snowflake-connector-python 4.3.0__tar.gz → 4.4.0__tar.gz

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/CONTRIBUTING.md

@@ -30,8 +30,8 @@ dependencies installed with `snowflake-connector-python` installed as an editabl
 Setting up a development environment is super easy with this [one simple tox command](https://tox.wiki/en/latest/example/devenv.html).
 
 ```shell
-tox --devenv venv37 -e py37
-. venv37/bin/activate
+tox --devenv venv39 -e py39
+. venv39/bin/activate
 ```
 
 Note: we suggest using the lowest supported Python version for development.

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/DESCRIPTION.md

@@ -7,6 +7,17 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.4.0(March 24,2026)
+  - Bump the lower boundary of cryptography to 46.0.5 due to CVE-2026-26007.
+  - Added support for Python 3.14.
+  - Removed pyOpenSSL upper bound dependency constraint to allow installation of pyOpenSSL 26.0.0+, which includes a fix for GHSA-vp96-hxj8-p424.
+  - Fixed Azure IMDS `Metadata` header to use lowercase `"true"` instead of `"True"`, which caused 400 errors during Azure Workload Identity Federation authentication.
+  - Fixed default `crl_download_max_size` to be 20MB instead of 200MB, as the previous value was set too high and could cause out-of-memory issues.
+  - Fixed a bug where Azure GET commands would incorrectly set the file status to UPLOADED instead of preserving the DOWNLOADED status during metadata retrieval.
+  - Renamed the environment variable for skipping config file permission warnings from `SF_SKIP_WARNING_FOR_READ_PERMISSIONS_ON_CONFIG_FILE` to `SF_SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION`. The old variable is still supported but emits a deprecation warning.
+  - Fixed `unsafe_skip_file_permissions_check` flag not being respected when reading `connections.toml`.
+  - Fixed JSONDecodeError in result_batch._load() when fetching large result sets
+
 - v4.3.0(February 12,2026)
   - Ensured proper list conversion - the converter runs to_snowflake on all list elements.
   - Made the parameter `server_session_keep_alive` in `SnowflakeConnection` skip checking for pending async queries, providing faster connection close times especially when many async queries are executed.
@@ -14,7 +25,10 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Log a warning when using http protocol for OAuth urls.
   - Deprecated support for custom revocation error classes in OCSP response cache deserialization. By default, only `RevocationCheckError` exceptions are deserialized from OCSP cache. Custom exception classes can be temporarily enabled by setting the `SNOWFLAKE_ENABLE_CUSTOM_REVOCATION_ERRORS` environment variable to `true` or `1`, but this support will be removed in a future release.
   - Bumped up vendored `urllib3` to `2.6.3`
-  - Added `force_microseconds_precision` to `cursor.fetch_arrow_all` and `cursor.fetch_pandas_all` to avoid PyArrow schema incosistency between batches.
+  - Added `force_microseconds_precision` to `cursor.fetch_arrow_all` and `cursor.fetch_pandas_all` to avoid PyArrow schema inconsistency between batches.
+  - Fixed a bug where tilde in path to `private_key_file` specified in the connection was not properly expanded
+  - Added `secondary_roles` connection parameter to control secondary role activation at session creation. Supports `ALL` or `NONE` or no value.
+
 
 - v4.2.0(January 07,2026)
   - Added `SnowflakeCursor.stats` property to expose granular DML statistics (rows inserted, deleted, updated, and duplicates) for operations like CTAS where `rowcount` is insufficient.

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.3.0
+Version: 4.4.0
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -27,6 +27,7 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: SQL
 Classifier: Topic :: Database
 Classifier: Topic :: Scientific/Engineering :: Information Analysis
@@ -39,8 +40,8 @@ Description-Content-Type: text/markdown
 License-File: LICENSE.txt
 License-File: NOTICE
 Requires-Dist: asn1crypto<2.0.0,>0.24.0
-Requires-Dist: cryptography>=44.0.1
-Requires-Dist: pyOpenSSL<26.0.0,>=24.0.0
+Requires-Dist: cryptography>=46.0.5
+Requires-Dist: pyOpenSSL>=24.0.0
 Requires-Dist: pyjwt<3.0.0,>=2.10.1
 Requires-Dist: pytz
 Requires-Dist: requests<3.0.0,>=2.32.4
@@ -62,9 +63,9 @@ Requires-Dist: botocore>=1.24; extra == "boto"
 Provides-Extra: development
 Requires-Dist: Cython; extra == "development"
 Requires-Dist: coverage; extra == "development"
-Requires-Dist: mitmproxy>=6.0.0; python_version >= "3.10" and extra == "development"
+Requires-Dist: mitmproxy>=12.0.0; python_version >= "3.12" and extra == "development"
 Requires-Dist: more-itertools; extra == "development"
-Requires-Dist: numpy<=2.2.4; extra == "development"
+Requires-Dist: numpy<=2.4.3; extra == "development"
 Requires-Dist: pendulum!=2.1.1; extra == "development"
 Requires-Dist: pexpect; extra == "development"
 Requires-Dist: pytest<7.5.0; extra == "development"
@@ -93,6 +94,17 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.4.0(March 24,2026)
+  - Bump the lower boundary of cryptography to 46.0.5 due to CVE-2026-26007.
+  - Added support for Python 3.14.
+  - Removed pyOpenSSL upper bound dependency constraint to allow installation of pyOpenSSL 26.0.0+, which includes a fix for GHSA-vp96-hxj8-p424.
+  - Fixed Azure IMDS `Metadata` header to use lowercase `"true"` instead of `"True"`, which caused 400 errors during Azure Workload Identity Federation authentication.
+  - Fixed default `crl_download_max_size` to be 20MB instead of 200MB, as the previous value was set too high and could cause out-of-memory issues.
+  - Fixed a bug where Azure GET commands would incorrectly set the file status to UPLOADED instead of preserving the DOWNLOADED status during metadata retrieval.
+  - Renamed the environment variable for skipping config file permission warnings from `SF_SKIP_WARNING_FOR_READ_PERMISSIONS_ON_CONFIG_FILE` to `SF_SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION`. The old variable is still supported but emits a deprecation warning.
+  - Fixed `unsafe_skip_file_permissions_check` flag not being respected when reading `connections.toml`.
+  - Fixed JSONDecodeError in result_batch._load() when fetching large result sets
+
 - v4.3.0(February 12,2026)
   - Ensured proper list conversion - the converter runs to_snowflake on all list elements.
   - Made the parameter `server_session_keep_alive` in `SnowflakeConnection` skip checking for pending async queries, providing faster connection close times especially when many async queries are executed.
@@ -100,7 +112,10 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Log a warning when using http protocol for OAuth urls.
   - Deprecated support for custom revocation error classes in OCSP response cache deserialization. By default, only `RevocationCheckError` exceptions are deserialized from OCSP cache. Custom exception classes can be temporarily enabled by setting the `SNOWFLAKE_ENABLE_CUSTOM_REVOCATION_ERRORS` environment variable to `true` or `1`, but this support will be removed in a future release.
   - Bumped up vendored `urllib3` to `2.6.3`
-  - Added `force_microseconds_precision` to `cursor.fetch_arrow_all` and `cursor.fetch_pandas_all` to avoid PyArrow schema incosistency between batches.
+  - Added `force_microseconds_precision` to `cursor.fetch_arrow_all` and `cursor.fetch_pandas_all` to avoid PyArrow schema inconsistency between batches.
+  - Fixed a bug where tilde in path to `private_key_file` specified in the connection was not properly expanded
+  - Added `secondary_roles` connection parameter to control secondary role activation at session creation. Supports `ALL` or `NONE` or no value.
+
 
 - v4.2.0(January 07,2026)
   - Added `SnowflakeCursor.stats` property to expose granular DML statistics (rows inserted, deleted, updated, and duplicates) for operations like CTAS where `rowcount` is insufficient.

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/setup.cfg

@@ -25,6 +25,7 @@ classifiers =
 	Programming Language :: Python :: 3.11
 	Programming Language :: Python :: 3.12
 	Programming Language :: Python :: 3.13
+	Programming Language :: Python :: 3.14
 	Programming Language :: SQL
 	Topic :: Database
 	Topic :: Scientific/Engineering :: Information Analysis
@@ -44,8 +45,8 @@ python_requires = >=3.9
 packages = find_namespace:
 install_requires = 
 	asn1crypto>0.24.0,<2.0.0
-	cryptography>=44.0.1
-	pyOpenSSL>=24.0.0,<26.0.0
+	cryptography>=46.0.5
+	pyOpenSSL>=24.0.0
 	pyjwt>=2.10.1,<3.0.0
 	pytz
 	requests>=2.32.4,<3.0.0
@@ -89,9 +90,9 @@ boto =
 development = 
 	Cython
 	coverage
-	mitmproxy>=6.0.0; python_version >= '3.10'
+	mitmproxy>=12.0.0; python_version >= '3.12'
 	more-itertools
-	numpy<=2.2.4
+	numpy<=2.4.3
 	pendulum!=2.1.1
 	pexpect
 	pytest<7.5.0

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/_utils.py

@@ -10,7 +10,6 @@ import threading
 import time
 from enum import Enum
 from inspect import stack
-from pathlib import Path
 from random import choice
 from threading import Timer
 from uuid import UUID
@@ -188,26 +187,10 @@ class _CoreLoader:
     @staticmethod
     def _detect_libc() -> str:
         """Detect libc type on Linux (glibc vs musl)."""
-        # Check if we're on Alpine/musl
-        if Path("/etc/alpine-release").exists():
-            return "musl"
-
-        # Check for musl by looking at the libc library
-        try:
-            import subprocess
-
-            result = subprocess.run(
-                ["ldd", "--version"],
-                capture_output=True,
-                text=True,
-            )
-            if "musl" in result.stdout.lower() or "musl" in result.stderr.lower():
-                return "musl"
-        except Exception:
-            pass
-
-        # Default to glibc
-        return "glibc"
+        lib, _ = platform.libc_ver()
+        if lib == "glibc":
+            return "glibc"
+        return "musl"
 
     @staticmethod
     def _get_platform_subdir() -> str:

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/aio/_wif_util.py

@@ -235,7 +235,7 @@ async def create_azure_attestation(
 
     If the application isn't running on Azure or no credentials were found, raises an error.
     """
-    headers = {"Metadata": "True"}
+    headers = {"Metadata": "true"}
     url_without_query_string = "http://169.254.169.254/metadata/identity/oauth2/token"
     query_params = f"api-version=2018-02-01&resource={snowflake_entra_resource}"
 

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/aio/auth/_auth.py

@@ -146,6 +146,11 @@ class Auth(AuthSync):
         if session_parameters:
             body["data"]["SESSION_PARAMETERS"] = session_parameters
 
+        # Add secondary_roles connection parameter if specified
+        secondary_roles = getattr(self._rest._connection, "_secondary_roles", None)
+        if secondary_roles and isinstance(secondary_roles, str):
+            body["data"]["SECONDARY_ROLES"] = secondary_roles.upper()
+
         logger.debug(
             "body['data']: %s",
             {

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/auth/_auth.py

@@ -63,6 +63,7 @@ from ..session_manager import SessionManager as SyncSessionManager
 from ..session_manager import SessionManagerFactory
 from ..sqlstate import SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED
 from ..token_cache import TokenCache, TokenKey, TokenType
+from ..util_text import expand_tilde
 from ..version import VERSION
 from .no_auth import AuthNoAuth
 from .oauth import AuthByOAuth
@@ -88,6 +89,7 @@ AUTHENTICATION_REQUEST_KEY_WHITELIST = {
     "CLIENT_ENVIRONMENT",
     "EXT_AUTHN_DUO_METHOD",
     "LOGIN_NAME",
+    "SECONDARY_ROLES",
     "SESSION_PARAMETERS",
     "SVN_REVISION",
 }
@@ -261,6 +263,11 @@ class Auth:
         if session_parameters:
             body["data"]["SESSION_PARAMETERS"] = session_parameters
 
+        # Add secondary_roles connection parameter if specified
+        secondary_roles = getattr(self._rest._connection, "_secondary_roles", None)
+        if secondary_roles and isinstance(secondary_roles, str):
+            body["data"]["SECONDARY_ROLES"] = secondary_roles.upper()
+
         logger.debug(
             "body['data']: %s",
             {
@@ -643,6 +650,8 @@ def get_token_from_private_key(
 
 def get_public_key_fingerprint(private_key_file: str, password: str) -> str:
     """Helper function to generate the public key fingerprint from the private key file"""
+    private_key_file = expand_tilde(private_key_file)
+
     with open(private_key_file, "rb") as key:
         p_key = load_pem_private_key(
             key.read(), password=password.encode(), backend=default_backend()

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/azure_storage_client.py

@@ -124,7 +124,9 @@ class SnowflakeAzureRestClient(SnowflakeStorageClient):
         self.retry_count[retry_id] = 0
         r = self._send_request_with_authentication_and_retry("HEAD", url, retry_id)
         if r.status_code == 200:
-            meta.result_status = ResultStatus.UPLOADED
+            # If we are in download path, do not update to UPLOADED
+            if meta.result_status != ResultStatus.DOWNLOADED:
+                meta.result_status = ResultStatus.UPLOADED
             enc_data_str = r.headers.get(ENCRYPTION_DATA)
             encryption_data = None if enc_data_str is None else json.loads(enc_data_str)
             encryption_metadata = (

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/config_manager.py

@@ -29,12 +29,21 @@ LOGGER = logging.getLogger(__name__)
 READABLE_BY_OTHERS = stat.S_IRGRP | stat.S_IROTH
 WRITABLE_BY_OTHERS = stat.S_IWGRP | stat.S_IWOTH
 
-SKIP_WARNING_ENV_VAR = "SF_SKIP_WARNING_FOR_READ_PERMISSIONS_ON_CONFIG_FILE"
+DEPRECATED_SKIP_WARNING_ENV_VAR = "SF_SKIP_WARNING_FOR_READ_PERMISSIONS_ON_CONFIG_FILE"
+SKIP_WARNING_ENV_VAR = "SF_SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION"
 
 
 def _should_skip_warning_for_read_permissions_on_config_file() -> bool:
     """Check if the warning should be skipped based on environment variable."""
-    return os.getenv(SKIP_WARNING_ENV_VAR, "false").lower() == "true"
+    if SKIP_WARNING_ENV_VAR in os.environ:
+        return os.getenv(SKIP_WARNING_ENV_VAR, "false").lower() == "true"
+    # Else fallback to old value
+    if DEPRECATED_SKIP_WARNING_ENV_VAR in os.environ:
+        warn(
+            f"{DEPRECATED_SKIP_WARNING_ENV_VAR} is deprecated. Please use {SKIP_WARNING_ENV_VAR} instead."
+        )
+        return os.getenv(DEPRECATED_SKIP_WARNING_ENV_VAR, "false").lower() == "true"
+    return False
 
 
 class ConfigSliceOptions(NamedTuple):
@@ -324,14 +333,36 @@ class ConfigManager:
         )
         for filep, sliceoptions, section in itertools.chain(
             ((self.file_path, config_slice_options, None),),
-            self._slices,
+            (
+                (
+                    s.path,
+                    (
+                        s.options._replace(
+                            check_permissions=not skip_file_permissions_check
+                        )
+                        if skip_file_permissions_check
+                        else s.options
+                    ),
+                    s.section,
+                )
+                for s in self._slices
+            ),
         ):
             if sliceoptions.only_in_slice:
                 del read_config_file[section]
             try:
                 if not filep.exists():
+                    # Python 3.14+ (cpython#118243): Path.exists() suppresses
+                    # PermissionError and returns False instead of raising, so
+                    # we explicitly check parent directory access.
+                    if not os.access(filep.parent, os.R_OK | os.X_OK):
+                        LOGGER.debug(
+                            f"Fail to read configuration file from {str(filep)} due to no permission on its parent directory"
+                        )
                     continue
             except PermissionError:
+                # Python < 3.14: Path.exists() raises PermissionError when
+                # the parent directory is not accessible.
                 LOGGER.debug(
                     f"Fail to read configuration file from {str(filep)} due to no permission on its parent directory"
                 )

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/connection.py

@@ -142,7 +142,7 @@ from .sqlstate import SQLSTATE_CONNECTION_NOT_EXISTS, SQLSTATE_FEATURE_NOT_SUPPO
 from .telemetry import TelemetryClient, TelemetryData, TelemetryField
 from .time_util import HeartBeatTimer, get_time_millis
 from .url_util import extract_top_level_domain_from_hostname
-from .util_text import construct_hostname, parse_account, split_statements
+from .util_text import construct_hostname, expand_tilde, parse_account, split_statements
 from .wif_util import AttestationProvider
 
 if sys.version_info >= (3, 13) or typing.TYPE_CHECKING:
@@ -173,6 +173,9 @@ def _get_private_bytes_from_file(
 ) -> bytes:
     if private_key_file_pwd is not None and isinstance(private_key_file_pwd, str):
         private_key_file_pwd = private_key_file_pwd.encode("utf-8")
+
+    private_key_file = expand_tilde(private_key_file)
+
     with open(private_key_file, "rb") as key:
         private_key = serialization.load_pem_private_key(
             key.read(),
@@ -483,6 +486,10 @@ DEFAULT_CONFIGURATION: dict[str, tuple[Any, type | tuple[type, ...]]] = {
         None,
         (type(None), int),
     ),  # Maximum CRL file size in bytes
+    "secondary_roles": (
+        None,
+        (type(None), str),
+    ),  # Secondary roles mode: ALL or NONE or no value
 }
 
 APPLICATION_RE = re.compile(r"[\w\d_]+")

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/crl.py

@@ -64,7 +64,7 @@ class CRLConfig:
     crl_cache_removal_delay_days: int = 7
     crl_cache_cleanup_interval_hours: int = 1
     crl_cache_start_cleanup: bool = False
-    crl_download_max_size: int = 200 * 1024 * 1024  # 200 MB
+    crl_download_max_size: int = 20 * 1024 * 1024  # 20 MB
     unsafe_skip_file_permissions_check: bool = False
 
     @classmethod

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/platform_detection.py

@@ -195,7 +195,7 @@ def is_azure_vm(
     try:
         token_resp = session_manager.get(
             "http://169.254.169.254/metadata/instance?api-version=2021-02-01",
-            headers={"Metadata": "True"},
+            headers={"Metadata": "true"},
             timeout=platform_detection_timeout_seconds,
         )
         return (

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/result_batch.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import abc
+import gzip
 import json
 import time
 from base64 import b64decode
@@ -52,6 +53,25 @@ SSE_C_ALGORITHM = "x-amz-server-side-encryption-customer-algorithm"
 SSE_C_KEY = "x-amz-server-side-encryption-customer-key"
 SSE_C_AES = "AES256"
 
+_GZIP_MAGIC = b"\x1f\x8b"
+
+
+def _ensure_decompressed(response: Response) -> None:
+    """Decompress the response body if HTTP-level gzip decompression was skipped.
+
+    Cloud storage (S3/GCS/Azure) may serve result-set chunks as raw gzip blobs
+    without a ``Content-Encoding: gzip`` header, in which case urllib3's
+    transparent decompression never activates.  Detect this by inspecting the
+    cached *response.content* for the gzip magic number and decompress in-place.
+    """
+    content = response.content
+    if isinstance(content, bytes) and content[:2] == _GZIP_MAGIC:
+        logger.debug(
+            "Response body starts with gzip magic number but was not "
+            "decompressed by the HTTP stack; decompressing explicitly."
+        )
+        response._content = gzip.decompress(content)
+
 
 def _create_nanoarrow_iterator(
     data: bytes,
@@ -418,6 +438,8 @@ class ResultBatch(abc.ABC):
         self._metrics[DownloadMetrics.download.value] = (
             download_metric.get_timing_millis()
         )
+
+        _ensure_decompressed(response)
         return response
 
     @abc.abstractmethod

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/token_cache.py

@@ -69,7 +69,7 @@ class TokenCache(ABC):
 
     Platform-specific implementations:
     - macOS/Windows: Uses OS keyring (Keychain/Credential Manager) via 'keyring' library
-    - Linux: Uses encrypted JSON file in ~/.cache/snowflake/ with 0o600 permissions
+    - Linux: Uses JSON file in ~/.cache/snowflake/ with 0o600 permissions
     - Fallback: NoopTokenCache (no caching) if secure storage unavailable
 
     Tokens are keyed by (host, user, token_type) to support multiple accounts.

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/util_text.py

@@ -8,7 +8,8 @@ import random
 import re
 import string
 from io import StringIO
-from typing import Sequence
+from pathlib import Path
+from typing import Any, Sequence
 
 COMMENT_PATTERN_RE = re.compile(r"^\s*\-\-")
 EMPTY_LINE_RE = re.compile(r"^\s*$")
@@ -301,3 +302,19 @@ def get_md5_for_integrity(text: str | bytes) -> bytes:
     md5 = hashlib.md5(usedforsecurity=False)
     md5.update(text)
     return md5.digest()
+
+
+def expand_tilde(path_to_expand: Any) -> Any:
+    try:
+        path_to_expand = (
+            str(Path(path_to_expand).expanduser())
+            if isinstance(path_to_expand, str)
+            else path_to_expand
+        )
+    except Exception as e:
+        # user home could not be resolved
+        _logger.debug(
+            "User home could not be determined, not expanding tilde. Exception: %s", e
+        )
+
+    return path_to_expand

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/version.py

@@ -1,3 +1,3 @@
 # Update this for the versions
 # Don't change the forth version number from None
-VERSION = (4, 3, 0, None)
+VERSION = (4, 4, 0, None)

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/src/snowflake/connector/wif_util.py

@@ -331,7 +331,7 @@ def create_azure_attestation(
 
     If the application isn't running on Azure or no credentials were found, raises an error.
     """
-    headers = {"Metadata": "True"}
+    headers = {"Metadata": "true"}
     url_without_query_string = "http://169.254.169.254/metadata/identity/oauth2/token"
     query_params = f"api-version=2018-02-01&resource={snowflake_entra_resource}"
 

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/src/snowflake_connector_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.3.0
+Version: 4.4.0
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -27,6 +27,7 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: SQL
 Classifier: Topic :: Database
 Classifier: Topic :: Scientific/Engineering :: Information Analysis
@@ -39,8 +40,8 @@ Description-Content-Type: text/markdown
 License-File: LICENSE.txt
 License-File: NOTICE
 Requires-Dist: asn1crypto<2.0.0,>0.24.0
-Requires-Dist: cryptography>=44.0.1
-Requires-Dist: pyOpenSSL<26.0.0,>=24.0.0
+Requires-Dist: cryptography>=46.0.5
+Requires-Dist: pyOpenSSL>=24.0.0
 Requires-Dist: pyjwt<3.0.0,>=2.10.1
 Requires-Dist: pytz
 Requires-Dist: requests<3.0.0,>=2.32.4
@@ -62,9 +63,9 @@ Requires-Dist: botocore>=1.24; extra == "boto"
 Provides-Extra: development
 Requires-Dist: Cython; extra == "development"
 Requires-Dist: coverage; extra == "development"
-Requires-Dist: mitmproxy>=6.0.0; python_version >= "3.10" and extra == "development"
+Requires-Dist: mitmproxy>=12.0.0; python_version >= "3.12" and extra == "development"
 Requires-Dist: more-itertools; extra == "development"
-Requires-Dist: numpy<=2.2.4; extra == "development"
+Requires-Dist: numpy<=2.4.3; extra == "development"
 Requires-Dist: pendulum!=2.1.1; extra == "development"
 Requires-Dist: pexpect; extra == "development"
 Requires-Dist: pytest<7.5.0; extra == "development"
@@ -93,6 +94,17 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.4.0(March 24,2026)
+  - Bump the lower boundary of cryptography to 46.0.5 due to CVE-2026-26007.
+  - Added support for Python 3.14.
+  - Removed pyOpenSSL upper bound dependency constraint to allow installation of pyOpenSSL 26.0.0+, which includes a fix for GHSA-vp96-hxj8-p424.
+  - Fixed Azure IMDS `Metadata` header to use lowercase `"true"` instead of `"True"`, which caused 400 errors during Azure Workload Identity Federation authentication.
+  - Fixed default `crl_download_max_size` to be 20MB instead of 200MB, as the previous value was set too high and could cause out-of-memory issues.
+  - Fixed a bug where Azure GET commands would incorrectly set the file status to UPLOADED instead of preserving the DOWNLOADED status during metadata retrieval.
+  - Renamed the environment variable for skipping config file permission warnings from `SF_SKIP_WARNING_FOR_READ_PERMISSIONS_ON_CONFIG_FILE` to `SF_SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION`. The old variable is still supported but emits a deprecation warning.
+  - Fixed `unsafe_skip_file_permissions_check` flag not being respected when reading `connections.toml`.
+  - Fixed JSONDecodeError in result_batch._load() when fetching large result sets
+
 - v4.3.0(February 12,2026)
   - Ensured proper list conversion - the converter runs to_snowflake on all list elements.
   - Made the parameter `server_session_keep_alive` in `SnowflakeConnection` skip checking for pending async queries, providing faster connection close times especially when many async queries are executed.
@@ -100,7 +112,10 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Log a warning when using http protocol for OAuth urls.
   - Deprecated support for custom revocation error classes in OCSP response cache deserialization. By default, only `RevocationCheckError` exceptions are deserialized from OCSP cache. Custom exception classes can be temporarily enabled by setting the `SNOWFLAKE_ENABLE_CUSTOM_REVOCATION_ERRORS` environment variable to `true` or `1`, but this support will be removed in a future release.
   - Bumped up vendored `urllib3` to `2.6.3`
-  - Added `force_microseconds_precision` to `cursor.fetch_arrow_all` and `cursor.fetch_pandas_all` to avoid PyArrow schema incosistency between batches.
+  - Added `force_microseconds_precision` to `cursor.fetch_arrow_all` and `cursor.fetch_pandas_all` to avoid PyArrow schema inconsistency between batches.
+  - Fixed a bug where tilde in path to `private_key_file` specified in the connection was not properly expanded
+  - Added `secondary_roles` connection parameter to control secondary role activation at session creation. Supports `ALL` or `NONE` or no value.
+
 
 - v4.2.0(January 07,2026)
   - Added `SnowflakeCursor.stats` property to expose granular DML statistics (rows inserted, deleted, updated, and duplicates) for operations like CTAS where `rowcount` is insufficient.

{snowflake_connector_python-4.3.0 → snowflake_connector_python-4.4.0}/src/snowflake_connector_python.egg-info/requires.txt

@@ -1,6 +1,6 @@
 asn1crypto<2.0.0,>0.24.0
-cryptography>=44.0.1
-pyOpenSSL<26.0.0,>=24.0.0
+cryptography>=46.0.5
+pyOpenSSL>=24.0.0
 pyjwt<3.0.0,>=2.10.1
 pytz
 requests<3.0.0,>=2.32.4
@@ -27,7 +27,7 @@ botocore>=1.24
 Cython
 coverage
 more-itertools
-numpy<=2.2.4
+numpy<=2.4.3
 pendulum!=2.1.1
 pexpect
 pytest<7.5.0
@@ -39,8 +39,8 @@ pytest-xdist
 pytzdata
 responses
 
-[development:python_version >= "3.10"]
-mitmproxy>=6.0.0
+[development:python_version >= "3.12"]
+mitmproxy>=12.0.0
 
 [pandas]
 pyarrow>=14.0.1