snowflake-connector-python 4.7.4__tar.gz → 4.7.5__tar.gz

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.7.5}/DESCRIPTION.md

@@ -7,10 +7,15 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.7.5(Sep 18,2026)
+  - Follow-up to the v4.7.4 incomplete-result fix (SNOW-4109042): when a successful query-request has an incomplete inline first chunk, the connector re-fetches the finished query once via `GET /queries/{qid}/result` before building the result set. JSON treats empty or shorter-than-declared inline rowsets as incomplete; Arrow only treats a missing/empty `rowsetBase64` as incomplete so the execute hot path does not decode IPC. If the result GET fails (transport error or `success: false`), the original payload is kept; if the GET succeeds but is still incomplete, that response is used. In either incomplete case the existing rowcount/total checks still raise `OperationalError` errno `252013` when the result is drained (no silent EOF). On the sync path, a remote result chunk whose body holds fewer rows than its declared `rowCount` is re-downloaded once before that check raises, so a truncated-but-valid chunk download can recover without silent data loss. Asynchronous (`snowflake.connector.aio`) remote-chunk re-download is unchanged.
+
 - v4.7.4(Sep 16,2026)
   - Fixed missing retries on transient HTTP failures when fetching an OAuth access token from the IdP token endpoint (`OAUTH_CLIENT_CREDENTIALS` and `OAUTH_AUTHORIZATION_CODE`). Token requests now retry transport errors, HTTP 408/429, and 5xx responses (SNOW-3984430, #3003).
   - Fixed a bug where a TLS handshake terminated by the peer (`SSLError` containing `SysCallError(-1, 'Unexpected EOF')`) was classified as non-retryable and surfaced as an `OperationalError`, unlike `ECONNRESET`. Such handshake `Unexpected EOF` errors are now retried, on both the sync and async request paths (SNOW-4058589).
   - Fixed `fetchone()`, `fetchmany()`, `fetchall()` and cursor iteration silently returning an incomplete result set. A downloaded result chunk holding fewer rows than the back-end reported just ended the iteration, which the fetch methods report as a normal end of results, so callers received fewer rows than the query produced with no exception raised. Such a chunk now raises an `OperationalError` (errno `252013`). Errors raised while iterating a result set are no longer reported as end-of-results either: `_fetchone()` caught every `TypeError` and returned `None`, so a failure anywhere in the download/parse chain was indistinguishable from an exhausted result set. Both the sync and async paths are fixed (SNOW-4109042).
+  - Added the `SNOWFLAKE_MIN_TLS_VERSION` environment variable (`1.2`, `1.3`, `TLSv1.2` or `TLSv1.3`, defaulting to TLS 1.2) to raise the minimum TLS version on every outbound connection a synchronous connector makes: the Snowflake API, stage transfers, OCSP/CRL fetches, platform detection, IdP requests, AWS SDK requests (workload identity STS calls and the platform-detection identity probe) and Azure AD token requests made by `azure-identity`. An unrecognized value is rejected at connect time. The variable name and accepted values match the Go and JDBC drivers. Asynchronous (`snowflake.connector.aio`) connections are not yet covered.
+  - Fixed a TLS handshake failure that cannot succeed on a retry — a minimum-version mismatch, an untrusted certificate, a hostname mismatch — being reported by `connect()` as a generic `250001: Could not connect to Snowflake backend after N attempt(s)` alongside a firewall-troubleshooting hint. The network layer already identified and named such failures, but the authentication layer retried them until the login timeout expired and then replaced the diagnosis. They now surface as `NonRetryableTlsError` (a subclass of `OperationalError` keeping the same errno, so existing handlers are unaffected) naming the underlying cause, and are no longer retried. Transient handshake faults (`ECONNRESET`, unexpected EOF) remain retryable.
 
 - v4.7.3(Sep 3,2026)
   - Added experimental Python 3.14t (free-threaded CPython) wheel support. **Experimental — not intended for production use.**

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.7.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.7.4
+Version: 4.7.5
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -97,10 +97,15 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.7.5(Sep 18,2026)
+  - Follow-up to the v4.7.4 incomplete-result fix (SNOW-4109042): when a successful query-request has an incomplete inline first chunk, the connector re-fetches the finished query once via `GET /queries/{qid}/result` before building the result set. JSON treats empty or shorter-than-declared inline rowsets as incomplete; Arrow only treats a missing/empty `rowsetBase64` as incomplete so the execute hot path does not decode IPC. If the result GET fails (transport error or `success: false`), the original payload is kept; if the GET succeeds but is still incomplete, that response is used. In either incomplete case the existing rowcount/total checks still raise `OperationalError` errno `252013` when the result is drained (no silent EOF). On the sync path, a remote result chunk whose body holds fewer rows than its declared `rowCount` is re-downloaded once before that check raises, so a truncated-but-valid chunk download can recover without silent data loss. Asynchronous (`snowflake.connector.aio`) remote-chunk re-download is unchanged.
+
 - v4.7.4(Sep 16,2026)
   - Fixed missing retries on transient HTTP failures when fetching an OAuth access token from the IdP token endpoint (`OAUTH_CLIENT_CREDENTIALS` and `OAUTH_AUTHORIZATION_CODE`). Token requests now retry transport errors, HTTP 408/429, and 5xx responses (SNOW-3984430, #3003).
   - Fixed a bug where a TLS handshake terminated by the peer (`SSLError` containing `SysCallError(-1, 'Unexpected EOF')`) was classified as non-retryable and surfaced as an `OperationalError`, unlike `ECONNRESET`. Such handshake `Unexpected EOF` errors are now retried, on both the sync and async request paths (SNOW-4058589).
   - Fixed `fetchone()`, `fetchmany()`, `fetchall()` and cursor iteration silently returning an incomplete result set. A downloaded result chunk holding fewer rows than the back-end reported just ended the iteration, which the fetch methods report as a normal end of results, so callers received fewer rows than the query produced with no exception raised. Such a chunk now raises an `OperationalError` (errno `252013`). Errors raised while iterating a result set are no longer reported as end-of-results either: `_fetchone()` caught every `TypeError` and returned `None`, so a failure anywhere in the download/parse chain was indistinguishable from an exhausted result set. Both the sync and async paths are fixed (SNOW-4109042).
+  - Added the `SNOWFLAKE_MIN_TLS_VERSION` environment variable (`1.2`, `1.3`, `TLSv1.2` or `TLSv1.3`, defaulting to TLS 1.2) to raise the minimum TLS version on every outbound connection a synchronous connector makes: the Snowflake API, stage transfers, OCSP/CRL fetches, platform detection, IdP requests, AWS SDK requests (workload identity STS calls and the platform-detection identity probe) and Azure AD token requests made by `azure-identity`. An unrecognized value is rejected at connect time. The variable name and accepted values match the Go and JDBC drivers. Asynchronous (`snowflake.connector.aio`) connections are not yet covered.
+  - Fixed a TLS handshake failure that cannot succeed on a retry — a minimum-version mismatch, an untrusted certificate, a hostname mismatch — being reported by `connect()` as a generic `250001: Could not connect to Snowflake backend after N attempt(s)` alongside a firewall-troubleshooting hint. The network layer already identified and named such failures, but the authentication layer retried them until the login timeout expired and then replaced the diagnosis. They now surface as `NonRetryableTlsError` (a subclass of `OperationalError` keeping the same errno, so existing handlers are unaffected) naming the underlying cause, and are no longer retried. Transient handshake faults (`ECONNRESET`, unexpected EOF) remain retryable.
 
 - v4.7.3(Sep 3,2026)
   - Added experimental Python 3.14t (free-threaded CPython) wheel support. **Experimental — not intended for production use.**

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.7.5}/src/snowflake/connector/aio/_connection.py

@@ -23,6 +23,7 @@ from snowflake.connector import (
     OperationalError,
     ProgrammingError,
 )
+from snowflake.connector.errors import NonRetryableTlsError
 
 from .._connection_identifier_shape import (
     ConnectionIdentifierShape,
@@ -38,6 +39,7 @@ from ..connection import _get_private_bytes_from_file
 from ..constants import (
     _CONNECTIVITY_ERR_MSG,
     _OAUTH_DEFAULT_SCOPE,
+    ENV_VAR_MIN_TLS_VERSION,
     PARAMETER_AUTOCOMMIT,
     PARAMETER_CLIENT_PREFETCH_THREADS,
     PARAMETER_CLIENT_REQUEST_MFA_TOKEN,
@@ -570,6 +572,11 @@ class SnowflakeConnection(SnowflakeConnectionSync):
                 password_callback=self._password_callback,
                 session_parameters=self._session_parameters,
             )
+        except NonRetryableTlsError:
+            # See the sync counterpart: a TLS failure that a retry cannot fix must
+            # surface with its diagnosis rather than be replaced by the generic
+            # "could not connect" message the retry loop below ends with.
+            raise
         except OperationalError as e:
             logger.debug(
                 "Operational Error raised at authentication"
@@ -1110,6 +1117,20 @@ class SnowflakeConnection(SnowflakeConnectionSync):
     async def connect(self, **kwargs) -> None:
         """Establishes connection to Snowflake."""
         logger.debug("connect")
+        self._validate_min_tls_version()
+        # Validating the value here must not be read as enforcing it: the async
+        # stack builds its TLS contexts through aiohttp, which the connector's
+        # urllib3 interception never sees, so the floor is not applied to async
+        # handshakes. Say so rather than let a successful connect imply otherwise.
+        # Not raised, because the variable is process-wide -- failing here would
+        # break async connections in any process that set it for the sync path.
+        if os.environ.get(ENV_VAR_MIN_TLS_VERSION, "").strip():
+            logger.warning(
+                "%s is set but is not enforced on asynchronous connections; their "
+                "TLS handshakes may negotiate a lower version. Use a synchronous "
+                "connection where the minimum must be guaranteed.",
+                ENV_VAR_MIN_TLS_VERSION,
+            )
         if len(kwargs) > 0:
             self.__config(**kwargs)
         else:

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.7.5}/src/snowflake/connector/aio/_network.py

@@ -42,6 +42,7 @@ from ..errors import (
     Error,
     ForbiddenError,
     HttpError,
+    NonRetryableTlsError,
     OperationalError,
     ProgrammingError,
     RefreshTokenError,
@@ -826,7 +827,7 @@ class SnowflakeRestful(SnowflakeRestfulSync):
             Error.errorhandler_wrapper(
                 self._connection,
                 None,
-                OperationalError,
+                NonRetryableTlsError,
                 {
                     "msg": msg,
                     "errno": ER_FAILED_TO_REQUEST,

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.7.5}/src/snowflake/connector/aio/_result_batch.py

@@ -32,7 +32,10 @@ from snowflake.connector.result_batch import DownloadMetrics
 from snowflake.connector.result_batch import JSONResultBatch as JSONResultBatchSync
 from snowflake.connector.result_batch import RemoteChunkInfo
 from snowflake.connector.result_batch import ResultBatch as ResultBatchSync
-from snowflake.connector.result_batch import _create_nanoarrow_iterator
+from snowflake.connector.result_batch import (
+    _create_nanoarrow_iterator,
+    inline_first_chunk_rowcount,
+)
 from snowflake.connector.secret_detector import SecretDetector
 
 if TYPE_CHECKING:
@@ -60,8 +63,7 @@ def create_batches_from_response(
     column_converters: list[tuple[str, SnowflakeConverterType]] = []
     arrow_context: ArrowConverterContext | None = None
     rowtypes = data["rowtype"]
-    total_len: int = data.get("total", 0)
-    first_chunk_len = total_len
+    first_chunk_len = inline_first_chunk_rowcount(data)
     rest_of_chunks: list[ResultBatch] = []
     if _format == "json":
 
@@ -138,8 +140,6 @@ def create_batches_from_response(
                 )
                 for c in chunks
             ]
-    for c in rest_of_chunks:
-        first_chunk_len -= c.rowcount
     if _format == "json":
         first_chunk = JSONResultBatch.from_data(
             data.get("rowset"),

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.7.5}/src/snowflake/connector/connection.py

@@ -76,6 +76,7 @@ from .constants import (
     _CONNECTIVITY_ERR_MSG,
     _DOMAIN_NAME_MAP,
     _OAUTH_DEFAULT_SCOPE,
+    ENV_VAR_MIN_TLS_VERSION,
     ENV_VAR_PARTNER,
     OCSP_ROOT_CERTS_DICT_LOCK_TIMEOUT_DEFAULT_NO_TIMEOUT,
     PARAMETER_AUTOCOMMIT,
@@ -92,6 +93,7 @@ from .constants import (
     PARAMETER_TIMEZONE,
     OCSPMode,
     QueryStatus,
+    get_min_tls_version,
 )
 from .converter import SnowflakeConverter
 from .crl import CRLConfig
@@ -119,7 +121,13 @@ from .errorcode import (
     ER_NO_USER,
     ER_NOT_IMPLICITY_SNOWFLAKE_DATATYPE,
 )
-from .errors import DatabaseError, Error, OperationalError, ProgrammingError
+from .errors import (
+    DatabaseError,
+    Error,
+    NonRetryableTlsError,
+    OperationalError,
+    ProgrammingError,
+)
 from .log_configuration import EasyLoggingConfigPython
 from .network import (
     DEFAULT_AUTHENTICATOR,
@@ -741,6 +749,44 @@ class SnowflakeConnection:
         self._file_operation_parser = FileOperationParser(self)
         self._stream_downloader = StreamDownloader(self)
 
+    def _validate_min_tls_version(self) -> None:
+        """Reject a malformed ``SNOWFLAKE_MIN_TLS_VERSION`` before any I/O.
+
+        The floor is otherwise resolved lazily, during the first TLS handshake,
+        where a bad value surfaces as a bare ``ValueError`` raised from deep
+        inside the HTTP stack. Checking it here turns that into an ordinary
+        connection-time ``ProgrammingError`` naming the variable.
+
+        ``ssl_wrap_socket`` keeps its own strict parse rather than trusting this
+        check: the variable is read per handshake and can change after
+        ``connect()``, and not every TLS connection originates from a
+        ``SnowflakeConnection``.
+        """
+        try:
+            get_min_tls_version()
+        except ValueError as exc:
+            raise ProgrammingError(msg=str(exc), errno=ER_INVALID_VALUE) from exc
+
+        # A botocore hook that could not be installed means AWS SDK requests are
+        # not honoring the floor. Report it to callers who actually configured one
+        # rather than at import time, which would break users who did not.
+        from . import ssl_wrap_socket
+
+        hook_error = ssl_wrap_socket.BOTOCORE_MIN_TLS_HOOK_ERROR
+        if (
+            hook_error is not None
+            and os.environ.get(ENV_VAR_MIN_TLS_VERSION, "").strip()
+        ):
+            raise ProgrammingError(
+                msg=(
+                    f"{ENV_VAR_MIN_TLS_VERSION} is set, but the minimum TLS version "
+                    f"cannot be enforced for AWS SDK requests: {hook_error}. Pin a "
+                    f"compatible botocore version, or unset the variable to accept "
+                    f"botocore's own TLS floor."
+                ),
+                errno=ER_INVALID_VALUE,
+            )
+
     def _validate_account(self, account_str):
         if not is_valid_account_identifier(account_str):
             Error.errorhandler_wrapper(
@@ -1171,6 +1217,7 @@ class SnowflakeConnection:
     def connect(self, **kwargs) -> None:
         """Establishes connection to Snowflake."""
         logger.debug("connect")
+        self._validate_min_tls_version()
         if len(kwargs) > 0:
             self.__config(**kwargs)
 
@@ -2083,6 +2130,13 @@ class SnowflakeConnection:
                 password_callback=self._password_callback,
                 session_parameters=self._session_parameters,
             )
+        except NonRetryableTlsError:
+            # A TLS failure that cannot succeed on a retry (version floor the peer
+            # can't meet, untrusted certificate, hostname mismatch). Re-raise it
+            # so the caller sees the diagnosis; the retry loop below would burn
+            # the login timeout and then replace it with a generic
+            # "could not connect" message that points at the firewall instead.
+            raise
         except OperationalError as e:
             logger.debug(
                 "Operational Error raised at authentication"

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.7.5}/src/snowflake/connector/connection_diagnostic.py

@@ -18,6 +18,7 @@ import certifi
 import OpenSSL
 
 from .compat import IS_WINDOWS, urlparse
+from .constants import get_min_tls_version
 from .cursor import SnowflakeCursor
 from .session_manager import SessionManager, SessionManagerFactory
 from .url_util import extract_top_level_domain_from_hostname
@@ -239,6 +240,10 @@ class ConnectionDiagnostic:
                     conn.recv(4096).decode("utf-8")
 
                 context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+                # This context is hand-built rather than obtained from the HTTP
+                # stack, so it does not inherit the connector's TLS floor; apply
+                # it here so the diagnostic probes what real connections would do.
+                context.minimum_version = get_min_tls_version()
                 context.load_verify_locations(certifi.where())
                 # Best-effort: enable partial-chain when supported
                 _partial_flag = getattr(ssl, "VERIFY_X509_PARTIAL_CHAIN", 0)

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.7.5}/src/snowflake/connector/constants.py

@@ -1,8 +1,11 @@
 #!/usr/bin/env python
 from __future__ import annotations
 
+import os
+import ssl
 from collections import defaultdict
 from enum import Enum, auto, unique
+from functools import lru_cache
 from typing import TYPE_CHECKING, Any, Callable, DefaultDict, NamedTuple
 
 from .options import pyarrow as pa
@@ -466,10 +469,62 @@ ENV_VAR_PARTNER = "SF_PARTNER"
 ENV_VAR_TEST_MODE = "SNOWFLAKE_TEST_MODE"
 ENV_VAR_DISABLE_PLATFORM_DETECTION = "SNOWFLAKE_DISABLE_PLATFORM_DETECTION"
 ENV_VAR_ENABLE_CUSTOM_REVOCATION_ERRORS = "SNOWFLAKE_ENABLE_CUSTOM_REVOCATION_ERRORS"
+ENV_VAR_MIN_TLS_VERSION = "SNOWFLAKE_MIN_TLS_VERSION"
 
 # Boolean positive values (lowercased) for environment variable checks
 ENV_VAR_BOOL_POSITIVE_VALUES_LOWERCASED = ["true"]
 
+# Floor applied when ENV_VAR_MIN_TLS_VERSION is unset. Matches urllib3's own
+# default (create_urllib3_context), so leaving the variable unset preserves the
+# connector's historical behavior exactly.
+DEFAULT_MIN_TLS_VERSION: ssl.TLSVersion = ssl.TLSVersion.TLSv1_2
+
+# Accepted spellings, matched case-insensitively after trimming. Deliberately the
+# same set the Go and JDBC drivers accept, so one value can be documented and
+# deployed across drivers unchanged.
+_MIN_TLS_VERSION_VALUES: dict[str, ssl.TLSVersion] = {
+    "1.2": ssl.TLSVersion.TLSv1_2,
+    "tlsv1.2": ssl.TLSVersion.TLSv1_2,
+    "1.3": ssl.TLSVersion.TLSv1_3,
+    "tlsv1.3": ssl.TLSVersion.TLSv1_3,
+}
+
+
+@lru_cache(maxsize=None)
+def _parse_min_tls_version(raw: str) -> ssl.TLSVersion:
+    """Parse a minimum-TLS-version string into an ``ssl.TLSVersion``.
+
+    Accepts ``1.2``, ``1.3``, ``TLSv1.2`` and ``TLSv1.3``, case-insensitively and
+    ignoring surrounding whitespace.
+
+    Raises:
+        ValueError: if the value is not a recognized TLS version. A minimum TLS
+            version is a security control, so an unrecognized value fails loudly
+            rather than silently falling back to a weaker floor.
+
+    Cached per distinct input string so that repeated handshakes don't re-parse.
+    """
+    parsed = _MIN_TLS_VERSION_VALUES.get(raw.strip().lower())
+    if parsed is None:
+        raise ValueError(
+            f"Invalid {ENV_VAR_MIN_TLS_VERSION} value {raw!r}. "
+            f"Supported values: {', '.join(sorted(_MIN_TLS_VERSION_VALUES))}."
+        )
+    return parsed
+
+
+def get_min_tls_version() -> ssl.TLSVersion:
+    """Return the process-wide minimum TLS version.
+
+    Read from ENV_VAR_MIN_TLS_VERSION on every call (so the value is not frozen
+    at import time), falling back to DEFAULT_MIN_TLS_VERSION when unset or empty.
+    """
+    raw = os.environ.get(ENV_VAR_MIN_TLS_VERSION, "").strip()
+    if not raw:
+        return DEFAULT_MIN_TLS_VERSION
+    return _parse_min_tls_version(raw)
+
+
 _DOMAIN_NAME_MAP = {_DEFAULT_HOSTNAME_TLD: "GLOBAL", _CHINA_HOSTNAME_TLD: "CHINA"}
 
 _CONNECTIVITY_ERR_MSG = (

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.7.5}/src/snowflake/connector/cursor.py

@@ -35,7 +35,11 @@ from typing import (
 
 from typing_extensions import Self
 
-from snowflake.connector.result_batch import create_batches_from_response
+from snowflake.connector.result_batch import (
+    MAX_INLINE_RESULT_RETRY,
+    create_batches_from_response,
+    is_inline_result_incomplete,
+)
 from snowflake.connector.result_set import ResultSet
 
 from . import compat
@@ -57,8 +61,11 @@ from .constants import (
     QueryStatus,
 )
 from .errorcode import (
+    ER_CONNECTION_IS_CLOSED,
     ER_CURSOR_IS_CLOSED,
     ER_FAILED_PROCESSING_PYFORMAT,
+    ER_FAILED_TO_CONNECT_TO_DB,
+    ER_FAILED_TO_RENEW_SESSION,
     ER_FAILED_TO_REWRITE_MULTI_ROW_INSERT,
     ER_INVALID_VALUE,
     ER_NO_ARROW_RESULT,
@@ -1099,12 +1106,18 @@ class SnowflakeCursorBase(abc.ABC, Generic[FetchRow]):
             if _exec_async:
                 self.connection._async_sfqids[self._sfqid] = None
             if _no_results:
+                # SNOW-4109042: skip recovery here. execute_async / _no_results
+                # returns before building a ResultSet; callers fetch rows later
+                # via query_result / get_results_from_sfqid, which re-GET and
+                # run the same incomplete-inline recovery.
                 self._total_rowcount = (
                     ret["data"]["total"]
                     if "data" in ret and "total" in ret["data"]
                     else -1
                 )
                 return data
+            if self._is_inline_chunk_incomplete(data):
+                data = self._refetch(data)
             self._init_result_and_meta(data)
         else:
             self._total_rowcount = (
@@ -1194,6 +1207,77 @@ class SnowflakeCursorBase(abc.ABC, Generic[FetchRow]):
             and int(data["statementTypeId"]) in STATEMENT_TYPE_ID_DML_SET
         )
 
+    def _is_inline_chunk_incomplete(self, data: dict[Any, Any]) -> bool:
+        """Whether the inline first chunk is short of the server-declared size.
+
+        DML and file-transfer responses are ignored: their ``total`` is not a
+        promise about returned rows. Truncated HTTP JSON bodies are handled
+        separately in ``network.py``.
+        """
+        if (
+            not isinstance(data, dict)
+            or not self._sfqid
+            or self._is_dml(data)
+            or self.is_file_transfer
+        ):
+            return False
+        return is_inline_result_incomplete(data, data.get("queryResultFormat", "json"))
+
+    def _should_reraise_refetch_error(self, err: Error) -> bool:
+        """True when a recovery GET failure must surface, not become keep-original.
+
+        Transport / HTTP-retryable failures keep the truncated payload so the
+        existing ``252013`` drain checks still fire. Closed-connection, session
+        renew, and programming errors are the real failure and must not be
+        masked as an incomplete-result OperationalError later.
+        """
+        if isinstance(err, (ProgrammingError, InterfaceError)):
+            return True
+        return err.errno in (
+            ER_CONNECTION_IS_CLOSED,
+            ER_CURSOR_IS_CLOSED,
+            ER_FAILED_TO_CONNECT_TO_DB,
+            ER_FAILED_TO_RENEW_SESSION,
+        )
+
+    def _refetch(self, data: dict[Any, Any]) -> dict[Any, Any]:
+        """Re-GET ``/queries/{sfqid}/result`` while the inline first chunk is short.
+
+        Callers enter after detecting incompleteness, so the incomplete check
+        runs after each GET (exit when recovered, continue while short).
+        """
+        for attempt in range(MAX_INLINE_RESULT_RETRY):
+            logger.warning(
+                "Incomplete inline result chunk for sfqid=%s; "
+                "re-fetching query result (%s retry(s) left)",
+                self._sfqid,
+                MAX_INLINE_RESULT_RETRY - attempt,
+            )
+            url = f"/queries/{self._sfqid}/result"
+            try:
+                ret = self._connection.rest.request(url=url, method="get")
+            except Error as err:
+                if self._should_reraise_refetch_error(err):
+                    raise
+                logger.warning(
+                    "Re-fetch of query result for sfqid=%s failed; "
+                    "keeping the original response",
+                    self._sfqid,
+                    exc_info=True,
+                )
+                return data
+            if not ret.get("success") or not isinstance(ret.get("data"), dict):
+                logger.warning(
+                    "Re-fetch of query result for sfqid=%s did not succeed; "
+                    "keeping the original response",
+                    self._sfqid,
+                )
+                return data
+            data = ret["data"]
+            if not self._is_inline_chunk_incomplete(data):
+                return data
+        return data
+
     def _init_result_and_meta(self, data: dict[Any, Any]) -> None:
         is_dml = self._is_dml(data)
         self._query_result_format = data.get("queryResultFormat", "json")
@@ -1323,6 +1407,8 @@ class SnowflakeCursorBase(abc.ABC, Generic[FetchRow]):
 
         if ret.get("success"):
             data = ret.get("data")
+            if self._is_inline_chunk_incomplete(data):
+                data = self._refetch(data)
             self._init_result_and_meta(data)
         else:
             logger.debug("failed")

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.7.5}/src/snowflake/connector/errors.py

@@ -461,6 +461,25 @@ class RevocationCheckError(OperationalError):
         )
 
 
+class NonRetryableTlsError(OperationalError):
+    """A TLS failure that cannot succeed on a retry.
+
+    Raised for handshake failures whose cause is a property of the endpoint or of
+    the local configuration rather than a transient network fault -- a protocol
+    version floor the peer cannot meet, an untrusted certificate, a hostname
+    mismatch. Retrying cannot change the outcome.
+
+    It exists as its own type so the authentication layer can re-raise it
+    directly instead of feeding it into its retry-until-timeout loop, which would
+    otherwise replace this error's diagnosis with a generic "could not connect"
+    message. Transient handshake faults (ECONNRESET, unexpected EOF) are *not*
+    raised as this type and remain retryable.
+
+    Still an ``OperationalError`` carrying the same errno, so existing handlers
+    keep working.
+    """
+
+
 # internal errors
 class InternalServerError(Error):
     """Exception for 500 HTTP code for retry."""

{snowflake_connector_python-4.7.4 → snowflake_connector_python-4.7.5}/src/snowflake/connector/network.py

@@ -75,6 +75,7 @@ from .errors import (
     HttpError,
     InternalServerError,
     MethodNotAllowed,
+    NonRetryableTlsError,
     OperationalError,
     OtherHTTPRetryableError,
     ProgrammingError,
@@ -122,6 +123,10 @@ Monkey patch for PyOpenSSL Socket wrapper
 """
 ssl_wrap_socket.inject_into_urllib3()
 
+# botocore builds its own SSL contexts on the real urllib3, so the patch above
+# does not reach AWS SDK requests. Hook their TLS floor separately.
+ssl_wrap_socket.inject_min_tls_version_into_botocore()
+
 # known applications
 APPLICATION_SNOWSQL = "SnowSQL"
 
@@ -1235,7 +1240,7 @@ class SnowflakeRestful:
             Error.errorhandler_wrapper(
                 self._connection,
                 None,
-                OperationalError,
+                NonRetryableTlsError,
                 {
                     "msg": msg,
                     "errno": ER_FAILED_TO_REQUEST,