeConnection(SnowflakeConnectionSync):
 
             if self.telemetry_enabled:
                 await self._telemetry.close(retry=retry)
-            if (
-                await self._all_async_queries_finished()
-                and not self._server_session_keep_alive
-            ):
-                logger.debug("No async queries seem to be running, deleting session")
-                try:
-                    await self.rest.delete_session(retry=retry)
-                except Exception as e:
+
+            if not self._server_session_keep_alive:
+                if await self._all_async_queries_finished():
                     logger.debug(
-                        "Exception encountered in deleting session. ignoring...: %s", e
+                        "No async queries seem to be running, deleting session"
                     )
-            else:
-                logger.debug(
-                    "There are {} async queries still running, not deleting session".format(
-                        len(self._async_sfqids)
+                    try:
+                        await self.rest.delete_session(retry=retry)
+                    except Exception as e:
+                        logger.debug(
+                            "Exception encountered in deleting session. ignoring...: %s",
+                            e,
+                        )
+                else:
+                    logger.debug(
+                        "There are {} async queries still running, not deleting session".format(
+                            len(self._async_sfqids)
+                        )
                     )
+            else:
+                logger.info(
+                    "Parameter server_session_keep_alive was set to True - skipping session logout. "
+                    "If there are any not-finished queries in the current session (session_id: %s) - "
+                    "they will continue to live in Snowflake and consume credits until they finish. "
+                    "To cancel them use Monitoring tab in Snowsight or plain SQL.",
+                    self.session_id,
                 )
             await self.rest.close()
             self._rest = None

{snowflake_connector_python-4.2.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/aio/_wif_util.py

@@ -235,7 +235,7 @@ async def create_azure_attestation(
 
     If the application isn't running on Azure or no credentials were found, raises an error.
     """
-    headers = {"Metadata": "True"}
+    headers = {"Metadata": "true"}
     url_without_query_string = "http://169.254.169.254/metadata/identity/oauth2/token"
     query_params = f"api-version=2018-02-01&resource={snowflake_entra_resource}"
 

{snowflake_connector_python-4.2.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/aio/auth/_auth.py

@@ -146,6 +146,11 @@ class Auth(AuthSync):
         if session_parameters:
             body["data"]["SESSION_PARAMETERS"] = session_parameters
 
+        # Add secondary_roles connection parameter if specified
+        secondary_roles = getattr(self._rest._connection, "_secondary_roles", None)
+        if secondary_roles and isinstance(secondary_roles, str):
+            body["data"]["SECONDARY_ROLES"] = secondary_roles.upper()
+
         logger.debug(
             "body['data']: %s",
             {

{snowflake_connector_python-4.2.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/arrow_context.py

@@ -165,10 +165,14 @@ class ArrowConverterContext:
     def DECFLOAT_to_numpy_float64(self, exponent: int, significand: bytes) -> float64:
         return numpy.float64(self.DECFLOAT_to_decimal(exponent, significand))
 
-    def INTERVAL_YEAR_MONTH_to_str(self, months: int) -> str:
-        return interval_year_month_to_string(months)
-
-    def INTERVAL_YEAR_MONTH_to_numpy_timedelta(self, months: int) -> timedelta64:
+    def INTERVAL_YEAR_MONTH_to_str(self, months: int, scale: int) -> str:
+        return interval_year_month_to_string(months, scale)
+
+    def INTERVAL_YEAR_MONTH_to_numpy_timedelta(
+        self, months: int, scale: int
+    ) -> timedelta64:
+        if scale == 1:  # interval year
+            return numpy.timedelta64(months // 12, "Y")
         return numpy.timedelta64(months, "M")
 
     def INTERVAL_DAY_TIME_int_to_numpy_timedelta(self, nanos: int) -> timedelta64:

{snowflake_connector_python-4.2.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/auth/_auth.py

@@ -56,12 +56,14 @@ from ..network import (
     PYTHON_CONNECTOR_USER_AGENT,
     ReauthenticationRequest,
 )
+from ..os_details import get_os_details
 from ..platform_detection import detect_platforms
 from ..session_manager import BaseHttpConfig, HttpConfig
 from ..session_manager import SessionManager as SyncSessionManager
 from ..session_manager import SessionManagerFactory
 from ..sqlstate import SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED
 from ..token_cache import TokenCache, TokenKey, TokenType
+from ..util_text import expand_tilde
 from ..version import VERSION
 from .no_auth import AuthNoAuth
 from .oauth import AuthByOAuth
@@ -87,6 +89,7 @@ AUTHENTICATION_REQUEST_KEY_WHITELIST = {
     "CLIENT_ENVIRONMENT",
     "EXT_AUTHN_DUO_METHOD",
     "LOGIN_NAME",
+    "SECONDARY_ROLES",
     "SESSION_PARAMETERS",
     "SVN_REVISION",
 }
@@ -159,6 +162,7 @@ class Auth:
                         platform_detection_timeout_seconds=platform_detection_timeout_seconds,
                         session_manager=session_manager.clone(max_retries=0),
                     ),
+                    "OS_DETAILS": get_os_details(),
                     **build_minicore_usage_for_session(),
                 },
             },
@@ -259,6 +263,11 @@ class Auth:
         if session_parameters:
             body["data"]["SESSION_PARAMETERS"] = session_parameters
 
+        # Add secondary_roles connection parameter if specified
+        secondary_roles = getattr(self._rest._connection, "_secondary_roles", None)
+        if secondary_roles and isinstance(secondary_roles, str):
+            body["data"]["SECONDARY_ROLES"] = secondary_roles.upper()
+
         logger.debug(
             "body['data']: %s",
             {
@@ -633,14 +642,16 @@ def get_token_from_private_key(
     from . import AuthByKeyPair
 
     auth_instance = AuthByKeyPair(
-        private_key,
-        DAY_IN_SECONDS,
+        private_key=private_key,
+        lifetime_in_seconds=DAY_IN_SECONDS,
     )  # token valid for 24 hours
     return auth_instance.prepare(account=account, user=user)
 
 
 def get_public_key_fingerprint(private_key_file: str, password: str) -> str:
     """Helper function to generate the public key fingerprint from the private key file"""
+    private_key_file = expand_tilde(private_key_file)
+
     with open(private_key_file, "rb") as key:
         p_key = load_pem_private_key(
             key.read(), password=password.encode(), backend=default_backend()

{snowflake_connector_python-4.2.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/auth/_oauth_base.py

@@ -428,6 +428,27 @@ class AuthByOAuthBase(AuthByPlugin, _OAuthTokensMixin, ABC):
             "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
         }
 
+    @staticmethod
+    def _log_if_http_in_use(url: str) -> None:
+        """Log a warning if the URL uses insecure HTTP protocol.
+
+        Args:
+            url: The URL to check for HTTP usage
+        """
+        try:
+            parsed_url = urllib.parse.urlparse(url)
+            if parsed_url.scheme == "http":
+                logger.warning(
+                    "OAuth URL uses insecure HTTP protocol: %s",
+                    SecretDetector.mask_secrets(url),
+                )
+        except Exception as e:
+            logger.warning(
+                "Cannot parse URL: %s. %s",
+                SecretDetector.mask_secrets(url),
+                e,
+            )
+
     @staticmethod
     def _resolve_proxy_url(
         connection: SnowflakeConnection, request_url: str

{snowflake_connector_python-4.2.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/auth/keypair.py

@@ -40,6 +40,7 @@ class AuthByKeyPair(AuthByPlugin):
     def __init__(
         self,
         private_key: bytes | str | RSAPrivateKey,
+        private_key_passphrase: bytes | None = None,
         lifetime_in_seconds: int = LIFETIME,
         **kwargs,
     ) -> None:
@@ -72,6 +73,7 @@ class AuthByKeyPair(AuthByPlugin):
         )
 
         self._private_key: bytes | str | RSAPrivateKey | None = private_key
+        self._private_key_passphrase: bytes | None = private_key_passphrase
         self._jwt_token = ""
         self._jwt_token_exp = 0
         self._lifetime = timedelta(
@@ -116,13 +118,14 @@ class AuthByKeyPair(AuthByPlugin):
             try:
                 private_key = load_der_private_key(
                     data=self._private_key,
-                    password=None,
+                    password=self._private_key_passphrase,
                     backend=default_backend(),
                 )
             except Exception as e:
                 raise ProgrammingError(
                     msg=f"Failed to load private key: {e}\nPlease provide a valid "
-                    "unencrypted rsa private key in DER format as bytes object",
+                    "rsa private key in DER format as bytes object. If the key is "
+                    "encrypted, provide the passphrase via private_key_passphrase",
                     errno=ER_INVALID_PRIVATE_KEY,
                 )