snowflake-connector-python 4.4.0__tar.gz → 4.5.0__tar.gz

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.5.0}/CONTRIBUTING.md

@@ -27,7 +27,7 @@ We require our contributors to sign a CLA, available at https://github.com/snowf
 What is a development environment? It's a [virtualenv](https://virtualenv.pypa.io) that has all of necessary
 dependencies installed with `snowflake-connector-python` installed as an editable package.
 
-Setting up a development environment is super easy with this [one simple tox command](https://tox.wiki/en/latest/example/devenv.html).
+Setting up a development environment is super easy with this [one simple tox command](https://tox.wiki/en/legacy/example/devenv.html).
 
 ```shell
 tox --devenv venv39 -e py39

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.5.0}/DESCRIPTION.md

@@ -7,7 +7,22 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v4.4.0(March 24,2026)
+- v4.5.0(May 12,2026)
+  - Fixed `write_pandas` temp stage name collisions (SNOW-3481510). The old PRNG could produce identical name sequences in forked processes (e.g. Notebook kernels), causing `CREATE TEMPORARY STAGE` to fail with "Object already exists".
+  - Fixed a security bug in Okta SAML authentication where `_is_prefix_equal()` compared `url1`'s port against itself instead of `url2`'s port, allowing an attacker to redirect credentials to a different port on the same hostname. Also fixed the default port fallback to use `int` instead of `str` for correct comparison when one URL omits the port.
+  - Fixed `executemany` with `paramstyle="pyformat"` to correctly locate the VALUES clause using a balanced-parentheses parser instead of a greedy regex. This fixes incorrect behaviour with nested function calls such as SQLAlchemy `@compiles VARIANT` patterns (e.g. `PARSE_JSON(%(col)s)`) and subquery-form INSERTs (SNOW-298756).
+  - Added ECDSA key support (ES256, ES384, ES512) for key-pair authentication.
+  - Added HTTP 307/308 redirect status codes to the retryable set as defense-in-depth, with redirect-aware logging in both sync and async paths.
+  - Consolidated keyring token cache to use a single service name with hashed account keys, reducing macOS Keychain password prompts. Legacy entries are auto-migrated on first read.
+  - Added support for AWS outbound JWT token attestation for Workload Identity Federation (WIF). This can be enabled by setting the `SNOWFLAKE_ENABLE_AWS_WIF_OUTBOUND_TOKEN` environment variable to `true`. Note: This environment variable will be removed in a future release.
+  - Removed dynamic class deserialization from the OCSP response validation cache to prevent arbitrary code execution via crafted cache files (SNOW-2439940). The `SNOWFLAKE_ENABLE_CUSTOM_REVOCATION_ERRORS` environment variable is now a no-op.
+  - Updated SPCS token injection to gate on `SNOWFLAKE_RUNNING_INSIDE_SPCS` environment variable, trim whitespace, and remove configurable token path.
+  - GCP WIF attestation now uses hostname `metadata.google.internal` instead of the IPv4 link-local address, so it works on IPv6-only GCP VMs.
+  - Fixed a bug where `write_pandas()` with `auto_create_table=False` and `overwrite=True` would execute `CREATE TABLE IF NOT EXISTS`, which required unnecessary `OWNERSHIP` privilege on the table. Now only `TRUNCATE TABLE` is executed in this case. Note: users who relied on the table being implicitly created despite `auto_create_table=False` should set `auto_create_table=True` instead.
+  - Added validation of the `account` connection parameter so malformed identifiers (for example path-like values or labels outside letters, digits, `_`, and `-`) are rejected with `ProgrammingError` before login (SNOW-1902886).
+  - Added support for Azure Workload Identity Federation impersonation, allowing a managed identity to authenticate as a service principal.
+
+- v4.4.0(March 25,2026)
   - Bump the lower boundary of cryptography to 46.0.5 due to CVE-2026-26007.
   - Added support for Python 3.14.
   - Removed pyOpenSSL upper bound dependency constraint to allow installation of pyOpenSSL 26.0.0+, which includes a fix for GHSA-vp96-hxj8-p424.
@@ -17,6 +32,8 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Renamed the environment variable for skipping config file permission warnings from `SF_SKIP_WARNING_FOR_READ_PERMISSIONS_ON_CONFIG_FILE` to `SF_SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION`. The old variable is still supported but emits a deprecation warning.
   - Fixed `unsafe_skip_file_permissions_check` flag not being respected when reading `connections.toml`.
   - Fixed JSONDecodeError in result_batch._load() when fetching large result sets
+  - Fixed validation ordering for `client_session_keep_alive_heartbeat_frequency`.
+
 
 - v4.3.0(February 12,2026)
   - Ensured proper list conversion - the converter runs to_snowflake on all list elements.
@@ -72,6 +89,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
 
 - v3.18.0(October 03,2025)
   - Added support for pandas conversion for Day-time and Year-Month Interval types
+* Fixed the return type of iterating over a cursor
 
 - v3.17.4(September 22,2025)
   - Added support for intermediate certificates as roots when they are stored in the trust store

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.4.0
+Version: 4.5.0
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -94,7 +94,22 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v4.4.0(March 24,2026)
+- v4.5.0(May 12,2026)
+  - Fixed `write_pandas` temp stage name collisions (SNOW-3481510). The old PRNG could produce identical name sequences in forked processes (e.g. Notebook kernels), causing `CREATE TEMPORARY STAGE` to fail with "Object already exists".
+  - Fixed a security bug in Okta SAML authentication where `_is_prefix_equal()` compared `url1`'s port against itself instead of `url2`'s port, allowing an attacker to redirect credentials to a different port on the same hostname. Also fixed the default port fallback to use `int` instead of `str` for correct comparison when one URL omits the port.
+  - Fixed `executemany` with `paramstyle="pyformat"` to correctly locate the VALUES clause using a balanced-parentheses parser instead of a greedy regex. This fixes incorrect behaviour with nested function calls such as SQLAlchemy `@compiles VARIANT` patterns (e.g. `PARSE_JSON(%(col)s)`) and subquery-form INSERTs (SNOW-298756).
+  - Added ECDSA key support (ES256, ES384, ES512) for key-pair authentication.
+  - Added HTTP 307/308 redirect status codes to the retryable set as defense-in-depth, with redirect-aware logging in both sync and async paths.
+  - Consolidated keyring token cache to use a single service name with hashed account keys, reducing macOS Keychain password prompts. Legacy entries are auto-migrated on first read.
+  - Added support for AWS outbound JWT token attestation for Workload Identity Federation (WIF). This can be enabled by setting the `SNOWFLAKE_ENABLE_AWS_WIF_OUTBOUND_TOKEN` environment variable to `true`. Note: This environment variable will be removed in a future release.
+  - Removed dynamic class deserialization from the OCSP response validation cache to prevent arbitrary code execution via crafted cache files (SNOW-2439940). The `SNOWFLAKE_ENABLE_CUSTOM_REVOCATION_ERRORS` environment variable is now a no-op.
+  - Updated SPCS token injection to gate on `SNOWFLAKE_RUNNING_INSIDE_SPCS` environment variable, trim whitespace, and remove configurable token path.
+  - GCP WIF attestation now uses hostname `metadata.google.internal` instead of the IPv4 link-local address, so it works on IPv6-only GCP VMs.
+  - Fixed a bug where `write_pandas()` with `auto_create_table=False` and `overwrite=True` would execute `CREATE TABLE IF NOT EXISTS`, which required unnecessary `OWNERSHIP` privilege on the table. Now only `TRUNCATE TABLE` is executed in this case. Note: users who relied on the table being implicitly created despite `auto_create_table=False` should set `auto_create_table=True` instead.
+  - Added validation of the `account` connection parameter so malformed identifiers (for example path-like values or labels outside letters, digits, `_`, and `-`) are rejected with `ProgrammingError` before login (SNOW-1902886).
+  - Added support for Azure Workload Identity Federation impersonation, allowing a managed identity to authenticate as a service principal.
+
+- v4.4.0(March 25,2026)
   - Bump the lower boundary of cryptography to 46.0.5 due to CVE-2026-26007.
   - Added support for Python 3.14.
   - Removed pyOpenSSL upper bound dependency constraint to allow installation of pyOpenSSL 26.0.0+, which includes a fix for GHSA-vp96-hxj8-p424.
@@ -104,6 +119,8 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Renamed the environment variable for skipping config file permission warnings from `SF_SKIP_WARNING_FOR_READ_PERMISSIONS_ON_CONFIG_FILE` to `SF_SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION`. The old variable is still supported but emits a deprecation warning.
   - Fixed `unsafe_skip_file_permissions_check` flag not being respected when reading `connections.toml`.
   - Fixed JSONDecodeError in result_batch._load() when fetching large result sets
+  - Fixed validation ordering for `client_session_keep_alive_heartbeat_frequency`.
+
 
 - v4.3.0(February 12,2026)
   - Ensured proper list conversion - the converter runs to_snowflake on all list elements.
@@ -159,6 +176,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
 
 - v3.18.0(October 03,2025)
   - Added support for pandas conversion for Day-time and Year-Month Interval types
+* Fixed the return type of iterating over a cursor
 
 - v3.17.4(September 22,2025)
   - Added support for intermediate certificates as roots when they are stored in the trust store

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.5.0}/src/snowflake/connector/_utils.py

@@ -10,7 +10,7 @@ import threading
 import time
 from enum import Enum
 from inspect import stack
-from random import choice
+from secrets import choice
 from threading import Timer
 from uuid import UUID
 
@@ -109,30 +109,29 @@ def get_application_path() -> str:
         return "unknown"
 
 
-_SPCS_TOKEN_ENV_VAR_NAME = "SF_SPCS_TOKEN_PATH"
-_SPCS_TOKEN_DEFAULT_PATH = "/snowflake/session/spcs_token"
+_SPCS_ENV_VAR = "SNOWFLAKE_RUNNING_INSIDE_SPCS"
+_SPCS_TOKEN_PATH = "/snowflake/session/spcs_token"
 
 
 def get_spcs_token() -> str | None:
-    """Return the SPCS token read from the configured path, or None.
+    """Return the SPCS token if running inside an SPCS container, or None.
 
-    The path is determined by the SF_SPCS_TOKEN_PATH environment variable,
-    falling back to ``/snowflake/session/spcs_token`` when unset.
+    The token is only read when the SNOWFLAKE_RUNNING_INSIDE_SPCS environment
+    variable is set.  The file at /snowflake/session/spcs_token is read as
+    UTF-8 text and leading/trailing whitespace is stripped.
 
-    Any I/O errors or missing/empty files are treated as \"no token\" and
-    will not cause authentication to fail.
+    Any read failure is logged as a warning and None is returned.
     """
-    path = os.getenv(_SPCS_TOKEN_ENV_VAR_NAME) or _SPCS_TOKEN_DEFAULT_PATH
+    if not os.environ.get(_SPCS_ENV_VAR):
+        return None
     try:
-        if not os.path.isfile(path):
-            return None
-        with open(path, encoding="utf-8") as f:
+        with open(_SPCS_TOKEN_PATH, encoding="utf-8") as f:
             token = f.read().strip()
         if not token:
             return None
         return token
-    except Exception as exc:  # pragma: no cover - best-effort logging only
-        logger.debug("Failed to read SPCS token from %s: %s", path, exc)
+    except Exception as exc:
+        logger.warning("Failed to read SPCS token from %s: %s", _SPCS_TOKEN_PATH, exc)
         return None
 
 
@@ -184,14 +183,35 @@ class _CoreLoader:
         else:
             return "unknown"
 
+    @staticmethod
+    def _libc_ver() -> tuple[str, str]:
+        """Return (libc_name, libc_version) from the platform."""
+        return platform.libc_ver()
+
     @staticmethod
     def _detect_libc() -> str:
         """Detect libc type on Linux (glibc vs musl)."""
-        lib, _ = platform.libc_ver()
+        lib, _ = _CoreLoader._libc_ver()
         if lib == "glibc":
             return "glibc"
         return "musl"
 
+    @staticmethod
+    def get_libc_version() -> str | None:
+        """Return libc version from :func:`platform.libc_ver`, or None if unknown."""
+        _, version = _CoreLoader._libc_ver()
+        if not version:
+            return None
+        stripped = version.strip()
+        return stripped or None
+
+    @staticmethod
+    def get_libc_family() -> str | None:
+        """Return libc family for Linux (glibc or musl), otherwise None."""
+        if _CoreLoader._detect_os() != "linux":
+            return None
+        return _CoreLoader._detect_libc()
+
     @staticmethod
     def _get_platform_subdir() -> str:
         """Get the platform-specific subdirectory name."""
@@ -330,6 +350,8 @@ def build_minicore_usage_for_session() -> dict[str, str | None]:
         "ISA": ISA,
         "CORE_VERSION": _core_loader.get_core_version(),
         "CORE_FILE_NAME": _core_loader.get_file_name(),
+        "LIBC_FAMILY": _CoreLoader.get_libc_family(),
+        "LIBC_VERSION": _CoreLoader.get_libc_version(),
     }
 
 

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.5.0}/src/snowflake/connector/aio/_connection.py

@@ -451,6 +451,7 @@ class SnowflakeConnection(SnowflakeConnectionSync):
                     not in (
                         AttestationProvider.GCP,
                         AttestationProvider.AWS,
+                        AttestationProvider.AZURE,
                     )
                 ):
                     Error.errorhandler_wrapper(
@@ -458,7 +459,7 @@ class SnowflakeConnection(SnowflakeConnectionSync):
                         None,
                         ProgrammingError,
                         {
-                            "msg": "workload_identity_impersonation_path is currently only supported for GCP and AWS.",
+                            "msg": "workload_identity_impersonation_path is currently only supported for GCP, AWS, and AZURE.",
                             "errno": ER_INVALID_WIF_SETTINGS,
                         },
                     )

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.5.0}/src/snowflake/connector/aio/_cursor.py

@@ -57,6 +57,7 @@ from snowflake.connector.errors import BindUploadError, DatabaseError
 from snowflake.connector.file_transfer_agent import SnowflakeProgressPercentage
 from snowflake.connector.telemetry import TelemetryData, TelemetryField
 from snowflake.connector.time_util import get_time_millis
+from snowflake.connector.util_text import extract_values_clause
 
 from .._utils import REQUEST_ID_STATEMENT_PARAM_NAME, is_uuid4
 
@@ -765,8 +766,8 @@ class SnowflakeCursorBase(SnowflakeCursorBaseSync, abc.ABC, typing.Generic[Fetch
                 #  accumulate results to mock the result from a single insert statement as formatted below
                 logger.debug("rewriting INSERT query")
                 command_wo_comments = re.sub(self.COMMENT_SQL_RE, "", command)
-                m = self.INSERT_SQL_VALUES_RE.match(command_wo_comments)
-                if not m:
+                fmt = extract_values_clause(command_wo_comments)
+                if fmt is None:
                     Error.errorhandler_wrapper(
                         self.connection,
                         self,
@@ -776,8 +777,6 @@ class SnowflakeCursorBase(SnowflakeCursorBaseSync, abc.ABC, typing.Generic[Fetch
                             "errno": ER_FAILED_TO_REWRITE_MULTI_ROW_INSERT,
                         },
                     )
-
-                fmt = m.group(1)
                 values = []
                 for param in seqparams:
                     logger.debug(f"parameter: {param}")

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.5.0}/src/snowflake/connector/aio/_network.py

@@ -11,7 +11,16 @@ from typing import TYPE_CHECKING, Any, AsyncGenerator
 
 import OpenSSL.SSL
 
-from ..compat import FORBIDDEN, OK, UNAUTHORIZED, urlencode, urlparse, urlsplit
+from ..compat import (
+    FORBIDDEN,
+    OK,
+    PERMANENT_REDIRECT,
+    TEMPORARY_REDIRECT,
+    UNAUTHORIZED,
+    urlencode,
+    urlparse,
+    urlsplit,
+)
 from ..constants import (
     _CONNECTIVITY_ERR_MSG,
     HTTP_HEADER_ACCEPT,
@@ -741,6 +750,18 @@ class SnowflakeRestful(SnowflakeRestfulSync):
                 data=input_data,
                 timeout=aiohttp.ClientTimeout(socket_timeout),
             )
+
+            # Log when the HTTP library auto-followed a redirect chain before
+            # delivering this response (history is populated by aiohttp).
+            if raw_ret.history:
+                for hist_resp in raw_ret.history:
+                    if hist_resp.status in (TEMPORARY_REDIRECT, PERMANENT_REDIRECT):
+                        logger.debug(
+                            "Request was redirected: HTTP %d to %s",
+                            hist_resp.status,
+                            hist_resp.headers.get("Location", "unknown"),
+                        )
+
             try:
                 if raw_ret.status == OK:
                     logger.debug("SUCCESS")
@@ -841,6 +862,23 @@ class SnowflakeRestful(SnowflakeRestfulSync):
                     exc_info=True,
                 )
                 raise RetryRequest(err)
+        except aiohttp.TooManyRedirects as err:
+            # aiohttp raises TooManyRedirects when max_redirects is exceeded.
+            # Unlike .NET's HttpClient (which returns the last 307/308 response),
+            # aiohttp throws here — so is_retryable_http_code(307/308) never fires.
+            # Catch explicitly and apply the same retry/login logic.
+            if is_login_request(full_url):
+                raise OperationalError(
+                    msg="Login request is retryable. Will be handled by authenticator",
+                    errno=ER_RETRYABLE_CODE,
+                )
+            else:
+                logger.debug(
+                    "Too many redirects. Retrying... Ignore the following "
+                    f"error stack: {err}",
+                    exc_info=True,
+                )
+                raise RetryRequest(err)
         except Exception as err:
             if isinstance(err, (Error, RetryRequest, ReauthenticationRequest)):
                 raise err

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.5.0}/src/snowflake/connector/aio/_pandas_tools.py

@@ -443,7 +443,7 @@ async def write_pandas(
             quote_identifiers,
         )
 
-        if auto_create_table or overwrite:
+        if auto_create_table:
             iceberg = "ICEBERG " if iceberg_config else ""
             iceberg_config_statement = _iceberg_config_statement_helper(
                 iceberg_config or {}

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.5.0}/src/snowflake/connector/aio/_wif_util.py

@@ -5,6 +5,8 @@ import logging
 import os
 from base64 import b64encode
 
+import jwt
+
 from snowflake.connector.options import (
     aioboto3,
     aiobotocore,
@@ -12,9 +14,10 @@ from snowflake.connector.options import (
     installed_aioboto,
 )
 
-from ..errorcode import ER_WIF_CREDENTIALS_NOT_FOUND
+from ..errorcode import ER_INVALID_WIF_SETTINGS, ER_WIF_CREDENTIALS_NOT_FOUND
 from ..errors import MissingDependencyError, ProgrammingError
 from ..wif_util import (
+    AZURE_WIF_FEDERATION_AUDIENCE,
     DEFAULT_ENTRA_SNOWFLAKE_RESOURCE,
     SNOWFLAKE_AUDIENCE,
     AttestationProvider,
@@ -27,9 +30,7 @@ from ._session_manager import SessionManager, SessionManagerFactory
 
 logger = logging.getLogger(__name__)
 
-GCP_METADATA_SERVICE_ACCOUNT_BASE_URL = (
-    "http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default"
-)
+GCP_METADATA_SERVICE_ACCOUNT_BASE_URL = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default"
 
 
 async def get_aws_region() -> str:
@@ -227,17 +228,75 @@ async def create_gcp_attestation(
     )
 
 
+async def get_azure_sp_token_via_impersonation(
+    mi_token: str,
+    sp_client_id: str,
+    snowflake_entra_resource: str,
+    session_manager: SessionManager,
+) -> str:
+    """Exchanges a managed identity token for a service principal token via the Entra ID token endpoint."""
+    # Azure requires the MI and the app registration to be in the same tenant, so the
+    # tid claim from the MI token is always the correct tenant for the token exchange endpoint.
+    tenant_id = jwt.decode(mi_token, options={"verify_signature": False}).get("tid")
+    if not tenant_id:
+        raise ProgrammingError(
+            msg="MI token is missing 'tid' claim; cannot determine tenant ID for impersonation.",
+            errno=ER_WIF_CREDENTIALS_NOT_FOUND,
+        )
+    response_text = None
+    try:
+        res = await session_manager.post(
+            url=f"https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token",
+            data={
+                "grant_type": "client_credentials",
+                "client_id": sp_client_id,
+                "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+                "client_assertion": mi_token,
+                "scope": f"{snowflake_entra_resource}/.default",
+            },
+        )
+        content = await res.content.read()
+        response_text = content.decode("utf-8")
+        response_data = json.loads(response_text)
+        res.raise_for_status()
+    except Exception as e:
+        raise ProgrammingError(
+            msg=f"Error fetching SP token for Azure client_id '{sp_client_id}': {e}. Response: {response_text}",
+            errno=ER_WIF_CREDENTIALS_NOT_FOUND,
+        )
+
+    sp_token = response_data.get("access_token")
+    if not sp_token:
+        raise ProgrammingError(
+            msg=f"No access token found in Entra ID response for client_id '{sp_client_id}'.",
+            errno=ER_WIF_CREDENTIALS_NOT_FOUND,
+        )
+    return sp_token
+
+
 async def create_azure_attestation(
     snowflake_entra_resource: str,
     session_manager: SessionManager | None = None,
+    impersonation_path: list[str] | None = None,
 ) -> WorkloadIdentityAttestation:
     """Tries to create a workload identity attestation for Azure.
 
     If the application isn't running on Azure or no credentials were found, raises an error.
     """
+    if impersonation_path:
+        if len(impersonation_path) != 1:
+            raise ProgrammingError(
+                msg="Azure WIF impersonation only supports a single service principal (single-hop). impersonation_path must contain exactly one client_id.",
+                errno=ER_INVALID_WIF_SETTINGS,
+            )
+    resource = (
+        AZURE_WIF_FEDERATION_AUDIENCE
+        if impersonation_path
+        else snowflake_entra_resource
+    )
     headers = {"Metadata": "true"}
     url_without_query_string = "http://169.254.169.254/metadata/identity/oauth2/token"
-    query_params = f"api-version=2018-02-01&resource={snowflake_entra_resource}"
+    query_params = f"api-version=2018-02-01&resource={resource}"
 
     # Check if running in Azure Functions environment
     identity_endpoint = os.environ.get("IDENTITY_ENDPOINT")
@@ -254,7 +313,7 @@ async def create_azure_attestation(
         # Azure Functions uses a different endpoint, headers and API version.
         url_without_query_string = identity_endpoint
         headers = {"X-IDENTITY-HEADER": identity_header}
-        query_params = f"api-version=2019-08-01&resource={snowflake_entra_resource}"
+        query_params = f"api-version=2019-08-01&resource={resource}"
 
     # Allow configuring an explicit client ID, which may be used in Azure Functions,
     # if there are user-assigned identities, or multiple managed identities available.
@@ -262,6 +321,7 @@ async def create_azure_attestation(
     if managed_identity_client_id:
         query_params += f"&client_id={managed_identity_client_id}"
 
+    response_text = None
     try:
         res = await session_manager.request(
             method="GET",
@@ -272,9 +332,10 @@ async def create_azure_attestation(
         content = await res.content.read()
         response_text = content.decode("utf-8")
         response_data = json.loads(response_text)
+        res.raise_for_status()
     except Exception as e:
         raise ProgrammingError(
-            msg=f"Error fetching Azure metadata: {e}. Ensure the application is running on Azure.",
+            msg=f"Error fetching Azure metadata: {e}. Response: {response_text}. Ensure the application is running on Azure.",
             errno=ER_WIF_CREDENTIALS_NOT_FOUND,
         )
 
@@ -285,6 +346,11 @@ async def create_azure_attestation(
             errno=ER_WIF_CREDENTIALS_NOT_FOUND,
         )
 
+    if impersonation_path:
+        jwt_str = await get_azure_sp_token_via_impersonation(
+            jwt_str, impersonation_path[0], snowflake_entra_resource, session_manager
+        )
+
     issuer, subject = extract_iss_and_sub_without_signature_verification(jwt_str)
     return WorkloadIdentityAttestation(
         AttestationProvider.AZURE, jwt_str, {"iss": issuer, "sub": subject}
@@ -312,7 +378,9 @@ async def create_attestation(
     if provider == AttestationProvider.AWS:
         return await create_aws_attestation(impersonation_path)
     elif provider == AttestationProvider.AZURE:
-        return await create_azure_attestation(entra_resource, session_manager)
+        return await create_azure_attestation(
+            entra_resource, session_manager, impersonation_path
+        )
     elif provider == AttestationProvider.GCP:
         return await create_gcp_attestation(session_manager, impersonation_path)
     elif provider == AttestationProvider.OIDC:

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.5.0}/src/snowflake/connector/auth/_auth.py

@@ -105,8 +105,8 @@ class Auth:
     def _add_spcs_token_to_body(self, body: dict[Any, Any]) -> None:
         """Inject SPCS_TOKEN into the login request body when available.
 
-        This reads the SPCS token from the path specified by SF_SPCS_TOKEN_PATH,
-        or from ``/snowflake/session/spcs_token`` when the env var is unset.
+        The token is read from /snowflake/session/spcs_token when
+        SNOWFLAKE_RUNNING_INSIDE_SPCS is set.
         """
         spcs_token = get_spcs_token()
         if spcs_token is not None:

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.5.0}/src/snowflake/connector/auth/keypair.py

@@ -10,6 +10,12 @@ from typing import Any
 
 import jwt
 from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives.asymmetric.ec import (
+    SECP256R1,
+    SECP384R1,
+    SECP521R1,
+    EllipticCurvePrivateKey,
+)
 from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
 from cryptography.hazmat.primitives.serialization import (
     Encoding,
@@ -28,7 +34,12 @@ logger = getLogger(__name__)
 class AuthByKeyPair(AuthByPlugin):
     """Key pair based authentication."""
 
-    ALGORITHM = "RS256"
+    ALG_RS256 = "RS256"
+    ALG_ES256 = "ES256"
+    ALG_ES384 = "ES384"
+    ALG_ES512 = "ES512"
+    ALGORITHM = ALG_RS256  # deprecated, kept for backward compatibility
+
     ISSUER = "iss"
     SUBJECT = "sub"
     EXPIRE_TIME = "exp"
@@ -39,7 +50,7 @@ class AuthByKeyPair(AuthByPlugin):
 
     def __init__(
         self,
-        private_key: bytes | str | RSAPrivateKey,
+        private_key: bytes | str | RSAPrivateKey | EllipticCurvePrivateKey,
         private_key_passphrase: bytes | None = None,
         lifetime_in_seconds: int = LIFETIME,
         **kwargs,
@@ -48,7 +59,7 @@ class AuthByKeyPair(AuthByPlugin):
 
         Args:
             private_key: a byte array of der formats of private key, or an
-                object that implements the `RSAPrivateKey` interface.
+                object that implements the `RSAPrivateKey` or `EllipticCurvePrivateKey` interface.
             lifetime_in_seconds: number of seconds the JWT token will be valid
         """
         super().__init__(
@@ -72,7 +83,9 @@ class AuthByKeyPair(AuthByPlugin):
             ).total_seconds()
         )
 
-        self._private_key: bytes | str | RSAPrivateKey | None = private_key
+        self._private_key: (
+            bytes | str | RSAPrivateKey | EllipticCurvePrivateKey | None
+        ) = private_key
         self._private_key_passphrase: bytes | None = private_key_passphrase
         self._jwt_token = ""
         self._jwt_token_exp = 0
@@ -109,7 +122,7 @@ class AuthByKeyPair(AuthByPlugin):
             except Exception as e:
                 raise ProgrammingError(
                     msg=f"Failed to decode private key: {e}\nPlease provide a valid "
-                    "unencrypted rsa private key in base64-encoded DER format as a "
+                    "unencrypted RSA or ECDSA private key in base64-encoded DER format as a "
                     "str object",
                     errno=ER_INVALID_PRIVATE_KEY,
                 )
@@ -124,23 +137,23 @@ class AuthByKeyPair(AuthByPlugin):
             except Exception as e:
                 raise ProgrammingError(
                     msg=f"Failed to load private key: {e}\nPlease provide a valid "
-                    "rsa private key in DER format as bytes object. If the key is "
+                    "RSA or ECDSA private key in DER format as bytes object. If the key is "
                     "encrypted, provide the passphrase via private_key_passphrase",
                     errno=ER_INVALID_PRIVATE_KEY,
                 )
 
-            if not isinstance(private_key, RSAPrivateKey):
+            if not isinstance(private_key, (RSAPrivateKey, EllipticCurvePrivateKey)):
                 raise ProgrammingError(
                     msg=f"Private key type ({private_key.__class__.__name__}) not supported."
-                    "\nPlease provide a valid rsa private key in DER format as bytes "
+                    "\nPlease provide a valid RSA or ECDSA private key in DER format as bytes "
                     "object",
                     errno=ER_INVALID_PRIVATE_KEY,
                 )
-        elif isinstance(self._private_key, RSAPrivateKey):
+        elif isinstance(self._private_key, (RSAPrivateKey, EllipticCurvePrivateKey)):
             private_key = self._private_key
         else:
             raise TypeError(
-                f"Expected bytes or RSAPrivateKey, got {type(self._private_key)}"
+                f"Expected bytes, RSAPrivateKey, or EllipticCurvePrivateKey, got {type(self._private_key)}"
             )
 
         public_key_fp = self.calculate_public_key_fingerprint(private_key)
@@ -153,7 +166,24 @@ class AuthByKeyPair(AuthByPlugin):
             self.EXPIRE_TIME: self._jwt_token_exp,
         }
 
-        _jwt_token = jwt.encode(payload, private_key, algorithm=self.ALGORITHM)
+        # select algorithm based on key type and curve
+        if isinstance(private_key, EllipticCurvePrivateKey):
+            curve = private_key.curve
+            if isinstance(curve, SECP256R1):
+                algorithm = self.ALG_ES256
+            elif isinstance(curve, SECP384R1):
+                algorithm = self.ALG_ES384
+            elif isinstance(curve, SECP521R1):
+                algorithm = self.ALG_ES512
+            else:
+                raise ProgrammingError(
+                    msg=f"Unsupported EC curve: {curve.name}. Supported: SECP256R1, SECP384R1, SECP521R1",
+                    errno=ER_INVALID_PRIVATE_KEY,
+                )
+        else:
+            algorithm = self.ALG_RS256
+
+        _jwt_token = jwt.encode(payload, private_key, algorithm=algorithm)
 
         # jwt.encode() returns bytes in pyjwt 1.x and a string
         # in pyjwt 2.x

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.5.0}/src/snowflake/connector/auth/okta.py

@@ -38,10 +38,10 @@ def _is_prefix_equal(url1, url2):
 
     port1 = parsed_url1.port
     if not port1 and parsed_url1.scheme == "https":
-        port1 = "443"
-    port2 = parsed_url1.port
+        port1 = 443
+    port2 = parsed_url2.port
     if not port2 and parsed_url2.scheme == "https":
-        port2 = "443"
+        port2 = 443
 
     return (
         parsed_url1.hostname == parsed_url2.hostname

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.5.0}/src/snowflake/connector/compat.py

@@ -70,6 +70,8 @@ METHOD_NOT_ALLOWED = http.client.METHOD_NOT_ALLOWED
 BAD_GATEWAY = http.client.BAD_GATEWAY
 BAD_REQUEST = http.client.BAD_REQUEST
 REQUEST_TIMEOUT = http.client.REQUEST_TIMEOUT
+TEMPORARY_REDIRECT = http.client.TEMPORARY_REDIRECT  # 307
+PERMANENT_REDIRECT = http.client.PERMANENT_REDIRECT  # type: ignore[attr-defined]  # 308 — stubs lag runtime
 TOO_MANY_REQUESTS = http.client.TOO_MANY_REQUESTS
 SERVICE_UNAVAILABLE = http.client.SERVICE_UNAVAILABLE
 GATEWAY_TIMEOUT = http.client.GATEWAY_TIMEOUT

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.5.0}/src/snowflake/connector/config_manager.py

@@ -29,7 +29,14 @@ LOGGER = logging.getLogger(__name__)
 READABLE_BY_OTHERS = stat.S_IRGRP | stat.S_IROTH
 WRITABLE_BY_OTHERS = stat.S_IWGRP | stat.S_IWOTH
 
+# NOTE: For historical and compatibility reasons, three environment variables are recognized:
+# - The skip warning mechanism was originally for internal use (only within SPCS containers).
+# - SPCS containers set SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION.
+# - SF_SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION is the documented/public way to disable the warning.
+# - In the Universal driver, this warning will become unskippable and the message will clarify:
+#   "SNOWFLAKE_RUNNING_INSIDE_SPCS is detected, skipping permission checks."
 DEPRECATED_SKIP_WARNING_ENV_VAR = "SF_SKIP_WARNING_FOR_READ_PERMISSIONS_ON_CONFIG_FILE"
+SPCS_INJECTED_SKIP_WARNING_ENV_VAR = "SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION"
 SKIP_WARNING_ENV_VAR = "SF_SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION"
 
 
@@ -37,6 +44,8 @@ def _should_skip_warning_for_read_permissions_on_config_file() -> bool:
     """Check if the warning should be skipped based on environment variable."""
     if SKIP_WARNING_ENV_VAR in os.environ:
         return os.getenv(SKIP_WARNING_ENV_VAR, "false").lower() == "true"
+    if SPCS_INJECTED_SKIP_WARNING_ENV_VAR in os.environ:
+        return os.getenv(SPCS_INJECTED_SKIP_WARNING_ENV_VAR, "false").lower() == "true"
     # Else fallback to old value
     if DEPRECATED_SKIP_WARNING_ENV_VAR in os.environ:
         warn(