snowflake-connector-python 4.7.3__tar.gz → 4.7.5__tar.gz

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.5}/DESCRIPTION.md

@@ -7,11 +7,22 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.7.5(Sep 18,2026)
+  - Follow-up to the v4.7.4 incomplete-result fix (SNOW-4109042): when a successful query-request has an incomplete inline first chunk, the connector re-fetches the finished query once via `GET /queries/{qid}/result` before building the result set. JSON treats empty or shorter-than-declared inline rowsets as incomplete; Arrow only treats a missing/empty `rowsetBase64` as incomplete so the execute hot path does not decode IPC. If the result GET fails (transport error or `success: false`), the original payload is kept; if the GET succeeds but is still incomplete, that response is used. In either incomplete case the existing rowcount/total checks still raise `OperationalError` errno `252013` when the result is drained (no silent EOF). On the sync path, a remote result chunk whose body holds fewer rows than its declared `rowCount` is re-downloaded once before that check raises, so a truncated-but-valid chunk download can recover without silent data loss. Asynchronous (`snowflake.connector.aio`) remote-chunk re-download is unchanged.
+
+- v4.7.4(Sep 16,2026)
+  - Fixed missing retries on transient HTTP failures when fetching an OAuth access token from the IdP token endpoint (`OAUTH_CLIENT_CREDENTIALS` and `OAUTH_AUTHORIZATION_CODE`). Token requests now retry transport errors, HTTP 408/429, and 5xx responses (SNOW-3984430, #3003).
+  - Fixed a bug where a TLS handshake terminated by the peer (`SSLError` containing `SysCallError(-1, 'Unexpected EOF')`) was classified as non-retryable and surfaced as an `OperationalError`, unlike `ECONNRESET`. Such handshake `Unexpected EOF` errors are now retried, on both the sync and async request paths (SNOW-4058589).
+  - Fixed `fetchone()`, `fetchmany()`, `fetchall()` and cursor iteration silently returning an incomplete result set. A downloaded result chunk holding fewer rows than the back-end reported just ended the iteration, which the fetch methods report as a normal end of results, so callers received fewer rows than the query produced with no exception raised. Such a chunk now raises an `OperationalError` (errno `252013`). Errors raised while iterating a result set are no longer reported as end-of-results either: `_fetchone()` caught every `TypeError` and returned `None`, so a failure anywhere in the download/parse chain was indistinguishable from an exhausted result set. Both the sync and async paths are fixed (SNOW-4109042).
+  - Added the `SNOWFLAKE_MIN_TLS_VERSION` environment variable (`1.2`, `1.3`, `TLSv1.2` or `TLSv1.3`, defaulting to TLS 1.2) to raise the minimum TLS version on every outbound connection a synchronous connector makes: the Snowflake API, stage transfers, OCSP/CRL fetches, platform detection, IdP requests, AWS SDK requests (workload identity STS calls and the platform-detection identity probe) and Azure AD token requests made by `azure-identity`. An unrecognized value is rejected at connect time. The variable name and accepted values match the Go and JDBC drivers. Asynchronous (`snowflake.connector.aio`) connections are not yet covered.
+  - Fixed a TLS handshake failure that cannot succeed on a retry — a minimum-version mismatch, an untrusted certificate, a hostname mismatch — being reported by `connect()` as a generic `250001: Could not connect to Snowflake backend after N attempt(s)` alongside a firewall-troubleshooting hint. The network layer already identified and named such failures, but the authentication layer retried them until the login timeout expired and then replaced the diagnosis. They now surface as `NonRetryableTlsError` (a subclass of `OperationalError` keeping the same errno, so existing handlers are unaffected) naming the underlying cause, and are no longer retried. Transient handshake faults (`ECONNRESET`, unexpected EOF) remain retryable.
+
 - v4.7.3(Sep 3,2026)
   - Added experimental Python 3.14t (free-threaded CPython) wheel support. **Experimental — not intended for production use.**
   - Fixed TLS hostname verification rejecting matching certificate SANs when a Snowflake account locator contains an underscore (SNOW-4011646).
   - Fixed `connect()` being significantly slower on deep call stacks (e.g. Django apps with several middleware/decorator layers) because `get_application_path()` used `inspect.stack()`, which reads and parses the source file of every frame on the stack. It now walks frame references directly instead (SNOW-3691001, #2908).
   - Fixed `split_statements` truncating unquoted URLs containing `://` at the `//`, misreading it as a line comment. The guards added alongside `//` comment support in 4.7.2 (SNOW-3772985) only recognized `file://`, so every other scheme (`http://`, `https://`, `s3://`, `snow://`, `azure://`) was cut short. Any `scheme://` is now recognized, on both the line-comment and block-comment paths (the latter affected globs such as `s3://bucket/*.csv`) (SNOW-3930192).
+  - Fixed the on-disk OCSP response validation cache failing with `RuntimeError: UnixFileLock on ... was inherited across fork; construct a new instance` when it was written from a forked child process. This could surface on fork-based platforms when fetching results with `client_fetch_use_mp=True`, where chunk downloads run in worker processes that perform their own certificate revocation checks. The cache's file lock is now re-created when the owning process changes, matching what already happened for the `spawn` start method.
   - Result batch construction now logs only whether a `qrmk` is present, for both the sync and async result paths (SNOW-3675590).
   - DEBUG logging in `create_batches_from_response()` reports chunk-header names with type/length value metadata (SNOW-3675590).
   - The malformed-response ERROR log in `create_batches_from_response()` reports a structural summary of the response (SNOW-3675590).
@@ -25,15 +36,15 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Extended log secret masking coverage (SNOW-3675583). The connection-token pattern accepts `:` and `%` in the token value. Added patterns for OAuth access and refresh tokens in serialized JSON, for one-time passcodes, and for OAuth client identifiers and secrets. The passcode pattern accepts quoted values. The password pattern requires at least six characters in the value, so ordinary prose following the word "password" is not redacted.
   - Request headers are copied before mutation on the async path, and masking is applied to the `Authorization` header in error logs (SNOW-3675593).
   - Applied secret masking to the `snowflake.connector` loggers by default, independent of how application logging is configured. The same filter also covers the third-party loggers the connector uses (`botocore`, `boto3`, `aiohttp`, `aiobotocore`, `aioboto3`, vendored `urllib3`). Set `SNOWFLAKE_DISABLE_LOG_SECRET_MASKING=true` to opt out; it is honored at emit time, including after import (SNOW-3675583).
-  - Fixed the on-disk OCSP response validation cache failing with `RuntimeError: UnixFileLock on ... was inherited across fork; construct a new instance` when it was written from a forked child process. This could surface on fork-based platforms when fetching results with `client_fetch_use_mp=True`, where chunk downloads run in worker processes that perform their own certificate revocation checks. The cache's file lock is now re-created when the owning process changes, matching what already happened for the `spawn` start method.
 
-- v4.7.2(Aug 6,2026)
+- v4.7.2(Aug 7,2026)
   - Fixed a thread leak in the file transfer agent by properly shutting down ThreadPoolExecutors after PUT/GET transfers (SNOW-3556240, #2878).
   - Fixed `split_statements` treating `//` as SQL instead of a line comment, which could merge multiple statements when a `//` comment contained an apostrophe (SNOW-3772985).
   - Fixed large-file PUT uploads to internal Azure stages failing against the Azure 50,000-block-per-blob limit. The Azure multipart chunk size is now scaled up dynamically for very large files (mirroring the existing S3 behavior), and the default Azure chunk size was raised from 4 MB to 8 MB (consistent with S3) for better throughput (SNOW-3839943).
   - Fixed OAuth cached-credential connections failing with `250001 Invalid OAuth access token` when the cached token was invalid (GS code `390303`); the connector now reauthenticates silently (via refresh token if available, otherwise browser) instead of hard-failing. Also fixed fresh processes holding only a cached refresh token going straight to an interactive browser prompt instead of attempting a silent refresh first.
   - Fixed Okta/SAML authentication reporting an exhausted `login_timeout` as `250003: Failed to execute request: Attempted to set connect timeout to <negative value>`. Obtaining the one-time token in step 4 can overshoot the login deadline, which made the remaining budget negative; it was then passed to the HTTP layer, which rejected it with an opaque `ValueError`. A timed-out SAML login now raises `250006` with a message naming `login_timeout`. Running out of budget while retrying on `RefreshTokenError` reports the same error instead of failing later with an `AttributeError` on an empty response (SNOW-3891419).
   - Fixed OAuth authorization code flow failing for accounts with uppercase letters in the account name. `urlparse().hostname` always returns lowercase, but the host was compared case-sensitively in `_is_snowflake_as_idp`, causing Snowflake-as-IdP detection to return `False` and raising error 251013 (`client_id is empty`) even for connections that don't require a client ID.
+  - Fixed JWT key-pair authentication errors to surface the server's specific error code (e.g. `394304` for fingerprint mismatch, `394303` for clock skew) instead of always reporting the generic `250001`. Auth-rejection failures now also use SQLState `28000` (invalid authorization) instead of `08001` (SNOW-3775156).
 
 - v4.7.1(Jul 15,2026)
   - Added support for Python 3.14t (free-threaded).
@@ -49,7 +60,6 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Added native AKS (Azure Kubernetes Service) workload identity support. When running on AKS with workload identity configured, the connector automatically uses `WorkloadIdentityCredential` to authenticate via the injected service account credentials. OIDC backward compatibility is also supported.
   - Added the `workload_identity_aws_use_outbound_token` connection option (default `false`) to opt into AWS WIF JWT attestation via STS `GetWebIdentityToken` instead of the default SigV4 `GetCallerIdentity` method.
   - Fixed a bug where a fully-qualified DDL statement (e.g. `CREATE VIEW db.schema.obj`) on a session with no current schema would populate the connector's cached `_schema`/`_database` from the referenced object's namespace. This made `get_current_schema()` diverge from the server's `CURRENT_SCHEMA()` and mis-qualified Snowpark temp objects (SNOW-3665226).
-  - Fixed JWT key-pair authentication errors to surface the server's specific error code (e.g. `394304` for fingerprint mismatch, `394303` for clock skew) instead of always reporting the generic `250001`. Auth-rejection failures now also use SQLState `28000` (invalid authorization) instead of `08001` (SNOW-3775156).
 
 - v4.6.0(May 28,2026)
   - Dropped support for Python 3.9. The minimum supported version is now Python 3.10.

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.7.3
+Version: 4.7.5
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -70,8 +70,8 @@ Requires-Dist: more-itertools; extra == "development"
 Requires-Dist: numpy<=2.4.3; extra == "development"
 Requires-Dist: pendulum!=2.1.1; extra == "development"
 Requires-Dist: pexpect; extra == "development"
-Requires-Dist: pytest<7.5.0; extra == "development"
-Requires-Dist: pytest-asyncio; extra == "development"
+Requires-Dist: pytest<9,>=8.4; extra == "development"
+Requires-Dist: pytest-asyncio<2,>=1.4.0; extra == "development"
 Requires-Dist: pytest-cov; extra == "development"
 Requires-Dist: pytest-rerunfailures<16.0; extra == "development"
 Requires-Dist: pytest-timeout; extra == "development"
@@ -97,11 +97,22 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.7.5(Sep 18,2026)
+  - Follow-up to the v4.7.4 incomplete-result fix (SNOW-4109042): when a successful query-request has an incomplete inline first chunk, the connector re-fetches the finished query once via `GET /queries/{qid}/result` before building the result set. JSON treats empty or shorter-than-declared inline rowsets as incomplete; Arrow only treats a missing/empty `rowsetBase64` as incomplete so the execute hot path does not decode IPC. If the result GET fails (transport error or `success: false`), the original payload is kept; if the GET succeeds but is still incomplete, that response is used. In either incomplete case the existing rowcount/total checks still raise `OperationalError` errno `252013` when the result is drained (no silent EOF). On the sync path, a remote result chunk whose body holds fewer rows than its declared `rowCount` is re-downloaded once before that check raises, so a truncated-but-valid chunk download can recover without silent data loss. Asynchronous (`snowflake.connector.aio`) remote-chunk re-download is unchanged.
+
+- v4.7.4(Sep 16,2026)
+  - Fixed missing retries on transient HTTP failures when fetching an OAuth access token from the IdP token endpoint (`OAUTH_CLIENT_CREDENTIALS` and `OAUTH_AUTHORIZATION_CODE`). Token requests now retry transport errors, HTTP 408/429, and 5xx responses (SNOW-3984430, #3003).
+  - Fixed a bug where a TLS handshake terminated by the peer (`SSLError` containing `SysCallError(-1, 'Unexpected EOF')`) was classified as non-retryable and surfaced as an `OperationalError`, unlike `ECONNRESET`. Such handshake `Unexpected EOF` errors are now retried, on both the sync and async request paths (SNOW-4058589).
+  - Fixed `fetchone()`, `fetchmany()`, `fetchall()` and cursor iteration silently returning an incomplete result set. A downloaded result chunk holding fewer rows than the back-end reported just ended the iteration, which the fetch methods report as a normal end of results, so callers received fewer rows than the query produced with no exception raised. Such a chunk now raises an `OperationalError` (errno `252013`). Errors raised while iterating a result set are no longer reported as end-of-results either: `_fetchone()` caught every `TypeError` and returned `None`, so a failure anywhere in the download/parse chain was indistinguishable from an exhausted result set. Both the sync and async paths are fixed (SNOW-4109042).
+  - Added the `SNOWFLAKE_MIN_TLS_VERSION` environment variable (`1.2`, `1.3`, `TLSv1.2` or `TLSv1.3`, defaulting to TLS 1.2) to raise the minimum TLS version on every outbound connection a synchronous connector makes: the Snowflake API, stage transfers, OCSP/CRL fetches, platform detection, IdP requests, AWS SDK requests (workload identity STS calls and the platform-detection identity probe) and Azure AD token requests made by `azure-identity`. An unrecognized value is rejected at connect time. The variable name and accepted values match the Go and JDBC drivers. Asynchronous (`snowflake.connector.aio`) connections are not yet covered.
+  - Fixed a TLS handshake failure that cannot succeed on a retry — a minimum-version mismatch, an untrusted certificate, a hostname mismatch — being reported by `connect()` as a generic `250001: Could not connect to Snowflake backend after N attempt(s)` alongside a firewall-troubleshooting hint. The network layer already identified and named such failures, but the authentication layer retried them until the login timeout expired and then replaced the diagnosis. They now surface as `NonRetryableTlsError` (a subclass of `OperationalError` keeping the same errno, so existing handlers are unaffected) naming the underlying cause, and are no longer retried. Transient handshake faults (`ECONNRESET`, unexpected EOF) remain retryable.
+
 - v4.7.3(Sep 3,2026)
   - Added experimental Python 3.14t (free-threaded CPython) wheel support. **Experimental — not intended for production use.**
   - Fixed TLS hostname verification rejecting matching certificate SANs when a Snowflake account locator contains an underscore (SNOW-4011646).
   - Fixed `connect()` being significantly slower on deep call stacks (e.g. Django apps with several middleware/decorator layers) because `get_application_path()` used `inspect.stack()`, which reads and parses the source file of every frame on the stack. It now walks frame references directly instead (SNOW-3691001, #2908).
   - Fixed `split_statements` truncating unquoted URLs containing `://` at the `//`, misreading it as a line comment. The guards added alongside `//` comment support in 4.7.2 (SNOW-3772985) only recognized `file://`, so every other scheme (`http://`, `https://`, `s3://`, `snow://`, `azure://`) was cut short. Any `scheme://` is now recognized, on both the line-comment and block-comment paths (the latter affected globs such as `s3://bucket/*.csv`) (SNOW-3930192).
+  - Fixed the on-disk OCSP response validation cache failing with `RuntimeError: UnixFileLock on ... was inherited across fork; construct a new instance` when it was written from a forked child process. This could surface on fork-based platforms when fetching results with `client_fetch_use_mp=True`, where chunk downloads run in worker processes that perform their own certificate revocation checks. The cache's file lock is now re-created when the owning process changes, matching what already happened for the `spawn` start method.
   - Result batch construction now logs only whether a `qrmk` is present, for both the sync and async result paths (SNOW-3675590).
   - DEBUG logging in `create_batches_from_response()` reports chunk-header names with type/length value metadata (SNOW-3675590).
   - The malformed-response ERROR log in `create_batches_from_response()` reports a structural summary of the response (SNOW-3675590).
@@ -115,15 +126,15 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Extended log secret masking coverage (SNOW-3675583). The connection-token pattern accepts `:` and `%` in the token value. Added patterns for OAuth access and refresh tokens in serialized JSON, for one-time passcodes, and for OAuth client identifiers and secrets. The passcode pattern accepts quoted values. The password pattern requires at least six characters in the value, so ordinary prose following the word "password" is not redacted.
   - Request headers are copied before mutation on the async path, and masking is applied to the `Authorization` header in error logs (SNOW-3675593).
   - Applied secret masking to the `snowflake.connector` loggers by default, independent of how application logging is configured. The same filter also covers the third-party loggers the connector uses (`botocore`, `boto3`, `aiohttp`, `aiobotocore`, `aioboto3`, vendored `urllib3`). Set `SNOWFLAKE_DISABLE_LOG_SECRET_MASKING=true` to opt out; it is honored at emit time, including after import (SNOW-3675583).
-  - Fixed the on-disk OCSP response validation cache failing with `RuntimeError: UnixFileLock on ... was inherited across fork; construct a new instance` when it was written from a forked child process. This could surface on fork-based platforms when fetching results with `client_fetch_use_mp=True`, where chunk downloads run in worker processes that perform their own certificate revocation checks. The cache's file lock is now re-created when the owning process changes, matching what already happened for the `spawn` start method.
 
-- v4.7.2(Aug 6,2026)
+- v4.7.2(Aug 7,2026)
   - Fixed a thread leak in the file transfer agent by properly shutting down ThreadPoolExecutors after PUT/GET transfers (SNOW-3556240, #2878).
   - Fixed `split_statements` treating `//` as SQL instead of a line comment, which could merge multiple statements when a `//` comment contained an apostrophe (SNOW-3772985).
   - Fixed large-file PUT uploads to internal Azure stages failing against the Azure 50,000-block-per-blob limit. The Azure multipart chunk size is now scaled up dynamically for very large files (mirroring the existing S3 behavior), and the default Azure chunk size was raised from 4 MB to 8 MB (consistent with S3) for better throughput (SNOW-3839943).
   - Fixed OAuth cached-credential connections failing with `250001 Invalid OAuth access token` when the cached token was invalid (GS code `390303`); the connector now reauthenticates silently (via refresh token if available, otherwise browser) instead of hard-failing. Also fixed fresh processes holding only a cached refresh token going straight to an interactive browser prompt instead of attempting a silent refresh first.
   - Fixed Okta/SAML authentication reporting an exhausted `login_timeout` as `250003: Failed to execute request: Attempted to set connect timeout to <negative value>`. Obtaining the one-time token in step 4 can overshoot the login deadline, which made the remaining budget negative; it was then passed to the HTTP layer, which rejected it with an opaque `ValueError`. A timed-out SAML login now raises `250006` with a message naming `login_timeout`. Running out of budget while retrying on `RefreshTokenError` reports the same error instead of failing later with an `AttributeError` on an empty response (SNOW-3891419).
   - Fixed OAuth authorization code flow failing for accounts with uppercase letters in the account name. `urlparse().hostname` always returns lowercase, but the host was compared case-sensitively in `_is_snowflake_as_idp`, causing Snowflake-as-IdP detection to return `False` and raising error 251013 (`client_id is empty`) even for connections that don't require a client ID.
+  - Fixed JWT key-pair authentication errors to surface the server's specific error code (e.g. `394304` for fingerprint mismatch, `394303` for clock skew) instead of always reporting the generic `250001`. Auth-rejection failures now also use SQLState `28000` (invalid authorization) instead of `08001` (SNOW-3775156).
 
 - v4.7.1(Jul 15,2026)
   - Added support for Python 3.14t (free-threaded).
@@ -139,7 +150,6 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Added native AKS (Azure Kubernetes Service) workload identity support. When running on AKS with workload identity configured, the connector automatically uses `WorkloadIdentityCredential` to authenticate via the injected service account credentials. OIDC backward compatibility is also supported.
   - Added the `workload_identity_aws_use_outbound_token` connection option (default `false`) to opt into AWS WIF JWT attestation via STS `GetWebIdentityToken` instead of the default SigV4 `GetCallerIdentity` method.
   - Fixed a bug where a fully-qualified DDL statement (e.g. `CREATE VIEW db.schema.obj`) on a session with no current schema would populate the connector's cached `_schema`/`_database` from the referenced object's namespace. This made `get_current_schema()` diverge from the server's `CURRENT_SCHEMA()` and mis-qualified Snowpark temp objects (SNOW-3665226).
-  - Fixed JWT key-pair authentication errors to surface the server's specific error code (e.g. `394304` for fingerprint mismatch, `394303` for clock skew) instead of always reporting the generic `250001`. Auth-rejection failures now also use SQLState `28000` (invalid authorization) instead of `08001` (SNOW-3775156).
 
 - v4.6.0(May 28,2026)
   - Dropped support for Python 3.9. The minimum supported version is now Python 3.10.

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.5}/README.md

@@ -1,10 +1,7 @@
 # Snowflake Connector for Python
 
-[![Build and Test](https://github.com/snowflakedb/snowflake-connector-python/actions/workflows/build_test.yml/badge.svg)](https://github.com/snowflakedb/snowflake-connector-python/actions/workflows/build_test.yml)
-[![codecov](https://codecov.io/gh/snowflakedb/snowflake-connector-python/branch/main/graph/badge.svg?token=MVKSNtnLr0)](https://codecov.io/gh/snowflakedb/snowflake-connector-python)
-[![PyPi](https://img.shields.io/pypi/v/snowflake-connector-python.svg)](https://pypi.python.org/pypi/snowflake-connector-python/)
-[![License Apache-2.0](https://img.shields.io/:license-Apache%202-brightgreen.svg)](http://www.apache.org/licenses/LICENSE-2.0.txt)
-[![Codestyle Black](https://img.shields.io/badge/code%20style-black-000000.svg)](https://github.com/psf/black)
+> [!IMPORTANT]
+> A new version of the driver is being developed in [snowflakedb/drivers](https://github.com/snowflakedb/drivers) and is currently in public preview. See the [documentation](https://docs.snowflake.com/en/developer-guide/python-connector/python-connector-universal-core) for more information.
 
 This package includes the Snowflake Connector for Python, which conforms to the [Python DB API 2.0](https://www.python.org/dev/peps/pep-0249/) specification.
 

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.5}/setup.cfg

@@ -97,8 +97,8 @@ development =
 	numpy<=2.4.3
 	pendulum!=2.1.1
 	pexpect
-	pytest<7.5.0
-	pytest-asyncio
+	pytest>=8.4,<9
+	pytest-asyncio>=1.4.0,<2
 	pytest-cov
 	pytest-rerunfailures<16.0
 	pytest-timeout

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.5}/src/snowflake/connector/aio/_connection.py

@@ -23,6 +23,7 @@ from snowflake.connector import (
     OperationalError,
     ProgrammingError,
 )
+from snowflake.connector.errors import NonRetryableTlsError
 
 from .._connection_identifier_shape import (
     ConnectionIdentifierShape,
@@ -38,6 +39,7 @@ from ..connection import _get_private_bytes_from_file
 from ..constants import (
     _CONNECTIVITY_ERR_MSG,
     _OAUTH_DEFAULT_SCOPE,
+    ENV_VAR_MIN_TLS_VERSION,
     PARAMETER_AUTOCOMMIT,
     PARAMETER_CLIENT_PREFETCH_THREADS,
     PARAMETER_CLIENT_REQUEST_MFA_TOKEN,
@@ -570,6 +572,11 @@ class SnowflakeConnection(SnowflakeConnectionSync):
                 password_callback=self._password_callback,
                 session_parameters=self._session_parameters,
             )
+        except NonRetryableTlsError:
+            # See the sync counterpart: a TLS failure that a retry cannot fix must
+            # surface with its diagnosis rather than be replaced by the generic
+            # "could not connect" message the retry loop below ends with.
+            raise
         except OperationalError as e:
             logger.debug(
                 "Operational Error raised at authentication"
@@ -1110,6 +1117,20 @@ class SnowflakeConnection(SnowflakeConnectionSync):
     async def connect(self, **kwargs) -> None:
         """Establishes connection to Snowflake."""
         logger.debug("connect")
+        self._validate_min_tls_version()
+        # Validating the value here must not be read as enforcing it: the async
+        # stack builds its TLS contexts through aiohttp, which the connector's
+        # urllib3 interception never sees, so the floor is not applied to async
+        # handshakes. Say so rather than let a successful connect imply otherwise.
+        # Not raised, because the variable is process-wide -- failing here would
+        # break async connections in any process that set it for the sync path.
+        if os.environ.get(ENV_VAR_MIN_TLS_VERSION, "").strip():
+            logger.warning(
+                "%s is set but is not enforced on asynchronous connections; their "
+                "TLS handshakes may negotiate a lower version. Use a synchronous "
+                "connection where the minimum must be guaranteed.",
+                ENV_VAR_MIN_TLS_VERSION,
+            )
         if len(kwargs) > 0:
             self.__config(**kwargs)
         else:

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.5}/src/snowflake/connector/aio/_cursor.py

@@ -379,6 +379,10 @@ class SnowflakeCursorBase(SnowflakeCursorBaseSync, abc.ABC, typing.Generic[Fetch
             self,
             result_chunks,
             self._connection.client_prefetch_threads,
+            # SNOW-4109042: a DML reuses "total" for the rows the statement
+            # affected, which says nothing about the rows in its result set, so
+            # only a query's total is a promise worth holding the back-end to.
+            total_row_count=None if is_dml else data.get("total"),
         )
         self._rownumber = -1
         self._result_state = ResultState.VALID
@@ -922,24 +926,25 @@ class SnowflakeCursorBase(SnowflakeCursorBaseSync, abc.ABC, typing.Generic[Fetch
         if self._result is None and self._result_set is not None:
             self._result: ResultSetIterator = await self._result_set._create_iter()
             self._result_state = ResultState.VALID
-        try:
-            if self._result is None:
-                raise TypeError("'NoneType' object is not an iterator")
-            _next = await self._result.get_next()
-            if isinstance(_next, Exception):
-                Error.errorhandler_wrapper_from_ready_exception(
-                    self._connection,
-                    self,
-                    _next,
-                )
-            if _next is not None:
-                self._rownumber += 1
-            return _next
-        except TypeError as err:
+        if self._result is None:
+            # SNOW-4109042: a missing result iterator is the only reason to report
+            # end-of-results here -- a cursor that was reset has no rows left to
+            # hand out. Errors raised while iterating a real result set must reach
+            # the caller instead of looking like a result set that ran out.
             if self._result_state == ResultState.DEFAULT:
-                raise err
-            else:
-                return None
+                raise TypeError("'NoneType' object is not an iterator")
+            return None
+
+        _next = await self._result.get_next()
+        if isinstance(_next, Exception):
+            Error.errorhandler_wrapper_from_ready_exception(
+                self._connection,
+                self,
+                _next,
+            )
+        if _next is not None:
+            self._rownumber += 1
+        return _next
 
     async def fetchmany(self, size: int | None = None) -> list[FetchRow]:
         """Fetches the number of specified rows."""

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.5}/src/snowflake/connector/aio/_network.py

@@ -42,6 +42,7 @@ from ..errors import (
     Error,
     ForbiddenError,
     HttpError,
+    NonRetryableTlsError,
     OperationalError,
     ProgrammingError,
     RefreshTokenError,
@@ -79,6 +80,7 @@ from ..network import (
     is_econnreset_exception,
     is_login_request,
     is_retryable_http_code,
+    is_unexpected_eof_exception,
 )
 from ..secret_detector import SecretDetector
 from ..sqlstate import (
@@ -816,7 +818,7 @@ class SnowflakeRestful(SnowflakeRestfulSync):
             finally:
                 raw_ret.close()  # ensure response is closed
         except (aiohttp.ClientSSLError, aiohttp.ClientConnectorSSLError) as se:
-            if is_econnreset_exception(se):
+            if is_econnreset_exception(se) or is_unexpected_eof_exception(se):
                 raise RetryRequest(se.os_error)
             msg = f"Hit non-retryable SSL error, {str(se)}.\n{_CONNECTIVITY_ERR_MSG}"
             logger.debug(msg)
@@ -825,7 +827,7 @@ class SnowflakeRestful(SnowflakeRestfulSync):
             Error.errorhandler_wrapper(
                 self._connection,
                 None,
-                OperationalError,
+                NonRetryableTlsError,
                 {
                     "msg": msg,
                     "errno": ER_FAILED_TO_REQUEST,

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.5}/src/snowflake/connector/aio/_result_batch.py

@@ -32,7 +32,10 @@ from snowflake.connector.result_batch import DownloadMetrics
 from snowflake.connector.result_batch import JSONResultBatch as JSONResultBatchSync
 from snowflake.connector.result_batch import RemoteChunkInfo
 from snowflake.connector.result_batch import ResultBatch as ResultBatchSync
-from snowflake.connector.result_batch import _create_nanoarrow_iterator
+from snowflake.connector.result_batch import (
+    _create_nanoarrow_iterator,
+    inline_first_chunk_rowcount,
+)
 from snowflake.connector.secret_detector import SecretDetector
 
 if TYPE_CHECKING:
@@ -60,8 +63,7 @@ def create_batches_from_response(
     column_converters: list[tuple[str, SnowflakeConverterType]] = []
     arrow_context: ArrowConverterContext | None = None
     rowtypes = data["rowtype"]
-    total_len: int = data.get("total", 0)
-    first_chunk_len = total_len
+    first_chunk_len = inline_first_chunk_rowcount(data)
     rest_of_chunks: list[ResultBatch] = []
     if _format == "json":
 
@@ -138,8 +140,6 @@ def create_batches_from_response(
                 )
                 for c in chunks
             ]
-    for c in rest_of_chunks:
-        first_chunk_len -= c.rowcount
     if _format == "json":
         first_chunk = JSONResultBatch.from_data(
             data.get("rowset"),
@@ -333,6 +333,7 @@ class JSONResultBatch(ResultBatch, JSONResultBatchSync):
         async with TimerContextManager() as parse_metric:
             parsed_data = self._parse(downloaded_data)
         self._metrics[DownloadMetrics.parse.value] = parse_metric.get_timing_millis()
+        self._check_rowcount(len(parsed_data))
         return iter(parsed_data)
 
     async def _load(self, content: bytes, encoding: str) -> list:
@@ -451,4 +452,6 @@ class ArrowResultBatch(ResultBatch, ArrowResultBatchSync):
             else:
                 return await self._get_arrow_iter(connection=connection)
         else:
-            return await self._create_iter(iter_unit=iter_unit, connection=connection)
+            return self._iter_checked_rows(
+                await self._create_iter(iter_unit=iter_unit, connection=connection)
+            )

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.5}/src/snowflake/connector/aio/_result_set.py

@@ -29,6 +29,7 @@ from snowflake.connector.aio._result_batch import (
 from snowflake.connector.constants import IterUnit
 from snowflake.connector.options import pandas
 from snowflake.connector.result_set import ResultSet as ResultSetSync
+from snowflake.connector.result_set import check_total_rowcount
 
 from .. import NotSupportedError
 from ..errors import Error
@@ -57,6 +58,7 @@ class ResultSetIterator:
     ) -> None:
         self._is_fetch_all = kw.pop("is_fetch_all", False)
         self._cursor = kw.pop("cursor", None)
+        self._total_row_count = kw.pop("total_row_count", None)
         self._first_batch_iter = first_batch_iter
         self._unfetched_batches = unfetched_batches
         self._final = final
@@ -104,9 +106,22 @@ class ResultSetIterator:
                     )
             rets.extend(batch)
         await self._final()
+        check_total_rowcount(len(rets), self._total_row_count)
         return rets
 
     async def generator(self):
+        """Yields every row, then verifies the count the back-end declared.
+
+        SNOW-4109042: the check sits past the last ``yield`` on purpose, so a
+        consumer that stops early abandons this generator before reaching it.
+        """
+        rows_yielded = 0
+        async for value in self._generate():
+            rows_yielded += 1
+            yield value
+        check_total_rowcount(rows_yielded, self._total_row_count)
+
+    async def _generate(self):
         if self._is_fetch_all:
 
             tasks = await self._download_all_batches()
@@ -172,12 +187,14 @@ class ResultSet(ResultSetSync):
         cursor: SnowflakeCursor,
         result_chunks: list[JSONResultBatch] | list[ArrowResultBatch],
         prefetch_thread_num: int,
+        total_row_count: int | None = None,
     ) -> None:
         super().__init__(
             cursor,
             result_chunks,
             prefetch_thread_num,
             use_mp=False,  # async code depends on aio rather than multiprocessing
+            total_row_count=total_row_count,
         )
         self.batches = cast(
             Union[list[JSONResultBatch], list[ArrowResultBatch]], self.batches
@@ -215,6 +232,14 @@ class ResultSet(ResultSetSync):
         for num, batch in enumerate(unfetched_batches):
             logger.debug(f"result batch {num + 1} has id: {batch.id}")
 
+        # SNOW-4109042: only row iteration yields one item per row; a table or
+        # pandas unit yields whole tables, so there is nothing to count there.
+        total_row_count = (
+            self._total_row_count
+            if kwargs.get("iter_unit", IterUnit.ROW_UNIT) == IterUnit.ROW_UNIT
+            else None
+        )
+
         return ResultSetIterator(
             first_batch_iter,
             unfetched_batches,
@@ -222,6 +247,7 @@ class ResultSet(ResultSetSync):
             self.prefetch_thread_num,
             cursor=self._cursor,
             is_fetch_all=is_fetch_all,
+            total_row_count=total_row_count,
             **kwargs,
         )
 

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.5}/src/snowflake/connector/aio/auth/_oauth_code.py

@@ -68,7 +68,12 @@ class AuthByOauthCode(AuthByPluginAsync, AuthByOauthCodeSync):
         AuthByOauthCodeSync.reset_secrets(self)
 
     async def prepare(self, **kwargs: Any) -> None:
-        AuthByOauthCodeSync.prepare(self, **kwargs)
+        # Sync prepare may open a browser, block on the callback socket, POST to
+        # the IdP via urllib3, and sleep on token-request retries.
+        loop = asyncio.get_running_loop()
+        await loop.run_in_executor(
+            None, lambda: AuthByOauthCodeSync.prepare(self, **kwargs)
+        )
 
     async def reauthenticate(
         self, conn: SnowflakeConnection, **kwargs: Any

{snowflake_connector_python-4.7.3 → snowflake_connector_python-4.7.5}/src/snowflake/connector/aio/auth/_oauth_credentials.py

@@ -51,7 +51,12 @@ class AuthByOauthCredentials(AuthByPluginAsync, AuthByOauthCredentialsSync):
         AuthByOauthCredentialsSync.reset_secrets(self)
 
     async def prepare(self, **kwargs: Any) -> None:
-        AuthByOauthCredentialsSync.prepare(self, **kwargs)
+        # Sync prepare POSTs to the IdP via urllib3 and may sleep on token-request
+        # retries, which would stall the asyncio event loop.
+        loop = asyncio.get_running_loop()
+        await loop.run_in_executor(
+            None, lambda: AuthByOauthCredentialsSync.prepare(self, **kwargs)
+        )
 
     async def reauthenticate(
         self, conn: SnowflakeConnection, **kwargs: Any