snowflake-connector-python 4.7.5__tar.gz → 4.8.1__tar.gz

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.1}/CONTRIBUTING.md

@@ -30,8 +30,8 @@ dependencies installed with `snowflake-connector-python` installed as an editabl
 Setting up a development environment is super easy with this [one simple tox command](https://tox.wiki/en/legacy/example/devenv.html).
 
 ```shell
-tox --devenv venv310 -e py310
-. venv310/bin/activate
+tox --devenv venv311 -e py311
+. venv311/bin/activate
 ```
 
 Note: we suggest using the lowest supported Python version for development.

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.1}/DESCRIPTION.md

@@ -7,6 +7,23 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.8.1(Oct 26,2026)
+  - Fixed `write_pandas` identifier quoting. Parquet field paths are quoted, Iceberg option values are escaped string literals, and `quote_identifiers=False` accepts only valid unquoted identifiers.
+  - Dropped support for Python 3.10. The minimum supported version is now Python 3.11.
+  - Bumped vendored `urllib3` to `2.8.0`. This includes the upstream fix for importing the connector on Python built against OpenSSL 4, where `ssl.PROTOCOL_TLSv1` no longer exists (SNOW-4232077).
+  - Fixed large result set batch chunk download logging every transient retry at ERROR level with a traceback. Intermediate retries now log at WARNING; only the final failure after all retries are exhausted logs at ERROR with a traceback. These retry and failure logs now also include the S3 request IDs (`x-amz-request-id` / `x-amz-id-2`) when present, to aid troubleshooting and correlation with AWS-side records (SNOW-4218352).
+  - Fixed a spurious `RequestsDependencyWarning` emitted at import time by the vendored `requests` when a newer `chardet` (7.x) or `charset_normalizer` is installed. `check_compatibility()` still requires `chardet >= 3.0.2` and `charset_normalizer >= 2.0.0`, but no longer rejects newer majors (SNOW-3559506).
+  - Raised the minimum certifi requirement to 2026.10.18
+  - Raised filelock upper bound dependency to allow installation of filelock 4.X.
+
+- v4.8.0(Sep 30,2026)
+  - Fixed external-browser (SSO) authentication to validate the `Origin` header on the local callback server, rejecting tokens delivered from unexpected origins. A trailing slash in the origin (e.g. `https://account.snowflakecomputing.com/`) is now accepted on par with the bare origin, matching JDBC and other driver behaviour. Preconnect probe connections (empty recv) no longer count against the retry budget and no longer abort the login flow.
+  - Added the `SNOWFLAKE_TLS_CIPHERS` environment variable to restrict which TLS ciphers the connector offers. It takes a colon-separated list; names beginning with `TLS_` are applied as TLS 1.3 cipher suites and the remainder as the cipher list for TLS 1.2 and below, so a single variable covers both. Leaving it unset keeps OpenSSL's defaults unchanged, and an unrecognized cipher name is rejected rather than silently ignored. The restriction covers Snowflake API traffic, cloud-storage (stage) transfers, OCSP/CRL fetches and IdP requests. Requests issued by the AWS and Azure SDKs, and asynchronous connections, are not covered — for TLS 1.3 suites specifically they cannot be, because the Python standard library exposes no API for restricting them.
+  - Raised the minimum `pyOpenSSL` requirement to 25.3.0, the first version providing `set_tls13_ciphersuites`. This does not narrow the set of installable versions in practice: earlier releases cap `cryptography` below 46 and so were already uninstallable alongside the connector's own `cryptography>=46.0.5` requirement.
+  - Added the `workload_identity_host` connection option that overrides the STS host used by AWS Workload Identity Federation, for endpoints the driver cannot derive from the region (such as an interface VPC endpoint). The default STS host is now resolved via botocore so partitions that do not use `amazonaws.com` (ISO, European Sovereign Cloud, ...) get the correct hostname. A privately routed host cannot be reached by Snowflake on the default GetCallerIdentity path, so a VPC or PrivateLink STS endpoint also requires `workload_identity_aws_use_outbound_token=True` (SNOW-4017192).
+  - Fixed MD5 computation for Azure clouds (SNOW-4168830).
+  - OCSP certificate revocation checks are now off unless you opt in. Set `ocsp_fail_open=True` or `ocsp_fail_open=False` to enable OCSP. The stored default is `None` (unset); only an explicit `True`/`False` opts in, so forwarding `DEFAULT_CONFIGURATION` as kwargs does not turn OCSP on. `disable_ocsp_checks=True` (or `insecure_mode=True`) always turns OCSP off, including when `ocsp_fail_open` is also set. `disable_ocsp_checks=False` and `insecure_mode=False` are the stored defaults and are not an opt-in. Connection attribute `ocsp_fail_open` is no longer a report of whether OCSP *is* fail-open; it is the stored preference (`None` = unset, `True` = fail-open, `False` = fail-closed). Use `_ocsp_mode()` / `disable_ocsp_checks` to see whether checks are actually on. `ocsp_response_cache_filename` and `ocsp_root_certs_dict_lock_timeout` do not turn OCSP on; if they are set without an OCSP mode parameter they are ignored and a warning is logged. The `SF_OCSP_FAIL_OPEN` environment variable still only switches fail-open vs fail-closed after OCSP is already on. Login `OCSP_MODE` telemetry now reports `DISABLE_OCSP_CHECKS` by default. The process-global `FEATURE_OCSP_MODE` is updated by each constructed REST client, except that a later default (OCSP off) client does not overwrite a non-default already stored on the process, and a later `FAIL_OPEN` client does not overwrite `FAIL_CLOSED`.
+
 - v4.7.5(Sep 18,2026)
   - Follow-up to the v4.7.4 incomplete-result fix (SNOW-4109042): when a successful query-request has an incomplete inline first chunk, the connector re-fetches the finished query once via `GET /queries/{qid}/result` before building the result set. JSON treats empty or shorter-than-declared inline rowsets as incomplete; Arrow only treats a missing/empty `rowsetBase64` as incomplete so the execute hot path does not decode IPC. If the result GET fails (transport error or `success: false`), the original payload is kept; if the GET succeeds but is still incomplete, that response is used. In either incomplete case the existing rowcount/total checks still raise `OperationalError` errno `252013` when the result is drained (no silent EOF). On the sync path, a remote result chunk whose body holds fewer rows than its declared `rowCount` is re-downloaded once before that check raises, so a truncated-but-valid chunk download can recover without silent data loss. Asynchronous (`snowflake.connector.aio`) remote-chunk re-download is unchanged.
 
@@ -14,8 +31,6 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Fixed missing retries on transient HTTP failures when fetching an OAuth access token from the IdP token endpoint (`OAUTH_CLIENT_CREDENTIALS` and `OAUTH_AUTHORIZATION_CODE`). Token requests now retry transport errors, HTTP 408/429, and 5xx responses (SNOW-3984430, #3003).
   - Fixed a bug where a TLS handshake terminated by the peer (`SSLError` containing `SysCallError(-1, 'Unexpected EOF')`) was classified as non-retryable and surfaced as an `OperationalError`, unlike `ECONNRESET`. Such handshake `Unexpected EOF` errors are now retried, on both the sync and async request paths (SNOW-4058589).
   - Fixed `fetchone()`, `fetchmany()`, `fetchall()` and cursor iteration silently returning an incomplete result set. A downloaded result chunk holding fewer rows than the back-end reported just ended the iteration, which the fetch methods report as a normal end of results, so callers received fewer rows than the query produced with no exception raised. Such a chunk now raises an `OperationalError` (errno `252013`). Errors raised while iterating a result set are no longer reported as end-of-results either: `_fetchone()` caught every `TypeError` and returned `None`, so a failure anywhere in the download/parse chain was indistinguishable from an exhausted result set. Both the sync and async paths are fixed (SNOW-4109042).
-  - Added the `SNOWFLAKE_MIN_TLS_VERSION` environment variable (`1.2`, `1.3`, `TLSv1.2` or `TLSv1.3`, defaulting to TLS 1.2) to raise the minimum TLS version on every outbound connection a synchronous connector makes: the Snowflake API, stage transfers, OCSP/CRL fetches, platform detection, IdP requests, AWS SDK requests (workload identity STS calls and the platform-detection identity probe) and Azure AD token requests made by `azure-identity`. An unrecognized value is rejected at connect time. The variable name and accepted values match the Go and JDBC drivers. Asynchronous (`snowflake.connector.aio`) connections are not yet covered.
-  - Fixed a TLS handshake failure that cannot succeed on a retry — a minimum-version mismatch, an untrusted certificate, a hostname mismatch — being reported by `connect()` as a generic `250001: Could not connect to Snowflake backend after N attempt(s)` alongside a firewall-troubleshooting hint. The network layer already identified and named such failures, but the authentication layer retried them until the login timeout expired and then replaced the diagnosis. They now surface as `NonRetryableTlsError` (a subclass of `OperationalError` keeping the same errno, so existing handlers are unaffected) naming the underlying cause, and are no longer retried. Transient handshake faults (`ECONNRESET`, unexpected EOF) remain retryable.
 
 - v4.7.3(Sep 3,2026)
   - Added experimental Python 3.14t (free-threaded CPython) wheel support. **Experimental — not intended for production use.**
@@ -33,6 +48,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Improved the robustness and correctness of OCSP revocation checking (SNOW-3675581).
     - When `SF_OCSP_RESPONSE_CACHE_SERVER_URL` is set, the connector uses it as the OCSP cache server, including on PrivateLink hosts.
     - A PrivateLink OCSP cache URL is derived only for hosts that consist of hostname characters, include a `.privatelink.` label, and end at `snowflakecomputing.com`, `.cn`, or `.mil`. Other hosts use the public default cache URL; set `SF_OCSP_RESPONSE_CACHE_SERVER_URL` to use a different cache server.
+    - Please review [Snowflake documentation](https://docs.snowflake.com/en/release-notes/clients-drivers/python-connector-2026#version-473-sep-3-2026) for possible implications to your workflow
   - Extended log secret masking coverage (SNOW-3675583). The connection-token pattern accepts `:` and `%` in the token value. Added patterns for OAuth access and refresh tokens in serialized JSON, for one-time passcodes, and for OAuth client identifiers and secrets. The passcode pattern accepts quoted values. The password pattern requires at least six characters in the value, so ordinary prose following the word "password" is not redacted.
   - Request headers are copied before mutation on the async path, and masking is applied to the `Authorization` header in error logs (SNOW-3675593).
   - Applied secret masking to the `snowflake.connector` loggers by default, independent of how application logging is configured. The same filter also covers the third-party loggers the connector uses (`botocore`, `boto3`, `aiohttp`, `aiobotocore`, `aioboto3`, vendored `urllib3`). Set `SNOWFLAKE_DISABLE_LOG_SECRET_MASKING=true` to opt out; it is honored at emit time, including after import (SNOW-3675583).

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 4.7.5
+Version: 4.8.1
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -22,7 +22,6 @@ Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
@@ -35,22 +34,22 @@ Classifier: Topic :: Software Development
 Classifier: Topic :: Software Development :: Libraries
 Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: >=3.10
+Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE.txt
 License-File: NOTICE
 Requires-Dist: asn1crypto<2.0.0,>0.24.0
 Requires-Dist: cryptography>=46.0.5
-Requires-Dist: pyOpenSSL>=24.0.0
+Requires-Dist: pyOpenSSL>=25.3.0
 Requires-Dist: pyjwt<3.0.0,>=2.10.1
 Requires-Dist: pytz
 Requires-Dist: requests<3.0.0,>=2.32.4
 Requires-Dist: packaging
 Requires-Dist: charset_normalizer<4,>=2
 Requires-Dist: idna<4,>=3.7
-Requires-Dist: certifi>=2024.7.4
+Requires-Dist: certifi>=2026.10.18
 Requires-Dist: typing_extensions<5,>=4.3
-Requires-Dist: filelock<4,>=3.5
+Requires-Dist: filelock<5,>=3.12
 Requires-Dist: sortedcontainers>=2.4.0
 Requires-Dist: platformdirs<5.0.0,>=2.6.0
 Requires-Dist: tomlkit
@@ -97,6 +96,23 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v4.8.1(Oct 26,2026)
+  - Fixed `write_pandas` identifier quoting. Parquet field paths are quoted, Iceberg option values are escaped string literals, and `quote_identifiers=False` accepts only valid unquoted identifiers.
+  - Dropped support for Python 3.10. The minimum supported version is now Python 3.11.
+  - Bumped vendored `urllib3` to `2.8.0`. This includes the upstream fix for importing the connector on Python built against OpenSSL 4, where `ssl.PROTOCOL_TLSv1` no longer exists (SNOW-4232077).
+  - Fixed large result set batch chunk download logging every transient retry at ERROR level with a traceback. Intermediate retries now log at WARNING; only the final failure after all retries are exhausted logs at ERROR with a traceback. These retry and failure logs now also include the S3 request IDs (`x-amz-request-id` / `x-amz-id-2`) when present, to aid troubleshooting and correlation with AWS-side records (SNOW-4218352).
+  - Fixed a spurious `RequestsDependencyWarning` emitted at import time by the vendored `requests` when a newer `chardet` (7.x) or `charset_normalizer` is installed. `check_compatibility()` still requires `chardet >= 3.0.2` and `charset_normalizer >= 2.0.0`, but no longer rejects newer majors (SNOW-3559506).
+  - Raised the minimum certifi requirement to 2026.10.18
+  - Raised filelock upper bound dependency to allow installation of filelock 4.X.
+
+- v4.8.0(Sep 30,2026)
+  - Fixed external-browser (SSO) authentication to validate the `Origin` header on the local callback server, rejecting tokens delivered from unexpected origins. A trailing slash in the origin (e.g. `https://account.snowflakecomputing.com/`) is now accepted on par with the bare origin, matching JDBC and other driver behaviour. Preconnect probe connections (empty recv) no longer count against the retry budget and no longer abort the login flow.
+  - Added the `SNOWFLAKE_TLS_CIPHERS` environment variable to restrict which TLS ciphers the connector offers. It takes a colon-separated list; names beginning with `TLS_` are applied as TLS 1.3 cipher suites and the remainder as the cipher list for TLS 1.2 and below, so a single variable covers both. Leaving it unset keeps OpenSSL's defaults unchanged, and an unrecognized cipher name is rejected rather than silently ignored. The restriction covers Snowflake API traffic, cloud-storage (stage) transfers, OCSP/CRL fetches and IdP requests. Requests issued by the AWS and Azure SDKs, and asynchronous connections, are not covered — for TLS 1.3 suites specifically they cannot be, because the Python standard library exposes no API for restricting them.
+  - Raised the minimum `pyOpenSSL` requirement to 25.3.0, the first version providing `set_tls13_ciphersuites`. This does not narrow the set of installable versions in practice: earlier releases cap `cryptography` below 46 and so were already uninstallable alongside the connector's own `cryptography>=46.0.5` requirement.
+  - Added the `workload_identity_host` connection option that overrides the STS host used by AWS Workload Identity Federation, for endpoints the driver cannot derive from the region (such as an interface VPC endpoint). The default STS host is now resolved via botocore so partitions that do not use `amazonaws.com` (ISO, European Sovereign Cloud, ...) get the correct hostname. A privately routed host cannot be reached by Snowflake on the default GetCallerIdentity path, so a VPC or PrivateLink STS endpoint also requires `workload_identity_aws_use_outbound_token=True` (SNOW-4017192).
+  - Fixed MD5 computation for Azure clouds (SNOW-4168830).
+  - OCSP certificate revocation checks are now off unless you opt in. Set `ocsp_fail_open=True` or `ocsp_fail_open=False` to enable OCSP. The stored default is `None` (unset); only an explicit `True`/`False` opts in, so forwarding `DEFAULT_CONFIGURATION` as kwargs does not turn OCSP on. `disable_ocsp_checks=True` (or `insecure_mode=True`) always turns OCSP off, including when `ocsp_fail_open` is also set. `disable_ocsp_checks=False` and `insecure_mode=False` are the stored defaults and are not an opt-in. Connection attribute `ocsp_fail_open` is no longer a report of whether OCSP *is* fail-open; it is the stored preference (`None` = unset, `True` = fail-open, `False` = fail-closed). Use `_ocsp_mode()` / `disable_ocsp_checks` to see whether checks are actually on. `ocsp_response_cache_filename` and `ocsp_root_certs_dict_lock_timeout` do not turn OCSP on; if they are set without an OCSP mode parameter they are ignored and a warning is logged. The `SF_OCSP_FAIL_OPEN` environment variable still only switches fail-open vs fail-closed after OCSP is already on. Login `OCSP_MODE` telemetry now reports `DISABLE_OCSP_CHECKS` by default. The process-global `FEATURE_OCSP_MODE` is updated by each constructed REST client, except that a later default (OCSP off) client does not overwrite a non-default already stored on the process, and a later `FAIL_OPEN` client does not overwrite `FAIL_CLOSED`.
+
 - v4.7.5(Sep 18,2026)
   - Follow-up to the v4.7.4 incomplete-result fix (SNOW-4109042): when a successful query-request has an incomplete inline first chunk, the connector re-fetches the finished query once via `GET /queries/{qid}/result` before building the result set. JSON treats empty or shorter-than-declared inline rowsets as incomplete; Arrow only treats a missing/empty `rowsetBase64` as incomplete so the execute hot path does not decode IPC. If the result GET fails (transport error or `success: false`), the original payload is kept; if the GET succeeds but is still incomplete, that response is used. In either incomplete case the existing rowcount/total checks still raise `OperationalError` errno `252013` when the result is drained (no silent EOF). On the sync path, a remote result chunk whose body holds fewer rows than its declared `rowCount` is re-downloaded once before that check raises, so a truncated-but-valid chunk download can recover without silent data loss. Asynchronous (`snowflake.connector.aio`) remote-chunk re-download is unchanged.
 
@@ -104,8 +120,6 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Fixed missing retries on transient HTTP failures when fetching an OAuth access token from the IdP token endpoint (`OAUTH_CLIENT_CREDENTIALS` and `OAUTH_AUTHORIZATION_CODE`). Token requests now retry transport errors, HTTP 408/429, and 5xx responses (SNOW-3984430, #3003).
   - Fixed a bug where a TLS handshake terminated by the peer (`SSLError` containing `SysCallError(-1, 'Unexpected EOF')`) was classified as non-retryable and surfaced as an `OperationalError`, unlike `ECONNRESET`. Such handshake `Unexpected EOF` errors are now retried, on both the sync and async request paths (SNOW-4058589).
   - Fixed `fetchone()`, `fetchmany()`, `fetchall()` and cursor iteration silently returning an incomplete result set. A downloaded result chunk holding fewer rows than the back-end reported just ended the iteration, which the fetch methods report as a normal end of results, so callers received fewer rows than the query produced with no exception raised. Such a chunk now raises an `OperationalError` (errno `252013`). Errors raised while iterating a result set are no longer reported as end-of-results either: `_fetchone()` caught every `TypeError` and returned `None`, so a failure anywhere in the download/parse chain was indistinguishable from an exhausted result set. Both the sync and async paths are fixed (SNOW-4109042).
-  - Added the `SNOWFLAKE_MIN_TLS_VERSION` environment variable (`1.2`, `1.3`, `TLSv1.2` or `TLSv1.3`, defaulting to TLS 1.2) to raise the minimum TLS version on every outbound connection a synchronous connector makes: the Snowflake API, stage transfers, OCSP/CRL fetches, platform detection, IdP requests, AWS SDK requests (workload identity STS calls and the platform-detection identity probe) and Azure AD token requests made by `azure-identity`. An unrecognized value is rejected at connect time. The variable name and accepted values match the Go and JDBC drivers. Asynchronous (`snowflake.connector.aio`) connections are not yet covered.
-  - Fixed a TLS handshake failure that cannot succeed on a retry — a minimum-version mismatch, an untrusted certificate, a hostname mismatch — being reported by `connect()` as a generic `250001: Could not connect to Snowflake backend after N attempt(s)` alongside a firewall-troubleshooting hint. The network layer already identified and named such failures, but the authentication layer retried them until the login timeout expired and then replaced the diagnosis. They now surface as `NonRetryableTlsError` (a subclass of `OperationalError` keeping the same errno, so existing handlers are unaffected) naming the underlying cause, and are no longer retried. Transient handshake faults (`ECONNRESET`, unexpected EOF) remain retryable.
 
 - v4.7.3(Sep 3,2026)
   - Added experimental Python 3.14t (free-threaded CPython) wheel support. **Experimental — not intended for production use.**
@@ -123,6 +137,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Improved the robustness and correctness of OCSP revocation checking (SNOW-3675581).
     - When `SF_OCSP_RESPONSE_CACHE_SERVER_URL` is set, the connector uses it as the OCSP cache server, including on PrivateLink hosts.
     - A PrivateLink OCSP cache URL is derived only for hosts that consist of hostname characters, include a `.privatelink.` label, and end at `snowflakecomputing.com`, `.cn`, or `.mil`. Other hosts use the public default cache URL; set `SF_OCSP_RESPONSE_CACHE_SERVER_URL` to use a different cache server.
+    - Please review [Snowflake documentation](https://docs.snowflake.com/en/release-notes/clients-drivers/python-connector-2026#version-473-sep-3-2026) for possible implications to your workflow
   - Extended log secret masking coverage (SNOW-3675583). The connection-token pattern accepts `:` and `%` in the token value. Added patterns for OAuth access and refresh tokens in serialized JSON, for one-time passcodes, and for OAuth client identifiers and secrets. The passcode pattern accepts quoted values. The password pattern requires at least six characters in the value, so ordinary prose following the word "password" is not redacted.
   - Request headers are copied before mutation on the async path, and masking is applied to the `Authorization` header in error logs (SNOW-3675593).
   - Applied secret masking to the `snowflake.connector` loggers by default, independent of how application logging is configured. The same filter also covers the third-party loggers the connector uses (`botocore`, `boto3`, `aiohttp`, `aiobotocore`, `aioboto3`, vendored `urllib3`). Set `SNOWFLAKE_DISABLE_LOG_SECRET_MASKING=true` to opt out; it is honored at emit time, including after import (SNOW-3675583).

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.1}/README.md

@@ -1,7 +1,7 @@
 # Snowflake Connector for Python
 
 > [!IMPORTANT]
-> A new version of the driver is being developed in [snowflakedb/drivers](https://github.com/snowflakedb/drivers) and is currently in public preview. See the [documentation](https://docs.snowflake.com/en/developer-guide/python-connector/python-connector-universal-core) for more information.
+> Version 5.0.0 of the Snowflake Connector for Python has been released. Development has moved to [snowflakedb/drivers](https://github.com/snowflakedb/drivers). See the [documentation](https://docs.snowflake.com/en/developer-guide/universal-core/universal-core) for more information.
 
 This package includes the Snowflake Connector for Python, which conforms to the [Python DB API 2.0](https://www.python.org/dev/peps/pep-0249/) specification.
 
@@ -12,7 +12,7 @@ using the Snowflake JDBC or ODBC drivers.
 
 The connector has **no** dependencies on JDBC or ODBC.
 It can be installed using ``pip`` on Linux, Mac OSX, and Windows platforms
-where Python 3.10.0 (or higher) is installed.
+where Python 3.11.0 (or higher) is installed.
 
 Snowflake Documentation is available at:
 https://docs.snowflake.com/
@@ -39,7 +39,7 @@ Find the `snowflake_connector_python*.whl` package in the `./dist` directory.
 ### In Docker
 Or use our Dockerized build script `ci/build_docker.sh` and find the built wheel files in `dist/repaired_wheels`.
 
-Note: `ci/build_docker.sh` can be used to compile only certain versions, like this: `ci/build_docker.sh "3.10 3.11"`
+Note: `ci/build_docker.sh` can be used to compile only certain versions, like this: `ci/build_docker.sh "3.11 3.12"`
 
 ## Code hygiene and other utilities
 These tools are integrated into `tox` to allow us to easily set them up universally on any computer.

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.1}/setup.cfg

@@ -20,7 +20,6 @@ classifiers =
 	Operating System :: OS Independent
 	Programming Language :: Python :: 3
 	Programming Language :: Python :: 3 :: Only
-	Programming Language :: Python :: 3.10
 	Programming Language :: Python :: 3.11
 	Programming Language :: Python :: 3.12
 	Programming Language :: Python :: 3.13
@@ -41,21 +40,21 @@ project_urls =
 	Changelog=https://github.com/snowflakedb/snowflake-connector-python/blob/main/DESCRIPTION.md
 
 [options]
-python_requires = >=3.10
+python_requires = >=3.11
 packages = find_namespace:
 install_requires = 
 	asn1crypto>0.24.0,<2.0.0
 	cryptography>=46.0.5
-	pyOpenSSL>=24.0.0
+	pyOpenSSL>=25.3.0
 	pyjwt>=2.10.1,<3.0.0
 	pytz
 	requests>=2.32.4,<3.0.0
 	packaging
 	charset_normalizer>=2,<4
 	idna>=3.7,<4
-	certifi>=2024.7.4
+	certifi>=2026.10.18
 	typing_extensions>=4.3,<5
-	filelock>=3.5,<4
+	filelock>=3.12,<5
 	sortedcontainers>=2.4.0
 	platformdirs>=2.6.0,<5.0.0
 	tomlkit

snowflake_connector_python-4.8.1/src/snowflake/connector/_ocsp_mode.py

@@ -0,0 +1,68 @@
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import Any, Collection
+
+from .constants import OCSPMode
+
+# ocsp_fail_open True/False opts into OCSP. None is the stored default and
+# is not an opt-in. disable_ocsp_checks / insecure_mode only turn OCSP off
+# when True; their stored False default is not an opt-in. Cache/timeout
+# knobs never enable OCSP.
+OCSP_MODE_PARAMS = frozenset({"disable_ocsp_checks", "ocsp_fail_open", "insecure_mode"})
+OCSP_SUPPORT_PARAMS = frozenset(
+    {"ocsp_response_cache_filename", "ocsp_root_certs_dict_lock_timeout"}
+)
+OCSP_EXPLICIT_PARAMS = OCSP_MODE_PARAMS | OCSP_SUPPORT_PARAMS
+
+IGNORED_OCSP_SUPPORT_PARAMS_WARNING = (
+    "OCSP is disabled unless you opt in. The following OCSP setting(s) will be "
+    "ignored because none of ocsp_fail_open, disable_ocsp_checks, or "
+    "insecure_mode was set: {params}. Set ocsp_fail_open=True or "
+    "ocsp_fail_open=False to enable OCSP."
+)
+
+
+def snapshot_ocsp_explicit_params(params: Mapping[str, Any]) -> frozenset[str]:
+    return frozenset(name for name in OCSP_EXPLICIT_PARAMS if name in params)
+
+
+def resolve_ocsp_mode(
+    *,
+    explicit: Collection[str],
+    disable_ocsp_checks: bool,
+    ocsp_fail_open: bool | None,
+    insecure_mode: bool | None = None,
+) -> OCSPMode:
+    """Resolve OCSP mode from explicit user/toml presence plus stored values.
+
+    ``ocsp_fail_open`` is the only opt-in: True = fail-open, False =
+    fail-closed. None is the stored default and does not enable OCSP, even
+    when the key is present (a caller forwarding DEFAULT_CONFIGURATION).
+
+    Connection-property disable (``disable_ocsp_checks=True`` or
+    ``insecure_mode=True``) always turns OCSP off, including when
+    ``ocsp_fail_open`` is True/False. Presence of
+    ``disable_ocsp_checks=False`` or ``insecure_mode=False`` is not an
+    opt-in; those are the stored defaults.
+    """
+    if "disable_ocsp_checks" in explicit:
+        disable_value = disable_ocsp_checks
+    elif "insecure_mode" in explicit:
+        disable_value = (
+            insecure_mode if insecure_mode is not None else disable_ocsp_checks
+        )
+    else:
+        disable_value = False
+
+    if disable_value:
+        return OCSPMode.DISABLE_OCSP_CHECKS
+    if ocsp_fail_open is not None:
+        return OCSPMode.FAIL_OPEN if ocsp_fail_open else OCSPMode.FAIL_CLOSED
+    return OCSPMode.DISABLE_OCSP_CHECKS
+
+
+def ignored_ocsp_support_params(explicit: Collection[str]) -> tuple[str, ...]:
+    if any(name in explicit for name in OCSP_MODE_PARAMS):
+        return ()
+    return tuple(sorted(name for name in OCSP_SUPPORT_PARAMS if name in explicit))

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.1}/src/snowflake/connector/aio/README.md

@@ -14,7 +14,7 @@ is not intended for production environments.**
 - ❌ `mfa_callback` / `password_callback` - not supported
 - ❌ `_probe_connection=True` - no connection diagnostic
 - ❌ Raw binary response handling - not supported
-- ❌ CRL (Certificate Revocation List) - not supported (only OCSP is supported)
+- ❌ CRL (Certificate Revocation List) - not supported (only OCSP is supported). OCSP is off by default; set `ocsp_fail_open=True`/`False` to enable it.
 
 ## Installation & Import
 

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.1}/src/snowflake/connector/aio/_azure_storage_client.py

@@ -17,7 +17,6 @@ from ..azure_storage_client import (
 from ..compat import quote
 from ..constants import FileHeader, ResultStatus
 from ..encryption_util import EncryptionMetadata
-from ..util_text import get_md5_for_integrity
 from ._storage_client import SnowflakeStorageClient as SnowflakeStorageClientAsync
 
 if TYPE_CHECKING:  # pragma: no cover
@@ -173,26 +172,12 @@ class SnowflakeAzureRestClient(
             part = ET.Element("Latest")
             part.text = block_id
             root.append(part)
-        # SNOW-1778088: We need to calculate the MD5 sum of this file for Azure Blob storage
-        new_stream = not bool(self.meta.src_stream or self.meta.intermediate_stream)
-        fd = (
-            self.meta.src_stream
-            or self.meta.intermediate_stream
-            or open(self.meta.real_src_file_name, "rb")
-        )
-        try:
-            if not new_stream:
-                # Reset position in file
-                fd.seek(0)
-            file_content = fd.read()
-        finally:
-            if new_stream:
-                fd.close()
+        # SNOW-1778088: We need to provide the MD5 sum of this file for Azure Blob storage.
         headers = {
             "x-ms-blob-content-encoding": "utf-8",
-            "x-ms-blob-content-md5": base64.b64encode(
-                get_md5_for_integrity(file_content)
-            ).decode("utf-8"),
+            "x-ms-blob-content-md5": base64.b64encode(self.meta.md5_digest).decode(
+                "utf-8"
+            ),
         }
         azure_metadata = self._prepare_file_metadata()
         headers.update(azure_metadata)

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.1}/src/snowflake/connector/aio/_connection.py

@@ -659,6 +659,7 @@ class SnowflakeConnection(SnowflakeConnectionSync):
         self._rest = None
         for name, (value, _) in DEFAULT_CONFIGURATION.items():
             setattr(self, f"_{name}", value)
+        self._ocsp_explicit: frozenset[str] = frozenset()
 
         self._heartbeat_task = None
         is_kwargs_empty = not connection_init_kwargs
@@ -675,6 +676,7 @@ class SnowflakeConnection(SnowflakeConnectionSync):
                 DeprecationWarning,
                 stacklevel=2,
             )
+            self._insecure_mode = connection_init_kwargs["insecure_mode"]
 
             if (
                 "disable_ocsp_checks" in connection_init_kwargs

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.1}/src/snowflake/connector/aio/_pandas_tools.py

@@ -12,6 +12,8 @@ from snowflake.connector.options import pandas
 # Import utilities from sync version
 from snowflake.connector.pandas_tools import (
     _iceberg_config_statement_helper,
+    _quote_sql_identifier,
+    _sql_column_identifier,
     build_location_helper,
     chunk_helper,
 )
@@ -240,7 +242,8 @@ async def write_pandas(
             https://docs.snowflake.com/en/sql-reference/sql/put.html#optional-parameters (Default value = 4).
         quote_identifiers: By default, identifiers, specifically database, schema, table and column names
             (from df.columns) will be quoted. If set to False, identifiers are passed on to Snowflake without quoting.
-            I.e. identifiers will be coerced to uppercase by Snowflake.  (Default value = True)
+            I.e. identifiers will be coerced to uppercase by Snowflake. Column names in this mode must be valid
+            Snowflake unquoted identifiers.  (Default value = True)
         infer_schema: Perform explicit schema inference on the data in the DataFrame and use the inferred data types
             when selecting columns from the DataFrame. (Default value = False)
         auto_create_table: When true, will automatically create a table with corresponding columns for each column in
@@ -335,6 +338,15 @@ async def write_pandas(
     else:
         sql_use_logical_type = " USE_LOGICAL_TYPE = FALSE"
 
+    # Validate/quote column names before creating temp objects or uploading.
+    # `$1:"field"` path syntax does not support IDENTIFIER(?) or ? bindings; always quote it.
+    # quote_identifiers only controls CREATE/COPY column lists (case-folding), not the parquet path.
+    snowflake_column_names = [
+        _sql_column_identifier(c, quote_identifiers) for c in df.columns
+    ]
+    parquet_field_names = [_quote_sql_identifier(c) for c in df.columns]
+    columns = ",".join(snowflake_column_names)
+
     cursor = conn.cursor()
     stage_location = await _create_temp_stage(
         cursor,
@@ -373,18 +385,6 @@ async def write_pandas(
                 options={"parallel": parallel, "source_compression": "auto_detect"},
             )
 
-    # in Snowflake, all parquet data is stored in a single column, $1, so we must select columns explicitly
-    # see (https://docs.snowflake.com/en/user-guide/script-data-load-transform-parquet.html)
-    if quote_identifiers:
-        quote = '"'
-        # if the column name contains a double quote, we need to escape it by replacing with two double quotes
-        # https://docs.snowflake.com/en/sql-reference/identifiers-syntax#double-quoted-identifiers
-        snowflake_column_names = [str(c).replace('"', '""') for c in df.columns]
-    else:
-        quote = ""
-        snowflake_column_names = list(df.columns)
-    columns = quote + f"{quote},{quote}".join(snowflake_column_names) + quote
-
     async def drop_object(name: str, object_type: str) -> None:
         drop_sql = f"DROP {object_type.upper()} IF EXISTS identifier(?) /* Python:snowflake.connector.aio._pandas_tools.write_pandas() */"
         params = (name,)
@@ -427,7 +427,7 @@ async def write_pandas(
         # columns in order
         create_table_columns = ", ".join(
             [
-                f"{quote}{snowflake_col}{quote} {column_type_mapping[col]}"
+                f"{snowflake_col} {column_type_mapping[col]}"
                 for snowflake_col, col in zip(snowflake_column_names, df.columns)
             ]
         )
@@ -468,8 +468,8 @@ async def write_pandas(
 
         # need explicit casting when the underlying table schema is inferred
         parquet_columns = "$1:" + ",$1:".join(
-            f"{quote}{snowflake_col}{quote}::{column_type_mapping[col]}"
-            for snowflake_col, col in zip(snowflake_column_names, df.columns)
+            f"{parquet_field}::{column_type_mapping[col]}"
+            for parquet_field, col in zip(parquet_field_names, df.columns)
         )
     else:
         target_table_location = build_location_helper(
@@ -478,9 +478,7 @@ async def write_pandas(
             name=table_name,
             quote_identifiers=quote_identifiers,
         )
-        parquet_columns = "$1:" + ",$1:".join(
-            f"{quote}{snowflake_col}{quote}" for snowflake_col in snowflake_column_names
-        )
+        parquet_columns = "$1:" + ",$1:".join(parquet_field_names)
 
     try:
         if overwrite and (not auto_create_table):

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.1}/src/snowflake/connector/aio/_result_batch.py

@@ -34,6 +34,7 @@ from snowflake.connector.result_batch import RemoteChunkInfo
 from snowflake.connector.result_batch import ResultBatch as ResultBatchSync
 from snowflake.connector.result_batch import (
     _create_nanoarrow_iterator,
+    _s3_request_id_log_suffix,
     inline_first_chunk_rowcount,
 )
 from snowflake.connector.secret_detector import SecretDetector
@@ -232,6 +233,7 @@ class ResultBatch(ResultBatchSync):
 
         content, encoding = None, None
         for retry in range(max(MAX_DOWNLOAD_RETRY, 1)):
+            amz_request_id_suffix = ""
             try:
 
                 async with TimerContextManager() as download_metric:
@@ -284,6 +286,7 @@ class ResultBatch(ResultBatchSync):
                         ) as session:
                             response, content, encoding = await download_chunk(session)
 
+                    amz_request_id_suffix = _s3_request_id_log_suffix(response)
                     if response.status == OK:
                         break
                     # Raise error here to correctly go in to exception clause
@@ -301,12 +304,18 @@ class ResultBatch(ResultBatchSync):
                 if retry == MAX_DOWNLOAD_RETRY - 1:
                     # Re-throw if we failed on the last retry
                     e = e.args[0] if isinstance(e, RetryRequest) else e
+                    logger.error(
+                        f"Failed to fetch the large result set batch "
+                        f"{self.id} after {MAX_DOWNLOAD_RETRY} attempts, "
+                        f"giving up for the reason: '{e}'{amz_request_id_suffix}",
+                        exc_info=True,
+                    )
                     raise e
                 sleep_timer = next(backoff)
-                logger.exception(
+                logger.warning(
                     f"Failed to fetch the large result set batch "
                     f"{self.id} for the {retry + 1} th time, "
-                    f"backing off for {sleep_timer}s for the reason: '{e}'"
+                    f"backing off for {sleep_timer}s for the reason: '{e}'{amz_request_id_suffix}"
                 )
                 await asyncio.sleep(sleep_timer)
 

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.1}/src/snowflake/connector/aio/_session_manager.py

@@ -44,7 +44,7 @@ class SnowflakeSSLConnector(aiohttp.TCPConnector):
     def __init__(
         self,
         *args,
-        snowflake_ocsp_mode: OCSPMode = OCSPMode.FAIL_OPEN,
+        snowflake_ocsp_mode: OCSPMode = OCSPMode.DISABLE_OCSP_CHECKS,
         session_manager: SessionManager | None = None,
         **kwargs,
     ):
@@ -139,7 +139,7 @@ class AioHttpConfig(BaseHttpConfig):
     """Trust environment variables for proxy configuration (HTTP_PROXY, HTTPS_PROXY, NO_PROXY).
     Required for proxy support set by proxy.set_proxies() in connection initialization."""
 
-    snowflake_ocsp_mode: OCSPMode = OCSPMode.FAIL_OPEN
+    snowflake_ocsp_mode: OCSPMode = OCSPMode.DISABLE_OCSP_CHECKS
     """OCSP validation mode obtained from connection._ocsp_mode()."""
 
     def get_connector(

{snowflake_connector_python-4.7.5 → snowflake_connector_python-4.8.1}/src/snowflake/connector/aio/_storage_client.py

@@ -104,6 +104,7 @@ class SnowflakeStorageClient(SnowflakeStorageClientSync):
         else:
             self.data_file = meta.real_src_file_name
         logger.debug("finished preprocessing")
+        self._compute_content_md5()
         if meta.upload_size < meta.multipart_threshold or not self.chunked_transfer:
             self.num_of_chunks = 1
         else: