snowflake-connector-python 4.4.0__tar.gz → 4.6.0__tar.gz

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.6.0}/CONTRIBUTING.md

@@ -27,11 +27,11 @@ We require our contributors to sign a CLA, available at https://github.com/snowf
 What is a development environment? It's a [virtualenv](https://virtualenv.pypa.io) that has all of necessary
 dependencies installed with `snowflake-connector-python` installed as an editable package.
 
-Setting up a development environment is super easy with this [one simple tox command](https://tox.wiki/en/latest/example/devenv.html).
+Setting up a development environment is super easy with this [one simple tox command](https://tox.wiki/en/legacy/example/devenv.html).
 
 ```shell
-tox --devenv venv39 -e py39
-. venv39/bin/activate
+tox --devenv venv310 -e py310
+. venv310/bin/activate
 ```
 
 Note: we suggest using the lowest supported Python version for development.

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.6.0}/DESCRIPTION.md

@@ -7,7 +7,29 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v4.4.0(March 24,2026)
+- v4.6.0(May 28,2026)
+  - Dropped support for Python 3.9. The minimum supported version is now Python 3.10.
+  - Fixed sdist to only install the minicore binary matching the current platform (SNOW-3526469). Previous 4.x releases copied every platform's minicore `.so`/`.dylib`/`.dll` into the install prefix, breaking downstream packagers (e.g. Homebrew) whose audits reject foreign-arch binaries.
+  - Added one in-band telemetry record per successful login describing which connection-identifier fields the user supplied (`account_provided`, `account_with_region`, `account_org_provided`, `region_provided`, `host_provided`). No hostname or account value is included. This is gated by the existing server-side `CLIENT_TELEMETRY_ENABLED` parameter and can additionally be disabled locally by setting `SF_TELEMETRY_DISABLE_CONNECTION_SHAPE=true`. The telemetry collection is time-boxed and will be removed in a future release.
+  - Bumped up vendored `urllib3` to `2.7.0`
+
+- v4.5.0(May 12,2026)
+  - Fixed `write_pandas` temp stage name collisions (SNOW-3481510). The old PRNG could produce identical name sequences in forked processes (e.g. Notebook kernels), causing `CREATE TEMPORARY STAGE` to fail with "Object already exists".
+  - Replaced third-party download URLs in CI scripts and Dockerfiles with Snowflake Artifactory to improve supply-chain security.
+  - Fixed a security bug in Okta SAML authentication where `_is_prefix_equal()` compared `url1`'s port against itself instead of `url2`'s port, allowing an attacker to redirect credentials to a different port on the same hostname. Also fixed the default port fallback to use `int` instead of `str` for correct comparison when one URL omits the port.
+  - Fixed `executemany` with `paramstyle="pyformat"` to correctly locate the VALUES clause using a balanced-parentheses parser instead of a greedy regex. This fixes incorrect behaviour with nested function calls such as SQLAlchemy `@compiles VARIANT` patterns (e.g. `PARSE_JSON(%(col)s)`) and subquery-form INSERTs (SNOW-298756).
+  - Added ECDSA key support (ES256, ES384, ES512) for key-pair authentication.
+  - Added HTTP 307/308 redirect status codes to the retryable set as defense-in-depth, with redirect-aware logging in both sync and async paths.
+  - Consolidated keyring token cache to use a single service name with hashed account keys, reducing macOS Keychain password prompts. Legacy entries are auto-migrated on first read.
+  - Added support for AWS outbound JWT token attestation for Workload Identity Federation (WIF). This can be enabled by setting the `SNOWFLAKE_ENABLE_AWS_WIF_OUTBOUND_TOKEN` environment variable to `true`. Note: This environment variable will be removed in a future release.
+  - Removed dynamic class deserialization from the OCSP response validation cache to prevent arbitrary code execution via crafted cache files (SNOW-2439940). The `SNOWFLAKE_ENABLE_CUSTOM_REVOCATION_ERRORS` environment variable is now a no-op.
+  - Updated SPCS token injection to gate on `SNOWFLAKE_RUNNING_INSIDE_SPCS` environment variable, trim whitespace, and remove configurable token path.
+  - GCP WIF attestation now uses hostname `metadata.google.internal` instead of the IPv4 link-local address, so it works on IPv6-only GCP VMs.
+  - Fixed a bug where `write_pandas()` with `auto_create_table=False` and `overwrite=True` would execute `CREATE TABLE IF NOT EXISTS`, which required unnecessary `OWNERSHIP` privilege on the table. Now only `TRUNCATE TABLE` is executed in this case. Note: users who relied on the table being implicitly created despite `auto_create_table=False` should set `auto_create_table=True` instead.
+  - Added validation of the `account` connection parameter so malformed identifiers (for example path-like values or labels outside letters, digits, `_`, and `-`) are rejected with `ProgrammingError` before login (SNOW-1902886).
+  - Added support for Azure Workload Identity Federation impersonation, allowing a managed identity to authenticate as a service principal.
+
+- v4.4.0(March 25,2026)
   - Bump the lower boundary of cryptography to 46.0.5 due to CVE-2026-26007.
   - Added support for Python 3.14.
   - Removed pyOpenSSL upper bound dependency constraint to allow installation of pyOpenSSL 26.0.0+, which includes a fix for GHSA-vp96-hxj8-p424.
@@ -17,6 +39,8 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Renamed the environment variable for skipping config file permission warnings from `SF_SKIP_WARNING_FOR_READ_PERMISSIONS_ON_CONFIG_FILE` to `SF_SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION`. The old variable is still supported but emits a deprecation warning.
   - Fixed `unsafe_skip_file_permissions_check` flag not being respected when reading `connections.toml`.
   - Fixed JSONDecodeError in result_batch._load() when fetching large result sets
+  - Fixed validation ordering for `client_session_keep_alive_heartbeat_frequency`.
+
 
 - v4.3.0(February 12,2026)
   - Ensured proper list conversion - the converter runs to_snowflake on all list elements.
@@ -72,6 +96,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
 
 - v3.18.0(October 03,2025)
   - Added support for pandas conversion for Day-time and Year-Month Interval types
+* Fixed the return type of iterating over a cursor
 
 - v3.17.4(September 22,2025)
   - Added support for intermediate certificates as roots when they are stored in the trust store

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.4.0
+Version: 4.6.0
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -22,7 +22,6 @@ Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
@@ -35,7 +34,7 @@ Classifier: Topic :: Software Development
 Classifier: Topic :: Software Development :: Libraries
 Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: >=3.9
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE.txt
 License-File: NOTICE
@@ -48,7 +47,6 @@ Requires-Dist: requests<3.0.0,>=2.32.4
 Requires-Dist: packaging
 Requires-Dist: charset_normalizer<4,>=2
 Requires-Dist: idna<4,>=3.7
-Requires-Dist: urllib3<2.0.0,>=1.26.5; python_version < "3.10"
 Requires-Dist: certifi>=2024.7.4
 Requires-Dist: typing_extensions<5,>=4.3
 Requires-Dist: filelock<4,>=3.5
@@ -94,7 +92,29 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v4.4.0(March 24,2026)
+- v4.6.0(May 28,2026)
+  - Dropped support for Python 3.9. The minimum supported version is now Python 3.10.
+  - Fixed sdist to only install the minicore binary matching the current platform (SNOW-3526469). Previous 4.x releases copied every platform's minicore `.so`/`.dylib`/`.dll` into the install prefix, breaking downstream packagers (e.g. Homebrew) whose audits reject foreign-arch binaries.
+  - Added one in-band telemetry record per successful login describing which connection-identifier fields the user supplied (`account_provided`, `account_with_region`, `account_org_provided`, `region_provided`, `host_provided`). No hostname or account value is included. This is gated by the existing server-side `CLIENT_TELEMETRY_ENABLED` parameter and can additionally be disabled locally by setting `SF_TELEMETRY_DISABLE_CONNECTION_SHAPE=true`. The telemetry collection is time-boxed and will be removed in a future release.
+  - Bumped up vendored `urllib3` to `2.7.0`
+
+- v4.5.0(May 12,2026)
+  - Fixed `write_pandas` temp stage name collisions (SNOW-3481510). The old PRNG could produce identical name sequences in forked processes (e.g. Notebook kernels), causing `CREATE TEMPORARY STAGE` to fail with "Object already exists".
+  - Replaced third-party download URLs in CI scripts and Dockerfiles with Snowflake Artifactory to improve supply-chain security.
+  - Fixed a security bug in Okta SAML authentication where `_is_prefix_equal()` compared `url1`'s port against itself instead of `url2`'s port, allowing an attacker to redirect credentials to a different port on the same hostname. Also fixed the default port fallback to use `int` instead of `str` for correct comparison when one URL omits the port.
+  - Fixed `executemany` with `paramstyle="pyformat"` to correctly locate the VALUES clause using a balanced-parentheses parser instead of a greedy regex. This fixes incorrect behaviour with nested function calls such as SQLAlchemy `@compiles VARIANT` patterns (e.g. `PARSE_JSON(%(col)s)`) and subquery-form INSERTs (SNOW-298756).
+  - Added ECDSA key support (ES256, ES384, ES512) for key-pair authentication.
+  - Added HTTP 307/308 redirect status codes to the retryable set as defense-in-depth, with redirect-aware logging in both sync and async paths.
+  - Consolidated keyring token cache to use a single service name with hashed account keys, reducing macOS Keychain password prompts. Legacy entries are auto-migrated on first read.
+  - Added support for AWS outbound JWT token attestation for Workload Identity Federation (WIF). This can be enabled by setting the `SNOWFLAKE_ENABLE_AWS_WIF_OUTBOUND_TOKEN` environment variable to `true`. Note: This environment variable will be removed in a future release.
+  - Removed dynamic class deserialization from the OCSP response validation cache to prevent arbitrary code execution via crafted cache files (SNOW-2439940). The `SNOWFLAKE_ENABLE_CUSTOM_REVOCATION_ERRORS` environment variable is now a no-op.
+  - Updated SPCS token injection to gate on `SNOWFLAKE_RUNNING_INSIDE_SPCS` environment variable, trim whitespace, and remove configurable token path.
+  - GCP WIF attestation now uses hostname `metadata.google.internal` instead of the IPv4 link-local address, so it works on IPv6-only GCP VMs.
+  - Fixed a bug where `write_pandas()` with `auto_create_table=False` and `overwrite=True` would execute `CREATE TABLE IF NOT EXISTS`, which required unnecessary `OWNERSHIP` privilege on the table. Now only `TRUNCATE TABLE` is executed in this case. Note: users who relied on the table being implicitly created despite `auto_create_table=False` should set `auto_create_table=True` instead.
+  - Added validation of the `account` connection parameter so malformed identifiers (for example path-like values or labels outside letters, digits, `_`, and `-`) are rejected with `ProgrammingError` before login (SNOW-1902886).
+  - Added support for Azure Workload Identity Federation impersonation, allowing a managed identity to authenticate as a service principal.
+
+- v4.4.0(March 25,2026)
   - Bump the lower boundary of cryptography to 46.0.5 due to CVE-2026-26007.
   - Added support for Python 3.14.
   - Removed pyOpenSSL upper bound dependency constraint to allow installation of pyOpenSSL 26.0.0+, which includes a fix for GHSA-vp96-hxj8-p424.
@@ -104,6 +124,8 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Renamed the environment variable for skipping config file permission warnings from `SF_SKIP_WARNING_FOR_READ_PERMISSIONS_ON_CONFIG_FILE` to `SF_SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION`. The old variable is still supported but emits a deprecation warning.
   - Fixed `unsafe_skip_file_permissions_check` flag not being respected when reading `connections.toml`.
   - Fixed JSONDecodeError in result_batch._load() when fetching large result sets
+  - Fixed validation ordering for `client_session_keep_alive_heartbeat_frequency`.
+
 
 - v4.3.0(February 12,2026)
   - Ensured proper list conversion - the converter runs to_snowflake on all list elements.
@@ -159,6 +181,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
 
 - v3.18.0(October 03,2025)
   - Added support for pandas conversion for Day-time and Year-Month Interval types
+* Fixed the return type of iterating over a cursor
 
 - v3.17.4(September 22,2025)
   - Added support for intermediate certificates as roots when they are stored in the trust store

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.6.0}/README.md

@@ -15,7 +15,7 @@ using the Snowflake JDBC or ODBC drivers.
 
 The connector has **no** dependencies on JDBC or ODBC.
 It can be installed using ``pip`` on Linux, Mac OSX, and Windows platforms
-where Python 3.9.0 (or higher) is installed.
+where Python 3.10.0 (or higher) is installed.
 
 Snowflake Documentation is available at:
 https://docs.snowflake.com/
@@ -42,7 +42,7 @@ Find the `snowflake_connector_python*.whl` package in the `./dist` directory.
 ### In Docker
 Or use our Dockerized build script `ci/build_docker.sh` and find the built wheel files in `dist/repaired_wheels`.
 
-Note: `ci/build_docker.sh` can be used to compile only certain versions, like this: `ci/build_docker.sh "3.9 3.10"`
+Note: `ci/build_docker.sh` can be used to compile only certain versions, like this: `ci/build_docker.sh "3.10 3.11"`
 
 ## Code hygiene and other utilities
 These tools are integrated into `tox` to allow us to easily set them up universally on any computer.

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.6.0}/setup.cfg

@@ -20,7 +20,6 @@ classifiers =
 	Operating System :: OS Independent
 	Programming Language :: Python :: 3
 	Programming Language :: Python :: 3 :: Only
-	Programming Language :: Python :: 3.9
 	Programming Language :: Python :: 3.10
 	Programming Language :: Python :: 3.11
 	Programming Language :: Python :: 3.12
@@ -41,7 +40,7 @@ project_urls =
 	Changelog=https://github.com/snowflakedb/snowflake-connector-python/blob/main/DESCRIPTION.md
 
 [options]
-python_requires = >=3.9
+python_requires = >=3.10
 packages = find_namespace:
 install_requires = 
 	asn1crypto>0.24.0,<2.0.0
@@ -53,7 +52,6 @@ install_requires =
 	packaging
 	charset_normalizer>=2,<4
 	idna>=3.7,<4
-	urllib3>=1.26.5,<2.0.0; python_version < '3.10'
 	certifi>=2024.7.4
 	typing_extensions>=4.3,<5
 	filelock>=3.5,<4

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.6.0}/setup.py

@@ -1,10 +1,13 @@
 #!/usr/bin/env python
 
 import os
+import platform
+import shutil
 import sys
 import warnings
 
 from setuptools import Extension, setup
+from setuptools.command.build_py import build_py
 from setuptools.command.egg_info import egg_info
 
 CONNECTOR_SRC_DIR = os.path.join("src", "snowflake", "connector")
@@ -192,8 +195,71 @@ class SetDefaultInstallationExtras(egg_info):
             self.distribution.install_requires += boto_extras
 
 
+def _minicore_native_subdir():
+    """Return the minicore/<platform> subdir matching the current interpreter.
+
+    Mirrors snowflake.connector._utils._CoreLoader._get_platform_subdir so the
+    build-time pruner and the runtime loader always agree on the layout.
+    Returns None when the platform is not recognised (leave tree untouched).
+    """
+    system = platform.system().lower()
+    machine = platform.machine().lower()
+    if machine in ("x86_64", "amd64"):
+        arch = "x86_64"
+    elif machine in ("aarch64", "arm64"):
+        arch = "aarch64"
+    elif machine == "ppc64":
+        arch = "ppc64"
+    else:
+        return None
+
+    if system == "linux":
+        libc, _ = platform.libc_ver()
+        libc_family = "glibc" if libc == "glibc" else "musl"
+        return f"linux_{arch}_{libc_family}"
+    if system == "darwin":
+        return f"macos_{arch}"
+    if system == "windows":
+        return f"windows_{arch}"
+    if system == "aix":
+        return f"aix_{arch}"
+    return None
+
+
+class PlatformBuildPy(build_py):
+    """Strip non-native minicore/<platform>/ dirs from the built distribution.
+
+    The sdist ships minicore binaries for every supported platform. At
+    build-time we keep only the one matching the current interpreter so wheels
+    and downstream sdist consumers (pip install, Homebrew, conda-forge,
+    nixpkgs) end up with a clean single-platform layout.
+    """
+
+    def run(self):
+        super().run()
+        self._prune_minicore()
+
+    def _prune_minicore(self):
+        minicore_build_dir = os.path.join(
+            self.build_lib, "snowflake", "connector", "minicore"
+        )
+        if not os.path.isdir(minicore_build_dir):
+            return
+        keep = _minicore_native_subdir()
+        if keep is None:
+            return
+        for entry in os.listdir(minicore_build_dir):
+            full = os.path.join(minicore_build_dir, entry)
+            if not os.path.isdir(full) or entry.startswith("__"):
+                continue
+            if entry == keep:
+                continue
+            shutil.rmtree(full)
+
+
 # Update command classes
 cmd_class["egg_info"] = SetDefaultInstallationExtras
+cmd_class["build_py"] = PlatformBuildPy
 
 setup(
     version=version,

snowflake_connector_python-4.6.0/src/snowflake/connector/_connection_identifier_shape.py

@@ -0,0 +1,136 @@
+#!/usr/bin/env python
+"""Capture user-supplied connection-identifier provenance for in-band telemetry.
+
+The shape captured here is consumed by ``SnowflakeConnection._log_connection_identifier_shape``
+and emitted as a single ``client_connection_identifier_shape`` telemetry event
+per successful login. The capture function inspects the raw kwargs passed to
+``SnowflakeConnection.__config`` before any normalization (host inference,
+account stripping of ``.global``, region extraction from dotted account) runs,
+so the shape reflects user intent rather than the final post-normalization
+state of the connection.
+
+Removal of this module and the emission it backs is tracked in SNOW-3548350
+(target: 2026-11-30).
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any, Mapping
+
+from .telemetry import TelemetryField
+
+
+@dataclass(frozen=True)
+class ConnectionIdentifierShape:
+    """Provenance of connection-identifier fields the user supplied.
+
+    All fields describe what the user supplied at the moment of input — they
+    reflect intent, not the final post-normalization state of the connection.
+
+    - ``account_provided``: the user explicitly set the ``account`` parameter
+      (via ``connect(account=...)``, kwargs, or ``connections.toml`` merged
+      into kwargs before ``__config`` runs).
+    - ``account_with_region``: the raw account string the user typed contained
+      a dot (e.g. ``"myacct.us-east-1"``), signaling the deprecated
+      ``account.region`` embedded form. Set only on the raw input.
+    - ``account_org_provided``: the raw account string carried a dash in its
+      account portion (e.g. ``"myorg-myacct"``), signaling the org-prefixed
+      form. Region-portion dashes (e.g. the ``-east-`` in
+      ``"myacct.us-east-1"``) are intentionally not counted; only the portion
+      before the first ``.`` is examined.
+    - ``region_provided``: the user explicitly set the ``region`` parameter as
+      a distinct kwarg. A region embedded inside a dotted account string is
+      NOT ``region_provided``; that's ``account_with_region``.
+    - ``host_provided``: the user explicitly set the ``host`` parameter.
+    """
+
+    account_provided: bool = False
+    account_with_region: bool = False
+    account_org_provided: bool = False
+    region_provided: bool = False
+    host_provided: bool = False
+
+
+def _is_user_supplied_string(value: Any) -> bool:
+    """A kwarg counts as user-supplied iff it's a non-empty string. Non-string
+    truthy values (e.g. an accidentally-passed ``True`` / ``int``) are not
+    treated as provided here — the regular ``__config`` validation will warn
+    or error on them later, and shape capture is best kept conservative."""
+    return isinstance(value, str) and value != ""
+
+
+def record_input_shape(kwargs: Mapping[str, Any]) -> ConnectionIdentifierShape:
+    """Capture the connection-identifier shape from the raw kwargs that
+    ``SnowflakeConnection.__config`` receives.
+
+    Must be invoked before any normalization (the ``setattr`` loop in
+    ``__config``, the ``construct_hostname`` call for host inference, or any
+    ``parse_account`` stripping) — otherwise inferred values are
+    indistinguishable from user-supplied ones and ``host_provided`` /
+    ``account_provided`` are no longer trustworthy.
+    """
+    account = kwargs.get("account")
+    region = kwargs.get("region")
+    host = kwargs.get("host")
+
+    account_provided = _is_user_supplied_string(account)
+    account_with_region = False
+    account_org_provided = False
+    if account_provided:
+        # Only a dot at position > 0 splits the string into account / region;
+        # a leading dot (pathological input like ``.us-east-1``) leaves the
+        # whole string as the account portion. Mirrors gosnowflake's
+        # ``recordAccountShape`` (internal/config/dsn.go), which gates on
+        # ``i > 0`` so the dash search runs against the full raw value when
+        # there is no real account/region split.
+        dot_index = account.find(".")
+        if dot_index > 0:
+            account_with_region = True
+            account_portion = account[:dot_index]
+        else:
+            account_portion = account
+        # ``Contains(accountPortion, "-")`` in Go — any dash anywhere in the
+        # account portion (including position 0) flips the flag. The
+        # region-tail dashes are excluded by virtue of being outside
+        # ``account_portion``, not by a position check.
+        account_org_provided = "-" in account_portion
+
+    return ConnectionIdentifierShape(
+        account_provided=account_provided,
+        account_with_region=account_with_region,
+        account_org_provided=account_org_provided,
+        region_provided=_is_user_supplied_string(region),
+        host_provided=_is_user_supplied_string(host),
+    )
+
+
+def build_shape_telemetry_message(shape: ConnectionIdentifierShape) -> dict[str, str]:
+    """Build the wire-format payload for the ``client_connection_identifier_shape``
+    in-band telemetry event from a captured ``ConnectionIdentifierShape``.
+
+    Hoisted out of the sync / async ``_log_connection_identifier_shape``
+    emitters so both branches stay in lockstep — the five payload keys
+    (``account_provided``, ``account_with_region``, ``account_org_provided``,
+    ``region_provided``, ``host_provided``) and their stringified-lowercase
+    boolean values are byte-identical across sibling drivers and must remain
+    so. Changing this builder is the only place that affects the wire format.
+
+    Booleans are stringified as lowercase ``"true"`` / ``"false"`` (matching
+    JSON-style boolean text) for cross-driver parity with gosnowflake's
+    ``strconv.FormatBool`` and the JDBC / Node.js siblings.
+
+    TODO(SNOW-3548350): remove with the telemetry emission
+    (target: 2026-11-30).
+    """
+    return {
+        TelemetryField.KEY_TYPE.value: TelemetryField.CONNECTION_IDENTIFIER_SHAPE.value,
+        TelemetryField.KEY_ACCOUNT_PROVIDED.value: str(shape.account_provided).lower(),
+        TelemetryField.KEY_ACCOUNT_WITH_REGION.value: str(
+            shape.account_with_region
+        ).lower(),
+        TelemetryField.KEY_ACCOUNT_ORG_PROVIDED.value: str(
+            shape.account_org_provided
+        ).lower(),
+        TelemetryField.KEY_REGION_PROVIDED.value: str(shape.region_provided).lower(),
+        TelemetryField.KEY_HOST_PROVIDED.value: str(shape.host_provided).lower(),
+    }

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.6.0}/src/snowflake/connector/_utils.py

@@ -10,7 +10,7 @@ import threading
 import time
 from enum import Enum
 from inspect import stack
-from random import choice
+from secrets import choice
 from threading import Timer
 from uuid import UUID
 
@@ -109,30 +109,29 @@ def get_application_path() -> str:
         return "unknown"
 
 
-_SPCS_TOKEN_ENV_VAR_NAME = "SF_SPCS_TOKEN_PATH"
-_SPCS_TOKEN_DEFAULT_PATH = "/snowflake/session/spcs_token"
+_SPCS_ENV_VAR = "SNOWFLAKE_RUNNING_INSIDE_SPCS"
+_SPCS_TOKEN_PATH = "/snowflake/session/spcs_token"
 
 
 def get_spcs_token() -> str | None:
-    """Return the SPCS token read from the configured path, or None.
+    """Return the SPCS token if running inside an SPCS container, or None.
 
-    The path is determined by the SF_SPCS_TOKEN_PATH environment variable,
-    falling back to ``/snowflake/session/spcs_token`` when unset.
+    The token is only read when the SNOWFLAKE_RUNNING_INSIDE_SPCS environment
+    variable is set.  The file at /snowflake/session/spcs_token is read as
+    UTF-8 text and leading/trailing whitespace is stripped.
 
-    Any I/O errors or missing/empty files are treated as \"no token\" and
-    will not cause authentication to fail.
+    Any read failure is logged as a warning and None is returned.
     """
-    path = os.getenv(_SPCS_TOKEN_ENV_VAR_NAME) or _SPCS_TOKEN_DEFAULT_PATH
+    if not os.environ.get(_SPCS_ENV_VAR):
+        return None
     try:
-        if not os.path.isfile(path):
-            return None
-        with open(path, encoding="utf-8") as f:
+        with open(_SPCS_TOKEN_PATH, encoding="utf-8") as f:
             token = f.read().strip()
         if not token:
             return None
         return token
-    except Exception as exc:  # pragma: no cover - best-effort logging only
-        logger.debug("Failed to read SPCS token from %s: %s", path, exc)
+    except Exception as exc:
+        logger.warning("Failed to read SPCS token from %s: %s", _SPCS_TOKEN_PATH, exc)
         return None
 
 
@@ -184,14 +183,35 @@ class _CoreLoader:
         else:
             return "unknown"
 
+    @staticmethod
+    def _libc_ver() -> tuple[str, str]:
+        """Return (libc_name, libc_version) from the platform."""
+        return platform.libc_ver()
+
     @staticmethod
     def _detect_libc() -> str:
         """Detect libc type on Linux (glibc vs musl)."""
-        lib, _ = platform.libc_ver()
+        lib, _ = _CoreLoader._libc_ver()
         if lib == "glibc":
             return "glibc"
         return "musl"
 
+    @staticmethod
+    def get_libc_version() -> str | None:
+        """Return libc version from :func:`platform.libc_ver`, or None if unknown."""
+        _, version = _CoreLoader._libc_ver()
+        if not version:
+            return None
+        stripped = version.strip()
+        return stripped or None
+
+    @staticmethod
+    def get_libc_family() -> str | None:
+        """Return libc family for Linux (glibc or musl), otherwise None."""
+        if _CoreLoader._detect_os() != "linux":
+            return None
+        return _CoreLoader._detect_libc()
+
     @staticmethod
     def _get_platform_subdir() -> str:
         """Get the platform-specific subdirectory name."""
@@ -330,6 +350,8 @@ def build_minicore_usage_for_session() -> dict[str, str | None]:
         "ISA": ISA,
         "CORE_VERSION": _core_loader.get_core_version(),
         "CORE_FILE_NAME": _core_loader.get_file_name(),
+        "LIBC_FAMILY": _CoreLoader.get_libc_family(),
+        "LIBC_VERSION": _CoreLoader.get_libc_version(),
     }
 
 

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.6.0}/src/snowflake/connector/aio/_connection.py

@@ -24,9 +24,14 @@ from snowflake.connector import (
     ProgrammingError,
 )
 
+from .._connection_identifier_shape import (
+    ConnectionIdentifierShape,
+    build_shape_telemetry_message,
+)
 from .._query_context_cache import QueryContextCache
 from ..compat import IS_LINUX, quote, urlencode
 from ..config_manager import CONFIG_MANAGER, _get_default_connection_params
+from ..connection import _DISABLE_CONNECTION_SHAPE_ENV
 from ..connection import DEFAULT_CONFIGURATION as DEFAULT_CONFIGURATION_SYNC
 from ..connection import SnowflakeConnection as SnowflakeConnectionSync
 from ..connection import _get_private_bytes_from_file
@@ -451,6 +456,7 @@ class SnowflakeConnection(SnowflakeConnectionSync):
                     not in (
                         AttestationProvider.GCP,
                         AttestationProvider.AWS,
+                        AttestationProvider.AZURE,
                     )
                 ):
                     Error.errorhandler_wrapper(
@@ -458,7 +464,7 @@ class SnowflakeConnection(SnowflakeConnectionSync):
                         None,
                         ProgrammingError,
                         {
-                            "msg": "workload_identity_impersonation_path is currently only supported for GCP and AWS.",
+                            "msg": "workload_identity_impersonation_path is currently only supported for GCP, AWS, and AZURE.",
                             "errno": ER_INVALID_WIF_SETTINGS,
                         },
                     )
@@ -782,6 +788,42 @@ class SnowflakeConnection(SnowflakeConnectionSync):
                 )
             )
 
+    async def _log_connection_identifier_shape(self) -> None:
+        """Async counterpart to ``SnowflakeConnectionSync._log_connection_identifier_shape``.
+
+        The sync implementation reaches for ``self._log_telemetry`` directly,
+        which is overridden as an awaitable on the async class — so the sync
+        method's call to ``self._log_telemetry(...)`` would return an
+        unawaited coroutine here. This override mirrors the sync logic and
+        awaits the emission instead.
+
+        TODO(SNOW-3548350): remove with the telemetry emission
+        (target: 2026-11-30).
+        """
+        # See sync sibling for the strict (no ``strip``) semantics.
+        if os.environ.get(_DISABLE_CONNECTION_SHAPE_ENV, "").lower() == "true":
+            logger.debug(
+                "connection-identifier-shape telemetry disabled via %s",
+                _DISABLE_CONNECTION_SHAPE_ENV,
+            )
+            return
+        shape: ConnectionIdentifierShape | None = getattr(
+            self, "_connection_identifier_shape", None
+        )
+        if shape is None:
+            logger.debug(
+                "connection-identifier-shape telemetry skipped: shape not captured"
+            )
+            return
+        ts = get_time_millis()
+        await self._log_telemetry(
+            TelemetryData.from_telemetry_data_dict(
+                from_dict=build_shape_telemetry_message(shape),
+                timestamp=ts,
+                connection=self,
+            )
+        )
+
     async def _next_sequence_counter(self) -> int:
         """Gets next sequence counter. Used internally."""
         async with self._lock_sequence_counter:
@@ -1098,6 +1140,7 @@ class SnowflakeConnection(SnowflakeConnectionSync):
             await self.__open_connection()
         self._telemetry = TelemetryClient(self._rest)
         await self._log_telemetry_imported_packages()
+        await self._log_connection_identifier_shape()
 
     def cursor(self, cursor_class: type[CursorCls] = SnowflakeCursor) -> CursorCls:
         logger.debug("cursor")

{snowflake_connector_python-4.4.0 → snowflake_connector_python-4.6.0}/src/snowflake/connector/aio/_cursor.py

@@ -57,6 +57,7 @@ from snowflake.connector.errors import BindUploadError, DatabaseError
 from snowflake.connector.file_transfer_agent import SnowflakeProgressPercentage
 from snowflake.connector.telemetry import TelemetryData, TelemetryField
 from snowflake.connector.time_util import get_time_millis
+from snowflake.connector.util_text import extract_values_clause
 
 from .._utils import REQUEST_ID_STATEMENT_PARAM_NAME, is_uuid4
 
@@ -765,8 +766,8 @@ class SnowflakeCursorBase(SnowflakeCursorBaseSync, abc.ABC, typing.Generic[Fetch
                 #  accumulate results to mock the result from a single insert statement as formatted below
                 logger.debug("rewriting INSERT query")
                 command_wo_comments = re.sub(self.COMMENT_SQL_RE, "", command)
-                m = self.INSERT_SQL_VALUES_RE.match(command_wo_comments)
-                if not m:
+                fmt = extract_values_clause(command_wo_comments)
+                if fmt is None:
                     Error.errorhandler_wrapper(
                         self.connection,
                         self,
@@ -776,8 +777,6 @@ class SnowflakeCursorBase(SnowflakeCursorBaseSync, abc.ABC, typing.Generic[Fetch
                             "errno": ER_FAILED_TO_REWRITE_MULTI_ROW_INSERT,
                         },
                     )
-
-                fmt = m.group(1)
                 values = []
                 for param in seqparams:
                     logger.debug(f"parameter: {param}")