snowflake-connector-python 4.7.3__tar.gz → 4.7.4__tar.gz

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.4}/DESCRIPTION.md

@@ -7,11 +7,17 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.7.4(Sep 16,2026)
+  - Fixed missing retries on transient HTTP failures when fetching an OAuth access token from the IdP token endpoint (`OAUTH_CLIENT_CREDENTIALS` and `OAUTH_AUTHORIZATION_CODE`). Token requests now retry transport errors, HTTP 408/429, and 5xx responses (SNOW-3984430, #3003).
+  - Fixed a bug where a TLS handshake terminated by the peer (`SSLError` containing `SysCallError(-1, 'Unexpected EOF')`) was classified as non-retryable and surfaced as an `OperationalError`, unlike `ECONNRESET`. Such handshake `Unexpected EOF` errors are now retried, on both the sync and async request paths (SNOW-4058589).
+  - Fixed `fetchone()`, `fetchmany()`, `fetchall()` and cursor iteration silently returning an incomplete result set. A downloaded result chunk holding fewer rows than the back-end reported just ended the iteration, which the fetch methods report as a normal end of results, so callers received fewer rows than the query produced with no exception raised. Such a chunk now raises an `OperationalError` (errno `252013`). Errors raised while iterating a result set are no longer reported as end-of-results either: `_fetchone()` caught every `TypeError` and returned `None`, so a failure anywhere in the download/parse chain was indistinguishable from an exhausted result set. Both the sync and async paths are fixed (SNOW-4109042).
+
 - v4.7.3(Sep 3,2026)
   - Added experimental Python 3.14t (free-threaded CPython) wheel support. **Experimental — not intended for production use.**
   - Fixed TLS hostname verification rejecting matching certificate SANs when a Snowflake account locator contains an underscore (SNOW-4011646).
   - Fixed `connect()` being significantly slower on deep call stacks (e.g. Django apps with several middleware/decorator layers) because `get_application_path()` used `inspect.stack()`, which reads and parses the source file of every frame on the stack. It now walks frame references directly instead (SNOW-3691001, #2908).
   - Fixed `split_statements` truncating unquoted URLs containing `://` at the `//`, misreading it as a line comment. The guards added alongside `//` comment support in 4.7.2 (SNOW-3772985) only recognized `file://`, so every other scheme (`http://`, `https://`, `s3://`, `snow://`, `azure://`) was cut short. Any `scheme://` is now recognized, on both the line-comment and block-comment paths (the latter affected globs such as `s3://bucket/*.csv`) (SNOW-3930192).
+  - Fixed the on-disk OCSP response validation cache failing with `RuntimeError: UnixFileLock on ... was inherited across fork; construct a new instance` when it was written from a forked child process. This could surface on fork-based platforms when fetching results with `client_fetch_use_mp=True`, where chunk downloads run in worker processes that perform their own certificate revocation checks. The cache's file lock is now re-created when the owning process changes, matching what already happened for the `spawn` start method.
   - Result batch construction now logs only whether a `qrmk` is present, for both the sync and async result paths (SNOW-3675590).
   - DEBUG logging in `create_batches_from_response()` reports chunk-header names with type/length value metadata (SNOW-3675590).
   - The malformed-response ERROR log in `create_batches_from_response()` reports a structural summary of the response (SNOW-3675590).
@@ -25,15 +31,15 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Extended log secret masking coverage (SNOW-3675583). The connection-token pattern accepts `:` and `%` in the token value. Added patterns for OAuth access and refresh tokens in serialized JSON, for one-time passcodes, and for OAuth client identifiers and secrets. The passcode pattern accepts quoted values. The password pattern requires at least six characters in the value, so ordinary prose following the word "password" is not redacted.
   - Request headers are copied before mutation on the async path, and masking is applied to the `Authorization` header in error logs (SNOW-3675593).
   - Applied secret masking to the `snowflake.connector` loggers by default, independent of how application logging is configured. The same filter also covers the third-party loggers the connector uses (`botocore`, `boto3`, `aiohttp`, `aiobotocore`, `aioboto3`, vendored `urllib3`). Set `SNOWFLAKE_DISABLE_LOG_SECRET_MASKING=true` to opt out; it is honored at emit time, including after import (SNOW-3675583).
-  - Fixed the on-disk OCSP response validation cache failing with `RuntimeError: UnixFileLock on ... was inherited across fork; construct a new instance` when it was written from a forked child process. This could surface on fork-based platforms when fetching results with `client_fetch_use_mp=True`, where chunk downloads run in worker processes that perform their own certificate revocation checks. The cache's file lock is now re-created when the owning process changes, matching what already happened for the `spawn` start method.
 
-- v4.7.2(Aug 6,2026)
+- v4.7.2(Aug 7,2026)
   - Fixed a thread leak in the file transfer agent by properly shutting down ThreadPoolExecutors after PUT/GET transfers (SNOW-3556240, #2878).
   - Fixed `split_statements` treating `//` as SQL instead of a line comment, which could merge multiple statements when a `//` comment contained an apostrophe (SNOW-3772985).
   - Fixed large-file PUT uploads to internal Azure stages failing against the Azure 50,000-block-per-blob limit. The Azure multipart chunk size is now scaled up dynamically for very large files (mirroring the existing S3 behavior), and the default Azure chunk size was raised from 4 MB to 8 MB (consistent with S3) for better throughput (SNOW-3839943).
   - Fixed OAuth cached-credential connections failing with `250001 Invalid OAuth access token` when the cached token was invalid (GS code `390303`); the connector now reauthenticates silently (via refresh token if available, otherwise browser) instead of hard-failing. Also fixed fresh processes holding only a cached refresh token going straight to an interactive browser prompt instead of attempting a silent refresh first.
   - Fixed Okta/SAML authentication reporting an exhausted `login_timeout` as `250003: Failed to execute request: Attempted to set connect timeout to <negative value>`. Obtaining the one-time token in step 4 can overshoot the login deadline, which made the remaining budget negative; it was then passed to the HTTP layer, which rejected it with an opaque `ValueError`. A timed-out SAML login now raises `250006` with a message naming `login_timeout`. Running out of budget while retrying on `RefreshTokenError` reports the same error instead of failing later with an `AttributeError` on an empty response (SNOW-3891419).
   - Fixed OAuth authorization code flow failing for accounts with uppercase letters in the account name. `urlparse().hostname` always returns lowercase, but the host was compared case-sensitively in `_is_snowflake_as_idp`, causing Snowflake-as-IdP detection to return `False` and raising error 251013 (`client_id is empty`) even for connections that don't require a client ID.
+  - Fixed JWT key-pair authentication errors to surface the server's specific error code (e.g. `394304` for fingerprint mismatch, `394303` for clock skew) instead of always reporting the generic `250001`. Auth-rejection failures now also use SQLState `28000` (invalid authorization) instead of `08001` (SNOW-3775156).
 
 - v4.7.1(Jul 15,2026)
   - Added support for Python 3.14t (free-threaded).
@@ -49,7 +55,6 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Added native AKS (Azure Kubernetes Service) workload identity support. When running on AKS with workload identity configured, the connector automatically uses `WorkloadIdentityCredential` to authenticate via the injected service account credentials. OIDC backward compatibility is also supported.
   - Added the `workload_identity_aws_use_outbound_token` connection option (default `false`) to opt into AWS WIF JWT attestation via STS `GetWebIdentityToken` instead of the default SigV4 `GetCallerIdentity` method.
   - Fixed a bug where a fully-qualified DDL statement (e.g. `CREATE VIEW db.schema.obj`) on a session with no current schema would populate the connector's cached `_schema`/`_database` from the referenced object's namespace. This made `get_current_schema()` diverge from the server's `CURRENT_SCHEMA()` and mis-qualified Snowpark temp objects (SNOW-3665226).
-  - Fixed JWT key-pair authentication errors to surface the server's specific error code (e.g. `394304` for fingerprint mismatch, `394303` for clock skew) instead of always reporting the generic `250001`. Auth-rejection failures now also use SQLState `28000` (invalid authorization) instead of `08001` (SNOW-3775156).
 
 - v4.6.0(May 28,2026)
   - Dropped support for Python 3.9. The minimum supported version is now Python 3.10.

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.7.3
+Version: 4.7.4
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -70,8 +70,8 @@ Requires-Dist: more-itertools; extra == "development"
 Requires-Dist: numpy<=2.4.3; extra == "development"
 Requires-Dist: pendulum!=2.1.1; extra == "development"
 Requires-Dist: pexpect; extra == "development"
-Requires-Dist: pytest<7.5.0; extra == "development"
-Requires-Dist: pytest-asyncio; extra == "development"
+Requires-Dist: pytest<9,>=8.4; extra == "development"
+Requires-Dist: pytest-asyncio<2,>=1.4.0; extra == "development"
 Requires-Dist: pytest-cov; extra == "development"
 Requires-Dist: pytest-rerunfailures<16.0; extra == "development"
 Requires-Dist: pytest-timeout; extra == "development"
@@ -97,11 +97,17 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.7.4(Sep 16,2026)
+  - Fixed missing retries on transient HTTP failures when fetching an OAuth access token from the IdP token endpoint (`OAUTH_CLIENT_CREDENTIALS` and `OAUTH_AUTHORIZATION_CODE`). Token requests now retry transport errors, HTTP 408/429, and 5xx responses (SNOW-3984430, #3003).
+  - Fixed a bug where a TLS handshake terminated by the peer (`SSLError` containing `SysCallError(-1, 'Unexpected EOF')`) was classified as non-retryable and surfaced as an `OperationalError`, unlike `ECONNRESET`. Such handshake `Unexpected EOF` errors are now retried, on both the sync and async request paths (SNOW-4058589).
+  - Fixed `fetchone()`, `fetchmany()`, `fetchall()` and cursor iteration silently returning an incomplete result set. A downloaded result chunk holding fewer rows than the back-end reported just ended the iteration, which the fetch methods report as a normal end of results, so callers received fewer rows than the query produced with no exception raised. Such a chunk now raises an `OperationalError` (errno `252013`). Errors raised while iterating a result set are no longer reported as end-of-results either: `_fetchone()` caught every `TypeError` and returned `None`, so a failure anywhere in the download/parse chain was indistinguishable from an exhausted result set. Both the sync and async paths are fixed (SNOW-4109042).
+
 - v4.7.3(Sep 3,2026)
   - Added experimental Python 3.14t (free-threaded CPython) wheel support. **Experimental — not intended for production use.**
   - Fixed TLS hostname verification rejecting matching certificate SANs when a Snowflake account locator contains an underscore (SNOW-4011646).
   - Fixed `connect()` being significantly slower on deep call stacks (e.g. Django apps with several middleware/decorator layers) because `get_application_path()` used `inspect.stack()`, which reads and parses the source file of every frame on the stack. It now walks frame references directly instead (SNOW-3691001, #2908).
   - Fixed `split_statements` truncating unquoted URLs containing `://` at the `//`, misreading it as a line comment. The guards added alongside `//` comment support in 4.7.2 (SNOW-3772985) only recognized `file://`, so every other scheme (`http://`, `https://`, `s3://`, `snow://`, `azure://`) was cut short. Any `scheme://` is now recognized, on both the line-comment and block-comment paths (the latter affected globs such as `s3://bucket/*.csv`) (SNOW-3930192).
+  - Fixed the on-disk OCSP response validation cache failing with `RuntimeError: UnixFileLock on ... was inherited across fork; construct a new instance` when it was written from a forked child process. This could surface on fork-based platforms when fetching results with `client_fetch_use_mp=True`, where chunk downloads run in worker processes that perform their own certificate revocation checks. The cache's file lock is now re-created when the owning process changes, matching what already happened for the `spawn` start method.
   - Result batch construction now logs only whether a `qrmk` is present, for both the sync and async result paths (SNOW-3675590).
   - DEBUG logging in `create_batches_from_response()` reports chunk-header names with type/length value metadata (SNOW-3675590).
   - The malformed-response ERROR log in `create_batches_from_response()` reports a structural summary of the response (SNOW-3675590).
@@ -115,15 +121,15 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Extended log secret masking coverage (SNOW-3675583). The connection-token pattern accepts `:` and `%` in the token value. Added patterns for OAuth access and refresh tokens in serialized JSON, for one-time passcodes, and for OAuth client identifiers and secrets. The passcode pattern accepts quoted values. The password pattern requires at least six characters in the value, so ordinary prose following the word "password" is not redacted.
   - Request headers are copied before mutation on the async path, and masking is applied to the `Authorization` header in error logs (SNOW-3675593).
   - Applied secret masking to the `snowflake.connector` loggers by default, independent of how application logging is configured. The same filter also covers the third-party loggers the connector uses (`botocore`, `boto3`, `aiohttp`, `aiobotocore`, `aioboto3`, vendored `urllib3`). Set `SNOWFLAKE_DISABLE_LOG_SECRET_MASKING=true` to opt out; it is honored at emit time, including after import (SNOW-3675583).
-  - Fixed the on-disk OCSP response validation cache failing with `RuntimeError: UnixFileLock on ... was inherited across fork; construct a new instance` when it was written from a forked child process. This could surface on fork-based platforms when fetching results with `client_fetch_use_mp=True`, where chunk downloads run in worker processes that perform their own certificate revocation checks. The cache's file lock is now re-created when the owning process changes, matching what already happened for the `spawn` start method.
 
-- v4.7.2(Aug 6,2026)
+- v4.7.2(Aug 7,2026)
   - Fixed a thread leak in the file transfer agent by properly shutting down ThreadPoolExecutors after PUT/GET transfers (SNOW-3556240, #2878).
   - Fixed `split_statements` treating `//` as SQL instead of a line comment, which could merge multiple statements when a `//` comment contained an apostrophe (SNOW-3772985).
   - Fixed large-file PUT uploads to internal Azure stages failing against the Azure 50,000-block-per-blob limit. The Azure multipart chunk size is now scaled up dynamically for very large files (mirroring the existing S3 behavior), and the default Azure chunk size was raised from 4 MB to 8 MB (consistent with S3) for better throughput (SNOW-3839943).
   - Fixed OAuth cached-credential connections failing with `250001 Invalid OAuth access token` when the cached token was invalid (GS code `390303`); the connector now reauthenticates silently (via refresh token if available, otherwise browser) instead of hard-failing. Also fixed fresh processes holding only a cached refresh token going straight to an interactive browser prompt instead of attempting a silent refresh first.
   - Fixed Okta/SAML authentication reporting an exhausted `login_timeout` as `250003: Failed to execute request: Attempted to set connect timeout to <negative value>`. Obtaining the one-time token in step 4 can overshoot the login deadline, which made the remaining budget negative; it was then passed to the HTTP layer, which rejected it with an opaque `ValueError`. A timed-out SAML login now raises `250006` with a message naming `login_timeout`. Running out of budget while retrying on `RefreshTokenError` reports the same error instead of failing later with an `AttributeError` on an empty response (SNOW-3891419).
   - Fixed OAuth authorization code flow failing for accounts with uppercase letters in the account name. `urlparse().hostname` always returns lowercase, but the host was compared case-sensitively in `_is_snowflake_as_idp`, causing Snowflake-as-IdP detection to return `False` and raising error 251013 (`client_id is empty`) even for connections that don't require a client ID.
+  - Fixed JWT key-pair authentication errors to surface the server's specific error code (e.g. `394304` for fingerprint mismatch, `394303` for clock skew) instead of always reporting the generic `250001`. Auth-rejection failures now also use SQLState `28000` (invalid authorization) instead of `08001` (SNOW-3775156).
 
 - v4.7.1(Jul 15,2026)
   - Added support for Python 3.14t (free-threaded).
@@ -139,7 +145,6 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Added native AKS (Azure Kubernetes Service) workload identity support. When running on AKS with workload identity configured, the connector automatically uses `WorkloadIdentityCredential` to authenticate via the injected service account credentials. OIDC backward compatibility is also supported.
   - Added the `workload_identity_aws_use_outbound_token` connection option (default `false`) to opt into AWS WIF JWT attestation via STS `GetWebIdentityToken` instead of the default SigV4 `GetCallerIdentity` method.
   - Fixed a bug where a fully-qualified DDL statement (e.g. `CREATE VIEW db.schema.obj`) on a session with no current schema would populate the connector's cached `_schema`/`_database` from the referenced object's namespace. This made `get_current_schema()` diverge from the server's `CURRENT_SCHEMA()` and mis-qualified Snowpark temp objects (SNOW-3665226).
-  - Fixed JWT key-pair authentication errors to surface the server's specific error code (e.g. `394304` for fingerprint mismatch, `394303` for clock skew) instead of always reporting the generic `250001`. Auth-rejection failures now also use SQLState `28000` (invalid authorization) instead of `08001` (SNOW-3775156).
 
 - v4.6.0(May 28,2026)
   - Dropped support for Python 3.9. The minimum supported version is now Python 3.10.

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.4}/README.md

@@ -1,10 +1,7 @@
 # Snowflake Connector for Python
 
-[![Build and Test](https://github.com/snowflakedb/snowflake-connector-python/actions/workflows/build_test.yml/badge.svg)](https://github.com/snowflakedb/snowflake-connector-python/actions/workflows/build_test.yml)
-[![codecov](https://codecov.io/gh/snowflakedb/snowflake-connector-python/branch/main/graph/badge.svg?token=MVKSNtnLr0)](https://codecov.io/gh/snowflakedb/snowflake-connector-python)
-[![PyPi](https://img.shields.io/pypi/v/snowflake-connector-python.svg)](https://pypi.python.org/pypi/snowflake-connector-python/)
-[![License Apache-2.0](https://img.shields.io/:license-Apache%202-brightgreen.svg)](http://www.apache.org/licenses/LICENSE-2.0.txt)
-[![Codestyle Black](https://img.shields.io/badge/code%20style-black-000000.svg)](https://github.com/psf/black)
+> [!IMPORTANT]
+> A new version of the driver is being developed in [snowflakedb/drivers](https://github.com/snowflakedb/drivers) and is currently in public preview. See the [documentation](https://docs.snowflake.com/en/developer-guide/python-connector/python-connector-universal-core) for more information.
 
 This package includes the Snowflake Connector for Python, which conforms to the [Python DB API 2.0](https://www.python.org/dev/peps/pep-0249/) specification.
 

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.4}/setup.cfg

@@ -97,8 +97,8 @@ development =
 	numpy<=2.4.3
 	pendulum!=2.1.1
 	pexpect
-	pytest<7.5.0
-	pytest-asyncio
+	pytest>=8.4,<9
+	pytest-asyncio>=1.4.0,<2
 	pytest-cov
 	pytest-rerunfailures<16.0
 	pytest-timeout

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.4}/src/snowflake/connector/aio/_cursor.py

@@ -379,6 +379,10 @@ class SnowflakeCursorBase(SnowflakeCursorBaseSync, abc.ABC, typing.Generic[Fetch
             self,
             result_chunks,
             self._connection.client_prefetch_threads,
+            # SNOW-4109042: a DML reuses "total" for the rows the statement
+            # affected, which says nothing about the rows in its result set, so
+            # only a query's total is a promise worth holding the back-end to.
+            total_row_count=None if is_dml else data.get("total"),
         )
         self._rownumber = -1
         self._result_state = ResultState.VALID
@@ -922,24 +926,25 @@ class SnowflakeCursorBase(SnowflakeCursorBaseSync, abc.ABC, typing.Generic[Fetch
         if self._result is None and self._result_set is not None:
             self._result: ResultSetIterator = await self._result_set._create_iter()
             self._result_state = ResultState.VALID
-        try:
-            if self._result is None:
-                raise TypeError("'NoneType' object is not an iterator")
-            _next = await self._result.get_next()
-            if isinstance(_next, Exception):
-                Error.errorhandler_wrapper_from_ready_exception(
-                    self._connection,
-                    self,
-                    _next,
-                )
-            if _next is not None:
-                self._rownumber += 1
-            return _next
-        except TypeError as err:
+        if self._result is None:
+            # SNOW-4109042: a missing result iterator is the only reason to report
+            # end-of-results here -- a cursor that was reset has no rows left to
+            # hand out. Errors raised while iterating a real result set must reach
+            # the caller instead of looking like a result set that ran out.
             if self._result_state == ResultState.DEFAULT:
-                raise err
-            else:
-                return None
+                raise TypeError("'NoneType' object is not an iterator")
+            return None
+
+        _next = await self._result.get_next()
+        if isinstance(_next, Exception):
+            Error.errorhandler_wrapper_from_ready_exception(
+                self._connection,
+                self,
+                _next,
+            )
+        if _next is not None:
+            self._rownumber += 1
+        return _next
 
     async def fetchmany(self, size: int | None = None) -> list[FetchRow]:
         """Fetches the number of specified rows."""

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.4}/src/snowflake/connector/aio/_network.py

@@ -79,6 +79,7 @@ from ..network import (
     is_econnreset_exception,
     is_login_request,
     is_retryable_http_code,
+    is_unexpected_eof_exception,
 )
 from ..secret_detector import SecretDetector
 from ..sqlstate import (
@@ -816,7 +817,7 @@ class SnowflakeRestful(SnowflakeRestfulSync):
             finally:
                 raw_ret.close()  # ensure response is closed
         except (aiohttp.ClientSSLError, aiohttp.ClientConnectorSSLError) as se:
-            if is_econnreset_exception(se):
+            if is_econnreset_exception(se) or is_unexpected_eof_exception(se):
                 raise RetryRequest(se.os_error)
             msg = f"Hit non-retryable SSL error, {str(se)}.\n{_CONNECTIVITY_ERR_MSG}"
             logger.debug(msg)

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.4}/src/snowflake/connector/aio/_result_batch.py

@@ -333,6 +333,7 @@ class JSONResultBatch(ResultBatch, JSONResultBatchSync):
         async with TimerContextManager() as parse_metric:
             parsed_data = self._parse(downloaded_data)
         self._metrics[DownloadMetrics.parse.value] = parse_metric.get_timing_millis()
+        self._check_rowcount(len(parsed_data))
         return iter(parsed_data)
 
     async def _load(self, content: bytes, encoding: str) -> list:
@@ -451,4 +452,6 @@ class ArrowResultBatch(ResultBatch, ArrowResultBatchSync):
             else:
                 return await self._get_arrow_iter(connection=connection)
         else:
-            return await self._create_iter(iter_unit=iter_unit, connection=connection)
+            return self._iter_checked_rows(
+                await self._create_iter(iter_unit=iter_unit, connection=connection)
+            )

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.4}/src/snowflake/connector/aio/_result_set.py

@@ -29,6 +29,7 @@ from snowflake.connector.aio._result_batch import (
 from snowflake.connector.constants import IterUnit
 from snowflake.connector.options import pandas
 from snowflake.connector.result_set import ResultSet as ResultSetSync
+from snowflake.connector.result_set import check_total_rowcount
 
 from .. import NotSupportedError
 from ..errors import Error
@@ -57,6 +58,7 @@ class ResultSetIterator:
     ) -> None:
         self._is_fetch_all = kw.pop("is_fetch_all", False)
         self._cursor = kw.pop("cursor", None)
+        self._total_row_count = kw.pop("total_row_count", None)
         self._first_batch_iter = first_batch_iter
         self._unfetched_batches = unfetched_batches
         self._final = final
@@ -104,9 +106,22 @@ class ResultSetIterator:
                     )
             rets.extend(batch)
         await self._final()
+        check_total_rowcount(len(rets), self._total_row_count)
         return rets
 
     async def generator(self):
+        """Yields every row, then verifies the count the back-end declared.
+
+        SNOW-4109042: the check sits past the last ``yield`` on purpose, so a
+        consumer that stops early abandons this generator before reaching it.
+        """
+        rows_yielded = 0
+        async for value in self._generate():
+            rows_yielded += 1
+            yield value
+        check_total_rowcount(rows_yielded, self._total_row_count)
+
+    async def _generate(self):
         if self._is_fetch_all:
 
             tasks = await self._download_all_batches()
@@ -172,12 +187,14 @@ class ResultSet(ResultSetSync):
         cursor: SnowflakeCursor,
         result_chunks: list[JSONResultBatch] | list[ArrowResultBatch],
         prefetch_thread_num: int,
+        total_row_count: int | None = None,
     ) -> None:
         super().__init__(
             cursor,
             result_chunks,
             prefetch_thread_num,
             use_mp=False,  # async code depends on aio rather than multiprocessing
+            total_row_count=total_row_count,
         )
         self.batches = cast(
             Union[list[JSONResultBatch], list[ArrowResultBatch]], self.batches
@@ -215,6 +232,14 @@ class ResultSet(ResultSetSync):
         for num, batch in enumerate(unfetched_batches):
             logger.debug(f"result batch {num + 1} has id: {batch.id}")
 
+        # SNOW-4109042: only row iteration yields one item per row; a table or
+        # pandas unit yields whole tables, so there is nothing to count there.
+        total_row_count = (
+            self._total_row_count
+            if kwargs.get("iter_unit", IterUnit.ROW_UNIT) == IterUnit.ROW_UNIT
+            else None
+        )
+
         return ResultSetIterator(
             first_batch_iter,
             unfetched_batches,
@@ -222,6 +247,7 @@ class ResultSet(ResultSetSync):
             self.prefetch_thread_num,
             cursor=self._cursor,
             is_fetch_all=is_fetch_all,
+            total_row_count=total_row_count,
             **kwargs,
         )
 

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.4}/src/snowflake/connector/aio/auth/_oauth_code.py

@@ -68,7 +68,12 @@ class AuthByOauthCode(AuthByPluginAsync, AuthByOauthCodeSync):
         AuthByOauthCodeSync.reset_secrets(self)
 
     async def prepare(self, **kwargs: Any) -> None:
-        AuthByOauthCodeSync.prepare(self, **kwargs)
+        # Sync prepare may open a browser, block on the callback socket, POST to
+        # the IdP via urllib3, and sleep on token-request retries.
+        loop = asyncio.get_running_loop()
+        await loop.run_in_executor(
+            None, lambda: AuthByOauthCodeSync.prepare(self, **kwargs)
+        )
 
     async def reauthenticate(
         self, conn: SnowflakeConnection, **kwargs: Any

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.4}/src/snowflake/connector/aio/auth/_oauth_credentials.py

@@ -51,7 +51,12 @@ class AuthByOauthCredentials(AuthByPluginAsync, AuthByOauthCredentialsSync):
         AuthByOauthCredentialsSync.reset_secrets(self)
 
     async def prepare(self, **kwargs: Any) -> None:
-        AuthByOauthCredentialsSync.prepare(self, **kwargs)
+        # Sync prepare POSTs to the IdP via urllib3 and may sleep on token-request
+        # retries, which would stall the asyncio event loop.
+        loop = asyncio.get_running_loop()
+        await loop.run_in_executor(
+            None, lambda: AuthByOauthCredentialsSync.prepare(self, **kwargs)
+        )
 
     async def reauthenticate(
         self, conn: SnowflakeConnection, **kwargs: Any

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.4}/src/snowflake/connector/auth/_oauth_base.py

@@ -7,11 +7,14 @@ from __future__ import annotations
 import base64
 import json
 import logging
+import time
 import urllib.parse
 from abc import ABC, abstractmethod
+from collections.abc import Iterator
 from typing import TYPE_CHECKING, Any
 from urllib.error import HTTPError, URLError
 
+from ..backoff_policies import exponential_backoff
 from ..errorcode import (
     ER_FAILED_TO_REQUEST,
     ER_IDP_CONNECTION_ERROR,
@@ -19,20 +22,39 @@ from ..errorcode import (
     ER_NO_CLIENT_SECRET,
 )
 from ..errors import Error, ProgrammingError
-from ..network import OAUTH_AUTHENTICATOR
+from ..network import (
+    OAUTH_AUTHENTICATOR,
+    is_econnreset_exception,
+    is_unexpected_eof_exception,
+)
 from ..proxy import get_proxy_url
 from ..secret_detector import SecretDetector
+from ..time_util import TimeoutBackoffCtx
 from ..token_cache import TokenCache, TokenKey, TokenType
 from ..vendored import urllib3
 from ..vendored.requests.utils import get_environ_proxies, select_proxy
+from ..vendored.urllib3.exceptions import IncompleteRead as Urllib3IncompleteRead
+from ..vendored.urllib3.exceptions import (
+    MaxRetryError,
+    NewConnectionError,
+    ProtocolError,
+)
+from ..vendored.urllib3.exceptions import SSLError as Urllib3SSLError
+from ..vendored.urllib3.exceptions import TimeoutError as Urllib3TimeoutError
 from ..vendored.urllib3.poolmanager import ProxyManager
-from .by_plugin import AuthByPlugin, AuthType
+from .by_plugin import DEFAULT_AUTH_CLASS_TIMEOUT, AuthByPlugin, AuthType
 
 if TYPE_CHECKING:
     from .. import SnowflakeConnection
 
 logger = logging.getLogger(__name__)
 
+# Total POSTs to the IdP token endpoint, including the first attempt. This is
+# independent of AuthByPlugin._retry_ctx, which is reserved for the later
+# Snowflake login-request retries in SnowflakeConnection._authenticate().
+_OAUTH_TOKEN_REQUEST_MAX_ATTEMPTS = 3
+_RETRYABLE_OAUTH_TOKEN_HTTP_STATUSES = frozenset({408, 429})
+
 
 class _OAuthTokensMixin:
     """Manages OAuth token caching to avoid repeated browser authentication flows.
@@ -470,19 +492,7 @@ class AuthByOAuthBase(AuthByPlugin, _OAuthTokensMixin, ABC):
             fields["scope"] = self._scope
         try:
             # TODO(SNOW-2229411) Session manager should be used here. It may require additional security validation (since we would transition from PoolManager to requests.Session) and some parameters would be passed implicitly. OAuth token exchange must NOT reuse pooled HTTP sessions. We should create a fresh SessionManager with use_pooling=False for each call.
-            proxy_url = self._resolve_proxy_url(conn, self._token_request_url)
-            http_client = (
-                ProxyManager(proxy_url=proxy_url)
-                if proxy_url
-                else urllib3.PoolManager()
-            )
-            return http_client.request_encode_body(
-                "POST",
-                self._token_request_url,
-                encode_multipart=False,
-                headers=self._create_token_request_headers(),
-                fields=fields,
-            )
+            return self._post_token_request(conn, fields)
         except HTTPError as e:
             self._handle_failure(
                 conn=conn,
@@ -516,17 +526,17 @@ class AuthByOAuthBase(AuthByPlugin, _OAuthTokensMixin, ABC):
         fields: dict[str, str],
     ) -> (str | None, str | None):
         # TODO(SNOW-2229411) Session manager should be used here. It may require additional security validation (since we would transition from PoolManager to requests.Session) and some parameters would be passed implicitly. Token request must bypass HTTP connection pools.
-        proxy_url = self._resolve_proxy_url(connection, self._token_request_url)
-        http_client = (
-            ProxyManager(proxy_url=proxy_url) if proxy_url else urllib3.PoolManager()
-        )
-        resp = http_client.request_encode_body(
-            "POST",
-            self._token_request_url,
-            headers=self._create_token_request_headers(),
-            encode_multipart=False,
-            fields=fields,
-        )
+        try:
+            resp = self._post_token_request(connection, fields)
+        except Exception as exc:
+            self._handle_failure(
+                conn=connection,
+                ret={
+                    "code": ER_FAILED_TO_REQUEST,
+                    "message": f"Failed to request OAuth access token from IdP: {exc}",
+                },
+            )
+            return None, None
         try:
             logger.debug("OAuth IdP response received, try to parse it")
             json_resp: dict = json.loads(resp.data)
@@ -552,6 +562,141 @@ class AuthByOAuthBase(AuthByPlugin, _OAuthTokensMixin, ABC):
             )
         return None, None
 
+    def _post_token_request(
+        self,
+        connection: SnowflakeConnection,
+        fields: dict[str, str],
+    ) -> urllib3.BaseHTTPResponse:
+        """POST to the IdP token endpoint, retrying transient transport and HTTP errors.
+
+        SnowflakeConnection._authenticate() calls prepare() (and therefore this
+        POST) once, outside the GS login retry loop. Transient IdP failures
+        (connection reset, timeout, 5xx, 429) must be retried here
+        (SNOW-3984430). Auth errors such as HTTP 400 invalid_grant are not retried.
+
+        Retries use a dedicated TimeoutBackoffCtx so AuthByPlugin._retry_ctx stays
+        reserved for later Snowflake login-request retries. Sleep is capped by
+        connection.login_timeout.
+        """
+        retry_ctx = self._oauth_token_request_retry_ctx(connection)
+        retry_ctx.set_start_time()
+        for attempt in range(1, _OAUTH_TOKEN_REQUEST_MAX_ATTEMPTS + 1):
+            proxy_url = self._resolve_proxy_url(connection, self._token_request_url)
+            http_client = (
+                ProxyManager(proxy_url=proxy_url)
+                if proxy_url
+                else urllib3.PoolManager()
+            )
+            try:
+                resp = http_client.request_encode_body(
+                    "POST",
+                    self._token_request_url,
+                    headers=self._create_token_request_headers(),
+                    encode_multipart=False,
+                    fields=fields,
+                )
+            except Exception as exc:
+                if not self._is_retryable_oauth_token_exception(exc):
+                    raise
+                logger.debug(
+                    "OAuth token request failed on attempt %s/%s: %s",
+                    attempt,
+                    _OAUTH_TOKEN_REQUEST_MAX_ATTEMPTS,
+                    exc,
+                )
+                if (
+                    attempt >= _OAUTH_TOKEN_REQUEST_MAX_ATTEMPTS
+                    or not retry_ctx.should_retry
+                ):
+                    raise
+                self._sleep_before_oauth_token_retry(retry_ctx)
+                retry_ctx.increment()
+                continue
+
+            if self._is_retryable_oauth_token_http_status(resp.status) and (
+                attempt < _OAUTH_TOKEN_REQUEST_MAX_ATTEMPTS and retry_ctx.should_retry
+            ):
+                logger.debug(
+                    "OAuth token request returned HTTP %s on attempt %s/%s; retrying",
+                    resp.status,
+                    attempt,
+                    _OAUTH_TOKEN_REQUEST_MAX_ATTEMPTS,
+                )
+                self._sleep_before_oauth_token_retry(retry_ctx)
+                retry_ctx.increment()
+                continue
+            return resp
+
+        raise RuntimeError("OAuth token request retry loop exited without a response")
+
+    @staticmethod
+    def _oauth_token_request_retry_ctx(
+        connection: SnowflakeConnection,
+    ) -> TimeoutBackoffCtx:
+        timeout = getattr(connection, "login_timeout", None)
+        if isinstance(timeout, bool) or not isinstance(timeout, (int, float)):
+            timeout = DEFAULT_AUTH_CLASS_TIMEOUT
+        return TimeoutBackoffCtx(
+            timeout=int(timeout),
+            backoff_generator=AuthByOAuthBase._oauth_token_request_backoff(connection),
+        )
+
+    @staticmethod
+    def _oauth_token_request_backoff(
+        connection: SnowflakeConnection,
+    ) -> Iterator:
+        candidate = getattr(connection, "_backoff_generator", None)
+        if candidate is None:
+            return exponential_backoff()()
+        try:
+            iterator = iter(candidate)
+            first = next(iterator)
+            float(first)
+        except (TypeError, StopIteration, ValueError):
+            return exponential_backoff()()
+
+        def _chained() -> Iterator:
+            yield first
+            yield from iterator
+
+        return _chained()
+
+    @staticmethod
+    def _sleep_before_oauth_token_retry(retry_ctx: TimeoutBackoffCtx) -> None:
+        sleep_time = float(retry_ctx.current_sleep_time)
+        if retry_ctx.timeout is not None:
+            remaining = retry_ctx.remaining_time_millis / 1000.0
+            if remaining <= 0:
+                return
+            sleep_time = min(sleep_time, remaining)
+        if sleep_time > 0:
+            time.sleep(sleep_time)
+
+    @staticmethod
+    def _is_retryable_oauth_token_http_status(status: int) -> bool:
+        return status >= 500 or status in _RETRYABLE_OAUTH_TOKEN_HTTP_STATUSES
+
+    @staticmethod
+    def _is_retryable_oauth_token_exception(exc: BaseException) -> bool:
+        if isinstance(exc, MaxRetryError):
+            return (
+                exc.reason is None
+                or AuthByOAuthBase._is_retryable_oauth_token_exception(exc.reason)
+            )
+        if isinstance(exc, Urllib3SSLError):
+            return is_econnreset_exception(exc) or is_unexpected_eof_exception(exc)
+        return isinstance(
+            exc,
+            (
+                ProtocolError,
+                Urllib3TimeoutError,
+                Urllib3IncompleteRead,
+                NewConnectionError,
+                ConnectionError,
+                TimeoutError,
+            ),
+        )
+
     def _create_token_request_headers(self) -> dict[str, str]:
         return {
             "Authorization": "Basic "

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.4}/src/snowflake/connector/cursor.py

@@ -1221,6 +1221,10 @@ class SnowflakeCursorBase(abc.ABC, Generic[FetchRow]):
             self._connection.client_fetch_threads
             or self._connection.client_prefetch_threads,
             self._connection.client_fetch_use_mp,
+            # SNOW-4109042: a DML reuses "total" for the rows the statement
+            # affected, which says nothing about the rows in its result set, so
+            # only a query's total is a promise worth holding the back-end to.
+            total_row_count=None if is_dml else data.get("total"),
         )
         self._rownumber = -1
         self._result_state = ResultState.VALID
@@ -1584,22 +1588,25 @@ class SnowflakeCursorBase(abc.ABC, Generic[FetchRow]):
             self._result = iter(self._result_set)
             self._result_state = ResultState.VALID
 
-        try:
-            _next = next(self._result, None)
-            if isinstance(_next, Exception):
-                Error.errorhandler_wrapper_from_ready_exception(
-                    self._connection,
-                    self,
-                    _next,
-                )
-            if _next is not None:
-                self._rownumber += 1
-            return _next
-        except TypeError as err:
+        if self._result is None:
+            # SNOW-4109042: a missing result iterator is the only reason to report
+            # end-of-results here -- a cursor that was reset has no rows left to
+            # hand out. Errors raised while iterating a real result set must reach
+            # the caller instead of looking like a result set that ran out.
             if self._result_state == ResultState.DEFAULT:
-                raise err
-            else:
-                return None
+                raise TypeError("'NoneType' object is not an iterator")
+            return None
+
+        _next = next(self._result, None)
+        if isinstance(_next, Exception):
+            Error.errorhandler_wrapper_from_ready_exception(
+                self._connection,
+                self,
+                _next,
+            )
+        if _next is not None:
+            self._rownumber += 1
+        return _next
 
     def fetchmany(self, size: int | None = None) -> list[FetchRow]:
         """Fetches the number of specified rows."""