snowflake-connector-python 4.7.0__tar.gz → 4.7.2__tar.gz

{snowflake_connector_python-4.7.0 → snowflake_connector_python-4.7.2}/DESCRIPTION.md

@@ -7,18 +7,29 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v4.7.0(Jul 2,2026)
+- v4.7.2(Aug 6,2026)
+  - Fixed a thread leak in the file transfer agent by properly shutting down ThreadPoolExecutors after PUT/GET transfers (SNOW-3556240, #2878).
+  - Fixed `split_statements` treating `//` as SQL instead of a line comment, which could merge multiple statements when a `//` comment contained an apostrophe (SNOW-3772985).
+  - Fixed large-file PUT uploads to internal Azure stages failing against the Azure 50,000-block-per-blob limit. The Azure multipart chunk size is now scaled up dynamically for very large files (mirroring the existing S3 behavior), and the default Azure chunk size was raised from 4 MB to 8 MB (consistent with S3) for better throughput (SNOW-3839943).
+  - Fixed OAuth cached-credential connections failing with `250001 Invalid OAuth access token` when the cached token was invalid (GS code `390303`); the connector now reauthenticates silently (via refresh token if available, otherwise browser) instead of hard-failing. Also fixed fresh processes holding only a cached refresh token going straight to an interactive browser prompt instead of attempting a silent refresh first.
+  - Fixed Okta/SAML authentication reporting an exhausted `login_timeout` as `250003: Failed to execute request: Attempted to set connect timeout to <negative value>`. Obtaining the one-time token in step 4 can overshoot the login deadline, which made the remaining budget negative; it was then passed to the HTTP layer, which rejected it with an opaque `ValueError`. A timed-out SAML login now raises `250006` with a message naming `login_timeout`. Running out of budget while retrying on `RefreshTokenError` reports the same error instead of failing later with an `AttributeError` on an empty response (SNOW-3891419).
+  - Fixed OAuth authorization code flow failing for accounts with uppercase letters in the account name. `urlparse().hostname` always returns lowercase, but the host was compared case-sensitively in `_is_snowflake_as_idp`, causing Snowflake-as-IdP detection to return `False` and raising error 251013 (`client_id is empty`) even for connections that don't require a client ID.
+
+- v4.7.1(Jul 15,2026)
+  - Added support for Python 3.14t (free-threaded).
+    - **Note:** Python 3.14t CI testing excludes `win_arm64` (no `cryptography` wheels available) and `mitmproxy` proxy tests on all platforms (transitive dependencies `aioquic`/`pylsqpack` lack free-threaded-compatible wheels).
+  - Improved verification of TLS connections (SNOW-3675579).
   - Fixed `python-connector.log` not rotating on Windows, and every record being logged twice, when easy logging is enabled via `config.toml` (SNOW-3680325).
     - **Note:** As part of this fix, easy logging no longer calls `logging.basicConfig()` and therefore no longer configures the root logger. `python-connector.log` now captures only the `snowflake.connector`, `botocore`, and `boto3`.
   - Improved URL validation reliability by replacing the hand-rolled regex in `is_valid_url()` with `urllib.parse.urlparse` (SNOW-3392651).
   - Fixed OAuth infinite loop when tokens expire by ensuring `reauthenticate()` calls `_request_tokens()` directly instead of looping through `prepare()`. Token cache is now read exactly once per connection, and `_store_tokens()` preserves macOS Keychain ACL by never calling `remove()`. The async OAuth `reauthenticate()` now runs the synchronous OAuth flow on a worker thread instead of blocking the event loop.
   - Fixed OAuth scope handling for Snowflake custom OAuth: when refresh tokens are enabled, the connector no longer appends the OIDC `offline_access` scope for token endpoints on `*.snowflakecomputing.com` or `*.snowflakecomputing.cn`, which caused `invalid_scope` errors. Snowflake custom OAuth expects `refresh_token` in scope instead. External IdP behavior is unchanged.
   - Fixed input validation for `scale` metadata in Arrow result set processing for `TIME`, `TIMESTAMP_NTZ`, `TIMESTAMP_LTZ`, and `TIMESTAMP_TZ` columns (SNOW-3388299).
-  - Removed pandas upper bound dependency constraint on the `[pandas]` extra to allow installation of pandas 3.0.0 and later.
   - Fixed S3 storage client to correctly handle 307/308 (method-preserving) and 301/302 (GET/HEAD only) redirects by disabling automatic redirect following and re-signing each request with AWS SigV4 credentials for the redirect target. The region is updated from the `x-amz-bucket-region` response header on each redirect. Redirects are capped at 5 hops.
   - Added native AKS (Azure Kubernetes Service) workload identity support. When running on AKS with workload identity configured, the connector automatically uses `WorkloadIdentityCredential` to authenticate via the injected service account credentials. OIDC backward compatibility is also supported.
   - Added the `workload_identity_aws_use_outbound_token` connection option (default `false`) to opt into AWS WIF JWT attestation via STS `GetWebIdentityToken` instead of the default SigV4 `GetCallerIdentity` method.
   - Fixed a bug where a fully-qualified DDL statement (e.g. `CREATE VIEW db.schema.obj`) on a session with no current schema would populate the connector's cached `_schema`/`_database` from the referenced object's namespace. This made `get_current_schema()` diverge from the server's `CURRENT_SCHEMA()` and mis-qualified Snowpark temp objects (SNOW-3665226).
+  - Fixed JWT key-pair authentication errors to surface the server's specific error code (e.g. `394304` for fingerprint mismatch, `394303` for clock skew) instead of always reporting the generic `250001`. Auth-rejection failures now also use SQLState `28000` (invalid authorization) instead of `08001` (SNOW-3775156).
 
 - v4.6.0(May 28,2026)
   - Dropped support for Python 3.9. The minimum supported version is now Python 3.10.

{snowflake_connector_python-4.7.0 → snowflake_connector_python-4.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.7.0
+Version: 4.7.2
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -27,6 +27,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: Free Threading :: 2 - Beta
 Classifier: Programming Language :: SQL
 Classifier: Topic :: Database
 Classifier: Topic :: Scientific/Engineering :: Information Analysis
@@ -61,10 +62,10 @@ Requires-Dist: botocore>=1.24; extra == "boto"
 Provides-Extra: azure
 Requires-Dist: azure-identity>=1.16; extra == "azure"
 Provides-Extra: development
-Requires-Dist: Cython; extra == "development"
+Requires-Dist: Cython>=3.1; extra == "development"
 Requires-Dist: azure-identity>=1.16; extra == "development"
 Requires-Dist: coverage; extra == "development"
-Requires-Dist: mitmproxy>=12.0.0; python_version >= "3.12" and extra == "development"
+Requires-Dist: mitmproxy>=12.0.0; (python_version >= "3.12" and python_version < "3.14") and extra == "development"
 Requires-Dist: more-itertools; extra == "development"
 Requires-Dist: numpy<=2.4.3; extra == "development"
 Requires-Dist: pendulum!=2.1.1; extra == "development"
@@ -78,9 +79,10 @@ Requires-Dist: pytest-xdist; extra == "development"
 Requires-Dist: pytzdata; extra == "development"
 Requires-Dist: responses; extra == "development"
 Provides-Extra: pandas
-Requires-Dist: pandas>=1.0.0; python_version < "3.13" and extra == "pandas"
-Requires-Dist: pandas>=2.1.2; python_version >= "3.13" and extra == "pandas"
-Requires-Dist: pyarrow>=14.0.1; extra == "pandas"
+Requires-Dist: pandas<3.0.0,>=1.0.0; python_version < "3.13" and extra == "pandas"
+Requires-Dist: pandas<3.0.0,>=2.1.2; python_version >= "3.13" and extra == "pandas"
+Requires-Dist: pyarrow<24,>=14.0.1; python_version >= "3.14" and extra == "pandas"
+Requires-Dist: pyarrow>=14.0.1; python_version < "3.14" and extra == "pandas"
 Provides-Extra: secure-local-storage
 Requires-Dist: keyring<26.0.0,>=23.1.0; extra == "secure-local-storage"
 Dynamic: license-file
@@ -95,18 +97,29 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v4.7.0(Jul 2,2026)
+- v4.7.2(Aug 6,2026)
+  - Fixed a thread leak in the file transfer agent by properly shutting down ThreadPoolExecutors after PUT/GET transfers (SNOW-3556240, #2878).
+  - Fixed `split_statements` treating `//` as SQL instead of a line comment, which could merge multiple statements when a `//` comment contained an apostrophe (SNOW-3772985).
+  - Fixed large-file PUT uploads to internal Azure stages failing against the Azure 50,000-block-per-blob limit. The Azure multipart chunk size is now scaled up dynamically for very large files (mirroring the existing S3 behavior), and the default Azure chunk size was raised from 4 MB to 8 MB (consistent with S3) for better throughput (SNOW-3839943).
+  - Fixed OAuth cached-credential connections failing with `250001 Invalid OAuth access token` when the cached token was invalid (GS code `390303`); the connector now reauthenticates silently (via refresh token if available, otherwise browser) instead of hard-failing. Also fixed fresh processes holding only a cached refresh token going straight to an interactive browser prompt instead of attempting a silent refresh first.
+  - Fixed Okta/SAML authentication reporting an exhausted `login_timeout` as `250003: Failed to execute request: Attempted to set connect timeout to <negative value>`. Obtaining the one-time token in step 4 can overshoot the login deadline, which made the remaining budget negative; it was then passed to the HTTP layer, which rejected it with an opaque `ValueError`. A timed-out SAML login now raises `250006` with a message naming `login_timeout`. Running out of budget while retrying on `RefreshTokenError` reports the same error instead of failing later with an `AttributeError` on an empty response (SNOW-3891419).
+  - Fixed OAuth authorization code flow failing for accounts with uppercase letters in the account name. `urlparse().hostname` always returns lowercase, but the host was compared case-sensitively in `_is_snowflake_as_idp`, causing Snowflake-as-IdP detection to return `False` and raising error 251013 (`client_id is empty`) even for connections that don't require a client ID.
+
+- v4.7.1(Jul 15,2026)
+  - Added support for Python 3.14t (free-threaded).
+    - **Note:** Python 3.14t CI testing excludes `win_arm64` (no `cryptography` wheels available) and `mitmproxy` proxy tests on all platforms (transitive dependencies `aioquic`/`pylsqpack` lack free-threaded-compatible wheels).
+  - Improved verification of TLS connections (SNOW-3675579).
   - Fixed `python-connector.log` not rotating on Windows, and every record being logged twice, when easy logging is enabled via `config.toml` (SNOW-3680325).
     - **Note:** As part of this fix, easy logging no longer calls `logging.basicConfig()` and therefore no longer configures the root logger. `python-connector.log` now captures only the `snowflake.connector`, `botocore`, and `boto3`.
   - Improved URL validation reliability by replacing the hand-rolled regex in `is_valid_url()` with `urllib.parse.urlparse` (SNOW-3392651).
   - Fixed OAuth infinite loop when tokens expire by ensuring `reauthenticate()` calls `_request_tokens()` directly instead of looping through `prepare()`. Token cache is now read exactly once per connection, and `_store_tokens()` preserves macOS Keychain ACL by never calling `remove()`. The async OAuth `reauthenticate()` now runs the synchronous OAuth flow on a worker thread instead of blocking the event loop.
   - Fixed OAuth scope handling for Snowflake custom OAuth: when refresh tokens are enabled, the connector no longer appends the OIDC `offline_access` scope for token endpoints on `*.snowflakecomputing.com` or `*.snowflakecomputing.cn`, which caused `invalid_scope` errors. Snowflake custom OAuth expects `refresh_token` in scope instead. External IdP behavior is unchanged.
   - Fixed input validation for `scale` metadata in Arrow result set processing for `TIME`, `TIMESTAMP_NTZ`, `TIMESTAMP_LTZ`, and `TIMESTAMP_TZ` columns (SNOW-3388299).
-  - Removed pandas upper bound dependency constraint on the `[pandas]` extra to allow installation of pandas 3.0.0 and later.
   - Fixed S3 storage client to correctly handle 307/308 (method-preserving) and 301/302 (GET/HEAD only) redirects by disabling automatic redirect following and re-signing each request with AWS SigV4 credentials for the redirect target. The region is updated from the `x-amz-bucket-region` response header on each redirect. Redirects are capped at 5 hops.
   - Added native AKS (Azure Kubernetes Service) workload identity support. When running on AKS with workload identity configured, the connector automatically uses `WorkloadIdentityCredential` to authenticate via the injected service account credentials. OIDC backward compatibility is also supported.
   - Added the `workload_identity_aws_use_outbound_token` connection option (default `false`) to opt into AWS WIF JWT attestation via STS `GetWebIdentityToken` instead of the default SigV4 `GetCallerIdentity` method.
   - Fixed a bug where a fully-qualified DDL statement (e.g. `CREATE VIEW db.schema.obj`) on a session with no current schema would populate the connector's cached `_schema`/`_database` from the referenced object's namespace. This made `get_current_schema()` diverge from the server's `CURRENT_SCHEMA()` and mis-qualified Snowpark temp objects (SNOW-3665226).
+  - Fixed JWT key-pair authentication errors to surface the server's specific error code (e.g. `394304` for fingerprint mismatch, `394303` for clock skew) instead of always reporting the generic `250001`. Auth-rejection failures now also use SQLState `28000` (invalid authorization) instead of `08001` (SNOW-3775156).
 
 - v4.6.0(May 28,2026)
   - Dropped support for Python 3.9. The minimum supported version is now Python 3.10.

{snowflake_connector_python-4.7.0 → snowflake_connector_python-4.7.2}/pyproject.toml

@@ -4,7 +4,9 @@ requires = [
     # and may be stricter than the version required in `setup.py`
     "setuptools>=40.6.0",
     "wheel",
-    "cython",
+    # cython>=3.1 is required for the `freethreading_compatible` directive
+    # used by src/snowflake/connector/nanoarrow_cpp/ArrowIterator/nanoarrow_arrow_iterator.pyx
+    "cython>=3.1",
 ]
 
 [tool.cibuildwheel]
@@ -12,6 +14,13 @@ test-skip = "*"
 manylinux-x86_64-image = "manylinux2014"
 environment = {AUDITWHEEL_PLAT="manylinux2014_$(uname -m)"}
 build-verbosity = 1
+# Opt in to free-threaded CPython wheel builds (cp313t, cp314t, ...).
+# Without this, cibuildwheel silently skips every `cp*t-*` target even when
+# the matrix and CIBW_BUILD env var ask for them. Requires cibuildwheel>=2.20.
+# Paired with the `freethreading_compatible` Cython directive in
+# src/snowflake/connector/nanoarrow_cpp/ArrowIterator/nanoarrow_arrow_iterator.pyx
+# so the produced wheel actually keeps the GIL disabled at import time.
+enable = ["cpython-freethreading"]
 
 [tool.cibuildwheel.linux]
 archs = ["x86_64", "aarch64"]

{snowflake_connector_python-4.7.0 → snowflake_connector_python-4.7.2}/setup.cfg

@@ -25,6 +25,7 @@ classifiers =
 	Programming Language :: Python :: 3.12
 	Programming Language :: Python :: 3.13
 	Programming Language :: Python :: 3.14
+	Programming Language :: Python :: Free Threading :: 2 - Beta
 	Programming Language :: SQL
 	Topic :: Database
 	Topic :: Scientific/Engineering :: Information Analysis
@@ -88,10 +89,10 @@ boto =
 azure = 
 	azure-identity>=1.16
 development = 
-	Cython
+	Cython>=3.1
 	azure-identity>=1.16
 	coverage
-	mitmproxy>=12.0.0; python_version >= '3.12'
+	mitmproxy>=12.0.0; python_version >= '3.12' and python_version < '3.14'
 	more-itertools
 	numpy<=2.4.3
 	pendulum!=2.1.1
@@ -105,9 +106,10 @@ development =
 	pytzdata
 	responses
 pandas = 
-	pandas>=1.0.0; python_version < '3.13'
-	pandas>=2.1.2; python_version >= '3.13'
-	pyarrow>=14.0.1
+	pandas>=1.0.0,<3.0.0; python_version < '3.13'
+	pandas>=2.1.2,<3.0.0; python_version >= '3.13'
+	pyarrow>=14.0.1,<24; python_version >= '3.14'
+	pyarrow>=14.0.1; python_version < '3.14'
 secure-local-storage = 
 	keyring>=23.1.0,<26.0.0
 

{snowflake_connector_python-4.7.0 → snowflake_connector_python-4.7.2}/src/snowflake/connector/aio/auth/_auth.py

@@ -29,12 +29,16 @@ from ...errors import (
 from ...network import (
     ACCEPT_TYPE_APPLICATION_SNOWFLAKE,
     CONTENT_TYPE_APPLICATION_JSON,
+    CREDENTIAL_REJECTION_GS_CODES,
     ID_TOKEN_INVALID_LOGIN_REQUEST_GS_CODE,
     OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE,
     PYTHON_CONNECTOR_USER_AGENT,
     ReauthenticationRequest,
 )
-from ...sqlstate import SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED
+from ...sqlstate import (
+    SQLSTATE_AUTHORIZATION_FAILURE,
+    SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED,
+)
 from ...token_cache import TokenType
 from ._no_auth import AuthNoAuth
 
@@ -334,8 +338,12 @@ class Auth(AuthSync):
                         port=self._rest._port,
                         message=ret["message"],
                     ),
-                    "errno": ER_FAILED_TO_CONNECT_TO_DB,
-                    "sqlstate": SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED,
+                    "errno": int(errno),
+                    "sqlstate": (
+                        SQLSTATE_AUTHORIZATION_FAILURE
+                        if str(errno) in CREDENTIAL_REJECTION_GS_CODES
+                        else SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED
+                    ),
                 },
             )
         else:

{snowflake_connector_python-4.7.0 → snowflake_connector_python-4.7.2}/src/snowflake/connector/aio/auth/_okta.py

@@ -212,7 +212,7 @@ class AuthByOkta(AuthByPluginAsync, AuthByOktaSync):
     ) -> dict[Any, Any]:
         logger.debug("step 4: query IDP URL snowflake app to get SAML " "response")
         timeout_time = time.time() + conn.login_timeout if conn.login_timeout else None
-        response_html = {}
+        response_html = None
         origin_sso_url = sso_url
         while timeout_time is None or time.time() < timeout_time:
             try:
@@ -225,6 +225,12 @@ class AuthByOkta(AuthByPluginAsync, AuthByOktaSync):
                     HTTP_HEADER_ACCEPT: "*/*",
                 }
                 remaining_timeout = timeout_time - time.time() if timeout_time else None
+                if remaining_timeout is not None and remaining_timeout <= 0:
+                    # Obtaining the one time token consumed the whole login budget.
+                    # The HTTP layer rejects a non-positive timeout with an opaque
+                    # ValueError, so stop here and report the timeout that actually
+                    # happened.
+                    break
                 response_html = await conn.rest.fetch(
                     "get",
                     sso_url,
@@ -237,6 +243,10 @@ class AuthByOkta(AuthByPluginAsync, AuthByOktaSync):
                 break
             except RefreshTokenError:
                 logger.debug("step4: refresh token for re-authentication")
+        if response_html is None:
+            # Every way out of the loop above without a response means the
+            # login_timeout budget ran out.
+            AuthByOktaSync._handle_login_timeout(conn)
         return response_html
 
     async def _step5(

{snowflake_connector_python-4.7.0 → snowflake_connector_python-4.7.2}/src/snowflake/connector/auth/_auth.py

@@ -51,8 +51,10 @@ from ..errors import (
 from ..network import (
     ACCEPT_TYPE_APPLICATION_SNOWFLAKE,
     CONTENT_TYPE_APPLICATION_JSON,
+    CREDENTIAL_REJECTION_GS_CODES,
     ID_TOKEN_INVALID_LOGIN_REQUEST_GS_CODE,
     OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE,
+    OAUTH_ACCESS_TOKEN_INVALID_GS_CODE,
     PYTHON_CONNECTOR_USER_AGENT,
     ReauthenticationRequest,
 )
@@ -61,12 +63,15 @@ from ..platform_detection import detect_platforms
 from ..session_manager import BaseHttpConfig, HttpConfig
 from ..session_manager import SessionManager as SyncSessionManager
 from ..session_manager import SessionManagerFactory
-from ..sqlstate import SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED
+from ..sqlstate import (
+    SQLSTATE_AUTHORIZATION_FAILURE,
+    SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED,
+)
 from ..token_cache import TokenCache, TokenKey, TokenType
 from ..util_text import expand_tilde
 from ..version import VERSION
+from ._oauth_base import AuthByOAuthBase
 from .no_auth import AuthNoAuth
-from .oauth import AuthByOAuth
 
 if TYPE_CHECKING:
     from . import AuthByPlugin
@@ -419,11 +424,24 @@ class Auth:
                         sqlstate=SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED,
                     )
                 )
-            elif (errno == OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE) and (
-                # SNOW-2329031: OAuth v1.0 does not support token renewal,
-                # for backward compatibility, we do not raise an exception here
-                not isinstance(auth_instance, AuthByOAuth)
-            ):
+            elif (
+                errno
+                in (
+                    OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE,
+                    OAUTH_ACCESS_TOKEN_INVALID_GS_CODE,
+                )
+            ) and isinstance(auth_instance, AuthByOAuthBase):
+                # A presented OAuth access token was rejected as expired (390318)
+                # or invalid (390303) - both are OAuth-scoped codes in GS.
+                # Reauthenticate (via refresh token or interactive) instead of
+                # hard-failing; reauthenticate() also evicts the stale token from
+                # the cache on terminal failure so it is not replayed.
+                #
+                # The guard is a positive isinstance(AuthByOAuthBase): only OAuth
+                # v2 authenticators (authorization-code, client-credentials) can
+                # renew a token. This excludes OAuth v1.0 (AuthByOAuth), whose
+                # user-supplied token cannot be renewed (SNOW-2329031), and keeps
+                # any non-OAuth authenticator out of the reauth retry.
                 raise ReauthenticationRequest(
                     ProgrammingError(
                         msg=ret["message"],
@@ -460,8 +478,12 @@ class Auth:
                         port=self._rest._port,
                         message=ret["message"],
                     ),
-                    "errno": ER_FAILED_TO_CONNECT_TO_DB,
-                    "sqlstate": SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED,
+                    "errno": int(errno),
+                    "sqlstate": (
+                        SQLSTATE_AUTHORIZATION_FAILURE
+                        if str(errno) in CREDENTIAL_REJECTION_GS_CODES
+                        else SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED
+                    ),
                 },
             )
         else:

{snowflake_connector_python-4.7.0 → snowflake_connector_python-4.7.2}/src/snowflake/connector/auth/_oauth_base.py

@@ -118,6 +118,23 @@ class _OAuthTokensMixin:
             if key:
                 self._token_cache.remove(key)
 
+    def _invalidate_access_token(self) -> None:
+        """Clear a confirmed-invalid access token from memory and cache.
+
+        Prevents a poisoned cached access token from being replayed on the next
+        connection (the symptom that made disabling the credential cache the only
+        workaround). Only call this on a *terminal* rejection, i.e. when it will
+        NOT be followed by a store of a fresh token: a lone remove() is safe, but
+        the remove-then-store pattern destroys macOS Keychain ACL entries. On a
+        successful reauth the new token is written via _store_tokens(), which
+        overwrites the stale one ACL-safely without a remove().
+        """
+        self._access_token = None
+        if self._token_cache:
+            key = self._get_access_token_cache_key()
+            if key:
+                self._token_cache.remove(key)
+
     def _store_tokens(
         self, access_token: str | None = None, refresh_token: str | None = None
     ) -> None:
@@ -308,6 +325,10 @@ class AuthByOAuthBase(AuthByPlugin, _OAuthTokensMixin, ABC):
             password=None,
         )
         if access_token is None:
+            # Terminal rejection: we could not obtain a new access token, so the
+            # stale one must not linger in the cache to be replayed next time.
+            # This is a lone remove() (no subsequent store), so it is ACL-safe.
+            self._invalidate_access_token()
             self._handle_failure(
                 conn=conn,
                 ret={
@@ -338,7 +359,43 @@ class AuthByOAuthBase(AuthByPlugin, _OAuthTokensMixin, ABC):
             logger.info("OAuth access token is already available in cache")
             return
 
-        # No cached token - request fresh tokens via browser
+        # No cached access token, but a cached refresh token may still be usable
+        # (loaded into memory above). Try to exchange it for a new access token
+        # BEFORE falling back to interactive auth, so a fresh process can refresh
+        # silently without a browser prompt. Gated on refresh_token_enabled, so
+        # behavior is unchanged when refresh tokens are disabled.
+        if self._refresh_token_enabled and self._refresh_token:
+            logger.debug(
+                "no cached OAuth access token; attempting silent refresh using "
+                "the cached refresh token"
+            )
+            try:
+                self._do_refresh_token(conn=conn)
+            except Exception as exc:
+                # A silent refresh at connection setup must never hard-fail the
+                # connection. _get_refresh_token_response() surfaces transport
+                # failures (e.g. a transient network error or an urllib3
+                # exception reaching the token endpoint) through _handle_failure,
+                # which raises. Swallow it here and fall back to interactive auth,
+                # which can still recover - this is the whole point of a proactive
+                # refresh. Note this differs from reauthenticate(), where raising
+                # mid-session is the correct behavior.
+                logger.debug(
+                    "silent refresh raised %s; falling back to interactive "
+                    "authentication",
+                    exc,
+                )
+            if self._access_token is not None:
+                logger.info(
+                    "obtained a new OAuth access token via the cached refresh token"
+                )
+                return
+            logger.debug(
+                "silent refresh did not yield an access token; falling back to "
+                "interactive authentication"
+            )
+
+        # No usable cached tokens - request fresh tokens via browser
         access_token, refresh_token = self._request_tokens(
             conn=conn,
             authenticator=authenticator,

{snowflake_connector_python-4.7.0 → snowflake_connector_python-4.7.2}/src/snowflake/connector/auth/oauth_code.py

@@ -431,7 +431,7 @@ You can close this window now and go back where you started from.
                 parsed_host = urllib.parse.urlparse(url).hostname
             except ValueError:
                 return False
-            return parsed_host is not None and parsed_host == host
+            return parsed_host is not None and parsed_host == host.lower()
 
         return _matches_host(authentication_url) and _matches_host(token_request_url)
 

{snowflake_connector_python-4.7.0 → snowflake_connector_python-4.7.2}/src/snowflake/connector/auth/okta.py

@@ -15,7 +15,7 @@ from ..constants import (
     HTTP_HEADER_USER_AGENT,
 )
 from ..errorcode import ER_IDP_CONNECTION_ERROR, ER_INCORRECT_DESTINATION
-from ..errors import DatabaseError, Error, RefreshTokenError
+from ..errors import DatabaseError, Error, OperationalError, RefreshTokenError
 from ..network import CONTENT_TYPE_APPLICATION_JSON, PYTHON_CONNECTOR_USER_AGENT
 from ..sqlstate import SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED
 from . import Auth
@@ -276,7 +276,7 @@ class AuthByOkta(AuthByPlugin):
     ) -> dict[Any, Any]:
         logger.debug("step 4: query IDP URL snowflake app to get SAML " "response")
         timeout_time = time.time() + conn.login_timeout if conn.login_timeout else None
-        response_html = {}
+        response_html = None
         origin_sso_url = sso_url
         while timeout_time is None or time.time() < timeout_time:
             try:
@@ -289,6 +289,12 @@ class AuthByOkta(AuthByPlugin):
                     HTTP_HEADER_ACCEPT: "*/*",
                 }
                 remaining_timeout = timeout_time - time.time() if timeout_time else None
+                if remaining_timeout is not None and remaining_timeout <= 0:
+                    # Obtaining the one time token consumed the whole login budget.
+                    # The HTTP layer rejects a non-positive timeout with an opaque
+                    # ValueError, so stop here and report the timeout that actually
+                    # happened.
+                    break
                 response_html = conn.rest.fetch(
                     "get",
                     sso_url,
@@ -301,8 +307,29 @@ class AuthByOkta(AuthByPlugin):
                 break
             except RefreshTokenError:
                 logger.debug("step4: refresh token for re-authentication")
+        if response_html is None:
+            # Every way out of the loop above without a response means the
+            # login_timeout budget ran out.
+            AuthByOkta._handle_login_timeout(conn)
         return response_html
 
+    @staticmethod
+    def _handle_login_timeout(conn: SnowflakeConnection) -> None:
+        Error.errorhandler_wrapper(
+            conn._rest._connection,
+            None,
+            OperationalError,
+            {
+                "msg": (
+                    f"Timed out after {conn.login_timeout} second(s) waiting for "
+                    "the identity provider to return a SAML response. Consider "
+                    "increasing login_timeout."
+                ),
+                "errno": ER_IDP_CONNECTION_ERROR,
+                "sqlstate": SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED,
+            },
+        )
+
     def _step5(
         self,
         conn: SnowflakeConnection,

{snowflake_connector_python-4.7.0 → snowflake_connector_python-4.7.2}/src/snowflake/connector/connection.py

@@ -2025,7 +2025,22 @@ class SnowflakeConnection:
             ):
                 # IDToken and OAuth auth need to authenticate through
                 # SSO if its credential has expired
-                self._reauthenticate()
+                result = self._reauthenticate()
+                # AuthByIdToken re-establishes the session inside reauthenticate()
+                # (it swaps to browser auth and re-runs _authenticate). The OAuth
+                # authenticators only obtain a fresh access token, so we must
+                # re-post the login here to actually establish a session with the
+                # new token - otherwise the connection is left without a session
+                # token and the first query fails with 250002 (connection closed).
+                # prepare() short-circuits on the in-memory token (tokens load from
+                # cache only once per connection), so this does not loop back into
+                # another refresh.
+                if (
+                    type(auth_instance) in (AuthByOauthCode, AuthByOauthCredentials)
+                    and isinstance(result, dict)
+                    and result.get("success")
+                ):
+                    self._authenticate(auth_instance)
             else:
                 self._authenticate(auth_instance)
 

{snowflake_connector_python-4.7.0 → snowflake_connector_python-4.7.2}/src/snowflake/connector/constants.py

@@ -430,7 +430,13 @@ S3_MIN_PART_SIZE = 5 * 1024**2
 S3_MAX_PARTS = 10000
 
 S3_CHUNK_SIZE = 8388608  # boto3 default
-AZURE_CHUNK_SIZE = 4 * megabyte
+
+# Azure Block Blob multipart upload limits
+# https://learn.microsoft.com/en-us/rest/api/storageservices/understanding-block-blobs--append-blobs--and-page-blobs
+AZURE_CHUNK_SIZE = 8 * megabyte  # kept consistent with S3_DEFAULT_CHUNK_SIZE
+AZURE_MAX_BLOCKS = 50000
+AZURE_MAX_BLOCK_SIZE = 4000 * megabyte
+AZURE_MAX_OBJECT_SIZE = AZURE_MAX_BLOCKS * AZURE_MAX_BLOCK_SIZE
 
 # https://requests.readthedocs.io/en/latest/user/advanced/#timeouts
 REQUEST_CONNECTION_TIMEOUT = 10