snowflake-connector-python 4.6.0__tar.gz → 4.7.1__tar.gz

{snowflake_connector_python-4.6.0 → snowflake_connector_python-4.7.1}/DESCRIPTION.md

@@ -7,6 +7,21 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.7.1(Jul 15,2026)
+  - Added support for Python 3.14t (free-threaded).
+    - **Note:** Python 3.14t CI testing excludes `win_arm64` (no `cryptography` wheels available) and `mitmproxy` proxy tests on all platforms (transitive dependencies `aioquic`/`pylsqpack` lack free-threaded-compatible wheels).
+  - Improved verification of TLS connections (SNOW-3675579).
+  - Fixed `python-connector.log` not rotating on Windows, and every record being logged twice, when easy logging is enabled via `config.toml` (SNOW-3680325).
+    - **Note:** As part of this fix, easy logging no longer calls `logging.basicConfig()` and therefore no longer configures the root logger. `python-connector.log` now captures only the `snowflake.connector`, `botocore`, and `boto3`.
+  - Improved URL validation reliability by replacing the hand-rolled regex in `is_valid_url()` with `urllib.parse.urlparse` (SNOW-3392651).
+  - Fixed OAuth infinite loop when tokens expire by ensuring `reauthenticate()` calls `_request_tokens()` directly instead of looping through `prepare()`. Token cache is now read exactly once per connection, and `_store_tokens()` preserves macOS Keychain ACL by never calling `remove()`. The async OAuth `reauthenticate()` now runs the synchronous OAuth flow on a worker thread instead of blocking the event loop.
+  - Fixed OAuth scope handling for Snowflake custom OAuth: when refresh tokens are enabled, the connector no longer appends the OIDC `offline_access` scope for token endpoints on `*.snowflakecomputing.com` or `*.snowflakecomputing.cn`, which caused `invalid_scope` errors. Snowflake custom OAuth expects `refresh_token` in scope instead. External IdP behavior is unchanged.
+  - Fixed input validation for `scale` metadata in Arrow result set processing for `TIME`, `TIMESTAMP_NTZ`, `TIMESTAMP_LTZ`, and `TIMESTAMP_TZ` columns (SNOW-3388299).
+  - Fixed S3 storage client to correctly handle 307/308 (method-preserving) and 301/302 (GET/HEAD only) redirects by disabling automatic redirect following and re-signing each request with AWS SigV4 credentials for the redirect target. The region is updated from the `x-amz-bucket-region` response header on each redirect. Redirects are capped at 5 hops.
+  - Added native AKS (Azure Kubernetes Service) workload identity support. When running on AKS with workload identity configured, the connector automatically uses `WorkloadIdentityCredential` to authenticate via the injected service account credentials. OIDC backward compatibility is also supported.
+  - Added the `workload_identity_aws_use_outbound_token` connection option (default `false`) to opt into AWS WIF JWT attestation via STS `GetWebIdentityToken` instead of the default SigV4 `GetCallerIdentity` method.
+  - Fixed a bug where a fully-qualified DDL statement (e.g. `CREATE VIEW db.schema.obj`) on a session with no current schema would populate the connector's cached `_schema`/`_database` from the referenced object's namespace. This made `get_current_schema()` diverge from the server's `CURRENT_SCHEMA()` and mis-qualified Snowpark temp objects (SNOW-3665226).
+
 - v4.6.0(May 28,2026)
   - Dropped support for Python 3.9. The minimum supported version is now Python 3.10.
   - Fixed sdist to only install the minicore binary matching the current platform (SNOW-3526469). Previous 4.x releases copied every platform's minicore `.so`/`.dylib`/`.dll` into the install prefix, breaking downstream packagers (e.g. Homebrew) whose audits reject foreign-arch binaries.

{snowflake_connector_python-4.6.0 → snowflake_connector_python-4.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.6.0
+Version: 4.7.1
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -58,10 +58,13 @@ Requires-Dist: botocore>=1.24
 Provides-Extra: boto
 Requires-Dist: boto3>=1.24; extra == "boto"
 Requires-Dist: botocore>=1.24; extra == "boto"
+Provides-Extra: azure
+Requires-Dist: azure-identity>=1.16; extra == "azure"
 Provides-Extra: development
 Requires-Dist: Cython; extra == "development"
+Requires-Dist: azure-identity>=1.16; extra == "development"
 Requires-Dist: coverage; extra == "development"
-Requires-Dist: mitmproxy>=12.0.0; python_version >= "3.12" and extra == "development"
+Requires-Dist: mitmproxy>=12.0.0; (python_version >= "3.12" and python_version < "3.14") and extra == "development"
 Requires-Dist: more-itertools; extra == "development"
 Requires-Dist: numpy<=2.4.3; extra == "development"
 Requires-Dist: pendulum!=2.1.1; extra == "development"
@@ -77,7 +80,8 @@ Requires-Dist: responses; extra == "development"
 Provides-Extra: pandas
 Requires-Dist: pandas<3.0.0,>=1.0.0; python_version < "3.13" and extra == "pandas"
 Requires-Dist: pandas<3.0.0,>=2.1.2; python_version >= "3.13" and extra == "pandas"
-Requires-Dist: pyarrow>=14.0.1; extra == "pandas"
+Requires-Dist: pyarrow<24,>=14.0.1; python_version >= "3.14" and extra == "pandas"
+Requires-Dist: pyarrow>=14.0.1; python_version < "3.14" and extra == "pandas"
 Provides-Extra: secure-local-storage
 Requires-Dist: keyring<26.0.0,>=23.1.0; extra == "secure-local-storage"
 Dynamic: license-file
@@ -92,6 +96,21 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.7.1(Jul 15,2026)
+  - Added support for Python 3.14t (free-threaded).
+    - **Note:** Python 3.14t CI testing excludes `win_arm64` (no `cryptography` wheels available) and `mitmproxy` proxy tests on all platforms (transitive dependencies `aioquic`/`pylsqpack` lack free-threaded-compatible wheels).
+  - Improved verification of TLS connections (SNOW-3675579).
+  - Fixed `python-connector.log` not rotating on Windows, and every record being logged twice, when easy logging is enabled via `config.toml` (SNOW-3680325).
+    - **Note:** As part of this fix, easy logging no longer calls `logging.basicConfig()` and therefore no longer configures the root logger. `python-connector.log` now captures only the `snowflake.connector`, `botocore`, and `boto3`.
+  - Improved URL validation reliability by replacing the hand-rolled regex in `is_valid_url()` with `urllib.parse.urlparse` (SNOW-3392651).
+  - Fixed OAuth infinite loop when tokens expire by ensuring `reauthenticate()` calls `_request_tokens()` directly instead of looping through `prepare()`. Token cache is now read exactly once per connection, and `_store_tokens()` preserves macOS Keychain ACL by never calling `remove()`. The async OAuth `reauthenticate()` now runs the synchronous OAuth flow on a worker thread instead of blocking the event loop.
+  - Fixed OAuth scope handling for Snowflake custom OAuth: when refresh tokens are enabled, the connector no longer appends the OIDC `offline_access` scope for token endpoints on `*.snowflakecomputing.com` or `*.snowflakecomputing.cn`, which caused `invalid_scope` errors. Snowflake custom OAuth expects `refresh_token` in scope instead. External IdP behavior is unchanged.
+  - Fixed input validation for `scale` metadata in Arrow result set processing for `TIME`, `TIMESTAMP_NTZ`, `TIMESTAMP_LTZ`, and `TIMESTAMP_TZ` columns (SNOW-3388299).
+  - Fixed S3 storage client to correctly handle 307/308 (method-preserving) and 301/302 (GET/HEAD only) redirects by disabling automatic redirect following and re-signing each request with AWS SigV4 credentials for the redirect target. The region is updated from the `x-amz-bucket-region` response header on each redirect. Redirects are capped at 5 hops.
+  - Added native AKS (Azure Kubernetes Service) workload identity support. When running on AKS with workload identity configured, the connector automatically uses `WorkloadIdentityCredential` to authenticate via the injected service account credentials. OIDC backward compatibility is also supported.
+  - Added the `workload_identity_aws_use_outbound_token` connection option (default `false`) to opt into AWS WIF JWT attestation via STS `GetWebIdentityToken` instead of the default SigV4 `GetCallerIdentity` method.
+  - Fixed a bug where a fully-qualified DDL statement (e.g. `CREATE VIEW db.schema.obj`) on a session with no current schema would populate the connector's cached `_schema`/`_database` from the referenced object's namespace. This made `get_current_schema()` diverge from the server's `CURRENT_SCHEMA()` and mis-qualified Snowpark temp objects (SNOW-3665226).
+
 - v4.6.0(May 28,2026)
   - Dropped support for Python 3.9. The minimum supported version is now Python 3.10.
   - Fixed sdist to only install the minicore binary matching the current platform (SNOW-3526469). Previous 4.x releases copied every platform's minicore `.so`/`.dylib`/`.dll` into the install prefix, breaking downstream packagers (e.g. Homebrew) whose audits reject foreign-arch binaries.

{snowflake_connector_python-4.6.0 → snowflake_connector_python-4.7.1}/setup.cfg

@@ -85,10 +85,13 @@ console_scripts =
 boto = 
 	boto3>=1.24
 	botocore>=1.24
+azure = 
+	azure-identity>=1.16
 development = 
 	Cython
+	azure-identity>=1.16
 	coverage
-	mitmproxy>=12.0.0; python_version >= '3.12'
+	mitmproxy>=12.0.0; python_version >= '3.12' and python_version < '3.14'
 	more-itertools
 	numpy<=2.4.3
 	pendulum!=2.1.1
@@ -104,7 +107,8 @@ development =
 pandas = 
 	pandas>=1.0.0,<3.0.0; python_version < '3.13'
 	pandas>=2.1.2,<3.0.0; python_version >= '3.13'
-	pyarrow>=14.0.1
+	pyarrow>=14.0.1,<24; python_version >= '3.14'
+	pyarrow>=14.0.1; python_version < '3.14'
 secure-local-storage = 
 	keyring>=23.1.0,<26.0.0
 

{snowflake_connector_python-4.6.0 → snowflake_connector_python-4.7.1}/src/snowflake/connector/aio/_connection.py

@@ -1084,9 +1084,14 @@ class SnowflakeConnection(SnowflakeConnectionSync):
             ret["data"] = {}
         if _update_current_object:
             data = ret["data"]
-            if "finalDatabaseName" in data and data["finalDatabaseName"] is not None:
+            is_context_switch = sql.strip().upper().startswith("USE ")
+            if data.get("finalDatabaseName") is not None and (
+                self._database is not None or is_context_switch
+            ):
                 self._database = data["finalDatabaseName"]
-            if "finalSchemaName" in data and data["finalSchemaName"] is not None:
+            if data.get("finalSchemaName") is not None and (
+                self._schema is not None or is_context_switch
+            ):
                 self._schema = data["finalSchemaName"]
             if "finalWarehouseName" in data and data["finalWarehouseName"] is not None:
                 self._warehouse = data["finalWarehouseName"]

{snowflake_connector_python-4.6.0 → snowflake_connector_python-4.7.1}/src/snowflake/connector/aio/_wif_util.py

@@ -10,8 +10,10 @@ import jwt
 from snowflake.connector.options import (
     aioboto3,
     aiobotocore,
+    azure_identity_aio,
     botocore,
     installed_aioboto,
+    installed_azure_identity,
 )
 
 from ..errorcode import ER_INVALID_WIF_SETTINGS, ER_WIF_CREDENTIALS_NOT_FOUND
@@ -33,6 +35,26 @@ logger = logging.getLogger(__name__)
 GCP_METADATA_SERVICE_ACCOUNT_BASE_URL = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default"
 
 
+async def get_azure_mi_token_via_aks(resource: str) -> str:
+    """Gets an Azure MI access token via AsyncWorkloadIdentityCredential on AKS."""
+    if not installed_azure_identity:
+        raise MissingDependencyError(
+            "azure-identity (install with: pip install 'snowflake-connector-python[azure]')"
+        )
+    logger.debug(
+        "Detected AKS workload identity environment, using WorkloadIdentityCredential"
+    )
+    try:
+        async with azure_identity_aio.WorkloadIdentityCredential() as credential:
+            token = await credential.get_token(f"{resource}/.default")
+            return token.token
+    except Exception as e:
+        raise ProgrammingError(
+            msg=f"Error fetching Azure MI token via WorkloadIdentityCredential: {e}. Ensure the application is running on AKS with workload identity configured.",
+            errno=ER_WIF_CREDENTIALS_NOT_FOUND,
+        )
+
+
 async def get_aws_region() -> str:
     """Get the current AWS workload's region."""
     region = os.environ.get("AWS_REGION") or os.environ.get("AWS_DEFAULT_REGION")
@@ -283,73 +305,100 @@ async def create_azure_attestation(
 
     If the application isn't running on Azure or no credentials were found, raises an error.
     """
-    if impersonation_path:
-        if len(impersonation_path) != 1:
+    # AKS Workload Identity path: the three env vars are injected by the AKS webhook,
+    # and the token file is mounted by the Azure Workload Identity webhook.
+    # Checking file existence (rather than KUBERNETES_SERVICE_HOST) correctly handles
+    # pods with enableServiceLinks=false and avoids false positives on non-AKS K8s.
+    _federated_token_file = os.environ.get("AZURE_FEDERATED_TOKEN_FILE", "")
+    is_aks = all(
+        [
+            os.environ.get("AZURE_CLIENT_ID"),
+            os.environ.get("AZURE_TENANT_ID"),
+            _federated_token_file,
+            os.path.exists(_federated_token_file),
+        ]
+    )
+    if is_aks:
+        if impersonation_path:
             raise ProgrammingError(
-                msg="Azure WIF impersonation only supports a single service principal (single-hop). impersonation_path must contain exactly one client_id.",
+                msg="workload_identity_impersonation_path is not supported on AKS.",
                 errno=ER_INVALID_WIF_SETTINGS,
             )
-    resource = (
-        AZURE_WIF_FEDERATION_AUDIENCE
-        if impersonation_path
-        else snowflake_entra_resource
-    )
-    headers = {"Metadata": "true"}
-    url_without_query_string = "http://169.254.169.254/metadata/identity/oauth2/token"
-    query_params = f"api-version=2018-02-01&resource={resource}"
+        jwt_str = await get_azure_mi_token_via_aks(snowflake_entra_resource)
+    else:
+        if impersonation_path:
+            if len(impersonation_path) != 1:
+                raise ProgrammingError(
+                    msg="Azure WIF impersonation only supports a single service principal (single-hop). impersonation_path must contain exactly one client_id.",
+                    errno=ER_INVALID_WIF_SETTINGS,
+                )
+        resource = (
+            AZURE_WIF_FEDERATION_AUDIENCE
+            if impersonation_path
+            else snowflake_entra_resource
+        )
 
-    # Check if running in Azure Functions environment
-    identity_endpoint = os.environ.get("IDENTITY_ENDPOINT")
-    identity_header = os.environ.get("IDENTITY_HEADER")
-    is_azure_functions = identity_endpoint is not None
+        headers = {"Metadata": "true"}
+        url_without_query_string = (
+            "http://169.254.169.254/metadata/identity/oauth2/token"
+        )
+        query_params = f"api-version=2018-02-01&resource={resource}"
+
+        # Check if running in Azure Functions environment
+        identity_endpoint = os.environ.get("IDENTITY_ENDPOINT")
+        identity_header = os.environ.get("IDENTITY_HEADER")
+        is_azure_functions = identity_endpoint is not None
+
+        if is_azure_functions:
+            if not identity_header:
+                raise ProgrammingError(
+                    msg="Managed identity is not enabled on this Azure function.",
+                    errno=ER_WIF_CREDENTIALS_NOT_FOUND,
+                )
+
+            # Azure Functions uses a different endpoint, headers and API version.
+            url_without_query_string = identity_endpoint
+            headers = {"X-IDENTITY-HEADER": identity_header}
+            query_params = f"api-version=2019-08-01&resource={resource}"
+
+        # Allow configuring an explicit client ID, which may be used in Azure Functions,
+        # if there are user-assigned identities, or multiple managed identities available.
+        managed_identity_client_id = os.environ.get("MANAGED_IDENTITY_CLIENT_ID")
+        if managed_identity_client_id:
+            query_params += f"&client_id={managed_identity_client_id}"
+
+        response_text = None
+        try:
+            res = await session_manager.request(
+                method="GET",
+                url=f"{url_without_query_string}?{query_params}",
+                headers=headers,
+            )
 
-    if is_azure_functions:
-        if not identity_header:
+            content = await res.content.read()
+            response_text = content.decode("utf-8")
+            response_data = json.loads(response_text)
+            res.raise_for_status()
+        except Exception as e:
             raise ProgrammingError(
-                msg="Managed identity is not enabled on this Azure function.",
+                msg=f"Error fetching Azure metadata: {e}. Response: {response_text}. Ensure the application is running on Azure.",
                 errno=ER_WIF_CREDENTIALS_NOT_FOUND,
             )
 
-        # Azure Functions uses a different endpoint, headers and API version.
-        url_without_query_string = identity_endpoint
-        headers = {"X-IDENTITY-HEADER": identity_header}
-        query_params = f"api-version=2019-08-01&resource={resource}"
-
-    # Allow configuring an explicit client ID, which may be used in Azure Functions,
-    # if there are user-assigned identities, or multiple managed identities available.
-    managed_identity_client_id = os.environ.get("MANAGED_IDENTITY_CLIENT_ID")
-    if managed_identity_client_id:
-        query_params += f"&client_id={managed_identity_client_id}"
-
-    response_text = None
-    try:
-        res = await session_manager.request(
-            method="GET",
-            url=f"{url_without_query_string}?{query_params}",
-            headers=headers,
-        )
-
-        content = await res.content.read()
-        response_text = content.decode("utf-8")
-        response_data = json.loads(response_text)
-        res.raise_for_status()
-    except Exception as e:
-        raise ProgrammingError(
-            msg=f"Error fetching Azure metadata: {e}. Response: {response_text}. Ensure the application is running on Azure.",
-            errno=ER_WIF_CREDENTIALS_NOT_FOUND,
-        )
-
-    jwt_str = response_data.get("access_token")
-    if not jwt_str:
-        raise ProgrammingError(
-            msg="No access token found in Azure metadata service response.",
-            errno=ER_WIF_CREDENTIALS_NOT_FOUND,
-        )
+        jwt_str = response_data.get("access_token")
+        if not jwt_str:
+            raise ProgrammingError(
+                msg="No access token found in Azure metadata service response.",
+                errno=ER_WIF_CREDENTIALS_NOT_FOUND,
+            )
 
-    if impersonation_path:
-        jwt_str = await get_azure_sp_token_via_impersonation(
-            jwt_str, impersonation_path[0], snowflake_entra_resource, session_manager
-        )
+        if impersonation_path:
+            jwt_str = await get_azure_sp_token_via_impersonation(
+                jwt_str,
+                impersonation_path[0],
+                snowflake_entra_resource,
+                session_manager,
+            )
 
     issuer, subject = extract_iss_and_sub_without_signature_verification(jwt_str)
     return WorkloadIdentityAttestation(

{snowflake_connector_python-4.6.0 → snowflake_connector_python-4.7.1}/src/snowflake/connector/aio/auth/_keypair.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 from logging import getLogger
 from typing import Any
 
+from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePrivateKey
 from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
 
 from ...auth.keypair import AuthByKeyPair as AuthByKeyPairSync
@@ -16,11 +17,14 @@ logger = getLogger(__name__)
 class AuthByKeyPair(AuthByPluginAsync, AuthByKeyPairSync):
     def __init__(
         self,
-        private_key: bytes | str | RSAPrivateKey,
+        private_key: bytes | str | RSAPrivateKey | EllipticCurvePrivateKey,
+        private_key_passphrase: bytes | None = None,
         lifetime_in_seconds: int = AuthByKeyPairSync.LIFETIME,
         **kwargs,
     ) -> None:
-        AuthByKeyPairSync.__init__(self, private_key, lifetime_in_seconds, **kwargs)
+        AuthByKeyPairSync.__init__(
+            self, private_key, private_key_passphrase, lifetime_in_seconds, **kwargs
+        )
 
     async def reset_secrets(self) -> None:
         AuthByKeyPairSync.reset_secrets(self)

{snowflake_connector_python-4.6.0 → snowflake_connector_python-4.7.1}/src/snowflake/connector/aio/auth/_oauth_code.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import asyncio
 import logging
 from typing import TYPE_CHECKING, Any
 
@@ -72,19 +73,14 @@ class AuthByOauthCode(AuthByPluginAsync, AuthByOauthCodeSync):
     async def reauthenticate(
         self, conn: SnowflakeConnection, **kwargs: Any
     ) -> dict[str, bool]:
-        """Override to use async connection properly."""
-        # Call the sync reset logic but handle the connection retry ourselves
-        self._reset_access_token()
-        if self._pop_cached_refresh_token():
-            logger.debug(
-                "OAuth refresh token is available, try to use it and get a new access token"
-            )
-            # this part is a little hacky - will need to refactor that in future.
-            # we treat conn as a sync connection here, but this method only reads data from the object - which should be fine.
-            self._do_refresh_token(conn=conn)
-        # Use async authenticate_with_retry
-        await conn.authenticate_with_retry(self)
-        return {"success": True}
+        # The sync reauthenticate path opens a browser, blocks on the local
+        # callback socket, and POSTs to the IdP via urllib3 - all of which
+        # would stall the asyncio event loop. Run it in a worker thread.
+        loop = asyncio.get_running_loop()
+        return await loop.run_in_executor(
+            None,
+            lambda: AuthByOauthCodeSync.reauthenticate(self, conn=conn, **kwargs),
+        )
 
     async def update_body(self, body: dict[Any, Any]) -> None:
         AuthByOauthCodeSync.update_body(self, body)

{snowflake_connector_python-4.6.0 → snowflake_connector_python-4.7.1}/src/snowflake/connector/aio/auth/_oauth_credentials.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import asyncio
 import logging
 from typing import TYPE_CHECKING, Any
 
@@ -55,19 +56,15 @@ class AuthByOauthCredentials(AuthByPluginAsync, AuthByOauthCredentialsSync):
     async def reauthenticate(
         self, conn: SnowflakeConnection, **kwargs: Any
     ) -> dict[str, bool]:
-        """Override to use async connection properly."""
-        # Call the sync reset logic but handle the connection retry ourselves
-        self._reset_access_token()
-        if self._pop_cached_refresh_token():
-            logger.debug(
-                "OAuth refresh token is available, try to use it and get a new access token"
-            )
-            # this part is a little hacky - will need to refactor that in future.
-            # we treat conn as a sync connection here, but this method only reads data from the object - which should be fine.
-            self._do_refresh_token(conn=conn)
-        # Use async authenticate_with_retry
-        await conn.authenticate_with_retry(self)
-        return {"success": True}
+        # The sync reauthenticate path POSTs to the IdP via urllib3, which
+        # would stall the asyncio event loop. Run it in a worker thread.
+        loop = asyncio.get_running_loop()
+        return await loop.run_in_executor(
+            None,
+            lambda: AuthByOauthCredentialsSync.reauthenticate(
+                self, conn=conn, **kwargs
+            ),
+        )
 
     async def update_body(self, body: dict[Any, Any]) -> None:
         AuthByOauthCredentialsSync.update_body(self, body)