snowflake-connector-python 4.7.2__tar.gz → 4.7.4__tar.gz

{snowflake_connector_python-4.7.2 → snowflake_connector_python-4.7.4}/DESCRIPTION.md

@@ -7,13 +7,39 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v4.7.2(Aug 6,2026)
+- v4.7.4(Sep 16,2026)
+  - Fixed missing retries on transient HTTP failures when fetching an OAuth access token from the IdP token endpoint (`OAUTH_CLIENT_CREDENTIALS` and `OAUTH_AUTHORIZATION_CODE`). Token requests now retry transport errors, HTTP 408/429, and 5xx responses (SNOW-3984430, #3003).
+  - Fixed a bug where a TLS handshake terminated by the peer (`SSLError` containing `SysCallError(-1, 'Unexpected EOF')`) was classified as non-retryable and surfaced as an `OperationalError`, unlike `ECONNRESET`. Such handshake `Unexpected EOF` errors are now retried, on both the sync and async request paths (SNOW-4058589).
+  - Fixed `fetchone()`, `fetchmany()`, `fetchall()` and cursor iteration silently returning an incomplete result set. A downloaded result chunk holding fewer rows than the back-end reported just ended the iteration, which the fetch methods report as a normal end of results, so callers received fewer rows than the query produced with no exception raised. Such a chunk now raises an `OperationalError` (errno `252013`). Errors raised while iterating a result set are no longer reported as end-of-results either: `_fetchone()` caught every `TypeError` and returned `None`, so a failure anywhere in the download/parse chain was indistinguishable from an exhausted result set. Both the sync and async paths are fixed (SNOW-4109042).
+
+- v4.7.3(Sep 3,2026)
+  - Added experimental Python 3.14t (free-threaded CPython) wheel support. **Experimental — not intended for production use.**
+  - Fixed TLS hostname verification rejecting matching certificate SANs when a Snowflake account locator contains an underscore (SNOW-4011646).
+  - Fixed `connect()` being significantly slower on deep call stacks (e.g. Django apps with several middleware/decorator layers) because `get_application_path()` used `inspect.stack()`, which reads and parses the source file of every frame on the stack. It now walks frame references directly instead (SNOW-3691001, #2908).
+  - Fixed `split_statements` truncating unquoted URLs containing `://` at the `//`, misreading it as a line comment. The guards added alongside `//` comment support in 4.7.2 (SNOW-3772985) only recognized `file://`, so every other scheme (`http://`, `https://`, `s3://`, `snow://`, `azure://`) was cut short. Any `scheme://` is now recognized, on both the line-comment and block-comment paths (the latter affected globs such as `s3://bucket/*.csv`) (SNOW-3930192).
+  - Fixed the on-disk OCSP response validation cache failing with `RuntimeError: UnixFileLock on ... was inherited across fork; construct a new instance` when it was written from a forked child process. This could surface on fork-based platforms when fetching results with `client_fetch_use_mp=True`, where chunk downloads run in worker processes that perform their own certificate revocation checks. The cache's file lock is now re-created when the owning process changes, matching what already happened for the `spawn` start method.
+  - Result batch construction now logs only whether a `qrmk` is present, for both the sync and async result paths (SNOW-3675590).
+  - DEBUG logging in `create_batches_from_response()` reports chunk-header names with type/length value metadata (SNOW-3675590).
+  - The malformed-response ERROR log in `create_batches_from_response()` reports a structural summary of the response (SNOW-3675590).
+  - SQL text is masked before it is written to DEBUG logs: `_format_query_for_log()` runs the query through `SecretDetector`, covering the cursor and connection paths on both sync and async. The cancel-query log paths use the same masking (SNOW-3675590).
+  - Deferred the SQL-masking cost to log emit-time: query DEBUG lines pass a lazy `_format_query_for_log_lazy()` wrapper whose `__str__` masks only when a handler emits the record (SNOW-3675590).
+  - Corrected the invalid-account-identifier error message so it matches the validator, which allows '.' as a label separator.
+  - The `WORKLOAD_IDENTITY` authenticator runs only against recognized Snowflake hosts: the connection host is normalized and suffix-anchored against `snowflakecomputing.com`, `.cn`, and `.mil` before the workload-identity flow proceeds. The `SNOWFLAKE_WIF_ALLOWED_HOST_SUFFIXES` environment variable additively extends the recognized-host list (SNOW-3675580).
+  - Improved the robustness and correctness of OCSP revocation checking (SNOW-3675581).
+    - When `SF_OCSP_RESPONSE_CACHE_SERVER_URL` is set, the connector uses it as the OCSP cache server, including on PrivateLink hosts.
+    - A PrivateLink OCSP cache URL is derived only for hosts that consist of hostname characters, include a `.privatelink.` label, and end at `snowflakecomputing.com`, `.cn`, or `.mil`. Other hosts use the public default cache URL; set `SF_OCSP_RESPONSE_CACHE_SERVER_URL` to use a different cache server.
+  - Extended log secret masking coverage (SNOW-3675583). The connection-token pattern accepts `:` and `%` in the token value. Added patterns for OAuth access and refresh tokens in serialized JSON, for one-time passcodes, and for OAuth client identifiers and secrets. The passcode pattern accepts quoted values. The password pattern requires at least six characters in the value, so ordinary prose following the word "password" is not redacted.
+  - Request headers are copied before mutation on the async path, and masking is applied to the `Authorization` header in error logs (SNOW-3675593).
+  - Applied secret masking to the `snowflake.connector` loggers by default, independent of how application logging is configured. The same filter also covers the third-party loggers the connector uses (`botocore`, `boto3`, `aiohttp`, `aiobotocore`, `aioboto3`, vendored `urllib3`). Set `SNOWFLAKE_DISABLE_LOG_SECRET_MASKING=true` to opt out; it is honored at emit time, including after import (SNOW-3675583).
+
+- v4.7.2(Aug 7,2026)
   - Fixed a thread leak in the file transfer agent by properly shutting down ThreadPoolExecutors after PUT/GET transfers (SNOW-3556240, #2878).
   - Fixed `split_statements` treating `//` as SQL instead of a line comment, which could merge multiple statements when a `//` comment contained an apostrophe (SNOW-3772985).
   - Fixed large-file PUT uploads to internal Azure stages failing against the Azure 50,000-block-per-blob limit. The Azure multipart chunk size is now scaled up dynamically for very large files (mirroring the existing S3 behavior), and the default Azure chunk size was raised from 4 MB to 8 MB (consistent with S3) for better throughput (SNOW-3839943).
   - Fixed OAuth cached-credential connections failing with `250001 Invalid OAuth access token` when the cached token was invalid (GS code `390303`); the connector now reauthenticates silently (via refresh token if available, otherwise browser) instead of hard-failing. Also fixed fresh processes holding only a cached refresh token going straight to an interactive browser prompt instead of attempting a silent refresh first.
   - Fixed Okta/SAML authentication reporting an exhausted `login_timeout` as `250003: Failed to execute request: Attempted to set connect timeout to <negative value>`. Obtaining the one-time token in step 4 can overshoot the login deadline, which made the remaining budget negative; it was then passed to the HTTP layer, which rejected it with an opaque `ValueError`. A timed-out SAML login now raises `250006` with a message naming `login_timeout`. Running out of budget while retrying on `RefreshTokenError` reports the same error instead of failing later with an `AttributeError` on an empty response (SNOW-3891419).
   - Fixed OAuth authorization code flow failing for accounts with uppercase letters in the account name. `urlparse().hostname` always returns lowercase, but the host was compared case-sensitively in `_is_snowflake_as_idp`, causing Snowflake-as-IdP detection to return `False` and raising error 251013 (`client_id is empty`) even for connections that don't require a client ID.
+  - Fixed JWT key-pair authentication errors to surface the server's specific error code (e.g. `394304` for fingerprint mismatch, `394303` for clock skew) instead of always reporting the generic `250001`. Auth-rejection failures now also use SQLState `28000` (invalid authorization) instead of `08001` (SNOW-3775156).
 
 - v4.7.1(Jul 15,2026)
   - Added support for Python 3.14t (free-threaded).
@@ -29,7 +55,6 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Added native AKS (Azure Kubernetes Service) workload identity support. When running on AKS with workload identity configured, the connector automatically uses `WorkloadIdentityCredential` to authenticate via the injected service account credentials. OIDC backward compatibility is also supported.
   - Added the `workload_identity_aws_use_outbound_token` connection option (default `false`) to opt into AWS WIF JWT attestation via STS `GetWebIdentityToken` instead of the default SigV4 `GetCallerIdentity` method.
   - Fixed a bug where a fully-qualified DDL statement (e.g. `CREATE VIEW db.schema.obj`) on a session with no current schema would populate the connector's cached `_schema`/`_database` from the referenced object's namespace. This made `get_current_schema()` diverge from the server's `CURRENT_SCHEMA()` and mis-qualified Snowpark temp objects (SNOW-3665226).
-  - Fixed JWT key-pair authentication errors to surface the server's specific error code (e.g. `394304` for fingerprint mismatch, `394303` for clock skew) instead of always reporting the generic `250001`. Auth-rejection failures now also use SQLState `28000` (invalid authorization) instead of `08001` (SNOW-3775156).
 
 - v4.6.0(May 28,2026)
   - Dropped support for Python 3.9. The minimum supported version is now Python 3.10.

{snowflake_connector_python-4.7.2 → snowflake_connector_python-4.7.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.7.2
+Version: 4.7.4
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -70,8 +70,8 @@ Requires-Dist: more-itertools; extra == "development"
 Requires-Dist: numpy<=2.4.3; extra == "development"
 Requires-Dist: pendulum!=2.1.1; extra == "development"
 Requires-Dist: pexpect; extra == "development"
-Requires-Dist: pytest<7.5.0; extra == "development"
-Requires-Dist: pytest-asyncio; extra == "development"
+Requires-Dist: pytest<9,>=8.4; extra == "development"
+Requires-Dist: pytest-asyncio<2,>=1.4.0; extra == "development"
 Requires-Dist: pytest-cov; extra == "development"
 Requires-Dist: pytest-rerunfailures<16.0; extra == "development"
 Requires-Dist: pytest-timeout; extra == "development"
@@ -97,13 +97,39 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v4.7.2(Aug 6,2026)
+- v4.7.4(Sep 16,2026)
+  - Fixed missing retries on transient HTTP failures when fetching an OAuth access token from the IdP token endpoint (`OAUTH_CLIENT_CREDENTIALS` and `OAUTH_AUTHORIZATION_CODE`). Token requests now retry transport errors, HTTP 408/429, and 5xx responses (SNOW-3984430, #3003).
+  - Fixed a bug where a TLS handshake terminated by the peer (`SSLError` containing `SysCallError(-1, 'Unexpected EOF')`) was classified as non-retryable and surfaced as an `OperationalError`, unlike `ECONNRESET`. Such handshake `Unexpected EOF` errors are now retried, on both the sync and async request paths (SNOW-4058589).
+  - Fixed `fetchone()`, `fetchmany()`, `fetchall()` and cursor iteration silently returning an incomplete result set. A downloaded result chunk holding fewer rows than the back-end reported just ended the iteration, which the fetch methods report as a normal end of results, so callers received fewer rows than the query produced with no exception raised. Such a chunk now raises an `OperationalError` (errno `252013`). Errors raised while iterating a result set are no longer reported as end-of-results either: `_fetchone()` caught every `TypeError` and returned `None`, so a failure anywhere in the download/parse chain was indistinguishable from an exhausted result set. Both the sync and async paths are fixed (SNOW-4109042).
+
+- v4.7.3(Sep 3,2026)
+  - Added experimental Python 3.14t (free-threaded CPython) wheel support. **Experimental — not intended for production use.**
+  - Fixed TLS hostname verification rejecting matching certificate SANs when a Snowflake account locator contains an underscore (SNOW-4011646).
+  - Fixed `connect()` being significantly slower on deep call stacks (e.g. Django apps with several middleware/decorator layers) because `get_application_path()` used `inspect.stack()`, which reads and parses the source file of every frame on the stack. It now walks frame references directly instead (SNOW-3691001, #2908).
+  - Fixed `split_statements` truncating unquoted URLs containing `://` at the `//`, misreading it as a line comment. The guards added alongside `//` comment support in 4.7.2 (SNOW-3772985) only recognized `file://`, so every other scheme (`http://`, `https://`, `s3://`, `snow://`, `azure://`) was cut short. Any `scheme://` is now recognized, on both the line-comment and block-comment paths (the latter affected globs such as `s3://bucket/*.csv`) (SNOW-3930192).
+  - Fixed the on-disk OCSP response validation cache failing with `RuntimeError: UnixFileLock on ... was inherited across fork; construct a new instance` when it was written from a forked child process. This could surface on fork-based platforms when fetching results with `client_fetch_use_mp=True`, where chunk downloads run in worker processes that perform their own certificate revocation checks. The cache's file lock is now re-created when the owning process changes, matching what already happened for the `spawn` start method.
+  - Result batch construction now logs only whether a `qrmk` is present, for both the sync and async result paths (SNOW-3675590).
+  - DEBUG logging in `create_batches_from_response()` reports chunk-header names with type/length value metadata (SNOW-3675590).
+  - The malformed-response ERROR log in `create_batches_from_response()` reports a structural summary of the response (SNOW-3675590).
+  - SQL text is masked before it is written to DEBUG logs: `_format_query_for_log()` runs the query through `SecretDetector`, covering the cursor and connection paths on both sync and async. The cancel-query log paths use the same masking (SNOW-3675590).
+  - Deferred the SQL-masking cost to log emit-time: query DEBUG lines pass a lazy `_format_query_for_log_lazy()` wrapper whose `__str__` masks only when a handler emits the record (SNOW-3675590).
+  - Corrected the invalid-account-identifier error message so it matches the validator, which allows '.' as a label separator.
+  - The `WORKLOAD_IDENTITY` authenticator runs only against recognized Snowflake hosts: the connection host is normalized and suffix-anchored against `snowflakecomputing.com`, `.cn`, and `.mil` before the workload-identity flow proceeds. The `SNOWFLAKE_WIF_ALLOWED_HOST_SUFFIXES` environment variable additively extends the recognized-host list (SNOW-3675580).
+  - Improved the robustness and correctness of OCSP revocation checking (SNOW-3675581).
+    - When `SF_OCSP_RESPONSE_CACHE_SERVER_URL` is set, the connector uses it as the OCSP cache server, including on PrivateLink hosts.
+    - A PrivateLink OCSP cache URL is derived only for hosts that consist of hostname characters, include a `.privatelink.` label, and end at `snowflakecomputing.com`, `.cn`, or `.mil`. Other hosts use the public default cache URL; set `SF_OCSP_RESPONSE_CACHE_SERVER_URL` to use a different cache server.
+  - Extended log secret masking coverage (SNOW-3675583). The connection-token pattern accepts `:` and `%` in the token value. Added patterns for OAuth access and refresh tokens in serialized JSON, for one-time passcodes, and for OAuth client identifiers and secrets. The passcode pattern accepts quoted values. The password pattern requires at least six characters in the value, so ordinary prose following the word "password" is not redacted.
+  - Request headers are copied before mutation on the async path, and masking is applied to the `Authorization` header in error logs (SNOW-3675593).
+  - Applied secret masking to the `snowflake.connector` loggers by default, independent of how application logging is configured. The same filter also covers the third-party loggers the connector uses (`botocore`, `boto3`, `aiohttp`, `aiobotocore`, `aioboto3`, vendored `urllib3`). Set `SNOWFLAKE_DISABLE_LOG_SECRET_MASKING=true` to opt out; it is honored at emit time, including after import (SNOW-3675583).
+
+- v4.7.2(Aug 7,2026)
   - Fixed a thread leak in the file transfer agent by properly shutting down ThreadPoolExecutors after PUT/GET transfers (SNOW-3556240, #2878).
   - Fixed `split_statements` treating `//` as SQL instead of a line comment, which could merge multiple statements when a `//` comment contained an apostrophe (SNOW-3772985).
   - Fixed large-file PUT uploads to internal Azure stages failing against the Azure 50,000-block-per-blob limit. The Azure multipart chunk size is now scaled up dynamically for very large files (mirroring the existing S3 behavior), and the default Azure chunk size was raised from 4 MB to 8 MB (consistent with S3) for better throughput (SNOW-3839943).
   - Fixed OAuth cached-credential connections failing with `250001 Invalid OAuth access token` when the cached token was invalid (GS code `390303`); the connector now reauthenticates silently (via refresh token if available, otherwise browser) instead of hard-failing. Also fixed fresh processes holding only a cached refresh token going straight to an interactive browser prompt instead of attempting a silent refresh first.
   - Fixed Okta/SAML authentication reporting an exhausted `login_timeout` as `250003: Failed to execute request: Attempted to set connect timeout to <negative value>`. Obtaining the one-time token in step 4 can overshoot the login deadline, which made the remaining budget negative; it was then passed to the HTTP layer, which rejected it with an opaque `ValueError`. A timed-out SAML login now raises `250006` with a message naming `login_timeout`. Running out of budget while retrying on `RefreshTokenError` reports the same error instead of failing later with an `AttributeError` on an empty response (SNOW-3891419).
   - Fixed OAuth authorization code flow failing for accounts with uppercase letters in the account name. `urlparse().hostname` always returns lowercase, but the host was compared case-sensitively in `_is_snowflake_as_idp`, causing Snowflake-as-IdP detection to return `False` and raising error 251013 (`client_id is empty`) even for connections that don't require a client ID.
+  - Fixed JWT key-pair authentication errors to surface the server's specific error code (e.g. `394304` for fingerprint mismatch, `394303` for clock skew) instead of always reporting the generic `250001`. Auth-rejection failures now also use SQLState `28000` (invalid authorization) instead of `08001` (SNOW-3775156).
 
 - v4.7.1(Jul 15,2026)
   - Added support for Python 3.14t (free-threaded).
@@ -119,7 +145,6 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Added native AKS (Azure Kubernetes Service) workload identity support. When running on AKS with workload identity configured, the connector automatically uses `WorkloadIdentityCredential` to authenticate via the injected service account credentials. OIDC backward compatibility is also supported.
   - Added the `workload_identity_aws_use_outbound_token` connection option (default `false`) to opt into AWS WIF JWT attestation via STS `GetWebIdentityToken` instead of the default SigV4 `GetCallerIdentity` method.
   - Fixed a bug where a fully-qualified DDL statement (e.g. `CREATE VIEW db.schema.obj`) on a session with no current schema would populate the connector's cached `_schema`/`_database` from the referenced object's namespace. This made `get_current_schema()` diverge from the server's `CURRENT_SCHEMA()` and mis-qualified Snowpark temp objects (SNOW-3665226).
-  - Fixed JWT key-pair authentication errors to surface the server's specific error code (e.g. `394304` for fingerprint mismatch, `394303` for clock skew) instead of always reporting the generic `250001`. Auth-rejection failures now also use SQLState `28000` (invalid authorization) instead of `08001` (SNOW-3775156).
 
 - v4.6.0(May 28,2026)
   - Dropped support for Python 3.9. The minimum supported version is now Python 3.10.

{snowflake_connector_python-4.7.2 → snowflake_connector_python-4.7.4}/README.md

@@ -1,10 +1,7 @@
 # Snowflake Connector for Python
 
-[![Build and Test](https://github.com/snowflakedb/snowflake-connector-python/actions/workflows/build_test.yml/badge.svg)](https://github.com/snowflakedb/snowflake-connector-python/actions/workflows/build_test.yml)
-[![codecov](https://codecov.io/gh/snowflakedb/snowflake-connector-python/branch/main/graph/badge.svg?token=MVKSNtnLr0)](https://codecov.io/gh/snowflakedb/snowflake-connector-python)
-[![PyPi](https://img.shields.io/pypi/v/snowflake-connector-python.svg)](https://pypi.python.org/pypi/snowflake-connector-python/)
-[![License Apache-2.0](https://img.shields.io/:license-Apache%202-brightgreen.svg)](http://www.apache.org/licenses/LICENSE-2.0.txt)
-[![Codestyle Black](https://img.shields.io/badge/code%20style-black-000000.svg)](https://github.com/psf/black)
+> [!IMPORTANT]
+> A new version of the driver is being developed in [snowflakedb/drivers](https://github.com/snowflakedb/drivers) and is currently in public preview. See the [documentation](https://docs.snowflake.com/en/developer-guide/python-connector/python-connector-universal-core) for more information.
 
 This package includes the Snowflake Connector for Python, which conforms to the [Python DB API 2.0](https://www.python.org/dev/peps/pep-0249/) specification.
 
@@ -53,6 +50,29 @@ These tools are integrated into `tox` to allow us to easily set them up universa
   and we would like to have an overall coverage data file created for them.
 * **flake8**: (Deprecated) Similar to `fix_lint`, but only runs `flake8` checks.
 
+## Log secret masking
+
+By default, the connector masks secrets (tokens, passwords, cloud credentials,
+private keys) in records emitted by `snowflake.connector` loggers and by the
+third-party loggers it uses (`botocore`, `boto3`, `aiohttp`, `aiobotocore`,
+`aioboto3`, and vendored `urllib3`). Masking applies even when logging is
+configured with `logging.basicConfig`, not only when Easy Logging
+(`save_logs = true` in `config.toml`) is enabled. The same opt-out covers
+those trees: they also interpolate the message and clear `record.args`.
+
+To disable masking, set `SNOWFLAKE_DISABLE_LOG_SECRET_MASKING` to `true`.
+The connector reads this on every log record, so it is an escape hatch if
+masking is incompatible with a log pipeline (for example one that depends
+on structured `record.args`). Setting it **before** importing
+`snowflake.connector` also skips installing the masking hook:
+
+```bash
+export SNOWFLAKE_DISABLE_LOG_SECRET_MASKING=true
+```
+
+The masker interpolates each log record and clears `record.args`. Leave
+masking enabled unless you need that escape hatch.
+
 ## Disable telemetry
 
 By default, the Snowflake Connector for Python collects telemetry data to improve the product.

{snowflake_connector_python-4.7.2 → snowflake_connector_python-4.7.4}/setup.cfg

@@ -97,8 +97,8 @@ development =
 	numpy<=2.4.3
 	pendulum!=2.1.1
 	pexpect
-	pytest<7.5.0
-	pytest-asyncio
+	pytest>=8.4,<9
+	pytest-asyncio>=1.4.0,<2
 	pytest-cov
 	pytest-rerunfailures<16.0
 	pytest-timeout

snowflake_connector_python-4.7.4/src/snowflake/connector/_host_util.py

@@ -0,0 +1,106 @@
+#!/usr/bin/env python
+#
+# Copyright (c) 2012-2023 Snowflake Computing Inc. All rights reserved.
+#
+
+"""Host normalization and recognition shared by every subsystem that turns a
+connection host into the authority of a URL the connector builds itself.
+
+Kept subsystem-agnostic so that WORKLOAD_IDENTITY attestation and OCSP cache-URL
+derivation match hosts identically; a second, slightly different rule in either
+place is what this module exists to prevent. The suffix list itself lives in
+``constants`` so the data stays next to the connector's other TLD constants.
+"""
+
+from __future__ import annotations
+
+from typing import Iterable
+
+from .constants import _SNOWFLAKE_ALLOWED_HOST_SUFFIXES
+
+# Maps only ASCII A-Z to a-z.
+#
+# Deliberately not str.lower(): full Unicode case folding maps some characters
+# into ASCII, so a host containing U+212A KELVIN SIGN folds
+# "snowfla<U+212A>ecomputing.com" into "snowflakecomputing.com" and would match a
+# recognized suffix while DNS still resolves the original, unrelated name.
+# Leaving non-ASCII untouched lets is_ldh_host reject it instead.
+_ASCII_LOWERCASE_TABLE = str.maketrans(
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ", "abcdefghijklmnopqrstuvwxyz"
+)
+
+# Characters legal in a DNS hostname label, plus '_': account labels
+# legitimately contain one.
+_LDH_CHARACTERS = frozenset("abcdefghijklmnopqrstuvwxyz0123456789-_")
+
+
+def normalize_host(host: str | None) -> str:
+    """Normalizes a host (or a configured host suffix) into the single string that
+    every subsequent check and every derived URL must use.
+
+    Trims, lower-cases ASCII only, drops everything from the first ':' onward,
+    then strips exactly one trailing '.' (FQDN form).
+
+    The port must be dropped before the trailing dot: a host in FQDN form
+    carrying an explicit port ("acct.snowflakecomputing.com.:443") still has the
+    dot immediately before the colon, and removing the dot first would leave it
+    attached to the label and match no suffix.
+    """
+    if not host:
+        return ""
+    normalized = host.strip().translate(_ASCII_LOWERCASE_TABLE)
+    if ":" in normalized:
+        normalized = normalized.split(":", 1)[0]
+    if normalized.endswith("."):
+        normalized = normalized[:-1]
+    return normalized
+
+
+def is_ldh_host(normalized_host: str) -> bool:
+    """Whether an already-normalized host is made only of characters legal in a
+    DNS hostname: every dot-separated label non-empty and drawn from
+    ``[a-z0-9_-]``.
+
+    This is an allow-list, not a list of forbidden delimiters, and that
+    distinction is load-bearing. A host is only safe to interpolate into a URL
+    authority if it cannot carry a character that some URL parser treats as
+    ending the host, and enumerating such characters does not work: parsers
+    variously terminate the authority at a space, ';', "'", a percent-escape, or
+    a full-width look-alike of '.', '#' or '?'. Since a host whose trailing
+    labels are a recognized Snowflake domain can still begin with an unrelated
+    name, a parser that stops early resolves that unrelated name instead.
+
+    Args:
+        normalized_host: output of :func:`normalize_host`.
+    """
+    if not normalized_host:
+        return False
+    return all(
+        label and _LDH_CHARACTERS.issuperset(label)
+        for label in normalized_host.split(".")
+    )
+
+
+def has_recognized_snowflake_suffix(
+    normalized_host: str,
+    extra_suffixes: Iterable[str] | None = None,
+) -> bool:
+    """Whether an already-normalized host ends at one of the recognized Snowflake
+    suffixes, matched on a label boundary so that only a listed suffix and its
+    subdomains qualify. The bare apex is accepted by the equality branch.
+
+    Args:
+        normalized_host: output of :func:`normalize_host`.
+        extra_suffixes: additional already-normalized suffixes to accept.
+            Additive only: callers cannot use this to disable the built-in list.
+    """
+    if not normalized_host:
+        return False
+    suffixes: tuple[str, ...] = _SNOWFLAKE_ALLOWED_HOST_SUFFIXES
+    if extra_suffixes:
+        suffixes = (*suffixes, *extra_suffixes)
+    return any(
+        normalized_host == suffix or normalized_host.endswith(f".{suffix}")
+        for suffix in suffixes
+        if suffix
+    )

{snowflake_connector_python-4.7.2 → snowflake_connector_python-4.7.4}/src/snowflake/connector/_utils.py

@@ -9,7 +9,7 @@ import string
 import threading
 import time
 from enum import Enum
-from inspect import stack
+from inspect import currentframe
 from secrets import choice
 from threading import Timer
 from uuid import UUID
@@ -101,12 +101,24 @@ class _TrackedQueryCancellationTimer(Timer):
 
 
 def get_application_path() -> str:
-    """Get the path of the application script using the connector."""
+    """Get the path of the application script using the connector.
+
+    Walks frame.f_back directly instead of using inspect.stack(), which
+    reads and parses the source file of every frame on the call stack.
+    That per-frame disk I/O made connect() take hundreds of milliseconds
+    on deep call stacks (see SNOW-3691001 / GH-2908).
+    """
+    frame = currentframe()
     try:
-        outermost_frame = stack()[-1]
-        return outermost_frame.filename
+        if frame is None:
+            return "unknown"
+        while frame.f_back is not None:
+            frame = frame.f_back
+        return frame.f_code.co_filename
     except Exception:
         return "unknown"
+    finally:
+        del frame
 
 
 _SPCS_ENV_VAR = "SNOWFLAKE_RUNNING_INSIDE_SPCS"

{snowflake_connector_python-4.7.2 → snowflake_connector_python-4.7.4}/src/snowflake/connector/aio/_connection.py

@@ -120,7 +120,6 @@ else:
 
 
 class SnowflakeConnection(SnowflakeConnectionSync):
-    OCSP_ENV_LOCK = asyncio.Lock()
 
     def __init__(
         self,
@@ -233,20 +232,17 @@ class SnowflakeConnection(SnowflakeConnectionSync):
         )
         logger.debug("REST API object was created: %s:%s", self.host, self.port)
 
+        # The PrivateLink OCSP cache URL is now derived per-connection inside
+        # OCSPServer from this connection's hostname (SNOW-3675581); the driver
+        # does not write SF_OCSP_RESPONSE_CACHE_SERVER_URL to the process
+        # environment. An operator-set value is still honored (and takes
+        # precedence) -- log it if present.
         if "SF_OCSP_RESPONSE_CACHE_SERVER_URL" in os.environ:
             logger.debug(
                 "Custom OCSP Cache Server URL found in environment - %s",
                 os.environ["SF_OCSP_RESPONSE_CACHE_SERVER_URL"],
             )
 
-        if ".privatelink.snowflakecomputing." in self.host.lower():
-            await SnowflakeConnection.setup_ocsp_privatelink(
-                self.application, self.host
-            )
-        else:
-            if "SF_OCSP_RESPONSE_CACHE_SERVER_URL" in os.environ:
-                del os.environ["SF_OCSP_RESPONSE_CACHE_SERVER_URL"]
-
         if self._session_parameters is None:
             self._session_parameters = {}
         if self._autocommit is not None:
@@ -715,7 +711,11 @@ class SnowflakeConnection(SnowflakeConnectionSync):
         self, sql: str, request_id: uuid.UUID
     ) -> dict[str, bool | None]:
         """Cancels the query with the exact SQL query and requestId."""
-        logger.debug("_cancel_query sql=[%s], request_id=[%s]", sql, request_id)
+        logger.debug(
+            "_cancel_query sql=[%s], request_id=[%s]",
+            self._format_query_for_log(sql),
+            request_id,
+        )
         url_parameters = {REQUEST_ID: str(uuid.uuid4())}
 
         return await self.rest.request(
@@ -1233,14 +1233,6 @@ class SnowflakeConnection(SnowflakeConnectionSync):
             self._process_error_query_status(sf_qid, status_resp)
         return status
 
-    @staticmethod
-    async def setup_ocsp_privatelink(app, hostname) -> None:
-        hostname = hostname.lower()
-        async with SnowflakeConnection.OCSP_ENV_LOCK:
-            ocsp_cache_server = f"http://ocsp.{hostname}/ocsp_response_cache.json"
-            os.environ["SF_OCSP_RESPONSE_CACHE_SERVER_URL"] = ocsp_cache_server
-            logger.debug("OCSP Cache Server is updated: %s", ocsp_cache_server)
-
     async def rollback(self) -> None:
         """Rolls back the current transaction."""
         await self.cursor().execute("ROLLBACK")

{snowflake_connector_python-4.7.2 → snowflake_connector_python-4.7.4}/src/snowflake/connector/aio/_cursor.py

@@ -142,7 +142,11 @@ class SnowflakeCursorBase(SnowflakeCursorBaseSync, abc.ABC, typing.Generic[Fetch
 
     async def __cancel_query(self, query) -> None:
         if self._sequence_counter >= 0 and not self.is_closed():
-            logger.debug("canceled. %s, request_id: %s", query, self._request_id)
+            logger.debug(
+                "canceled. %s, request_id: %s",
+                self._format_query_for_log_lazy(query),
+                self._request_id,
+            )
             async with self._lock_canceling:
                 await self._connection._cancel_query(query, self._request_id)
 
@@ -234,7 +238,7 @@ class SnowflakeCursorBase(SnowflakeCursorBaseSync, abc.ABC, typing.Generic[Fetch
 
         logger.debug(f"Request id: {self._request_id}")
 
-        logger.debug("running query [%s]", self._format_query_for_log(query))
+        logger.debug("running query [%s]", self._format_query_for_log_lazy(query))
         if _is_put_get is not None:
             # if told the query is PUT or GET, use the information
             self._is_file_transfer = _is_put_get
@@ -375,6 +379,10 @@ class SnowflakeCursorBase(SnowflakeCursorBaseSync, abc.ABC, typing.Generic[Fetch
             self,
             result_chunks,
             self._connection.client_prefetch_threads,
+            # SNOW-4109042: a DML reuses "total" for the rows the statement
+            # affected, which says nothing about the rows in its result set, so
+            # only a query's total is a promise worth holding the back-end to.
+            total_row_count=None if is_dml else data.get("total"),
         )
         self._rownumber = -1
         self._result_state = ResultState.VALID
@@ -574,7 +582,7 @@ class SnowflakeCursorBase(SnowflakeCursorBaseSync, abc.ABC, typing.Generic[Fetch
                 logger.warning("execute: no query is given to execute")
                 return None
 
-        logger.debug("query: [%s]", self._format_query_for_log(command))
+        logger.debug("query: [%s]", self._format_query_for_log_lazy(command))
 
         _statement_params = _statement_params or dict()
         # If we need to add another parameter, please consider introducing a dict for all extra params
@@ -918,24 +926,25 @@ class SnowflakeCursorBase(SnowflakeCursorBaseSync, abc.ABC, typing.Generic[Fetch
         if self._result is None and self._result_set is not None:
             self._result: ResultSetIterator = await self._result_set._create_iter()
             self._result_state = ResultState.VALID
-        try:
-            if self._result is None:
-                raise TypeError("'NoneType' object is not an iterator")
-            _next = await self._result.get_next()
-            if isinstance(_next, Exception):
-                Error.errorhandler_wrapper_from_ready_exception(
-                    self._connection,
-                    self,
-                    _next,
-                )
-            if _next is not None:
-                self._rownumber += 1
-            return _next
-        except TypeError as err:
+        if self._result is None:
+            # SNOW-4109042: a missing result iterator is the only reason to report
+            # end-of-results here -- a cursor that was reset has no rows left to
+            # hand out. Errors raised while iterating a real result set must reach
+            # the caller instead of looking like a result set that ran out.
             if self._result_state == ResultState.DEFAULT:
-                raise err
-            else:
-                return None
+                raise TypeError("'NoneType' object is not an iterator")
+            return None
+
+        _next = await self._result.get_next()
+        if isinstance(_next, Exception):
+            Error.errorhandler_wrapper_from_ready_exception(
+                self._connection,
+                self,
+                _next,
+            )
+        if _next is not None:
+            self._rownumber += 1
+        return _next
 
     async def fetchmany(self, size: int | None = None) -> list[FetchRow]:
         """Fetches the number of specified rows."""

{snowflake_connector_python-4.7.2 → snowflake_connector_python-4.7.4}/src/snowflake/connector/aio/_network.py

@@ -79,6 +79,7 @@ from ..network import (
     is_econnreset_exception,
     is_login_request,
     is_retryable_http_code,
+    is_unexpected_eof_exception,
 )
 from ..secret_detector import SecretDetector
 from ..sqlstate import (
@@ -730,6 +731,8 @@ class SnowflakeRestful(SnowflakeRestfulSync):
             else:
                 input_data = data
 
+            # Work on a copy so the caller-supplied dict is never mutated.
+            headers = dict(headers)
             if HEADER_AUTHORIZATION_KEY in headers:
                 del headers[HEADER_AUTHORIZATION_KEY]
             if token != NO_TOKEN:
@@ -814,7 +817,7 @@ class SnowflakeRestful(SnowflakeRestfulSync):
             finally:
                 raw_ret.close()  # ensure response is closed
         except (aiohttp.ClientSSLError, aiohttp.ClientConnectorSSLError) as se:
-            if is_econnreset_exception(se):
+            if is_econnreset_exception(se) or is_unexpected_eof_exception(se):
                 raise RetryRequest(se.os_error)
             msg = f"Hit non-retryable SSL error, {str(se)}.\n{_CONNECTIVITY_ERR_MSG}"
             logger.debug(msg)

{snowflake_connector_python-4.7.2 → snowflake_connector_python-4.7.4}/src/snowflake/connector/aio/_ocsp_snowflake.py

@@ -33,7 +33,6 @@ from snowflake.connector.ocsp_snowflake import (
 from snowflake.connector.ocsp_snowflake import OCSPServer as OCSPServerSync
 from snowflake.connector.ocsp_snowflake import OCSPTelemetryData
 from snowflake.connector.ocsp_snowflake import SnowflakeOCSP as SnowflakeOCSPSync
-from snowflake.connector.url_util import extract_top_level_domain_from_hostname
 
 if TYPE_CHECKING:
     from snowflake.connector.aio._session_manager import SessionManager
@@ -157,11 +156,7 @@ class SnowflakeOCSP(SnowflakeOCSPSync):
 
         self._use_post_method = use_post_method
         self._root_certs_dict_lock_timeout = root_certs_dict_lock_timeout
-        self.OCSP_CACHE_SERVER = OCSPServer(
-            top_level_domain=extract_top_level_domain_from_hostname(
-                kwargs.pop("hostname", None)
-            )
-        )
+        self.OCSP_CACHE_SERVER = OCSPServer(hostname=kwargs.pop("hostname", None))
 
         self.debug_ocsp_failure_url = None
 

{snowflake_connector_python-4.7.2 → snowflake_connector_python-4.7.4}/src/snowflake/connector/aio/_result_batch.py

@@ -86,12 +86,19 @@ def create_batches_from_response(
             chunk_headers = {}
             for header_key, header_value in data["chunkHeaders"].items():
                 chunk_headers[header_key] = header_value
-                if "encryption" not in header_key:
-                    logger.debug(
-                        f"added chunk header: key={header_key}, value={header_value}"
-                    )
+                # SNOW-3675590: never log the value — chunk-header values can be
+                # secrets (SSE-C customer key). Log the header name plus
+                # non-sensitive value metadata only. Capture real headers via a
+                # proxy (drivers-usage PROXY=1) when debugging.
+                logger.debug(
+                    f"added chunk header: key={header_key} "
+                    f"value={SecretDetector.describe_value(header_value)}"
+                )
         elif qrmk is not None:
-            logger.debug(f"qrmk={SecretDetector.mask_secrets(qrmk)}")
+            # SNOW-3675590: never log the qrmk value — it is the AES-256 SSE-C
+            # result-encryption key. Log only its presence; do not route it
+            # through masking helpers as a substitute.
+            logger.debug("qrmk is present in the result response")
             chunk_headers[SSE_C_ALGORITHM] = SSE_C_AES
             chunk_headers[SSE_C_KEY] = qrmk
 
@@ -154,7 +161,12 @@ def create_batches_from_response(
             session_manager=cursor._connection._session_manager.clone(),
         )
     else:
-        logger.error(f"Don't know how to construct ResultBatches from response: {data}")
+        # SNOW-3675590: log only the structural shape — the raw response can
+        # carry secrets, and this ERROR line is emitted regardless of DEBUG level.
+        logger.error(
+            "Don't know how to construct ResultBatches from response: "
+            f"format={_format!r}, shape={SecretDetector.describe_value(data)}"
+        )
         first_chunk = ArrowResultBatch.from_data(
             "",
             0,
@@ -321,6 +333,7 @@ class JSONResultBatch(ResultBatch, JSONResultBatchSync):
         async with TimerContextManager() as parse_metric:
             parsed_data = self._parse(downloaded_data)
         self._metrics[DownloadMetrics.parse.value] = parse_metric.get_timing_millis()
+        self._check_rowcount(len(parsed_data))
         return iter(parsed_data)
 
     async def _load(self, content: bytes, encoding: str) -> list:
@@ -439,4 +452,6 @@ class ArrowResultBatch(ResultBatch, ArrowResultBatchSync):
             else:
                 return await self._get_arrow_iter(connection=connection)
         else:
-            return await self._create_iter(iter_unit=iter_unit, connection=connection)
+            return self._iter_checked_rows(
+                await self._create_iter(iter_unit=iter_unit, connection=connection)
+            )