snowflake-connector-python 4.5.0__tar.gz → 4.6.0__tar.gz

{snowflake_connector_python-4.5.0 → snowflake_connector_python-4.6.0}/CONTRIBUTING.md

@@ -30,8 +30,8 @@ dependencies installed with `snowflake-connector-python` installed as an editabl
 Setting up a development environment is super easy with this [one simple tox command](https://tox.wiki/en/legacy/example/devenv.html).
 
 ```shell
-tox --devenv venv39 -e py39
-. venv39/bin/activate
+tox --devenv venv310 -e py310
+. venv310/bin/activate
 ```
 
 Note: we suggest using the lowest supported Python version for development.

{snowflake_connector_python-4.5.0 → snowflake_connector_python-4.6.0}/DESCRIPTION.md

@@ -7,8 +7,15 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.6.0(May 28,2026)
+  - Dropped support for Python 3.9. The minimum supported version is now Python 3.10.
+  - Fixed sdist to only install the minicore binary matching the current platform (SNOW-3526469). Previous 4.x releases copied every platform's minicore `.so`/`.dylib`/`.dll` into the install prefix, breaking downstream packagers (e.g. Homebrew) whose audits reject foreign-arch binaries.
+  - Added one in-band telemetry record per successful login describing which connection-identifier fields the user supplied (`account_provided`, `account_with_region`, `account_org_provided`, `region_provided`, `host_provided`). No hostname or account value is included. This is gated by the existing server-side `CLIENT_TELEMETRY_ENABLED` parameter and can additionally be disabled locally by setting `SF_TELEMETRY_DISABLE_CONNECTION_SHAPE=true`. The telemetry collection is time-boxed and will be removed in a future release.
+  - Bumped up vendored `urllib3` to `2.7.0`
+
 - v4.5.0(May 12,2026)
   - Fixed `write_pandas` temp stage name collisions (SNOW-3481510). The old PRNG could produce identical name sequences in forked processes (e.g. Notebook kernels), causing `CREATE TEMPORARY STAGE` to fail with "Object already exists".
+  - Replaced third-party download URLs in CI scripts and Dockerfiles with Snowflake Artifactory to improve supply-chain security.
   - Fixed a security bug in Okta SAML authentication where `_is_prefix_equal()` compared `url1`'s port against itself instead of `url2`'s port, allowing an attacker to redirect credentials to a different port on the same hostname. Also fixed the default port fallback to use `int` instead of `str` for correct comparison when one URL omits the port.
   - Fixed `executemany` with `paramstyle="pyformat"` to correctly locate the VALUES clause using a balanced-parentheses parser instead of a greedy regex. This fixes incorrect behaviour with nested function calls such as SQLAlchemy `@compiles VARIANT` patterns (e.g. `PARSE_JSON(%(col)s)`) and subquery-form INSERTs (SNOW-298756).
   - Added ECDSA key support (ES256, ES384, ES512) for key-pair authentication.

{snowflake_connector_python-4.5.0 → snowflake_connector_python-4.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.5.0
+Version: 4.6.0
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -22,7 +22,6 @@ Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
@@ -35,7 +34,7 @@ Classifier: Topic :: Software Development
 Classifier: Topic :: Software Development :: Libraries
 Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: >=3.9
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE.txt
 License-File: NOTICE
@@ -48,7 +47,6 @@ Requires-Dist: requests<3.0.0,>=2.32.4
 Requires-Dist: packaging
 Requires-Dist: charset_normalizer<4,>=2
 Requires-Dist: idna<4,>=3.7
-Requires-Dist: urllib3<2.0.0,>=1.26.5; python_version < "3.10"
 Requires-Dist: certifi>=2024.7.4
 Requires-Dist: typing_extensions<5,>=4.3
 Requires-Dist: filelock<4,>=3.5
@@ -94,8 +92,15 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.6.0(May 28,2026)
+  - Dropped support for Python 3.9. The minimum supported version is now Python 3.10.
+  - Fixed sdist to only install the minicore binary matching the current platform (SNOW-3526469). Previous 4.x releases copied every platform's minicore `.so`/`.dylib`/`.dll` into the install prefix, breaking downstream packagers (e.g. Homebrew) whose audits reject foreign-arch binaries.
+  - Added one in-band telemetry record per successful login describing which connection-identifier fields the user supplied (`account_provided`, `account_with_region`, `account_org_provided`, `region_provided`, `host_provided`). No hostname or account value is included. This is gated by the existing server-side `CLIENT_TELEMETRY_ENABLED` parameter and can additionally be disabled locally by setting `SF_TELEMETRY_DISABLE_CONNECTION_SHAPE=true`. The telemetry collection is time-boxed and will be removed in a future release.
+  - Bumped up vendored `urllib3` to `2.7.0`
+
 - v4.5.0(May 12,2026)
   - Fixed `write_pandas` temp stage name collisions (SNOW-3481510). The old PRNG could produce identical name sequences in forked processes (e.g. Notebook kernels), causing `CREATE TEMPORARY STAGE` to fail with "Object already exists".
+  - Replaced third-party download URLs in CI scripts and Dockerfiles with Snowflake Artifactory to improve supply-chain security.
   - Fixed a security bug in Okta SAML authentication where `_is_prefix_equal()` compared `url1`'s port against itself instead of `url2`'s port, allowing an attacker to redirect credentials to a different port on the same hostname. Also fixed the default port fallback to use `int` instead of `str` for correct comparison when one URL omits the port.
   - Fixed `executemany` with `paramstyle="pyformat"` to correctly locate the VALUES clause using a balanced-parentheses parser instead of a greedy regex. This fixes incorrect behaviour with nested function calls such as SQLAlchemy `@compiles VARIANT` patterns (e.g. `PARSE_JSON(%(col)s)`) and subquery-form INSERTs (SNOW-298756).
   - Added ECDSA key support (ES256, ES384, ES512) for key-pair authentication.

{snowflake_connector_python-4.5.0 → snowflake_connector_python-4.6.0}/README.md

@@ -15,7 +15,7 @@ using the Snowflake JDBC or ODBC drivers.
 
 The connector has **no** dependencies on JDBC or ODBC.
 It can be installed using ``pip`` on Linux, Mac OSX, and Windows platforms
-where Python 3.9.0 (or higher) is installed.
+where Python 3.10.0 (or higher) is installed.
 
 Snowflake Documentation is available at:
 https://docs.snowflake.com/
@@ -42,7 +42,7 @@ Find the `snowflake_connector_python*.whl` package in the `./dist` directory.
 ### In Docker
 Or use our Dockerized build script `ci/build_docker.sh` and find the built wheel files in `dist/repaired_wheels`.
 
-Note: `ci/build_docker.sh` can be used to compile only certain versions, like this: `ci/build_docker.sh "3.9 3.10"`
+Note: `ci/build_docker.sh` can be used to compile only certain versions, like this: `ci/build_docker.sh "3.10 3.11"`
 
 ## Code hygiene and other utilities
 These tools are integrated into `tox` to allow us to easily set them up universally on any computer.

{snowflake_connector_python-4.5.0 → snowflake_connector_python-4.6.0}/setup.cfg

@@ -20,7 +20,6 @@ classifiers =
 	Operating System :: OS Independent
 	Programming Language :: Python :: 3
 	Programming Language :: Python :: 3 :: Only
-	Programming Language :: Python :: 3.9
 	Programming Language :: Python :: 3.10
 	Programming Language :: Python :: 3.11
 	Programming Language :: Python :: 3.12
@@ -41,7 +40,7 @@ project_urls =
 	Changelog=https://github.com/snowflakedb/snowflake-connector-python/blob/main/DESCRIPTION.md
 
 [options]
-python_requires = >=3.9
+python_requires = >=3.10
 packages = find_namespace:
 install_requires = 
 	asn1crypto>0.24.0,<2.0.0
@@ -53,7 +52,6 @@ install_requires =
 	packaging
 	charset_normalizer>=2,<4
 	idna>=3.7,<4
-	urllib3>=1.26.5,<2.0.0; python_version < '3.10'
 	certifi>=2024.7.4
 	typing_extensions>=4.3,<5
 	filelock>=3.5,<4

{snowflake_connector_python-4.5.0 → snowflake_connector_python-4.6.0}/setup.py

@@ -1,10 +1,13 @@
 #!/usr/bin/env python
 
 import os
+import platform
+import shutil
 import sys
 import warnings
 
 from setuptools import Extension, setup
+from setuptools.command.build_py import build_py
 from setuptools.command.egg_info import egg_info
 
 CONNECTOR_SRC_DIR = os.path.join("src", "snowflake", "connector")
@@ -192,8 +195,71 @@ class SetDefaultInstallationExtras(egg_info):
             self.distribution.install_requires += boto_extras
 
 
+def _minicore_native_subdir():
+    """Return the minicore/<platform> subdir matching the current interpreter.
+
+    Mirrors snowflake.connector._utils._CoreLoader._get_platform_subdir so the
+    build-time pruner and the runtime loader always agree on the layout.
+    Returns None when the platform is not recognised (leave tree untouched).
+    """
+    system = platform.system().lower()
+    machine = platform.machine().lower()
+    if machine in ("x86_64", "amd64"):
+        arch = "x86_64"
+    elif machine in ("aarch64", "arm64"):
+        arch = "aarch64"
+    elif machine == "ppc64":
+        arch = "ppc64"
+    else:
+        return None
+
+    if system == "linux":
+        libc, _ = platform.libc_ver()
+        libc_family = "glibc" if libc == "glibc" else "musl"
+        return f"linux_{arch}_{libc_family}"
+    if system == "darwin":
+        return f"macos_{arch}"
+    if system == "windows":
+        return f"windows_{arch}"
+    if system == "aix":
+        return f"aix_{arch}"
+    return None
+
+
+class PlatformBuildPy(build_py):
+    """Strip non-native minicore/<platform>/ dirs from the built distribution.
+
+    The sdist ships minicore binaries for every supported platform. At
+    build-time we keep only the one matching the current interpreter so wheels
+    and downstream sdist consumers (pip install, Homebrew, conda-forge,
+    nixpkgs) end up with a clean single-platform layout.
+    """
+
+    def run(self):
+        super().run()
+        self._prune_minicore()
+
+    def _prune_minicore(self):
+        minicore_build_dir = os.path.join(
+            self.build_lib, "snowflake", "connector", "minicore"
+        )
+        if not os.path.isdir(minicore_build_dir):
+            return
+        keep = _minicore_native_subdir()
+        if keep is None:
+            return
+        for entry in os.listdir(minicore_build_dir):
+            full = os.path.join(minicore_build_dir, entry)
+            if not os.path.isdir(full) or entry.startswith("__"):
+                continue
+            if entry == keep:
+                continue
+            shutil.rmtree(full)
+
+
 # Update command classes
 cmd_class["egg_info"] = SetDefaultInstallationExtras
+cmd_class["build_py"] = PlatformBuildPy
 
 setup(
     version=version,

snowflake_connector_python-4.6.0/src/snowflake/connector/_connection_identifier_shape.py

@@ -0,0 +1,136 @@
+#!/usr/bin/env python
+"""Capture user-supplied connection-identifier provenance for in-band telemetry.
+
+The shape captured here is consumed by ``SnowflakeConnection._log_connection_identifier_shape``
+and emitted as a single ``client_connection_identifier_shape`` telemetry event
+per successful login. The capture function inspects the raw kwargs passed to
+``SnowflakeConnection.__config`` before any normalization (host inference,
+account stripping of ``.global``, region extraction from dotted account) runs,
+so the shape reflects user intent rather than the final post-normalization
+state of the connection.
+
+Removal of this module and the emission it backs is tracked in SNOW-3548350
+(target: 2026-11-30).
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any, Mapping
+
+from .telemetry import TelemetryField
+
+
+@dataclass(frozen=True)
+class ConnectionIdentifierShape:
+    """Provenance of connection-identifier fields the user supplied.
+
+    All fields describe what the user supplied at the moment of input — they
+    reflect intent, not the final post-normalization state of the connection.
+
+    - ``account_provided``: the user explicitly set the ``account`` parameter
+      (via ``connect(account=...)``, kwargs, or ``connections.toml`` merged
+      into kwargs before ``__config`` runs).
+    - ``account_with_region``: the raw account string the user typed contained
+      a dot (e.g. ``"myacct.us-east-1"``), signaling the deprecated
+      ``account.region`` embedded form. Set only on the raw input.
+    - ``account_org_provided``: the raw account string carried a dash in its
+      account portion (e.g. ``"myorg-myacct"``), signaling the org-prefixed
+      form. Region-portion dashes (e.g. the ``-east-`` in
+      ``"myacct.us-east-1"``) are intentionally not counted; only the portion
+      before the first ``.`` is examined.
+    - ``region_provided``: the user explicitly set the ``region`` parameter as
+      a distinct kwarg. A region embedded inside a dotted account string is
+      NOT ``region_provided``; that's ``account_with_region``.
+    - ``host_provided``: the user explicitly set the ``host`` parameter.
+    """
+
+    account_provided: bool = False
+    account_with_region: bool = False
+    account_org_provided: bool = False
+    region_provided: bool = False
+    host_provided: bool = False
+
+
+def _is_user_supplied_string(value: Any) -> bool:
+    """A kwarg counts as user-supplied iff it's a non-empty string. Non-string
+    truthy values (e.g. an accidentally-passed ``True`` / ``int``) are not
+    treated as provided here — the regular ``__config`` validation will warn
+    or error on them later, and shape capture is best kept conservative."""
+    return isinstance(value, str) and value != ""
+
+
+def record_input_shape(kwargs: Mapping[str, Any]) -> ConnectionIdentifierShape:
+    """Capture the connection-identifier shape from the raw kwargs that
+    ``SnowflakeConnection.__config`` receives.
+
+    Must be invoked before any normalization (the ``setattr`` loop in
+    ``__config``, the ``construct_hostname`` call for host inference, or any
+    ``parse_account`` stripping) — otherwise inferred values are
+    indistinguishable from user-supplied ones and ``host_provided`` /
+    ``account_provided`` are no longer trustworthy.
+    """
+    account = kwargs.get("account")
+    region = kwargs.get("region")
+    host = kwargs.get("host")
+
+    account_provided = _is_user_supplied_string(account)
+    account_with_region = False
+    account_org_provided = False
+    if account_provided:
+        # Only a dot at position > 0 splits the string into account / region;
+        # a leading dot (pathological input like ``.us-east-1``) leaves the
+        # whole string as the account portion. Mirrors gosnowflake's
+        # ``recordAccountShape`` (internal/config/dsn.go), which gates on
+        # ``i > 0`` so the dash search runs against the full raw value when
+        # there is no real account/region split.
+        dot_index = account.find(".")
+        if dot_index > 0:
+            account_with_region = True
+            account_portion = account[:dot_index]
+        else:
+            account_portion = account
+        # ``Contains(accountPortion, "-")`` in Go — any dash anywhere in the
+        # account portion (including position 0) flips the flag. The
+        # region-tail dashes are excluded by virtue of being outside
+        # ``account_portion``, not by a position check.
+        account_org_provided = "-" in account_portion
+
+    return ConnectionIdentifierShape(
+        account_provided=account_provided,
+        account_with_region=account_with_region,
+        account_org_provided=account_org_provided,
+        region_provided=_is_user_supplied_string(region),
+        host_provided=_is_user_supplied_string(host),
+    )
+
+
+def build_shape_telemetry_message(shape: ConnectionIdentifierShape) -> dict[str, str]:
+    """Build the wire-format payload for the ``client_connection_identifier_shape``
+    in-band telemetry event from a captured ``ConnectionIdentifierShape``.
+
+    Hoisted out of the sync / async ``_log_connection_identifier_shape``
+    emitters so both branches stay in lockstep — the five payload keys
+    (``account_provided``, ``account_with_region``, ``account_org_provided``,
+    ``region_provided``, ``host_provided``) and their stringified-lowercase
+    boolean values are byte-identical across sibling drivers and must remain
+    so. Changing this builder is the only place that affects the wire format.
+
+    Booleans are stringified as lowercase ``"true"`` / ``"false"`` (matching
+    JSON-style boolean text) for cross-driver parity with gosnowflake's
+    ``strconv.FormatBool`` and the JDBC / Node.js siblings.
+
+    TODO(SNOW-3548350): remove with the telemetry emission
+    (target: 2026-11-30).
+    """
+    return {
+        TelemetryField.KEY_TYPE.value: TelemetryField.CONNECTION_IDENTIFIER_SHAPE.value,
+        TelemetryField.KEY_ACCOUNT_PROVIDED.value: str(shape.account_provided).lower(),
+        TelemetryField.KEY_ACCOUNT_WITH_REGION.value: str(
+            shape.account_with_region
+        ).lower(),
+        TelemetryField.KEY_ACCOUNT_ORG_PROVIDED.value: str(
+            shape.account_org_provided
+        ).lower(),
+        TelemetryField.KEY_REGION_PROVIDED.value: str(shape.region_provided).lower(),
+        TelemetryField.KEY_HOST_PROVIDED.value: str(shape.host_provided).lower(),
+    }

{snowflake_connector_python-4.5.0 → snowflake_connector_python-4.6.0}/src/snowflake/connector/aio/_connection.py

@@ -24,9 +24,14 @@ from snowflake.connector import (
     ProgrammingError,
 )
 
+from .._connection_identifier_shape import (
+    ConnectionIdentifierShape,
+    build_shape_telemetry_message,
+)
 from .._query_context_cache import QueryContextCache
 from ..compat import IS_LINUX, quote, urlencode
 from ..config_manager import CONFIG_MANAGER, _get_default_connection_params
+from ..connection import _DISABLE_CONNECTION_SHAPE_ENV
 from ..connection import DEFAULT_CONFIGURATION as DEFAULT_CONFIGURATION_SYNC
 from ..connection import SnowflakeConnection as SnowflakeConnectionSync
 from ..connection import _get_private_bytes_from_file
@@ -783,6 +788,42 @@ class SnowflakeConnection(SnowflakeConnectionSync):
                 )
             )
 
+    async def _log_connection_identifier_shape(self) -> None:
+        """Async counterpart to ``SnowflakeConnectionSync._log_connection_identifier_shape``.
+
+        The sync implementation reaches for ``self._log_telemetry`` directly,
+        which is overridden as an awaitable on the async class — so the sync
+        method's call to ``self._log_telemetry(...)`` would return an
+        unawaited coroutine here. This override mirrors the sync logic and
+        awaits the emission instead.
+
+        TODO(SNOW-3548350): remove with the telemetry emission
+        (target: 2026-11-30).
+        """
+        # See sync sibling for the strict (no ``strip``) semantics.
+        if os.environ.get(_DISABLE_CONNECTION_SHAPE_ENV, "").lower() == "true":
+            logger.debug(
+                "connection-identifier-shape telemetry disabled via %s",
+                _DISABLE_CONNECTION_SHAPE_ENV,
+            )
+            return
+        shape: ConnectionIdentifierShape | None = getattr(
+            self, "_connection_identifier_shape", None
+        )
+        if shape is None:
+            logger.debug(
+                "connection-identifier-shape telemetry skipped: shape not captured"
+            )
+            return
+        ts = get_time_millis()
+        await self._log_telemetry(
+            TelemetryData.from_telemetry_data_dict(
+                from_dict=build_shape_telemetry_message(shape),
+                timestamp=ts,
+                connection=self,
+            )
+        )
+
     async def _next_sequence_counter(self) -> int:
         """Gets next sequence counter. Used internally."""
         async with self._lock_sequence_counter:
@@ -1099,6 +1140,7 @@ class SnowflakeConnection(SnowflakeConnectionSync):
             await self.__open_connection()
         self._telemetry = TelemetryClient(self._rest)
         await self._log_telemetry_imported_packages()
+        await self._log_connection_identifier_shape()
 
     def cursor(self, cursor_class: type[CursorCls] = SnowflakeCursor) -> CursorCls:
         logger.debug("cursor")

{snowflake_connector_python-4.5.0 → snowflake_connector_python-4.6.0}/src/snowflake/connector/aio/_session_manager.py

@@ -55,15 +55,6 @@ class SnowflakeSSLConnector(aiohttp.TCPConnector):
             )
             session_manager = SessionManagerFactory.get_manager()
         self._session_manager = session_manager
-        if self._snowflake_ocsp_mode == OCSPMode.FAIL_OPEN and sys.version_info < (
-            3,
-            10,
-        ):
-            raise RuntimeError(
-                "Async Snowflake Python Connector requires Python 3.10+ for OCSP validation related features. "
-                "Please open a feature request issue in github if your want to use Python 3.9 or lower: "
-                "https://github.com/snowflakedb/snowflake-connector-python/issues/new/choose."
-            )
 
         super().__init__(*args, **kwargs)
 

{snowflake_connector_python-4.5.0 → snowflake_connector_python-4.6.0}/src/snowflake/connector/connection.py

@@ -38,6 +38,11 @@ from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
 
 from . import errors
+from ._connection_identifier_shape import (
+    ConnectionIdentifierShape,
+    build_shape_telemetry_message,
+    record_input_shape,
+)
 from ._query_context_cache import QueryContextCache
 from ._utils import (
     _DEFAULT_VALUE_SERVER_DOP_CAP_FOR_FILE_TRANSFER,
@@ -161,6 +166,13 @@ MAX_CLIENT_PREFETCH_THREADS = 10
 MAX_CLIENT_FETCH_THREADS = 1024
 DEFAULT_BACKOFF_POLICY = exponential_backoff()
 
+# Local kill switch for the client_connection_identifier_shape in-band
+# telemetry event (case-insensitive "true" disables emission). Sibling
+# drivers use the same env-var name for the same purpose.
+# TODO(SNOW-3548350): remove together with the telemetry emission
+# (target: 2026-11-30).
+_DISABLE_CONNECTION_SHAPE_ENV = "SF_TELEMETRY_DISABLE_CONNECTION_SHAPE"
+
 
 def DefaultConverterClass() -> type:
     if IS_WINDOWS:
@@ -699,6 +711,7 @@ class SnowflakeConnection:
         self._log_telemetry_imported_packages()
         self._log_nanoarrow_import()
         self._log_minicore_import()
+        self._log_connection_identifier_shape()
         # check SNOW-1218851 for long term improvement plan to refactor ocsp code
         atexit.register(self._close_at_exit)
 
@@ -1655,6 +1668,18 @@ class SnowflakeConnection:
     def __config(self, **kwargs):
         """Sets up parameters in the connection object."""
         logger.debug("__config")
+        # Capture connection-identifier shape from the raw user-supplied kwargs
+        # before any normalization (the setattr loop below, construct_hostname
+        # at "account" handling, or parse_account further down) runs.
+        # Idempotent: only set on the first __config call so the original
+        # user intent isn't overwritten by a later reconfigure with derived
+        # values. Consumed by _log_connection_identifier_shape.
+        # TODO(SNOW-3548350): remove with the telemetry emission
+        # (target: 2026-11-30).
+        if getattr(self, "_connection_identifier_shape", None) is None:
+            self._connection_identifier_shape: ConnectionIdentifierShape = (
+                record_input_shape(kwargs)
+            )
         # Handle special cases first
         if "sequence_counter" in kwargs:
             self.sequence_counter = kwargs["sequence_counter"]
@@ -2588,6 +2613,47 @@ class SnowflakeConnection:
             )
         )
 
+    def _log_connection_identifier_shape(self):
+        """Emit a single client_connection_identifier_shape in-band telemetry
+        record describing which connection-identifier fields the user supplied.
+
+        Honors a local environment kill switch
+        ``SF_TELEMETRY_DISABLE_CONNECTION_SHAPE`` (case-insensitive ``"true"``)
+        and the post-login ``CLIENT_TELEMETRY_ENABLED`` server parameter (via
+        ``self.telemetry_enabled`` consulted inside ``_log_telemetry``).
+
+        TODO(SNOW-3548350): remove together with the supporting
+        ``ConnectionIdentifierShape`` capture (target: 2026-11-30).
+        """
+        # Mirrors gosnowflake's ``strings.EqualFold(os.Getenv(...), "true")``:
+        # case-insensitive ``"true"`` only, with NO surrounding-whitespace
+        # tolerance. Keeping the comparison strict here means a shell
+        # accidentally exporting ``" true "`` (with stray whitespace) leaves
+        # the emission enabled instead of silently disabling it, matching the
+        # Go / Node.js / JDBC siblings byte-for-byte.
+        if os.environ.get(_DISABLE_CONNECTION_SHAPE_ENV, "").lower() == "true":
+            logger.debug(
+                "connection-identifier-shape telemetry disabled via %s",
+                _DISABLE_CONNECTION_SHAPE_ENV,
+            )
+            return
+        shape: ConnectionIdentifierShape | None = getattr(
+            self, "_connection_identifier_shape", None
+        )
+        if shape is None:
+            logger.debug(
+                "connection-identifier-shape telemetry skipped: shape not captured"
+            )
+            return
+        ts = get_time_millis()
+        self._log_telemetry(
+            TelemetryData.from_telemetry_data_dict(
+                from_dict=build_shape_telemetry_message(shape),
+                timestamp=ts,
+                connection=self,
+            )
+        )
+
     def _log_telemetry_imported_packages(self) -> None:
         if self._log_imported_packages_in_telemetry:
             # filter out duplicates caused by submodules

{snowflake_connector_python-4.5.0 → snowflake_connector_python-4.6.0}/src/snowflake/connector/telemetry.py

@@ -44,6 +44,11 @@ class TelemetryField(Enum):
     NANOARROW_IMPORT = "nanoarrow_import"
     # multi-statement usage
     MULTI_STATEMENT = "client_multi_statement_query"
+    # Connection-identifier shape (see connection_identifier_shape.py).
+    # TODO(SNOW-3548350): remove this event type and the five KEY_*_PROVIDED /
+    # KEY_ACCOUNT_WITH_REGION keys below together with the emission
+    # (target: 2026-11-30).
+    CONNECTION_IDENTIFIER_SHAPE = "client_connection_identifier_shape"
     # Keys for telemetry data sent through either in-band or out-of-band telemetry
     KEY_TYPE = "type"
     KEY_SOURCE = "source"
@@ -54,6 +59,17 @@ class TelemetryField(Enum):
     KEY_REASON = "reason"
     KEY_VALUE = "value"
     KEY_EXCEPTION = "exception"
+    # Payload keys for the client_connection_identifier_shape event. Values
+    # are stringified booleans ("true" / "false") to match the existing
+    # in-band telemetry style used by sibling drivers (Go / JDBC). See the
+    # docstring on ConnectionIdentifierShape for the semantic meaning.
+    # TODO(SNOW-3548350): remove together with CONNECTION_IDENTIFIER_SHAPE
+    # above (target: 2026-11-30).
+    KEY_ACCOUNT_PROVIDED = "account_provided"
+    KEY_ACCOUNT_WITH_REGION = "account_with_region"
+    KEY_ACCOUNT_ORG_PROVIDED = "account_org_provided"
+    KEY_REGION_PROVIDED = "region_provided"
+    KEY_HOST_PROVIDED = "host_provided"
     # Reserved UpperCamelName keys
     KEY_ERROR_NUMBER = "ErrorNumber"
     KEY_ERROR_MESSAGE = "ErrorMessage"

{snowflake_connector_python-4.5.0 → snowflake_connector_python-4.6.0}/src/snowflake/connector/vendored/urllib3/_base_connection.py

@@ -6,7 +6,9 @@ from .util.connection import _TYPE_SOCKET_OPTIONS
 from .util.timeout import _DEFAULT_TIMEOUT, _TYPE_TIMEOUT
 from .util.url import Url
 
-_TYPE_BODY = typing.Union[bytes, typing.IO[typing.Any], typing.Iterable[bytes], str]
+_TYPE_BODY = typing.Union[
+    bytes, typing.IO[typing.Any], typing.Iterable[bytes | str], str
+]
 
 
 class ProxyConfig(typing.NamedTuple):

{snowflake_connector_python-4.5.0 → snowflake_connector_python-4.6.0}/src/snowflake/connector/vendored/urllib3/_collections.py

@@ -356,7 +356,6 @@ class HTTPHeaderDict(typing.MutableMapping[str, str]):
             for key, val in other.items():
                 self.add(key, val)
         elif isinstance(other, typing.Iterable):
-            other = typing.cast(typing.Iterable[tuple[str, str]], other)
             for key, value in other:
                 self.add(key, value)
         elif hasattr(other, "keys") and hasattr(other, "__getitem__"):

snowflake_connector_python-4.6.0/src/snowflake/connector/vendored/urllib3/_version.py

@@ -0,0 +1,24 @@
+# file generated by vcs-versioning
+# don't change, don't track in version control
+from __future__ import annotations
+
+__all__ = [
+    "__version__",
+    "__version_tuple__",
+    "version",
+    "version_tuple",
+    "__commit_id__",
+    "commit_id",
+]
+
+version: str
+__version__: str
+__version_tuple__: tuple[int | str, ...]
+version_tuple: tuple[int | str, ...]
+commit_id: str | None
+__commit_id__: str | None
+
+__version__ = version = '2.7.0'
+__version_tuple__ = version_tuple = (2, 7, 0)
+
+__commit_id__ = commit_id = None

{snowflake_connector_python-4.5.0 → snowflake_connector_python-4.6.0}/src/snowflake/connector/vendored/urllib3/connection.py

@@ -540,8 +540,8 @@ class HTTPConnection(_HTTPConnection):
         """
         warnings.warn(
             "HTTPConnection.request_chunked() is deprecated and will be removed "
-            "in urllib3 v2.1.0. Instead use HTTPConnection.request(..., chunked=True).",
-            category=DeprecationWarning,
+            "in urllib3 v3.0. Instead use HTTPConnection.request(..., chunked=True).",
+            category=FutureWarning,
             stacklevel=2,
         )
         self.request(method, url, body=body, headers=headers, chunked=True)
@@ -706,9 +706,9 @@ class HTTPSConnection(HTTPConnection):
         """
         warnings.warn(
             "HTTPSConnection.set_cert() is deprecated and will be removed "
-            "in urllib3 v2.1.0. Instead provide the parameters to the "
+            "in urllib3 v3.0. Instead provide the parameters to the "
             "HTTPSConnection constructor.",
-            category=DeprecationWarning,
+            category=FutureWarning,
             stacklevel=2,
         )