snowflake-connector-python 4.7.0__tar.gz → 4.7.1__tar.gz

{snowflake_connector_python-4.7.0 → snowflake_connector_python-4.7.1}/DESCRIPTION.md

@@ -7,14 +7,16 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v4.7.0(Jul 2,2026)
+- v4.7.1(Jul 15,2026)
+  - Added support for Python 3.14t (free-threaded).
+    - **Note:** Python 3.14t CI testing excludes `win_arm64` (no `cryptography` wheels available) and `mitmproxy` proxy tests on all platforms (transitive dependencies `aioquic`/`pylsqpack` lack free-threaded-compatible wheels).
+  - Improved verification of TLS connections (SNOW-3675579).
   - Fixed `python-connector.log` not rotating on Windows, and every record being logged twice, when easy logging is enabled via `config.toml` (SNOW-3680325).
     - **Note:** As part of this fix, easy logging no longer calls `logging.basicConfig()` and therefore no longer configures the root logger. `python-connector.log` now captures only the `snowflake.connector`, `botocore`, and `boto3`.
   - Improved URL validation reliability by replacing the hand-rolled regex in `is_valid_url()` with `urllib.parse.urlparse` (SNOW-3392651).
   - Fixed OAuth infinite loop when tokens expire by ensuring `reauthenticate()` calls `_request_tokens()` directly instead of looping through `prepare()`. Token cache is now read exactly once per connection, and `_store_tokens()` preserves macOS Keychain ACL by never calling `remove()`. The async OAuth `reauthenticate()` now runs the synchronous OAuth flow on a worker thread instead of blocking the event loop.
   - Fixed OAuth scope handling for Snowflake custom OAuth: when refresh tokens are enabled, the connector no longer appends the OIDC `offline_access` scope for token endpoints on `*.snowflakecomputing.com` or `*.snowflakecomputing.cn`, which caused `invalid_scope` errors. Snowflake custom OAuth expects `refresh_token` in scope instead. External IdP behavior is unchanged.
   - Fixed input validation for `scale` metadata in Arrow result set processing for `TIME`, `TIMESTAMP_NTZ`, `TIMESTAMP_LTZ`, and `TIMESTAMP_TZ` columns (SNOW-3388299).
-  - Removed pandas upper bound dependency constraint on the `[pandas]` extra to allow installation of pandas 3.0.0 and later.
   - Fixed S3 storage client to correctly handle 307/308 (method-preserving) and 301/302 (GET/HEAD only) redirects by disabling automatic redirect following and re-signing each request with AWS SigV4 credentials for the redirect target. The region is updated from the `x-amz-bucket-region` response header on each redirect. Redirects are capped at 5 hops.
   - Added native AKS (Azure Kubernetes Service) workload identity support. When running on AKS with workload identity configured, the connector automatically uses `WorkloadIdentityCredential` to authenticate via the injected service account credentials. OIDC backward compatibility is also supported.
   - Added the `workload_identity_aws_use_outbound_token` connection option (default `false`) to opt into AWS WIF JWT attestation via STS `GetWebIdentityToken` instead of the default SigV4 `GetCallerIdentity` method.

{snowflake_connector_python-4.7.0 → snowflake_connector_python-4.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.7.0
+Version: 4.7.1
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -64,7 +64,7 @@ Provides-Extra: development
 Requires-Dist: Cython; extra == "development"
 Requires-Dist: azure-identity>=1.16; extra == "development"
 Requires-Dist: coverage; extra == "development"
-Requires-Dist: mitmproxy>=12.0.0; python_version >= "3.12" and extra == "development"
+Requires-Dist: mitmproxy>=12.0.0; (python_version >= "3.12" and python_version < "3.14") and extra == "development"
 Requires-Dist: more-itertools; extra == "development"
 Requires-Dist: numpy<=2.4.3; extra == "development"
 Requires-Dist: pendulum!=2.1.1; extra == "development"
@@ -78,9 +78,10 @@ Requires-Dist: pytest-xdist; extra == "development"
 Requires-Dist: pytzdata; extra == "development"
 Requires-Dist: responses; extra == "development"
 Provides-Extra: pandas
-Requires-Dist: pandas>=1.0.0; python_version < "3.13" and extra == "pandas"
-Requires-Dist: pandas>=2.1.2; python_version >= "3.13" and extra == "pandas"
-Requires-Dist: pyarrow>=14.0.1; extra == "pandas"
+Requires-Dist: pandas<3.0.0,>=1.0.0; python_version < "3.13" and extra == "pandas"
+Requires-Dist: pandas<3.0.0,>=2.1.2; python_version >= "3.13" and extra == "pandas"
+Requires-Dist: pyarrow<24,>=14.0.1; python_version >= "3.14" and extra == "pandas"
+Requires-Dist: pyarrow>=14.0.1; python_version < "3.14" and extra == "pandas"
 Provides-Extra: secure-local-storage
 Requires-Dist: keyring<26.0.0,>=23.1.0; extra == "secure-local-storage"
 Dynamic: license-file
@@ -95,14 +96,16 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v4.7.0(Jul 2,2026)
+- v4.7.1(Jul 15,2026)
+  - Added support for Python 3.14t (free-threaded).
+    - **Note:** Python 3.14t CI testing excludes `win_arm64` (no `cryptography` wheels available) and `mitmproxy` proxy tests on all platforms (transitive dependencies `aioquic`/`pylsqpack` lack free-threaded-compatible wheels).
+  - Improved verification of TLS connections (SNOW-3675579).
   - Fixed `python-connector.log` not rotating on Windows, and every record being logged twice, when easy logging is enabled via `config.toml` (SNOW-3680325).
     - **Note:** As part of this fix, easy logging no longer calls `logging.basicConfig()` and therefore no longer configures the root logger. `python-connector.log` now captures only the `snowflake.connector`, `botocore`, and `boto3`.
   - Improved URL validation reliability by replacing the hand-rolled regex in `is_valid_url()` with `urllib.parse.urlparse` (SNOW-3392651).
   - Fixed OAuth infinite loop when tokens expire by ensuring `reauthenticate()` calls `_request_tokens()` directly instead of looping through `prepare()`. Token cache is now read exactly once per connection, and `_store_tokens()` preserves macOS Keychain ACL by never calling `remove()`. The async OAuth `reauthenticate()` now runs the synchronous OAuth flow on a worker thread instead of blocking the event loop.
   - Fixed OAuth scope handling for Snowflake custom OAuth: when refresh tokens are enabled, the connector no longer appends the OIDC `offline_access` scope for token endpoints on `*.snowflakecomputing.com` or `*.snowflakecomputing.cn`, which caused `invalid_scope` errors. Snowflake custom OAuth expects `refresh_token` in scope instead. External IdP behavior is unchanged.
   - Fixed input validation for `scale` metadata in Arrow result set processing for `TIME`, `TIMESTAMP_NTZ`, `TIMESTAMP_LTZ`, and `TIMESTAMP_TZ` columns (SNOW-3388299).
-  - Removed pandas upper bound dependency constraint on the `[pandas]` extra to allow installation of pandas 3.0.0 and later.
   - Fixed S3 storage client to correctly handle 307/308 (method-preserving) and 301/302 (GET/HEAD only) redirects by disabling automatic redirect following and re-signing each request with AWS SigV4 credentials for the redirect target. The region is updated from the `x-amz-bucket-region` response header on each redirect. Redirects are capped at 5 hops.
   - Added native AKS (Azure Kubernetes Service) workload identity support. When running on AKS with workload identity configured, the connector automatically uses `WorkloadIdentityCredential` to authenticate via the injected service account credentials. OIDC backward compatibility is also supported.
   - Added the `workload_identity_aws_use_outbound_token` connection option (default `false`) to opt into AWS WIF JWT attestation via STS `GetWebIdentityToken` instead of the default SigV4 `GetCallerIdentity` method.

{snowflake_connector_python-4.7.0 → snowflake_connector_python-4.7.1}/setup.cfg

@@ -91,7 +91,7 @@ development =
 	Cython
 	azure-identity>=1.16
 	coverage
-	mitmproxy>=12.0.0; python_version >= '3.12'
+	mitmproxy>=12.0.0; python_version >= '3.12' and python_version < '3.14'
 	more-itertools
 	numpy<=2.4.3
 	pendulum!=2.1.1
@@ -105,9 +105,10 @@ development =
 	pytzdata
 	responses
 pandas = 
-	pandas>=1.0.0; python_version < '3.13'
-	pandas>=2.1.2; python_version >= '3.13'
-	pyarrow>=14.0.1
+	pandas>=1.0.0,<3.0.0; python_version < '3.13'
+	pandas>=2.1.2,<3.0.0; python_version >= '3.13'
+	pyarrow>=14.0.1,<24; python_version >= '3.14'
+	pyarrow>=14.0.1; python_version < '3.14'
 secure-local-storage = 
 	keyring>=23.1.0,<26.0.0
 

{snowflake_connector_python-4.7.0 → snowflake_connector_python-4.7.1}/src/snowflake/connector/ssl_wrap_socket.py

@@ -29,6 +29,7 @@ from .session_manager import SessionManager, SessionManagerFactory
 from .vendored.urllib3 import connection as connection_
 from .vendored.urllib3.contrib.pyopenssl import PyOpenSSLContext, WrappedSocket
 from .vendored.urllib3.util import ssl_ as ssl_
+from .vendored.urllib3.util.ssl_match_hostname import CertificateError, match_hostname
 
 if TYPE_CHECKING:
     from cryptography import x509
@@ -85,13 +86,79 @@ def _ensure_partial_chain_on_context(ctx: PyOpenSSLContext, cafile: str | None)
         pass
 
 
-def _build_context_with_partial_chain(cafile: str | None) -> PyOpenSSLContext:
-    """Create PyOpenSSL context configured for CERT_REQUIRED and partial-chain trust."""
+def _nonnegative_options(value: int) -> int:
+    """Return *value* as the non-negative bitmask pyOpenSSL/cryptography expects.
+
+    ``ssl.SSLContext.options`` is exposed through a signed, platform-width C
+    ``long``. On Windows that type is 32 bits, so the common default mask (which
+    has bit 31 set, e.g. ``0x82520050``) is returned as a *negative* Python int.
+    cryptography's binding marshals the value into an unsigned parameter and
+    rejects negatives with ``OverflowError: can't convert negative number to
+    unsigned`` -- which previously aborted every Windows TLS handshake the
+    moment we carried these options onto the substituted ``PyOpenSSLContext``.
+    Recover the intended unsigned 32-bit mask; values that are already
+    non-negative (every other platform) pass through unchanged.
+    """
+    return value & 0xFFFFFFFF if value < 0 else value
+
+
+def _apply_stdlib_hardening(dst: PyOpenSSLContext, src: ssl.SSLContext | None) -> None:
+    """Carry TLS hardening from a stdlib ``SSLContext`` onto ``dst``.
+
+    The connector replaces the stdlib ``ssl.SSLContext`` that urllib3 builds
+    (or that a caller supplied) with a ``PyOpenSSLContext``. Without copying the
+    original context's hardening forward, the substitution silently drops the
+    TLS-version floor and ``OP_NO_*`` options urllib3 configured and
+    any hardening a caller set on a supplied context. Copy the
+    settings we can read back; fall back to urllib3's default floor when there
+    is no source context to mirror.
+
+    Limitation: cipher restrictions and pinned CA material (``cadata`` /
+    ``load_verify_locations``) cannot be read back out of an ``ssl.SSLContext``,
+    so they cannot be transferred here. Honoring caller-supplied pinning needs a
+    dedicated, supported channel and is tracked as a follow-up.
+    """
+    if isinstance(src, ssl.SSLContext):
+        # Mirror the protocol-version floor/ceiling and OpenSSL options the
+        # original context carried (e.g. TLS 1.2 minimum, OP_NO_SSLv3,
+        # OP_NO_COMPRESSION) plus any caller hardening (e.g. VERIFY_X509_STRICT).
+        for attr in ("minimum_version", "maximum_version", "verify_flags"):
+            try:
+                setattr(dst, attr, getattr(src, attr))
+            except (ValueError, OSError, OpenSSL.SSL.Error):
+                # Best-effort; an unsupported value must not break the handshake.
+                pass
+        try:
+            dst.options |= _nonnegative_options(src.options)
+        except (ValueError, OSError, OpenSSL.SSL.Error, OverflowError, TypeError):
+            # Best-effort; carrying options forward must never break the
+            # handshake even if a value can't be marshalled into pyOpenSSL.
+            pass
+    else:
+        # No source context to mirror (no ssl_context was supplied): restore the
+        # hardening urllib3's create_urllib3_context() would have applied.
+        try:
+            dst.minimum_version = ssl.TLSVersion.TLSv1_2
+            dst.options |= ssl.OP_NO_COMPRESSION
+        except (ValueError, OSError, OpenSSL.SSL.Error, OverflowError, TypeError):
+            pass
+
+
+def _build_context_with_partial_chain(
+    cafile: str | None, src_context: ssl.SSLContext | None = None
+) -> PyOpenSSLContext:
+    """Create PyOpenSSL context configured for CERT_REQUIRED and partial-chain trust.
+
+    When ``src_context`` is the stdlib context being replaced, its TLS hardening
+    (version floor, options, verify flags) is carried forward so the
+    substitution does not weaken the connection.
+    """
     ctx = PyOpenSSLContext(ssl_.PROTOCOL_TLS_CLIENT)
     try:
         ctx.verify_mode = ssl.CERT_REQUIRED
     except Exception:
         pass
+    _apply_stdlib_hardening(ctx, src_context)
     _ensure_partial_chain_on_context(ctx, cafile)
     return ctx
 
@@ -168,6 +235,54 @@ def _load_trusted_certificates(cafile: str | None) -> list[x509.Certificate]:
     return [load_der_x509_certificate(cert, default_backend()) for cert in certs]
 
 
+def _verify_hostname_after_handshake(
+    wrapped_socket: WrappedSocket,
+    server_hostname: str | None,
+    ssl_context: Any,
+) -> None:
+    """Match the peer certificate against *server_hostname*."""
+    # Honor explicitly-disabled certificate verification (CERT_NONE) first; when
+    # verification is off there is nothing to assert about server identity, so a
+    # missing hostname is acceptable. Check this before the hostname so we only
+    # skip when the caller genuinely opted out of verification.
+    verify_mode = getattr(ssl_context, "verify_mode", ssl.CERT_REQUIRED)
+    if verify_mode == ssl.CERT_NONE:
+        return
+
+    # Verification is required but there is no host to match against (e.g. TLS
+    # without SNI). Fail closed rather than accepting the peer: without a
+    # hostname we cannot assert server identity.
+    if not server_hostname:
+        raise CertificateError(
+            "no server hostname supplied to match against the peer certificate; "
+            "cannot verify server identity"
+        )
+
+    # Normalize bracketed / scoped IPv6 literals the same way urllib3 does:
+    # strip the brackets and drop any "%scope" suffix before testing for an IP,
+    # since Python's ssl module treats scoped addresses as DNS hostnames.
+    normalized = server_hostname.strip("[]")
+    if "%" in normalized:
+        normalized = normalized[: normalized.rfind("%")]
+    if ssl_.is_ipaddress(normalized):
+        server_hostname = normalized
+
+    cert = wrapped_socket.getpeercert()
+    try:
+        match_hostname(cert, server_hostname)
+    except CertificateError as e:
+        log.warning(
+            "Certificate did not match expected hostname: %s. Certificate: %s",
+            server_hostname,
+            cert,
+        )
+        # Attach the cert so callers catching CertificateError can inspect it,
+        # matching urllib3's own _match_hostname behavior.
+        e._peer_cert = cert
+        wrapped_socket.close()
+        raise
+
+
 @wraps(ssl_.ssl_wrap_socket)
 def ssl_wrap_socket_with_cert_revocation_checks(
     *args: Any, **kwargs: Any
@@ -186,13 +301,19 @@ def ssl_wrap_socket_with_cert_revocation_checks(
     provided_ctx = params.get("ssl_context")
     cafile_for_ctx = _resolve_cafile(params)
     if not isinstance(provided_ctx, PyOpenSSLContext):
-        params["ssl_context"] = _build_context_with_partial_chain(cafile_for_ctx)
+        # Carry the replaced stdlib context's TLS hardening forward so the
+        # substitution doesn't silently weaken the connection.
+        params["ssl_context"] = _build_context_with_partial_chain(
+            cafile_for_ctx, src_context=provided_ctx
+        )
     else:
         # If a PyOpenSSLContext is provided, ensure it trusts the provided CA and partial-chain is enabled
         _ensure_partial_chain_on_context(provided_ctx, cafile_for_ctx)
 
     ret = ssl_.ssl_wrap_socket(**params)
 
+    _verify_hostname_after_handshake(ret, server_hostname, params.get("ssl_context"))
+
     log.debug(
         "CRL Check Mode: %s",
         FEATURE_CRL_CONFIG.cert_revocation_check_mode.name,

{snowflake_connector_python-4.7.0 → snowflake_connector_python-4.7.1}/src/snowflake/connector/version.py

@@ -1,3 +1,3 @@
 # Update this for the versions
 # Don't change the fourth version number from None
-VERSION = (4, 7, 0, None)
+VERSION = (4, 7, 1, None)

{snowflake_connector_python-4.7.0 → snowflake_connector_python-4.7.1}/src/snowflake_connector_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.7.0
+Version: 4.7.1
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -64,7 +64,7 @@ Provides-Extra: development
 Requires-Dist: Cython; extra == "development"
 Requires-Dist: azure-identity>=1.16; extra == "development"
 Requires-Dist: coverage; extra == "development"
-Requires-Dist: mitmproxy>=12.0.0; python_version >= "3.12" and extra == "development"
+Requires-Dist: mitmproxy>=12.0.0; (python_version >= "3.12" and python_version < "3.14") and extra == "development"
 Requires-Dist: more-itertools; extra == "development"
 Requires-Dist: numpy<=2.4.3; extra == "development"
 Requires-Dist: pendulum!=2.1.1; extra == "development"
@@ -78,9 +78,10 @@ Requires-Dist: pytest-xdist; extra == "development"
 Requires-Dist: pytzdata; extra == "development"
 Requires-Dist: responses; extra == "development"
 Provides-Extra: pandas
-Requires-Dist: pandas>=1.0.0; python_version < "3.13" and extra == "pandas"
-Requires-Dist: pandas>=2.1.2; python_version >= "3.13" and extra == "pandas"
-Requires-Dist: pyarrow>=14.0.1; extra == "pandas"
+Requires-Dist: pandas<3.0.0,>=1.0.0; python_version < "3.13" and extra == "pandas"
+Requires-Dist: pandas<3.0.0,>=2.1.2; python_version >= "3.13" and extra == "pandas"
+Requires-Dist: pyarrow<24,>=14.0.1; python_version >= "3.14" and extra == "pandas"
+Requires-Dist: pyarrow>=14.0.1; python_version < "3.14" and extra == "pandas"
 Provides-Extra: secure-local-storage
 Requires-Dist: keyring<26.0.0,>=23.1.0; extra == "secure-local-storage"
 Dynamic: license-file
@@ -95,14 +96,16 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v4.7.0(Jul 2,2026)
+- v4.7.1(Jul 15,2026)
+  - Added support for Python 3.14t (free-threaded).
+    - **Note:** Python 3.14t CI testing excludes `win_arm64` (no `cryptography` wheels available) and `mitmproxy` proxy tests on all platforms (transitive dependencies `aioquic`/`pylsqpack` lack free-threaded-compatible wheels).
+  - Improved verification of TLS connections (SNOW-3675579).
   - Fixed `python-connector.log` not rotating on Windows, and every record being logged twice, when easy logging is enabled via `config.toml` (SNOW-3680325).
     - **Note:** As part of this fix, easy logging no longer calls `logging.basicConfig()` and therefore no longer configures the root logger. `python-connector.log` now captures only the `snowflake.connector`, `botocore`, and `boto3`.
   - Improved URL validation reliability by replacing the hand-rolled regex in `is_valid_url()` with `urllib.parse.urlparse` (SNOW-3392651).
   - Fixed OAuth infinite loop when tokens expire by ensuring `reauthenticate()` calls `_request_tokens()` directly instead of looping through `prepare()`. Token cache is now read exactly once per connection, and `_store_tokens()` preserves macOS Keychain ACL by never calling `remove()`. The async OAuth `reauthenticate()` now runs the synchronous OAuth flow on a worker thread instead of blocking the event loop.
   - Fixed OAuth scope handling for Snowflake custom OAuth: when refresh tokens are enabled, the connector no longer appends the OIDC `offline_access` scope for token endpoints on `*.snowflakecomputing.com` or `*.snowflakecomputing.cn`, which caused `invalid_scope` errors. Snowflake custom OAuth expects `refresh_token` in scope instead. External IdP behavior is unchanged.
   - Fixed input validation for `scale` metadata in Arrow result set processing for `TIME`, `TIMESTAMP_NTZ`, `TIMESTAMP_LTZ`, and `TIMESTAMP_TZ` columns (SNOW-3388299).
-  - Removed pandas upper bound dependency constraint on the `[pandas]` extra to allow installation of pandas 3.0.0 and later.
   - Fixed S3 storage client to correctly handle 307/308 (method-preserving) and 301/302 (GET/HEAD only) redirects by disabling automatic redirect following and re-signing each request with AWS SigV4 credentials for the redirect target. The region is updated from the `x-amz-bucket-region` response header on each redirect. Redirects are capped at 5 hops.
   - Added native AKS (Azure Kubernetes Service) workload identity support. When running on AKS with workload identity configured, the connector automatically uses `WorkloadIdentityCredential` to authenticate via the injected service account credentials. OIDC backward compatibility is also supported.
   - Added the `workload_identity_aws_use_outbound_token` connection option (default `false`) to opt into AWS WIF JWT attestation via STS `GetWebIdentityToken` instead of the default SigV4 `GetCallerIdentity` method.

{snowflake_connector_python-4.7.0 → snowflake_connector_python-4.7.1}/src/snowflake_connector_python.egg-info/requires.txt

@@ -40,17 +40,22 @@ pytest-xdist
 pytzdata
 responses
 
-[development:python_version >= "3.12"]
+[development:python_version >= "3.12" and python_version < "3.14"]
 mitmproxy>=12.0.0
 
 [pandas]
-pyarrow>=14.0.1
 
 [pandas:python_version < "3.13"]
-pandas>=1.0.0
+pandas<3.0.0,>=1.0.0
+
+[pandas:python_version < "3.14"]
+pyarrow>=14.0.1
 
 [pandas:python_version >= "3.13"]
-pandas>=2.1.2
+pandas<3.0.0,>=2.1.2
+
+[pandas:python_version >= "3.14"]
+pyarrow<24,>=14.0.1
 
 [secure-local-storage]
 keyring<26.0.0,>=23.1.0