snowflake-connector-python 4.7.1__tar.gz → 4.7.3__tar.gz

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.3}/DESCRIPTION.md

@@ -7,6 +7,34 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.7.3(Sep 3,2026)
+  - Added experimental Python 3.14t (free-threaded CPython) wheel support. **Experimental — not intended for production use.**
+  - Fixed TLS hostname verification rejecting matching certificate SANs when a Snowflake account locator contains an underscore (SNOW-4011646).
+  - Fixed `connect()` being significantly slower on deep call stacks (e.g. Django apps with several middleware/decorator layers) because `get_application_path()` used `inspect.stack()`, which reads and parses the source file of every frame on the stack. It now walks frame references directly instead (SNOW-3691001, #2908).
+  - Fixed `split_statements` truncating unquoted URLs containing `://` at the `//`, misreading it as a line comment. The guards added alongside `//` comment support in 4.7.2 (SNOW-3772985) only recognized `file://`, so every other scheme (`http://`, `https://`, `s3://`, `snow://`, `azure://`) was cut short. Any `scheme://` is now recognized, on both the line-comment and block-comment paths (the latter affected globs such as `s3://bucket/*.csv`) (SNOW-3930192).
+  - Result batch construction now logs only whether a `qrmk` is present, for both the sync and async result paths (SNOW-3675590).
+  - DEBUG logging in `create_batches_from_response()` reports chunk-header names with type/length value metadata (SNOW-3675590).
+  - The malformed-response ERROR log in `create_batches_from_response()` reports a structural summary of the response (SNOW-3675590).
+  - SQL text is masked before it is written to DEBUG logs: `_format_query_for_log()` runs the query through `SecretDetector`, covering the cursor and connection paths on both sync and async. The cancel-query log paths use the same masking (SNOW-3675590).
+  - Deferred the SQL-masking cost to log emit-time: query DEBUG lines pass a lazy `_format_query_for_log_lazy()` wrapper whose `__str__` masks only when a handler emits the record (SNOW-3675590).
+  - Corrected the invalid-account-identifier error message so it matches the validator, which allows '.' as a label separator.
+  - The `WORKLOAD_IDENTITY` authenticator runs only against recognized Snowflake hosts: the connection host is normalized and suffix-anchored against `snowflakecomputing.com`, `.cn`, and `.mil` before the workload-identity flow proceeds. The `SNOWFLAKE_WIF_ALLOWED_HOST_SUFFIXES` environment variable additively extends the recognized-host list (SNOW-3675580).
+  - Improved the robustness and correctness of OCSP revocation checking (SNOW-3675581).
+    - When `SF_OCSP_RESPONSE_CACHE_SERVER_URL` is set, the connector uses it as the OCSP cache server, including on PrivateLink hosts.
+    - A PrivateLink OCSP cache URL is derived only for hosts that consist of hostname characters, include a `.privatelink.` label, and end at `snowflakecomputing.com`, `.cn`, or `.mil`. Other hosts use the public default cache URL; set `SF_OCSP_RESPONSE_CACHE_SERVER_URL` to use a different cache server.
+  - Extended log secret masking coverage (SNOW-3675583). The connection-token pattern accepts `:` and `%` in the token value. Added patterns for OAuth access and refresh tokens in serialized JSON, for one-time passcodes, and for OAuth client identifiers and secrets. The passcode pattern accepts quoted values. The password pattern requires at least six characters in the value, so ordinary prose following the word "password" is not redacted.
+  - Request headers are copied before mutation on the async path, and masking is applied to the `Authorization` header in error logs (SNOW-3675593).
+  - Applied secret masking to the `snowflake.connector` loggers by default, independent of how application logging is configured. The same filter also covers the third-party loggers the connector uses (`botocore`, `boto3`, `aiohttp`, `aiobotocore`, `aioboto3`, vendored `urllib3`). Set `SNOWFLAKE_DISABLE_LOG_SECRET_MASKING=true` to opt out; it is honored at emit time, including after import (SNOW-3675583).
+  - Fixed the on-disk OCSP response validation cache failing with `RuntimeError: UnixFileLock on ... was inherited across fork; construct a new instance` when it was written from a forked child process. This could surface on fork-based platforms when fetching results with `client_fetch_use_mp=True`, where chunk downloads run in worker processes that perform their own certificate revocation checks. The cache's file lock is now re-created when the owning process changes, matching what already happened for the `spawn` start method.
+
+- v4.7.2(Aug 6,2026)
+  - Fixed a thread leak in the file transfer agent by properly shutting down ThreadPoolExecutors after PUT/GET transfers (SNOW-3556240, #2878).
+  - Fixed `split_statements` treating `//` as SQL instead of a line comment, which could merge multiple statements when a `//` comment contained an apostrophe (SNOW-3772985).
+  - Fixed large-file PUT uploads to internal Azure stages failing against the Azure 50,000-block-per-blob limit. The Azure multipart chunk size is now scaled up dynamically for very large files (mirroring the existing S3 behavior), and the default Azure chunk size was raised from 4 MB to 8 MB (consistent with S3) for better throughput (SNOW-3839943).
+  - Fixed OAuth cached-credential connections failing with `250001 Invalid OAuth access token` when the cached token was invalid (GS code `390303`); the connector now reauthenticates silently (via refresh token if available, otherwise browser) instead of hard-failing. Also fixed fresh processes holding only a cached refresh token going straight to an interactive browser prompt instead of attempting a silent refresh first.
+  - Fixed Okta/SAML authentication reporting an exhausted `login_timeout` as `250003: Failed to execute request: Attempted to set connect timeout to <negative value>`. Obtaining the one-time token in step 4 can overshoot the login deadline, which made the remaining budget negative; it was then passed to the HTTP layer, which rejected it with an opaque `ValueError`. A timed-out SAML login now raises `250006` with a message naming `login_timeout`. Running out of budget while retrying on `RefreshTokenError` reports the same error instead of failing later with an `AttributeError` on an empty response (SNOW-3891419).
+  - Fixed OAuth authorization code flow failing for accounts with uppercase letters in the account name. `urlparse().hostname` always returns lowercase, but the host was compared case-sensitively in `_is_snowflake_as_idp`, causing Snowflake-as-IdP detection to return `False` and raising error 251013 (`client_id is empty`) even for connections that don't require a client ID.
+
 - v4.7.1(Jul 15,2026)
   - Added support for Python 3.14t (free-threaded).
     - **Note:** Python 3.14t CI testing excludes `win_arm64` (no `cryptography` wheels available) and `mitmproxy` proxy tests on all platforms (transitive dependencies `aioquic`/`pylsqpack` lack free-threaded-compatible wheels).
@@ -21,6 +49,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Added native AKS (Azure Kubernetes Service) workload identity support. When running on AKS with workload identity configured, the connector automatically uses `WorkloadIdentityCredential` to authenticate via the injected service account credentials. OIDC backward compatibility is also supported.
   - Added the `workload_identity_aws_use_outbound_token` connection option (default `false`) to opt into AWS WIF JWT attestation via STS `GetWebIdentityToken` instead of the default SigV4 `GetCallerIdentity` method.
   - Fixed a bug where a fully-qualified DDL statement (e.g. `CREATE VIEW db.schema.obj`) on a session with no current schema would populate the connector's cached `_schema`/`_database` from the referenced object's namespace. This made `get_current_schema()` diverge from the server's `CURRENT_SCHEMA()` and mis-qualified Snowpark temp objects (SNOW-3665226).
+  - Fixed JWT key-pair authentication errors to surface the server's specific error code (e.g. `394304` for fingerprint mismatch, `394303` for clock skew) instead of always reporting the generic `250001`. Auth-rejection failures now also use SQLState `28000` (invalid authorization) instead of `08001` (SNOW-3775156).
 
 - v4.6.0(May 28,2026)
   - Dropped support for Python 3.9. The minimum supported version is now Python 3.10.

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.7.1
+Version: 4.7.3
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -27,6 +27,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: Free Threading :: 2 - Beta
 Classifier: Programming Language :: SQL
 Classifier: Topic :: Database
 Classifier: Topic :: Scientific/Engineering :: Information Analysis
@@ -61,7 +62,7 @@ Requires-Dist: botocore>=1.24; extra == "boto"
 Provides-Extra: azure
 Requires-Dist: azure-identity>=1.16; extra == "azure"
 Provides-Extra: development
-Requires-Dist: Cython; extra == "development"
+Requires-Dist: Cython>=3.1; extra == "development"
 Requires-Dist: azure-identity>=1.16; extra == "development"
 Requires-Dist: coverage; extra == "development"
 Requires-Dist: mitmproxy>=12.0.0; (python_version >= "3.12" and python_version < "3.14") and extra == "development"
@@ -96,6 +97,34 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.7.3(Sep 3,2026)
+  - Added experimental Python 3.14t (free-threaded CPython) wheel support. **Experimental — not intended for production use.**
+  - Fixed TLS hostname verification rejecting matching certificate SANs when a Snowflake account locator contains an underscore (SNOW-4011646).
+  - Fixed `connect()` being significantly slower on deep call stacks (e.g. Django apps with several middleware/decorator layers) because `get_application_path()` used `inspect.stack()`, which reads and parses the source file of every frame on the stack. It now walks frame references directly instead (SNOW-3691001, #2908).
+  - Fixed `split_statements` truncating unquoted URLs containing `://` at the `//`, misreading it as a line comment. The guards added alongside `//` comment support in 4.7.2 (SNOW-3772985) only recognized `file://`, so every other scheme (`http://`, `https://`, `s3://`, `snow://`, `azure://`) was cut short. Any `scheme://` is now recognized, on both the line-comment and block-comment paths (the latter affected globs such as `s3://bucket/*.csv`) (SNOW-3930192).
+  - Result batch construction now logs only whether a `qrmk` is present, for both the sync and async result paths (SNOW-3675590).
+  - DEBUG logging in `create_batches_from_response()` reports chunk-header names with type/length value metadata (SNOW-3675590).
+  - The malformed-response ERROR log in `create_batches_from_response()` reports a structural summary of the response (SNOW-3675590).
+  - SQL text is masked before it is written to DEBUG logs: `_format_query_for_log()` runs the query through `SecretDetector`, covering the cursor and connection paths on both sync and async. The cancel-query log paths use the same masking (SNOW-3675590).
+  - Deferred the SQL-masking cost to log emit-time: query DEBUG lines pass a lazy `_format_query_for_log_lazy()` wrapper whose `__str__` masks only when a handler emits the record (SNOW-3675590).
+  - Corrected the invalid-account-identifier error message so it matches the validator, which allows '.' as a label separator.
+  - The `WORKLOAD_IDENTITY` authenticator runs only against recognized Snowflake hosts: the connection host is normalized and suffix-anchored against `snowflakecomputing.com`, `.cn`, and `.mil` before the workload-identity flow proceeds. The `SNOWFLAKE_WIF_ALLOWED_HOST_SUFFIXES` environment variable additively extends the recognized-host list (SNOW-3675580).
+  - Improved the robustness and correctness of OCSP revocation checking (SNOW-3675581).
+    - When `SF_OCSP_RESPONSE_CACHE_SERVER_URL` is set, the connector uses it as the OCSP cache server, including on PrivateLink hosts.
+    - A PrivateLink OCSP cache URL is derived only for hosts that consist of hostname characters, include a `.privatelink.` label, and end at `snowflakecomputing.com`, `.cn`, or `.mil`. Other hosts use the public default cache URL; set `SF_OCSP_RESPONSE_CACHE_SERVER_URL` to use a different cache server.
+  - Extended log secret masking coverage (SNOW-3675583). The connection-token pattern accepts `:` and `%` in the token value. Added patterns for OAuth access and refresh tokens in serialized JSON, for one-time passcodes, and for OAuth client identifiers and secrets. The passcode pattern accepts quoted values. The password pattern requires at least six characters in the value, so ordinary prose following the word "password" is not redacted.
+  - Request headers are copied before mutation on the async path, and masking is applied to the `Authorization` header in error logs (SNOW-3675593).
+  - Applied secret masking to the `snowflake.connector` loggers by default, independent of how application logging is configured. The same filter also covers the third-party loggers the connector uses (`botocore`, `boto3`, `aiohttp`, `aiobotocore`, `aioboto3`, vendored `urllib3`). Set `SNOWFLAKE_DISABLE_LOG_SECRET_MASKING=true` to opt out; it is honored at emit time, including after import (SNOW-3675583).
+  - Fixed the on-disk OCSP response validation cache failing with `RuntimeError: UnixFileLock on ... was inherited across fork; construct a new instance` when it was written from a forked child process. This could surface on fork-based platforms when fetching results with `client_fetch_use_mp=True`, where chunk downloads run in worker processes that perform their own certificate revocation checks. The cache's file lock is now re-created when the owning process changes, matching what already happened for the `spawn` start method.
+
+- v4.7.2(Aug 6,2026)
+  - Fixed a thread leak in the file transfer agent by properly shutting down ThreadPoolExecutors after PUT/GET transfers (SNOW-3556240, #2878).
+  - Fixed `split_statements` treating `//` as SQL instead of a line comment, which could merge multiple statements when a `//` comment contained an apostrophe (SNOW-3772985).
+  - Fixed large-file PUT uploads to internal Azure stages failing against the Azure 50,000-block-per-blob limit. The Azure multipart chunk size is now scaled up dynamically for very large files (mirroring the existing S3 behavior), and the default Azure chunk size was raised from 4 MB to 8 MB (consistent with S3) for better throughput (SNOW-3839943).
+  - Fixed OAuth cached-credential connections failing with `250001 Invalid OAuth access token` when the cached token was invalid (GS code `390303`); the connector now reauthenticates silently (via refresh token if available, otherwise browser) instead of hard-failing. Also fixed fresh processes holding only a cached refresh token going straight to an interactive browser prompt instead of attempting a silent refresh first.
+  - Fixed Okta/SAML authentication reporting an exhausted `login_timeout` as `250003: Failed to execute request: Attempted to set connect timeout to <negative value>`. Obtaining the one-time token in step 4 can overshoot the login deadline, which made the remaining budget negative; it was then passed to the HTTP layer, which rejected it with an opaque `ValueError`. A timed-out SAML login now raises `250006` with a message naming `login_timeout`. Running out of budget while retrying on `RefreshTokenError` reports the same error instead of failing later with an `AttributeError` on an empty response (SNOW-3891419).
+  - Fixed OAuth authorization code flow failing for accounts with uppercase letters in the account name. `urlparse().hostname` always returns lowercase, but the host was compared case-sensitively in `_is_snowflake_as_idp`, causing Snowflake-as-IdP detection to return `False` and raising error 251013 (`client_id is empty`) even for connections that don't require a client ID.
+
 - v4.7.1(Jul 15,2026)
   - Added support for Python 3.14t (free-threaded).
     - **Note:** Python 3.14t CI testing excludes `win_arm64` (no `cryptography` wheels available) and `mitmproxy` proxy tests on all platforms (transitive dependencies `aioquic`/`pylsqpack` lack free-threaded-compatible wheels).
@@ -110,6 +139,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Added native AKS (Azure Kubernetes Service) workload identity support. When running on AKS with workload identity configured, the connector automatically uses `WorkloadIdentityCredential` to authenticate via the injected service account credentials. OIDC backward compatibility is also supported.
   - Added the `workload_identity_aws_use_outbound_token` connection option (default `false`) to opt into AWS WIF JWT attestation via STS `GetWebIdentityToken` instead of the default SigV4 `GetCallerIdentity` method.
   - Fixed a bug where a fully-qualified DDL statement (e.g. `CREATE VIEW db.schema.obj`) on a session with no current schema would populate the connector's cached `_schema`/`_database` from the referenced object's namespace. This made `get_current_schema()` diverge from the server's `CURRENT_SCHEMA()` and mis-qualified Snowpark temp objects (SNOW-3665226).
+  - Fixed JWT key-pair authentication errors to surface the server's specific error code (e.g. `394304` for fingerprint mismatch, `394303` for clock skew) instead of always reporting the generic `250001`. Auth-rejection failures now also use SQLState `28000` (invalid authorization) instead of `08001` (SNOW-3775156).
 
 - v4.6.0(May 28,2026)
   - Dropped support for Python 3.9. The minimum supported version is now Python 3.10.

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.3}/README.md

@@ -53,6 +53,29 @@ These tools are integrated into `tox` to allow us to easily set them up universa
   and we would like to have an overall coverage data file created for them.
 * **flake8**: (Deprecated) Similar to `fix_lint`, but only runs `flake8` checks.
 
+## Log secret masking
+
+By default, the connector masks secrets (tokens, passwords, cloud credentials,
+private keys) in records emitted by `snowflake.connector` loggers and by the
+third-party loggers it uses (`botocore`, `boto3`, `aiohttp`, `aiobotocore`,
+`aioboto3`, and vendored `urllib3`). Masking applies even when logging is
+configured with `logging.basicConfig`, not only when Easy Logging
+(`save_logs = true` in `config.toml`) is enabled. The same opt-out covers
+those trees: they also interpolate the message and clear `record.args`.
+
+To disable masking, set `SNOWFLAKE_DISABLE_LOG_SECRET_MASKING` to `true`.
+The connector reads this on every log record, so it is an escape hatch if
+masking is incompatible with a log pipeline (for example one that depends
+on structured `record.args`). Setting it **before** importing
+`snowflake.connector` also skips installing the masking hook:
+
+```bash
+export SNOWFLAKE_DISABLE_LOG_SECRET_MASKING=true
+```
+
+The masker interpolates each log record and clears `record.args`. Leave
+masking enabled unless you need that escape hatch.
+
 ## Disable telemetry
 
 By default, the Snowflake Connector for Python collects telemetry data to improve the product.

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.3}/pyproject.toml

@@ -4,7 +4,9 @@ requires = [
     # and may be stricter than the version required in `setup.py`
     "setuptools>=40.6.0",
     "wheel",
-    "cython",
+    # cython>=3.1 is required for the `freethreading_compatible` directive
+    # used by src/snowflake/connector/nanoarrow_cpp/ArrowIterator/nanoarrow_arrow_iterator.pyx
+    "cython>=3.1",
 ]
 
 [tool.cibuildwheel]
@@ -12,6 +14,13 @@ test-skip = "*"
 manylinux-x86_64-image = "manylinux2014"
 environment = {AUDITWHEEL_PLAT="manylinux2014_$(uname -m)"}
 build-verbosity = 1
+# Opt in to free-threaded CPython wheel builds (cp313t, cp314t, ...).
+# Without this, cibuildwheel silently skips every `cp*t-*` target even when
+# the matrix and CIBW_BUILD env var ask for them. Requires cibuildwheel>=2.20.
+# Paired with the `freethreading_compatible` Cython directive in
+# src/snowflake/connector/nanoarrow_cpp/ArrowIterator/nanoarrow_arrow_iterator.pyx
+# so the produced wheel actually keeps the GIL disabled at import time.
+enable = ["cpython-freethreading"]
 
 [tool.cibuildwheel.linux]
 archs = ["x86_64", "aarch64"]

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.3}/setup.cfg

@@ -25,6 +25,7 @@ classifiers =
 	Programming Language :: Python :: 3.12
 	Programming Language :: Python :: 3.13
 	Programming Language :: Python :: 3.14
+	Programming Language :: Python :: Free Threading :: 2 - Beta
 	Programming Language :: SQL
 	Topic :: Database
 	Topic :: Scientific/Engineering :: Information Analysis
@@ -88,7 +89,7 @@ boto =
 azure = 
 	azure-identity>=1.16
 development = 
-	Cython
+	Cython>=3.1
 	azure-identity>=1.16
 	coverage
 	mitmproxy>=12.0.0; python_version >= '3.12' and python_version < '3.14'

snowflake_connector_python-4.7.3/src/snowflake/connector/_host_util.py

@@ -0,0 +1,106 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2012-2023 Snowflake Computing Inc. All rights reserved.
+#
+
+"""Host normalization and recognition shared by every subsystem that turns a
+connection host into the authority of a URL the connector builds itself.
+
+Kept subsystem-agnostic so that WORKLOAD_IDENTITY attestation and OCSP cache-URL
+derivation match hosts identically; a second, slightly different rule in either
+place is what this module exists to prevent. The suffix list itself lives in
+``constants`` so the data stays next to the connector's other TLD constants.
+"""
+
+from __future__ import annotations
+
+from typing import Iterable
+
+from .constants import _SNOWFLAKE_ALLOWED_HOST_SUFFIXES
+
+# Maps only ASCII A-Z to a-z.
+#
+# Deliberately not str.lower(): full Unicode case folding maps some characters
+# into ASCII, so a host containing U+212A KELVIN SIGN folds
+# "snowfla<U+212A>ecomputing.com" into "snowflakecomputing.com" and would match a
+# recognized suffix while DNS still resolves the original, unrelated name.
+# Leaving non-ASCII untouched lets is_ldh_host reject it instead.
+_ASCII_LOWERCASE_TABLE = str.maketrans(
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ", "abcdefghijklmnopqrstuvwxyz"
+)
+
+# Characters legal in a DNS hostname label, plus '_': account labels
+# legitimately contain one.
+_LDH_CHARACTERS = frozenset("abcdefghijklmnopqrstuvwxyz0123456789-_")
+
+
+def normalize_host(host: str | None) -> str:
+    """Normalizes a host (or a configured host suffix) into the single string that
+    every subsequent check and every derived URL must use.
+
+    Trims, lower-cases ASCII only, drops everything from the first ':' onward,
+    then strips exactly one trailing '.' (FQDN form).
+
+    The port must be dropped before the trailing dot: a host in FQDN form
+    carrying an explicit port ("acct.snowflakecomputing.com.:443") still has the
+    dot immediately before the colon, and removing the dot first would leave it
+    attached to the label and match no suffix.
+    """
+    if not host:
+        return ""
+    normalized = host.strip().translate(_ASCII_LOWERCASE_TABLE)
+    if ":" in normalized:
+        normalized = normalized.split(":", 1)[0]
+    if normalized.endswith("."):
+        normalized = normalized[:-1]
+    return normalized
+
+
+def is_ldh_host(normalized_host: str) -> bool:
+    """Whether an already-normalized host is made only of characters legal in a
+    DNS hostname: every dot-separated label non-empty and drawn from
+    ``[a-z0-9_-]``.
+
+    This is an allow-list, not a list of forbidden delimiters, and that
+    distinction is load-bearing. A host is only safe to interpolate into a URL
+    authority if it cannot carry a character that some URL parser treats as
+    ending the host, and enumerating such characters does not work: parsers
+    variously terminate the authority at a space, ';', "'", a percent-escape, or
+    a full-width look-alike of '.', '#' or '?'. Since a host whose trailing
+    labels are a recognized Snowflake domain can still begin with an unrelated
+    name, a parser that stops early resolves that unrelated name instead.
+
+    Args:
+        normalized_host: output of :func:`normalize_host`.
+    """
+    if not normalized_host:
+        return False
+    return all(
+        label and _LDH_CHARACTERS.issuperset(label)
+        for label in normalized_host.split(".")
+    )
+
+
+def has_recognized_snowflake_suffix(
+    normalized_host: str,
+    extra_suffixes: Iterable[str] | None = None,
+) -> bool:
+    """Whether an already-normalized host ends at one of the recognized Snowflake
+    suffixes, matched on a label boundary so that only a listed suffix and its
+    subdomains qualify. The bare apex is accepted by the equality branch.
+
+    Args:
+        normalized_host: output of :func:`normalize_host`.
+        extra_suffixes: additional already-normalized suffixes to accept.
+            Additive only: callers cannot use this to disable the built-in list.
+    """
+    if not normalized_host:
+        return False
+    suffixes: tuple[str, ...] = _SNOWFLAKE_ALLOWED_HOST_SUFFIXES
+    if extra_suffixes:
+        suffixes = (*suffixes, *extra_suffixes)
+    return any(
+        normalized_host == suffix or normalized_host.endswith(f".{suffix}")
+        for suffix in suffixes
+        if suffix
+    )

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.3}/src/snowflake/connector/_utils.py

@@ -9,7 +9,7 @@ import string
 import threading
 import time
 from enum import Enum
-from inspect import stack
+from inspect import currentframe
 from secrets import choice
 from threading import Timer
 from uuid import UUID
@@ -101,12 +101,24 @@ class _TrackedQueryCancellationTimer(Timer):
 
 
 def get_application_path() -> str:
-    """Get the path of the application script using the connector."""
+    """Get the path of the application script using the connector.
+
+    Walks frame.f_back directly instead of using inspect.stack(), which
+    reads and parses the source file of every frame on the call stack.
+    That per-frame disk I/O made connect() take hundreds of milliseconds
+    on deep call stacks (see SNOW-3691001 / GH-2908).
+    """
+    frame = currentframe()
     try:
-        outermost_frame = stack()[-1]
-        return outermost_frame.filename
+        if frame is None:
+            return "unknown"
+        while frame.f_back is not None:
+            frame = frame.f_back
+        return frame.f_code.co_filename
     except Exception:
         return "unknown"
+    finally:
+        del frame
 
 
 _SPCS_ENV_VAR = "SNOWFLAKE_RUNNING_INSIDE_SPCS"

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.3}/src/snowflake/connector/aio/_connection.py

@@ -120,7 +120,6 @@ else:
 
 
 class SnowflakeConnection(SnowflakeConnectionSync):
-    OCSP_ENV_LOCK = asyncio.Lock()
 
     def __init__(
         self,
@@ -233,20 +232,17 @@ class SnowflakeConnection(SnowflakeConnectionSync):
         )
         logger.debug("REST API object was created: %s:%s", self.host, self.port)
 
+        # The PrivateLink OCSP cache URL is now derived per-connection inside
+        # OCSPServer from this connection's hostname (SNOW-3675581); the driver
+        # does not write SF_OCSP_RESPONSE_CACHE_SERVER_URL to the process
+        # environment. An operator-set value is still honored (and takes
+        # precedence) -- log it if present.
         if "SF_OCSP_RESPONSE_CACHE_SERVER_URL" in os.environ:
             logger.debug(
                 "Custom OCSP Cache Server URL found in environment - %s",
                 os.environ["SF_OCSP_RESPONSE_CACHE_SERVER_URL"],
             )
 
-        if ".privatelink.snowflakecomputing." in self.host.lower():
-            await SnowflakeConnection.setup_ocsp_privatelink(
-                self.application, self.host
-            )
-        else:
-            if "SF_OCSP_RESPONSE_CACHE_SERVER_URL" in os.environ:
-                del os.environ["SF_OCSP_RESPONSE_CACHE_SERVER_URL"]
-
         if self._session_parameters is None:
             self._session_parameters = {}
         if self._autocommit is not None:
@@ -715,7 +711,11 @@ class SnowflakeConnection(SnowflakeConnectionSync):
         self, sql: str, request_id: uuid.UUID
     ) -> dict[str, bool | None]:
         """Cancels the query with the exact SQL query and requestId."""
-        logger.debug("_cancel_query sql=[%s], request_id=[%s]", sql, request_id)
+        logger.debug(
+            "_cancel_query sql=[%s], request_id=[%s]",
+            self._format_query_for_log(sql),
+            request_id,
+        )
         url_parameters = {REQUEST_ID: str(uuid.uuid4())}
 
         return await self.rest.request(
@@ -1233,14 +1233,6 @@ class SnowflakeConnection(SnowflakeConnectionSync):
             self._process_error_query_status(sf_qid, status_resp)
         return status
 
-    @staticmethod
-    async def setup_ocsp_privatelink(app, hostname) -> None:
-        hostname = hostname.lower()
-        async with SnowflakeConnection.OCSP_ENV_LOCK:
-            ocsp_cache_server = f"http://ocsp.{hostname}/ocsp_response_cache.json"
-            os.environ["SF_OCSP_RESPONSE_CACHE_SERVER_URL"] = ocsp_cache_server
-            logger.debug("OCSP Cache Server is updated: %s", ocsp_cache_server)
-
     async def rollback(self) -> None:
         """Rolls back the current transaction."""
         await self.cursor().execute("ROLLBACK")

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.3}/src/snowflake/connector/aio/_cursor.py

@@ -142,7 +142,11 @@ class SnowflakeCursorBase(SnowflakeCursorBaseSync, abc.ABC, typing.Generic[Fetch
 
     async def __cancel_query(self, query) -> None:
         if self._sequence_counter >= 0 and not self.is_closed():
-            logger.debug("canceled. %s, request_id: %s", query, self._request_id)
+            logger.debug(
+                "canceled. %s, request_id: %s",
+                self._format_query_for_log_lazy(query),
+                self._request_id,
+            )
             async with self._lock_canceling:
                 await self._connection._cancel_query(query, self._request_id)
 
@@ -234,7 +238,7 @@ class SnowflakeCursorBase(SnowflakeCursorBaseSync, abc.ABC, typing.Generic[Fetch
 
         logger.debug(f"Request id: {self._request_id}")
 
-        logger.debug("running query [%s]", self._format_query_for_log(query))
+        logger.debug("running query [%s]", self._format_query_for_log_lazy(query))
         if _is_put_get is not None:
             # if told the query is PUT or GET, use the information
             self._is_file_transfer = _is_put_get
@@ -574,7 +578,7 @@ class SnowflakeCursorBase(SnowflakeCursorBaseSync, abc.ABC, typing.Generic[Fetch
                 logger.warning("execute: no query is given to execute")
                 return None
 
-        logger.debug("query: [%s]", self._format_query_for_log(command))
+        logger.debug("query: [%s]", self._format_query_for_log_lazy(command))
 
         _statement_params = _statement_params or dict()
         # If we need to add another parameter, please consider introducing a dict for all extra params

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.3}/src/snowflake/connector/aio/_network.py

@@ -730,6 +730,8 @@ class SnowflakeRestful(SnowflakeRestfulSync):
             else:
                 input_data = data
 
+            # Work on a copy so the caller-supplied dict is never mutated.
+            headers = dict(headers)
             if HEADER_AUTHORIZATION_KEY in headers:
                 del headers[HEADER_AUTHORIZATION_KEY]
             if token != NO_TOKEN:

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.3}/src/snowflake/connector/aio/_ocsp_snowflake.py

@@ -33,7 +33,6 @@ from snowflake.connector.ocsp_snowflake import (
 from snowflake.connector.ocsp_snowflake import OCSPServer as OCSPServerSync
 from snowflake.connector.ocsp_snowflake import OCSPTelemetryData
 from snowflake.connector.ocsp_snowflake import SnowflakeOCSP as SnowflakeOCSPSync
-from snowflake.connector.url_util import extract_top_level_domain_from_hostname
 
 if TYPE_CHECKING:
     from snowflake.connector.aio._session_manager import SessionManager
@@ -157,11 +156,7 @@ class SnowflakeOCSP(SnowflakeOCSPSync):
 
         self._use_post_method = use_post_method
         self._root_certs_dict_lock_timeout = root_certs_dict_lock_timeout
-        self.OCSP_CACHE_SERVER = OCSPServer(
-            top_level_domain=extract_top_level_domain_from_hostname(
-                kwargs.pop("hostname", None)
-            )
-        )
+        self.OCSP_CACHE_SERVER = OCSPServer(hostname=kwargs.pop("hostname", None))
 
         self.debug_ocsp_failure_url = None
 

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.3}/src/snowflake/connector/aio/_result_batch.py

@@ -86,12 +86,19 @@ def create_batches_from_response(
             chunk_headers = {}
             for header_key, header_value in data["chunkHeaders"].items():
                 chunk_headers[header_key] = header_value
-                if "encryption" not in header_key:
-                    logger.debug(
-                        f"added chunk header: key={header_key}, value={header_value}"
-                    )
+                # SNOW-3675590: never log the value — chunk-header values can be
+                # secrets (SSE-C customer key). Log the header name plus
+                # non-sensitive value metadata only. Capture real headers via a
+                # proxy (drivers-usage PROXY=1) when debugging.
+                logger.debug(
+                    f"added chunk header: key={header_key} "
+                    f"value={SecretDetector.describe_value(header_value)}"
+                )
         elif qrmk is not None:
-            logger.debug(f"qrmk={SecretDetector.mask_secrets(qrmk)}")
+            # SNOW-3675590: never log the qrmk value — it is the AES-256 SSE-C
+            # result-encryption key. Log only its presence; do not route it
+            # through masking helpers as a substitute.
+            logger.debug("qrmk is present in the result response")
             chunk_headers[SSE_C_ALGORITHM] = SSE_C_AES
             chunk_headers[SSE_C_KEY] = qrmk
 
@@ -154,7 +161,12 @@ def create_batches_from_response(
             session_manager=cursor._connection._session_manager.clone(),
         )
     else:
-        logger.error(f"Don't know how to construct ResultBatches from response: {data}")
+        # SNOW-3675590: log only the structural shape — the raw response can
+        # carry secrets, and this ERROR line is emitted regardless of DEBUG level.
+        logger.error(
+            "Don't know how to construct ResultBatches from response: "
+            f"format={_format!r}, shape={SecretDetector.describe_value(data)}"
+        )
         first_chunk = ArrowResultBatch.from_data(
             "",
             0,

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.3}/src/snowflake/connector/aio/auth/_auth.py

@@ -29,12 +29,16 @@ from ...errors import (
 from ...network import (
     ACCEPT_TYPE_APPLICATION_SNOWFLAKE,
     CONTENT_TYPE_APPLICATION_JSON,
+    CREDENTIAL_REJECTION_GS_CODES,
     ID_TOKEN_INVALID_LOGIN_REQUEST_GS_CODE,
     OAUTH_ACCESS_TOKEN_EXPIRED_GS_CODE,
     PYTHON_CONNECTOR_USER_AGENT,
     ReauthenticationRequest,
 )
-from ...sqlstate import SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED
+from ...sqlstate import (
+    SQLSTATE_AUTHORIZATION_FAILURE,
+    SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED,
+)
 from ...token_cache import TokenType
 from ._no_auth import AuthNoAuth
 
@@ -334,8 +338,12 @@ class Auth(AuthSync):
                         port=self._rest._port,
                         message=ret["message"],
                     ),
-                    "errno": ER_FAILED_TO_CONNECT_TO_DB,
-                    "sqlstate": SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED,
+                    "errno": int(errno),
+                    "sqlstate": (
+                        SQLSTATE_AUTHORIZATION_FAILURE
+                        if str(errno) in CREDENTIAL_REJECTION_GS_CODES
+                        else SQLSTATE_CONNECTION_WAS_NOT_ESTABLISHED
+                    ),
                 },
             )
         else:

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.3}/src/snowflake/connector/aio/auth/_okta.py

@@ -212,7 +212,7 @@ class AuthByOkta(AuthByPluginAsync, AuthByOktaSync):
     ) -> dict[Any, Any]:
         logger.debug("step 4: query IDP URL snowflake app to get SAML " "response")
         timeout_time = time.time() + conn.login_timeout if conn.login_timeout else None
-        response_html = {}
+        response_html = None
         origin_sso_url = sso_url
         while timeout_time is None or time.time() < timeout_time:
             try:
@@ -225,6 +225,12 @@ class AuthByOkta(AuthByPluginAsync, AuthByOktaSync):
                     HTTP_HEADER_ACCEPT: "*/*",
                 }
                 remaining_timeout = timeout_time - time.time() if timeout_time else None
+                if remaining_timeout is not None and remaining_timeout <= 0:
+                    # Obtaining the one time token consumed the whole login budget.
+                    # The HTTP layer rejects a non-positive timeout with an opaque
+                    # ValueError, so stop here and report the timeout that actually
+                    # happened.
+                    break
                 response_html = await conn.rest.fetch(
                     "get",
                     sso_url,
@@ -237,6 +243,10 @@ class AuthByOkta(AuthByPluginAsync, AuthByOktaSync):
                 break
             except RefreshTokenError:
                 logger.debug("step4: refresh token for re-authentication")
+        if response_html is None:
+            # Every way out of the loop above without a response means the
+            # login_timeout budget ran out.
+            AuthByOktaSync._handle_login_timeout(conn)
         return response_html
 
     async def _step5(

{snowflake_connector_python-4.7.1 → snowflake_connector_python-4.7.3}/src/snowflake/connector/aio/auth/_workload_identity.py

@@ -9,6 +9,7 @@ if TYPE_CHECKING:
 from ...auth.workload_identity import (
     AuthByWorkloadIdentity as AuthByWorkloadIdentitySync,
 )
+from ...auth.workload_identity import _verify_host_allowed_for_workload_identity
 from .._wif_util import AttestationProvider, create_attestation
 from ._by_plugin import AuthByPlugin as AuthByPluginAsync
 
@@ -42,6 +43,7 @@ class AuthByWorkloadIdentity(AuthByPluginAsync, AuthByWorkloadIdentitySync):
         self, *, conn: SnowflakeConnection | None, **kwargs: typing.Any
     ) -> None:
         """Fetch the token using async wif_util."""
+        _verify_host_allowed_for_workload_identity(conn)
         self.attestation = await create_attestation(
             self.provider,
             self.entra_resource,