snowflake-connector-python 4.7.1__tar.gz → 4.7.2__tar.gz

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.2}/DESCRIPTION.md

@@ -7,6 +7,14 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.7.2(Aug 6,2026)
+  - Fixed a thread leak in the file transfer agent by properly shutting down ThreadPoolExecutors after PUT/GET transfers (SNOW-3556240, #2878).
+  - Fixed `split_statements` treating `//` as SQL instead of a line comment, which could merge multiple statements when a `//` comment contained an apostrophe (SNOW-3772985).
+  - Fixed large-file PUT uploads to internal Azure stages failing against the Azure 50,000-block-per-blob limit. The Azure multipart chunk size is now scaled up dynamically for very large files (mirroring the existing S3 behavior), and the default Azure chunk size was raised from 4 MB to 8 MB (consistent with S3) for better throughput (SNOW-3839943).
+  - Fixed OAuth cached-credential connections failing with `250001 Invalid OAuth access token` when the cached token was invalid (GS code `390303`); the connector now reauthenticates silently (via refresh token if available, otherwise browser) instead of hard-failing. Also fixed fresh processes holding only a cached refresh token going straight to an interactive browser prompt instead of attempting a silent refresh first.
+  - Fixed Okta/SAML authentication reporting an exhausted `login_timeout` as `250003: Failed to execute request: Attempted to set connect timeout to <negative value>`. Obtaining the one-time token in step 4 can overshoot the login deadline, which made the remaining budget negative; it was then passed to the HTTP layer, which rejected it with an opaque `ValueError`. A timed-out SAML login now raises `250006` with a message naming `login_timeout`. Running out of budget while retrying on `RefreshTokenError` reports the same error instead of failing later with an `AttributeError` on an empty response (SNOW-3891419).
+  - Fixed OAuth authorization code flow failing for accounts with uppercase letters in the account name. `urlparse().hostname` always returns lowercase, but the host was compared case-sensitively in `_is_snowflake_as_idp`, causing Snowflake-as-IdP detection to return `False` and raising error 251013 (`client_id is empty`) even for connections that don't require a client ID.
+
 - v4.7.1(Jul 15,2026)
   - Added support for Python 3.14t (free-threaded).
     - **Note:** Python 3.14t CI testing excludes `win_arm64` (no `cryptography` wheels available) and `mitmproxy` proxy tests on all platforms (transitive dependencies `aioquic`/`pylsqpack` lack free-threaded-compatible wheels).
@@ -21,6 +29,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Added native AKS (Azure Kubernetes Service) workload identity support. When running on AKS with workload identity configured, the connector automatically uses `WorkloadIdentityCredential` to authenticate via the injected service account credentials. OIDC backward compatibility is also supported.
   - Added the `workload_identity_aws_use_outbound_token` connection option (default `false`) to opt into AWS WIF JWT attestation via STS `GetWebIdentityToken` instead of the default SigV4 `GetCallerIdentity` method.
   - Fixed a bug where a fully-qualified DDL statement (e.g. `CREATE VIEW db.schema.obj`) on a session with no current schema would populate the connector's cached `_schema`/`_database` from the referenced object's namespace. This made `get_current_schema()` diverge from the server's `CURRENT_SCHEMA()` and mis-qualified Snowpark temp objects (SNOW-3665226).
+  - Fixed JWT key-pair authentication errors to surface the server's specific error code (e.g. `394304` for fingerprint mismatch, `394303` for clock skew) instead of always reporting the generic `250001`. Auth-rejection failures now also use SQLState `28000` (invalid authorization) instead of `08001` (SNOW-3775156).
 
 - v4.6.0(May 28,2026)
   - Dropped support for Python 3.9. The minimum supported version is now Python 3.10.

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.7.1
+Version: 4.7.2
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -27,6 +27,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: Free Threading :: 2 - Beta
 Classifier: Programming Language :: SQL
 Classifier: Topic :: Database
 Classifier: Topic :: Scientific/Engineering :: Information Analysis
@@ -61,7 +62,7 @@ Requires-Dist: botocore>=1.24; extra == "boto"
 Provides-Extra: azure
 Requires-Dist: azure-identity>=1.16; extra == "azure"
 Provides-Extra: development
-Requires-Dist: Cython; extra == "development"
+Requires-Dist: Cython>=3.1; extra == "development"
 Requires-Dist: azure-identity>=1.16; extra == "development"
 Requires-Dist: coverage; extra == "development"
 Requires-Dist: mitmproxy>=12.0.0; (python_version >= "3.12" and python_version < "3.14") and extra == "development"
@@ -96,6 +97,14 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.7.2(Aug 6,2026)
+  - Fixed a thread leak in the file transfer agent by properly shutting down ThreadPoolExecutors after PUT/GET transfers (SNOW-3556240, #2878).
+  - Fixed `split_statements` treating `//` as SQL instead of a line comment, which could merge multiple statements when a `//` comment contained an apostrophe (SNOW-3772985).
+  - Fixed large-file PUT uploads to internal Azure stages failing against the Azure 50,000-block-per-blob limit. The Azure multipart chunk size is now scaled up dynamically for very large files (mirroring the existing S3 behavior), and the default Azure chunk size was raised from 4 MB to 8 MB (consistent with S3) for better throughput (SNOW-3839943).
+  - Fixed OAuth cached-credential connections failing with `250001 Invalid OAuth access token` when the cached token was invalid (GS code `390303`); the connector now reauthenticates silently (via refresh token if available, otherwise browser) instead of hard-failing. Also fixed fresh processes holding only a cached refresh token going straight to an interactive browser prompt instead of attempting a silent refresh first.
+  - Fixed Okta/SAML authentication reporting an exhausted `login_timeout` as `250003: Failed to execute request: Attempted to set connect timeout to <negative value>`. Obtaining the one-time token in step 4 can overshoot the login deadline, which made the remaining budget negative; it was then passed to the HTTP layer, which rejected it with an opaque `ValueError`. A timed-out SAML login now raises `250006` with a message naming `login_timeout`. Running out of budget while retrying on `RefreshTokenError` reports the same error instead of failing later with an `AttributeError` on an empty response (SNOW-3891419).
+  - Fixed OAuth authorization code flow failing for accounts with uppercase letters in the account name. `urlparse().hostname` always returns lowercase, but the host was compared case-sensitively in `_is_snowflake_as_idp`, causing Snowflake-as-IdP detection to return `False` and raising error 251013 (`client_id is empty`) even for connections that don't require a client ID.
+
 - v4.7.1(Jul 15,2026)
   - Added support for Python 3.14t (free-threaded).
     - **Note:** Python 3.14t CI testing excludes `win_arm64` (no `cryptography` wheels available) and `mitmproxy` proxy tests on all platforms (transitive dependencies `aioquic`/`pylsqpack` lack free-threaded-compatible wheels).
@@ -110,6 +119,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Added native AKS (Azure Kubernetes Service) workload identity support. When running on AKS with workload identity configured, the connector automatically uses `WorkloadIdentityCredential` to authenticate via the injected service account credentials. OIDC backward compatibility is also supported.
   - Added the `workload_identity_aws_use_outbound_token` connection option (default `false`) to opt into AWS WIF JWT attestation via STS `GetWebIdentityToken` instead of the default SigV4 `GetCallerIdentity` method.
   - Fixed a bug where a fully-qualified DDL statement (e.g. `CREATE VIEW db.schema.obj`) on a session with no current schema would populate the connector's cached `_schema`/`_database` from the referenced object's namespace. This made `get_current_schema()` diverge from the server's `CURRENT_SCHEMA()` and mis-qualified Snowpark temp objects (SNOW-3665226).
+  - Fixed JWT key-pair authentication errors to surface the server's specific error code (e.g. `394304` for fingerprint mismatch, `394303` for clock skew) instead of always reporting the generic `250001`. Auth-rejection failures now also use SQLState `28000` (invalid authorization) instead of `08001` (SNOW-3775156).
 
 - v4.6.0(May 28,2026)
   - Dropped support for Python 3.9. The minimum supported version is now Python 3.10.

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.2}/pyproject.toml

@@ -4,7 +4,9 @@ requires = [
     # and may be stricter than the version required in `setup.py`
     "setuptools>=40.6.0",
     "wheel",
-    "cython",
+    # cython>=3.1 is required for the `freethreading_compatible` directive
+    # used by src/snowflake/connector/nanoarrow_cpp/ArrowIterator/nanoarrow_arrow_iterator.pyx
+    "cython>=3.1",
 ]
 
 [tool.cibuildwheel]
@@ -12,6 +14,13 @@ test-skip = "*"
 manylinux-x86_64-image = "manylinux2014"
 environment = {AUDITWHEEL_PLAT="manylinux2014_$(uname -m)"}
 build-verbosity = 1
+# Opt in to free-threaded CPython wheel builds (cp313t, cp314t, ...).
+# Without this, cibuildwheel silently skips every `cp*t-*` target even when
+# the matrix and CIBW_BUILD env var ask for them. Requires cibuildwheel>=2.20.
+# Paired with the `freethreading_compatible` Cython directive in
+# src/snowflake/connector/nanoarrow_cpp/ArrowIterator/nanoarrow_arrow_iterator.pyx
+# so the produced wheel actually keeps the GIL disabled at import time.
+enable = ["cpython-freethreading"]
 
 [tool.cibuildwheel.linux]
 archs = ["x86_64", "aarch64"]

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.2}/setup.cfg

@@ -25,6 +25,7 @@ classifiers =
 	Programming Language :: Python :: 3.12
 	Programming Language :: Python :: 3.13
 	Programming Language :: Python :: 3.14
+	Programming Language :: Python :: Free Threading :: 2 - Beta
 	Programming Language :: SQL
 	Topic :: Database
 	Topic :: Scientific/Engineering :: Information Analysis
@@ -88,7 +89,7 @@ boto =
 azure = 
 	azure-identity>=1.16
 development = 
-	Cython
+	Cython>=3.1
 	azure-identity>=1.16
 	coverage
 	mitmproxy>=12.0.0; python_version >= '3.12' and python_version < '3.14'

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.2}/src/snowflake/connector/aio/auth/_auth.py

@@ -29,12 +29,16 @@ from ...errors import (
 from ...network import (
     ACCEPT_TYPE_APPLICATION_SNOWFLAKE,
     CONTENT_TYPE_APPLICATION_JSON,
+    CREDENTIAL_REJECTION_GS_CODES,
     ID_TOKEN_INVALID_LOGIN_REQUEST_GS_CODE,
     OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE,
     PYTHON_CONNECTOR_USER_AGENT,
     ReauthenticationRequest,
 )
-from ...sqlstate import SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED
+from ...sqlstate import (
+    SQLSTATE_AUTHORIZATION_FAILURE,
+    SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED,
+)
 from ...token_cache import TokenType
 from ._no_auth import AuthNoAuth
 
@@ -334,8 +338,12 @@ class Auth(AuthSync):
                         port=self._rest._port,
                         message=ret["message"],
                     ),
-                    "errno": ER_FAILED_TO_CONNECT_TO_DB,
-                    "sqlstate": SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED,
+                    "errno": int(errno),
+                    "sqlstate": (
+                        SQLSTATE_AUTHORIZATION_FAILURE
+                        if str(errno) in CREDENTIAL_REJECTION_GS_CODES
+                        else SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED
+                    ),
                 },
             )
         else:

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.2}/src/snowflake/connector/aio/auth/_okta.py

@@ -212,7 +212,7 @@ class AuthByOkta(AuthByPluginAsync, AuthByOktaSync):
     ) -> dict[Any, Any]:
         logger.debug("step 4: query IDP URL snowflake app to get SAML " "response")
         timeout_time = time.time() + conn.login_timeout if conn.login_timeout else None
-        response_html = {}
+        response_html = None
         origin_sso_url = sso_url
         while timeout_time is None or time.time() < timeout_time:
             try:
@@ -225,6 +225,12 @@ class AuthByOkta(AuthByPluginAsync, AuthByOktaSync):
                     HTTP_HEADER_ACCEPT: "*/*",
                 }
                 remaining_timeout = timeout_time - time.time() if timeout_time else None
+                if remaining_timeout is not None and remaining_timeout <= 0:
+                    # Obtaining the one time token consumed the whole login budget.
+                    # The HTTP layer rejects a non-positive timeout with an opaque
+                    # ValueError, so stop here and report the timeout that actually
+                    # happened.
+                    break
                 response_html = await conn.rest.fetch(
                     "get",
                     sso_url,
@@ -237,6 +243,10 @@ class AuthByOkta(AuthByPluginAsync, AuthByOktaSync):
                 break
             except RefreshTokenError:
                 logger.debug("step4: refresh token for re-authentication")
+        if response_html is None:
+            # Every way out of the loop above without a response means the
+            # login_timeout budget ran out.
+            AuthByOktaSync._handle_login_timeout(conn)
         return response_html
 
     async def _step5(

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.2}/src/snowflake/connector/auth/_auth.py

@@ -51,8 +51,10 @@ from ..errors import (
 from ..network import (
     ACCEPT_TYPE_APPLICATION_SNOWFLAKE,
     CONTENT_TYPE_APPLICATION_JSON,
+    CREDENTIAL_REJECTION_GS_CODES,
     ID_TOKEN_INVALID_LOGIN_REQUEST_GS_CODE,
     OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE,
+    OAUTH_ACCESS_TOKEN_INVALID_GS_CODE,
     PYTHON_CONNECTOR_USER_AGENT,
     ReauthenticationRequest,
 )
@@ -61,12 +63,15 @@ from ..platform_detection import detect_platforms
 from ..session_manager import BaseHttpConfig, HttpConfig
 from ..session_manager import SessionManager as SyncSessionManager
 from ..session_manager import SessionManagerFactory
-from ..sqlstate import SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED
+from ..sqlstate import (
+    SQLSTATE_AUTHORIZATION_FAILURE,
+    SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED,
+)
 from ..token_cache import TokenCache, TokenKey, TokenType
 from ..util_text import expand_tilde
 from ..version import VERSION
+from ._oauth_base import AuthByOAuthBase
 from .no_auth import AuthNoAuth
-from .oauth import AuthByOAuth
 
 if TYPE_CHECKING:
     from . import AuthByPlugin
@@ -419,11 +424,24 @@ class Auth:
                         sqlstate=SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED,
                     )
                 )
-            elif (errno == OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE) and (
-                # SNOW-2329031: OAuth v1.0 does not support token renewal,
-                # for backward compatibility, we do not raise an exception here
-                not isinstance(auth_instance, AuthByOAuth)
-            ):
+            elif (
+                errno
+                in (
+                    OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE,
+                    OAUTH_ACCESS_TOKEN_INVALID_GS_CODE,
+                )
+            ) and isinstance(auth_instance, AuthByOAuthBase):
+                # A presented OAuth access token was rejected as expired (390318)
+                # or invalid (390303) - both are OAuth-scoped codes in GS.
+                # Reauthenticate (via refresh token or interactive) instead of
+                # hard-failing; reauthenticate() also evicts the stale token from
+                # the cache on terminal failure so it is not replayed.
+                #
+                # The guard is a positive isinstance(AuthByOAuthBase): only OAuth
+                # v2 authenticators (authorization-code, client-credentials) can
+                # renew a token. This excludes OAuth v1.0 (AuthByOAuth), whose
+                # user-supplied token cannot be renewed (SNOW-2329031), and keeps
+                # any non-OAuth authenticator out of the reauth retry.
                 raise ReauthenticationRequest(
                     ProgrammingError(
                         msg=ret["message"],
@@ -460,8 +478,12 @@ class Auth:
                         port=self._rest._port,
                         message=ret["message"],
                     ),
-                    "errno": ER_FAILED_TO_CONNECT_TO_DB,
-                    "sqlstate": SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED,
+                    "errno": int(errno),
+                    "sqlstate": (
+                        SQLSTATE_AUTHORIZATION_FAILURE
+                        if str(errno) in CREDENTIAL_REJECTION_GS_CODES
+                        else SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED
+                    ),
                 },
             )
         else:

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.2}/src/snowflake/connector/auth/_oauth_base.py

@@ -118,6 +118,23 @@ class _OAuthTokensMixin:
             if key:
                 self._token_cache.remove(key)
 
+    def _invalidate_access_token(self) -> None:
+        """Clear a confirmed-invalid access token from memory and cache.
+
+        Prevents a poisoned cached access token from being replayed on the next
+        connection (the symptom that made disabling the credential cache the only
+        workaround). Only call this on a *terminal* rejection, i.e. when it will
+        NOT be followed by a store of a fresh token: a lone remove() is safe, but
+        the remove-then-store pattern destroys macOS Keychain ACL entries. On a
+        successful reauth the new token is written via _store_tokens(), which
+        overwrites the stale one ACL-safely without a remove().
+        """
+        self._access_token = None
+        if self._token_cache:
+            key = self._get_access_token_cache_key()
+            if key:
+                self._token_cache.remove(key)
+
     def _store_tokens(
         self, access_token: str | None = None, refresh_token: str | None = None
     ) -> None:
@@ -308,6 +325,10 @@ class AuthByOAuthBase(AuthByPlugin, _OAuthTokensMixin, ABC):
             password=None,
         )
         if access_token is None:
+            # Terminal rejection: we could not obtain a new access token, so the
+            # stale one must not linger in the cache to be replayed next time.
+            # This is a lone remove() (no subsequent store), so it is ACL-safe.
+            self._invalidate_access_token()
             self._handle_failure(
                 conn=conn,
                 ret={
@@ -338,7 +359,43 @@ class AuthByOAuthBase(AuthByPlugin, _OAuthTokensMixin, ABC):
             logger.info("OAuth access token is already available in cache")
             return
 
-        # No cached token - request fresh tokens via browser
+        # No cached access token, but a cached refresh token may still be usable
+        # (loaded into memory above). Try to exchange it for a new access token
+        # BEFORE falling back to interactive auth, so a fresh process can refresh
+        # silently without a browser prompt. Gated on refresh_token_enabled, so
+        # behavior is unchanged when refresh tokens are disabled.
+        if self._refresh_token_enabled and self._refresh_token:
+            logger.debug(
+                "no cached OAuth access token; attempting silent refresh using "
+                "the cached refresh token"
+            )
+            try:
+                self._do_refresh_token(conn=conn)
+            except Exception as exc:
+                # A silent refresh at connection setup must never hard-fail the
+                # connection. _get_refresh_token_response() surfaces transport
+                # failures (e.g. a transient network error or an urllib3
+                # exception reaching the token endpoint) through _handle_failure,
+                # which raises. Swallow it here and fall back to interactive auth,
+                # which can still recover - this is the whole point of a proactive
+                # refresh. Note this differs from reauthenticate(), where raising
+                # mid-session is the correct behavior.
+                logger.debug(
+                    "silent refresh raised %s; falling back to interactive "
+                    "authentication",
+                    exc,
+                )
+            if self._access_token is not None:
+                logger.info(
+                    "obtained a new OAuth access token via the cached refresh token"
+                )
+                return
+            logger.debug(
+                "silent refresh did not yield an access token; falling back to "
+                "interactive authentication"
+            )
+
+        # No usable cached tokens - request fresh tokens via browser
         access_token, refresh_token = self._request_tokens(
             conn=conn,
             authenticator=authenticator,

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.2}/src/snowflake/connector/auth/oauth_code.py

@@ -431,7 +431,7 @@ You can close this window now and go back where you started from.
                 parsed_host = urllib.parse.urlparse(url).hostname
             except ValueError:
                 return False
-            return parsed_host is not None and parsed_host == host
+            return parsed_host is not None and parsed_host == host.lower()
 
         return _matches_host(authentication_url) and _matches_host(token_request_url)
 

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.2}/src/snowflake/connector/auth/okta.py

@@ -15,7 +15,7 @@ from ..constants import (
     HTTP_HEADER_USER_AGENT,
 )
 from ..errorcode import ER_IDP_CONNECTION_ERROR, ER_INCORRECT_DESTINATION
-from ..errors import DatabaseError, Error, RefreshTokenError
+from ..errors import DatabaseError, Error, OperationalError, RefreshTokenError
 from ..network import CONTENT_TYPE_APPLICATION_JSON, PYTHON_CONNECTOR_USER_AGENT
 from ..sqlstate import SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED
 from . import Auth
@@ -276,7 +276,7 @@ class AuthByOkta(AuthByPlugin):
     ) -> dict[Any, Any]:
         logger.debug("step 4: query IDP URL snowflake app to get SAML " "response")
         timeout_time = time.time() + conn.login_timeout if conn.login_timeout else None
-        response_html = {}
+        response_html = None
         origin_sso_url = sso_url
         while timeout_time is None or time.time() < timeout_time:
             try:
@@ -289,6 +289,12 @@ class AuthByOkta(AuthByPlugin):
                     HTTP_HEADER_ACCEPT: "*/*",
                 }
                 remaining_timeout = timeout_time - time.time() if timeout_time else None
+                if remaining_timeout is not None and remaining_timeout <= 0:
+                    # Obtaining the one time token consumed the whole login budget.
+                    # The HTTP layer rejects a non-positive timeout with an opaque
+                    # ValueError, so stop here and report the timeout that actually
+                    # happened.
+                    break
                 response_html = conn.rest.fetch(
                     "get",
                     sso_url,
@@ -301,8 +307,29 @@ class AuthByOkta(AuthByPlugin):
                 break
             except RefreshTokenError:
                 logger.debug("step4: refresh token for re-authentication")
+        if response_html is None:
+            # Every way out of the loop above without a response means the
+            # login_timeout budget ran out.
+            AuthByOkta._handle_login_timeout(conn)
         return response_html
 
+    @staticmethod
+    def _handle_login_timeout(conn: SnowflakeConnection) -> None:
+        Error.errorhandler_wrapper(
+            conn._rest._connection,
+            None,
+            OperationalError,
+            {
+                "msg": (
+                    f"Timed out after {conn.login_timeout} second(s) waiting for "
+                    "the identity provider to return a SAML response. Consider "
+                    "increasing login_timeout."
+                ),
+                "errno": ER_IDP_CONNECTION_ERROR,
+                "sqlstate": SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED,
+            },
+        )
+
     def _step5(
         self,
         conn: SnowflakeConnection,

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.2}/src/snowflake/connector/connection.py

@@ -2025,7 +2025,22 @@ class SnowflakeConnection:
             ):
                 # IDToken and OAuth auth need to authenticate through
                 # SSO if its credential has expired
-                self._reauthenticate()
+                result = self._reauthenticate()
+                # AuthByIdToken re-establishes the session inside reauthenticate()
+                # (it swaps to browser auth and re-runs _authenticate). The OAuth
+                # authenticators only obtain a fresh access token, so we must
+                # re-post the login here to actually establish a session with the
+                # new token - otherwise the connection is left without a session
+                # token and the first query fails with 250002 (connection closed).
+                # prepare() short-circuits on the in-memory token (tokens load from
+                # cache only once per connection), so this does not loop back into
+                # another refresh.
+                if (
+                    type(auth_instance) in (AuthByOauthCode, AuthByOauthCredentials)
+                    and isinstance(result, dict)
+                    and result.get("success")
+                ):
+                    self._authenticate(auth_instance)
             else:
                 self._authenticate(auth_instance)
 

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.2}/src/snowflake/connector/constants.py

@@ -430,7 +430,13 @@ S3_MIN_PART_SIZE = 5 * 1024**2
 S3_MAX_PARTS = 10000
 
 S3_CHUNK_SIZE = 8388608  # boto3 default
-AZURE_CHUNK_SIZE = 4 * megabyte
+
+# Azure Block Blob multipart upload limits
+# https://learn.microsoft.com/en-us/rest/api/storageservices/understanding-block-blobs--append-blobs--and-page-blobs
+AZURE_CHUNK_SIZE = 8 * megabyte  # kept consistent with S3_DEFAULT_CHUNK_SIZE
+AZURE_MAX_BLOCKS = 50000
+AZURE_MAX_BLOCK_SIZE = 4000 * megabyte
+AZURE_MAX_OBJECT_SIZE = AZURE_MAX_BLOCKS * AZURE_MAX_BLOCK_SIZE
 
 # https://requests.readthedocs.io/en/latest/user/advanced/#timeouts
 REQUEST_CONNECTION_TIMEOUT = 10

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.2}/src/snowflake/connector/file_transfer_agent.py

@@ -9,6 +9,7 @@ import os
 import sys
 import threading
 from concurrent.futures.thread import ThreadPoolExecutor
+from contextlib import ExitStack
 from dataclasses import dataclass
 from functools import partial
 from logging import getLogger
@@ -21,6 +22,8 @@ from .compat import IS_WINDOWS
 from .constants import (
     AZURE_CHUNK_SIZE,
     AZURE_FS,
+    AZURE_MAX_BLOCKS,
+    AZURE_MAX_OBJECT_SIZE,
     CMD_TYPE_DOWNLOAD,
     CMD_TYPE_UPLOAD,
     GCS_FS,
@@ -186,24 +189,31 @@ def _update_progress(
     return progress == 1.0
 
 
-def _chunk_size_calculator(file_size: int) -> int:
-    # S3 has limitation on the num of parts to be uploaded, this helper method recalculate the num of parts
-    if file_size > S3_MAX_OBJECT_SIZE:
-        # check if we don't exceed the allowed S3 max file size 5 TiB
+def _chunk_size_calculator(
+    file_size: int,
+    default_chunk_size: int = S3_DEFAULT_CHUNK_SIZE,
+    max_parts: int = S3_MAX_PARTS,
+    min_part_size: int = S3_MIN_PART_SIZE,
+    max_object_size: int = S3_MAX_OBJECT_SIZE,
+) -> int:
+    # Cloud providers cap the number of parts/blocks per object (S3: 10,000 parts,
+    # Azure: 50,000 blocks). This helper scales the chunk size up so the resulting
+    # number of parts stays within that limit; otherwise it keeps the default chunk size.
+    if file_size > max_object_size:
         raise ValueError(
-            f"File size {file_size} exceeds the maximum file size {S3_MAX_OBJECT_SIZE} allowed in S3."
+            f"File size {file_size} exceeds the maximum allowed file size {max_object_size}."
         )
 
     # num_parts = math.ceil(file_size / default_chunk_size)
-    # if num_parts is greater than the allowed S3_MAX_PARTS, we update our chunk_size, otherwise we use the default one
+    # if num_parts is greater than the allowed max_parts, we update our chunk_size, otherwise we use the default one
     calculated_chunk_size = (
-        max(math.ceil(file_size / S3_MAX_PARTS), S3_MIN_PART_SIZE)
-        if math.ceil(file_size / S3_DEFAULT_CHUNK_SIZE) > S3_MAX_PARTS
-        else S3_DEFAULT_CHUNK_SIZE
+        max(math.ceil(file_size / max_parts), min_part_size)
+        if math.ceil(file_size / default_chunk_size) > max_parts
+        else default_chunk_size
     )
-    if calculated_chunk_size != S3_DEFAULT_CHUNK_SIZE:
+    if calculated_chunk_size != default_chunk_size:
         logger.debug(
-            f"Setting chunksize to {calculated_chunk_size} instead of the default {S3_DEFAULT_CHUNK_SIZE}."
+            f"Setting chunksize to {calculated_chunk_size} instead of the default {default_chunk_size}."
         )
     return calculated_chunk_size
 
@@ -462,9 +472,16 @@ class SnowflakeFileTransferAgent:
         max_concurrency = min(
             self._parallel, self._snowflake_server_dop_cap_for_file_transfer
         )
-        network_tpe = ThreadPoolExecutor(max_concurrency)
-        preprocess_tpe = ThreadPoolExecutor(iobound_tpe_limit)
-        postprocess_tpe = ThreadPoolExecutor(iobound_tpe_limit)
+        thread_pools_exit_stack = ExitStack()
+        network_tpe = thread_pools_exit_stack.enter_context(
+            ThreadPoolExecutor(max_concurrency)
+        )
+        preprocess_tpe = thread_pools_exit_stack.enter_context(
+            ThreadPoolExecutor(iobound_tpe_limit)
+        )
+        postprocess_tpe = thread_pools_exit_stack.enter_context(
+            ThreadPoolExecutor(iobound_tpe_limit)
+        )
         logger.debug(f"Chunk ThreadPoolExecutor size: {max_concurrency}")
         cv_main_thread = threading.Condition()  # to signal the main thread
         cv_chunk_process = (
@@ -661,37 +678,38 @@ class SnowflakeFileTransferAgent:
                         f"An exception was raised in {repr(callback)}", exc_info=True
                     )
 
-        for file_client in files:
-            callback = partial(preprocess_done_cb, done_client=file_client)
-            if is_upload:
-                preprocess_tpe.submit(
-                    function_and_callback_wrapper,
-                    # Work fn
-                    file_client.prepare_upload,
-                    # Callback fn
-                    callback,
-                    file_client.meta,
-                )
-            else:
-                preprocess_tpe.submit(
-                    function_and_callback_wrapper,
-                    # Work fn
-                    file_client.prepare_download,
-                    # Callback fn
-                    callback,
-                    file_client.meta,
-                )
-            transfer_metadata.num_files_started += 1  # TODO: do we need this?
-
-        with cv_main_thread:
-            while transfer_metadata.num_files_completed < num_total_files:
-                cv_main_thread.wait()
-                # If both exception_caught_in_work and exception_caught_in_callback
-                # are present, the former will take precedence.
-                if exception_caught_in_work is not None:
-                    raise exception_caught_in_work
-                if exception_caught_in_callback is not None:
-                    raise exception_caught_in_callback
+        with thread_pools_exit_stack:
+            for file_client in files:
+                callback = partial(preprocess_done_cb, done_client=file_client)
+                if is_upload:
+                    preprocess_tpe.submit(
+                        function_and_callback_wrapper,
+                        # Work fn
+                        file_client.prepare_upload,
+                        # Callback fn
+                        callback,
+                        file_client.meta,
+                    )
+                else:
+                    preprocess_tpe.submit(
+                        function_and_callback_wrapper,
+                        # Work fn
+                        file_client.prepare_download,
+                        # Callback fn
+                        callback,
+                        file_client.meta,
+                    )
+                transfer_metadata.num_files_started += 1  # TODO: do we need this?
+
+            with cv_main_thread:
+                while transfer_metadata.num_files_completed < num_total_files:
+                    cv_main_thread.wait()
+                    # If both exception_caught_in_work and exception_caught_in_callback
+                    # are present, the former will take precedence.
+                    if exception_caught_in_work is not None:
+                        raise exception_caught_in_work
+                    if exception_caught_in_callback is not None:
+                        raise exception_caught_in_callback
 
         self._results = metas
 
@@ -709,7 +727,13 @@ class SnowflakeFileTransferAgent:
             return SnowflakeAzureRestClient(
                 meta,
                 self._credentials,
-                AZURE_CHUNK_SIZE,
+                _chunk_size_calculator(
+                    meta.src_file_size,
+                    default_chunk_size=AZURE_CHUNK_SIZE,
+                    max_parts=AZURE_MAX_BLOCKS,
+                    min_part_size=AZURE_CHUNK_SIZE,
+                    max_object_size=AZURE_MAX_OBJECT_SIZE,
+                ),
                 self._stage_info,
                 unsafe_file_write=self._unsafe_file_write,
             )

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.2}/src/snowflake/connector/nanoarrow_cpp/ArrowIterator/DateConverter.cpp

@@ -1,6 +1,7 @@
 #include "DateConverter.hpp"
 
 #include <memory>
+#include <mutex>
 
 #include "Python/Helpers.hpp"
 
@@ -9,12 +10,14 @@ Logger* DateConverter::logger = new Logger("snowflake.connector.DateConverter");
 
 py::UniqueRef& DateConverter::initPyDatetimeDate() {
   static py::UniqueRef pyDatetimeDate;
-  if (pyDatetimeDate.empty()) {
+  // Serializes the lazy import for free-threaded builds
+  static std::once_flag onceFlag;
+  std::call_once(onceFlag, []() {
     py::UniqueRef pyDatetimeModule;
     py::importPythonModule("datetime", pyDatetimeModule);
     py::importFromModule(pyDatetimeModule, "date", pyDatetimeDate);
     Py_XINCREF(pyDatetimeDate.get());
-  }
+  });
   return pyDatetimeDate;
 }