snowflake-connector-python 5.0.0rc5__tar.gz → 5.1.0__tar.gz

{snowflake_connector_python-5.0.0rc5 → snowflake_connector_python-5.1.0}/Cargo.lock

@@ -2434,15 +2434,6 @@ dependencies = [
  "either",
 ]
 
-[[package]]
-name = "itertools"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1c173a5686ce8bfa551b3563d0c2170bf24ca44da99c7ca4bfdab5418c3fe57"
-dependencies = [
- "either",
-]
-
 [[package]]
 name = "itertools"
 version = "0.14.0"
@@ -3646,7 +3637,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "81bddcdb20abf9501610992b6759a4c888aef7d1a7247ef75e2404275ac24af1"
 dependencies = [
  "anyhow",
- "itertools 0.11.0",
+ "itertools 0.10.5",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -4230,9 +4221,7 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8572f3c2cb9934231157b45499fc41e1f58c589fdfb81a844ba873265e80f8eb"
+version = "0.103.16"
 dependencies = [
  "aws-lc-rs",
  "ring",
@@ -4423,6 +4412,7 @@ dependencies = [
  "async-trait",
  "aws-config",
  "aws-credential-types",
+ "aws-lc-fips-sys",
  "aws-lc-rs",
  "aws-runtime",
  "aws-sdk-s3",
@@ -4484,6 +4474,7 @@ dependencies = [
  "rustls",
  "rustls-native-certs",
  "rustls-pemfile",
+ "rustls-webpki",
  "scopeguard",
  "serde",
  "serde_json",
@@ -5599,9 +5590,9 @@ dependencies = [
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.2"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e8983c3ab33d6fb807cfcdad2491c4ea8cbc8ed839181c7dfd9c67c83e261b2"
+checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
 dependencies = [
  "rustls-pki-types",
 ]

{snowflake_connector_python-5.0.0rc5 → snowflake_connector_python-5.1.0}/Cargo.toml

@@ -21,3 +21,8 @@ resolver = "2"
 strip = true
 opt-level = "z"
 lto = false
+
+# Same override as the main workspace Cargo.toml. The sdist workspace does
+# not inherit that patch.
+[patch.crates-io]
+rustls-webpki = { path = "sf_core/third_party/rustls-webpki" }

{snowflake_connector_python-5.0.0rc5 → snowflake_connector_python-5.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: snowflake-connector-python
-Version: 5.0.0rc5
+Version: 5.1.0
 Summary: Snowflake DB driver for Python
 Project-URL: Homepage, https://github.com/snowflakedb/drivers
 Project-URL: Bug Reports, https://github.com/snowflakedb/drivers/issues
@@ -16,6 +16,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: Free Threading :: 2 - Beta
 Classifier: Topic :: Database
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.11
@@ -32,7 +33,7 @@ Requires-Dist: types-protobuf; extra == 'dev'
 Requires-Dist: types-pytz; extra == 'dev'
 Provides-Extra: pandas
 Requires-Dist: pandas<3.0.0,>=1.0.0; (python_version < '3.13') and extra == 'pandas'
-Requires-Dist: pandas>=2.1.2; (python_version >= '3.13') and extra == 'pandas'
+Requires-Dist: pandas<3.0.0,>=2.1.2; (python_version >= '3.13') and extra == 'pandas'
 Requires-Dist: pyarrow>=14.0.1; extra == 'pandas'
 Provides-Extra: pyarrow
 Requires-Dist: pyarrow>=14.0.1; extra == 'pyarrow'
@@ -58,9 +59,6 @@ Description-Content-Type: text/markdown
 
 # Snowflake Connector for Python
 
-> [!CAUTION]
-> This version of the driver is in public preview and is not ready for use with production data and may be unstable.
-
 This package includes the Snowflake Connector for Python, which conforms to the [Python DB API 2.0](https://www.python.org/dev/peps/pep-0249/) specification.
 
 The Snowflake Connector for Python provides an interface for developing Python
@@ -187,4 +185,4 @@ PYTHON_REFERENCE_DRIVER_VERSION='==4.3.0' hatch run reference:test
 ## References
 
 - [PEP 249 - Python Database API Specification v2.0](https://peps.python.org/pep-0249/)
-- [Python Database API Specification v2.0](https://www.python.org/dev/peps/pep-0249/) 
+- [Python Database API Specification v2.0](https://www.python.org/dev/peps/pep-0249/)

{snowflake_connector_python-5.0.0rc5 → snowflake_connector_python-5.1.0}/README.md

@@ -1,8 +1,5 @@
 # Snowflake Connector for Python
 
-> [!CAUTION]
-> This version of the driver is in public preview and is not ready for use with production data and may be unstable.
-
 This package includes the Snowflake Connector for Python, which conforms to the [Python DB API 2.0](https://www.python.org/dev/peps/pep-0249/) specification.
 
 The Snowflake Connector for Python provides an interface for developing Python
@@ -129,4 +126,4 @@ PYTHON_REFERENCE_DRIVER_VERSION='==4.3.0' hatch run reference:test
 ## References
 
 - [PEP 249 - Python Database API Specification v2.0](https://peps.python.org/pep-0249/)
-- [Python Database API Specification v2.0](https://www.python.org/dev/peps/pep-0249/) 
+- [Python Database API Specification v2.0](https://www.python.org/dev/peps/pep-0249/)

{snowflake_connector_python-5.0.0rc5 → snowflake_connector_python-5.1.0}/hatch_build.py

@@ -125,15 +125,38 @@ class BuildHook(BuildHookInterface):
         build_data["pure_python"] = False
         build_data["infer_tag"] = True
 
+    def _fips_requested(self) -> bool:
+        """Return whether this build should link the FIPS module.
+
+        ``SNOWFLAKE_FIPS`` applies only when the project root is an unpacked
+        sdist (it carries ``PKG-INFO``). A checkout, an editable install, or a
+        wheel build fails when the variable is set.
+        """
+        if os.environ.get("SNOWFLAKE_FIPS", "").lower() not in ("1", "true"):
+            return False
+        if (Path(self.root) / "PKG-INFO").is_file():
+            return True
+        raise RuntimeError(
+            "SNOWFLAKE_FIPS is set, but this build is not an unpacked sdist "
+            "(PKG-INFO is absent). The variable applies only to an sdist install."
+        )
+
     def _select_core_extension(self, build_data: dict[str, Any]) -> None:
         """Force-include only the sf_core_python binary matching this interpreter."""
         ext_name = f"sf_core_python{sysconfig.get_config_var('EXT_SUFFIX')}"
-        core_ext = Path(self.root) / "src" / "snowflake" / "connector" / "_core" / ext_name
+        core_dir = Path(self.root) / "src" / "snowflake" / "connector" / "_core"
+        core_ext = core_dir / ext_name
         if not core_ext.is_file():
             return
-        build_data.setdefault("force_include", {})[str(core_ext)] = (
-            f"snowflake/connector/_core/{ext_name}"
-        )
+        force_include = build_data.setdefault("force_include", {})
+        force_include[str(core_ext)] = f"snowflake/connector/_core/{ext_name}"
+        # macOS and Windows sdist installs link shared aws-lc libraries that
+        # must ship beside the extension. Linux links that module statically.
+        if not self._fips_requested():
+            return
+        for lib in core_dir.iterdir():
+            if lib.is_file() and "aws_lc_fips" in lib.name and lib.suffix in (".dylib", ".so", ".dll"):
+                force_include[str(lib)] = f"snowflake/connector/_core/{lib.name}"
 
     def _generate_protobuf(self) -> None:
         """Generate Python protobuf code using the Rust proto_generator binary."""
@@ -146,8 +169,7 @@ class BuildHook(BuildHookInterface):
 
         if not proto_input.exists():
             raise RuntimeError(
-                f"Proto file not found at {proto_input}. "
-                "Cannot build package without protobuf definitions."
+                f"Proto file not found at {proto_input}. Cannot build package without protobuf definitions."
             )
 
         cargo_manifest = python_dir / "Cargo.toml"
@@ -156,8 +178,7 @@ class BuildHook(BuildHookInterface):
             # Rust toolchain), fall back to previously generated files if they exist.
             if any(protobuf_gen_dir.glob("*_pb2.py")):
                 warnings.warn(
-                    "Cargo.toml not found; skipping protobuf regeneration. "
-                    "Using previously generated protobuf files.",
+                    "Cargo.toml not found; skipping protobuf regeneration. Using previously generated protobuf files.",
                     stacklevel=1,
                 )
                 return
@@ -315,11 +336,13 @@ class BuildHook(BuildHookInterface):
                     # Suppress warnings for vendored/generated C files (Unix only, GCC/Clang flags)
                     if is_unix and src.endswith(vendored_c_files):
                         extra_postargs = list(extra_postargs)
-                        extra_postargs.extend([
-                            "-Wno-unused-variable",
-                            "-Wno-unused-const-variable",
-                            "-Wno-unreachable-code",
-                        ])
+                        extra_postargs.extend(
+                            [
+                                "-Wno-unused-variable",
+                                "-Wno-unused-const-variable",
+                                "-Wno-unreachable-code",
+                            ]
+                        )
                     return original_compile(obj, src, ext_arg, cc_args, extra_postargs, pp_opts)
 
                 self.compiler._compile = new_compile
@@ -344,7 +367,6 @@ class BuildHook(BuildHookInterface):
         Produces a version-tagged ``sf_core_python.<EXT_SUFFIX>`` native
         extension (e.g. ``.cpython-313-darwin.so`` / ``.cp313-win_amd64.pyd``).
         """
-
         if os.environ.get("SKIP_CORE_BUILD", "").lower() in self.POSITIVE_VALUES:
             return
 
@@ -380,6 +402,9 @@ class BuildHook(BuildHookInterface):
         if os.environ.get("SF_PERF_METRICS", "").lower() in ("1", "true"):
             extra_cargo_args.extend(["--features", "sf_core/perf_timing"])
 
+        if self._fips_requested():
+            extra_cargo_args.extend(["--features", "fips"])
+
         # Use a stable target dir when CORE_CARGO_TARGET_DIR is set (enables
         # incremental Rust compilation and CI caching). Otherwise fall back to a
         # temporary directory that is cleaned up after the build.
@@ -461,9 +486,24 @@ class BuildHook(BuildHookInterface):
                 found_core = True
                 break
             if not found_core:
-                raise Exception(
-                    f"No sf_core_python shared library (.dll/.so/.dylib) found in {release_dir}"
-                )
+                raise Exception(f"No sf_core_python shared library (.dll/.so/.dylib) found in {release_dir}")
+
+            # aws-lc-fips-sys emits its shared libraries under release/build/, not
+            # release/. Copy those by name; do not bundle the rest of the tree.
+            copied_fips: set[str] = set()
+            if self._fips_requested():
+                for lib in release_dir.rglob("*"):
+                    if not lib.is_file() or "aws_lc_fips" not in lib.name:
+                        continue
+                    if lib.suffix not in (".dylib", ".so", ".dll") or lib.name in copied_fips:
+                        continue
+                    copied_fips.add(lib.name)
+                    lib_tmp = target_dir / (lib.name + ".tmp")
+                    shutil.copy2(lib, lib_tmp)
+                    os.replace(lib_tmp, target_dir / lib.name)
+            for old in target_dir.iterdir():
+                if old.is_file() and "aws_lc_fips" in old.name and old.name not in copied_fips:
+                    old.unlink()
 
             # No OpenSSL DLLs are bundled next to sf_core_python. The driver
             # stopped linking OpenSSL entirely; `openssl` survives only as an

{snowflake_connector_python-5.0.0rc5 → snowflake_connector_python-5.1.0}/protobuf/database_driver_v1.proto

@@ -302,6 +302,7 @@ message WrapperIdentity {
   optional string language_version = 4;
   optional string language_compiler = 5;
   optional string release_type = 6;
+  optional string application_path = 7;
 }
 
 message ConnectionInitRequest {
@@ -1029,15 +1030,13 @@ message ConfigGetPathsResponse {
   string connections_file = 2;
 }
 
-// Reports this build's linked TLS provider only. These fields do not establish
-// that every operation or the complete driver artifact is FIPS compliant.
-message DriverGetTlsStatusRequest {}
+// Reports whether this process is the FIPS driver. Does not open a connection.
+message DriverGetFipsStatusRequest {}
 
-message DriverGetTlsStatusResponse {
-  // Rustls's FIPS verdict for the linked TLS crypto provider.
-  bool tls_provider_is_fips = 1;
-  // Whether sf_core was compiled with the fips-tls feature.
-  bool fips_tls_build_enabled = 2;
+message DriverGetFipsStatusResponse {
+  // True when this binary was built with the fips feature and its linked TLS
+  // provider is in FIPS mode. A standard build returns false.
+  bool is_fips = 1;
 }
 
 // =============================================================================
@@ -1064,6 +1063,8 @@ message WifCreateAttestationRequest {
   // of the default pre-signed GetCallerIdentity attestation. Takes precedence
   // over SNOWFLAKE_ENABLE_AWS_WIF_OUTBOUND_TOKEN.
   optional bool aws_use_outbound_token = 5;
+  // AWS STS hostname override. Empty/unset uses the regional STS default.
+  optional string wif_host = 6;
 }
 
 message WifCreateAttestationResponse {
@@ -1107,7 +1108,7 @@ message TelemetrySendLogRequest {
 service DatabaseDriver {
   option (service_error) = "DriverException";
   // Available without a database or connection handle, even in standard builds.
-  rpc DriverGetTlsStatus(DriverGetTlsStatusRequest) returns (DriverGetTlsStatusResponse);
+  rpc DriverGetFipsStatus(DriverGetFipsStatusRequest) returns (DriverGetFipsStatusResponse);
 
   // Database operations
   rpc DatabaseNew(DatabaseNewRequest) returns (DatabaseNewResponse);

{snowflake_connector_python-5.0.0rc5 → snowflake_connector_python-5.1.0}/pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["hatchling", "editables", "Cython", "setuptools", "mypy-protobuf~=5.0"]
+requires = ["hatchling", "editables", "Cython>=3.1", "setuptools", "mypy-protobuf~=5.0"]
 build-backend = "hatchling.build"
 
 [project]
@@ -20,6 +20,7 @@ classifiers = [
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
     "Programming Language :: Python :: 3.14",
+    "Programming Language :: Python :: Free Threading :: 2 - Beta",
 ]
 requires-python = ">=3.11"
 dependencies = [
@@ -47,7 +48,7 @@ pyarrow = [
 pandas = [
     "pyarrow>=14.0.1",
     "pandas>=1.0.0,<3.0.0; python_version < '3.13'",
-    "pandas>=2.1.2; python_version >= '3.13'",
+    "pandas>=2.1.2,<3.0.0; python_version >= '3.13'",
 ]
 test = [
     "pytest>=8",
@@ -102,6 +103,7 @@ exclude = [
     "src/snowflake/connector/_internal/nanoarrow_cpp/scripts",
     # Exclude Rust build artifacts
     "sf_core/target/",
+    "sf_core/third_party/rustls-webpki/target/",
     "python_bridge/target/",
     "sf_params_spec/target/",
     "sf_types/target/",
@@ -110,6 +112,9 @@ exclude = [
     "sf_core/tests/e2e/",
     "sf_core/tests/integration/",
     "sf_core/tests/*.rs",
+    # Vendored rustls-webpki unit-test fixtures. The library build does not read them.
+    "sf_core/third_party/rustls-webpki/tests/",
+    "sf_core/third_party/rustls-webpki/third-party/",
 ]
 
 # Individual files need force-include (file symlinks are not dereferenced)
@@ -117,6 +122,7 @@ exclude = [
 "Cargo.toml.sdist" = "Cargo.toml"
 "Cargo.lock.sdist" = "Cargo.lock"
 "../build_common.rs" = "build_common.rs"
+"../rust-toolchain.toml" = "rust-toolchain.toml"
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/snowflake"]
@@ -289,7 +295,7 @@ fix = [
 skip-install = false
 dev-mode = true
 dependencies = [
-    "Cython",
+    "Cython>=3.1",
     "setuptools",
 ]
 
@@ -300,7 +306,7 @@ PARAMETER_PATH = "{env:PARAMETER_PATH:../parameters.json}"
 SKIP_CORE_BUILD = "{env:SKIP_CORE_BUILD:1}"
 
 [[tool.hatch.envs.dev.matrix]]
-python = ["3.11", "3.12", "3.13", "3.14"]
+python = ["3.11", "3.12", "3.13", "3.14", "3.14t"]
 
 [tool.hatch.envs.dev.scripts]
 # Per-test retries come from addopts --reruns 2 (not a second whole-suite run).
@@ -323,7 +329,7 @@ skip-install = true
 dev-mode = false
 
 [[tool.hatch.envs.test.matrix]]
-python = ["3.11", "3.12", "3.13", "3.14"]
+python = ["3.11", "3.12", "3.13", "3.14", "3.14t"]
 
 [tool.hatch.envs.test.scripts]
 # Install from wheel
@@ -345,7 +351,7 @@ no_mfa = "pytest tests/e2e/authentication/test_user_password.py -m requires_no_m
 template = "test"
 
 [[tool.hatch.envs.test-native-arrow.matrix]]
-python = ["3.13"]
+python = ["3.13", "3.14t"]
 
 [tool.hatch.envs.test-native-arrow.env-vars]
 SNOWFLAKE_TEST_USE_CORE_ARROW = "1"
@@ -356,7 +362,7 @@ template = "test"
 features = ["test", "dev", "pandas"]
 
 [[tool.hatch.envs.test-pandas.matrix]]
-python = ["3.11", "3.12", "3.13", "3.14"]
+python = ["3.11", "3.12", "3.13", "3.14", "3.14t"]
 
 [tool.hatch.envs.test-pandas.scripts]
 cov = "pytest tests/e2e/pandas tests/e2e/numpy --cov=src/snowflake --cov-report=xml --cov-report=html {args}"
@@ -365,7 +371,7 @@ cov = "pytest tests/e2e/pandas tests/e2e/numpy --cov=src/snowflake --cov-report=
 [tool.hatch.envs.packaging]
 features = ["test"]
 installer = "uv"
-extra-dependencies = ["build"]
+extra-dependencies = ["build", "hatchling"]
 
 [[tool.hatch.envs.packaging.matrix]]
 python = ["3.13"]

{snowflake_connector_python-5.0.0rc5 → snowflake_connector_python-5.1.0}/python_bridge/Cargo.toml

@@ -11,12 +11,7 @@ crate-type = ["cdylib", "rlib"]
 default = ["extension-module", "native-arrow"]
 extension-module = ["pyo3/extension-module"]
 native-arrow = ["dep:arrow", "dep:snafu", "dep:error_trace", "dep:sf_types", "dep:chrono", "pyo3/chrono"]
-# Links the FIPS-mode crypto module (aws-lc-fips-sys) instead of
-# aws-lc-sys. Despite the name it is no longer TLS-only: JWT signing, DPoP,
-# stage file encryption and private-key parsing now run on the same module. The
-# name and the caveat both stand -- see the `fips-tls` feature comment in
-# sf_core/Cargo.toml for why this is still not a FIPS artifact on its own.
-fips-tls = ["sf_core/fips-tls"]
+fips = ["sf_core/fips"]
 
 [dependencies]
 arrow = { version = ">=54.0.0, <59", features = ["ffi"], optional = true }

{snowflake_connector_python-5.0.0rc5 → snowflake_connector_python-5.1.0}/python_bridge/build.rs

@@ -2,8 +2,11 @@ fn main() {
     // On macOS, Python extension modules leave Python symbols undefined at
     // link time - they are resolved at load time by the interpreter. Without
     // this flag the linker rejects the build with "symbol(s) not found".
+    // FIPS builds also link shared aws-lc libraries whose install name is
+    // `@rpath`, so the extension looks beside itself.
     if std::env::var("CARGO_CFG_TARGET_OS").as_deref() == Ok("macos") {
         println!("cargo:rustc-cdylib-link-arg=-undefined");
         println!("cargo:rustc-cdylib-link-arg=dynamic_lookup");
+        println!("cargo:rustc-cdylib-link-arg=-Wl,-rpath,@loader_path");
     }
 }

{snowflake_connector_python-5.0.0rc5 → snowflake_connector_python-5.1.0}/python_bridge/src/lib.rs

@@ -262,7 +262,7 @@ fn native_arrow_enabled() -> bool {
     cfg!(feature = "native-arrow")
 }
 
-#[pymodule]
+#[pymodule(gil_used = false)]
 fn sf_core_python(m: &Bound<'_, PyModule>) -> PyResult<()> {
     m.add_function(wrap_pyfunction!(init, m)?)?;
     m.add_function(wrap_pyfunction!(log_event, m)?)?;

snowflake_connector_python-5.1.0/rust-toolchain.toml

@@ -0,0 +1,4 @@
+[toolchain]
+channel = "1.94.1"
+components = ["clippy", "rustfmt"]
+profile = "minimal"

{snowflake_connector_python-5.0.0rc5 → snowflake_connector_python-5.1.0}/sf_core/CHANGELOG.md

@@ -4,13 +4,17 @@
 
 New features:
 
+- Added a `wif_host` connection parameter that sets the AWS STS endpoint for Workload Identity Federation, including the pre-signed GetCallerIdentity request, AssumeRole impersonation, and outbound GetWebIdentityToken; unset keeps the AWS SDK regional STS hostname. (snowflakedb/drivers#2439)
+- Added JDBC aliases `wifHost`, `workloadIdentityHost`, and `workload_identity_host`, a Python alias `workload_identity_host`, and a Node.js alias `wifHost` for the `wif_host` connection parameter. (snowflakedb/drivers#2439)
 - Added `workload_identity_azure_client_id` so Azure WIF can select a user-assigned managed identity from a connection option, with `MANAGED_IDENTITY_CLIENT_ID` as fallback. (snowflakedb/drivers#2226)
 - Added PAT-with-external-session authentication (`authenticator=PAT_WITH_EXTERNAL_SESSION`) so a programmatic access token plus `external_session_id` can reuse a server-side session without a login request, sending `Authorization: Bearer` and `X-Snowflake-External-Session-ID` on subsequent requests. (snowflakedb/drivers#1996)
-- Added a connection-free TLS status API and protobuf RPC that report whether the linked rustls TLS provider is in FIPS mode and whether this build enabled `fips-tls`. Neither field claims validated-module or whole-driver FIPS compliance. (snowflakedb/drivers#1355)
+- Added `APPLICATION_PATH` to the login `CLIENT_ENVIRONMENT` payload. Wrappers pass it through `WrapperIdentity.application_path`. An unset or blank path is reported as `UNKNOWN`. (snowflakedb/drivers#2535)
+- Added a connection-free status call that reports whether this process is the FIPS driver. Python `get_fips_status()`, JDBC `getFipsStatus()`, Node.js `getFipsStatus()`, .NET `GetFipsStatus()`, and ODBC `SFGetFipsStatus` return the same `is_fips` value. (snowflakedb/drivers#2562)
 - Added Duo push continuation for username/password MFA so a pending Duo challenge can wait for device approval and then finish login. (snowflakedb/drivers#2021)
 - Added a Python `platform_detection_timeout_seconds` connection parameter that limits each cloud-metadata platform check. Setting it to `0` skips those HTTP and STS queries and keeps only environment-based detection, matching the legacy Python connector. (snowflakedb/drivers#2186)
 - Added Azure blob Content-MD5 on PUT (single Put Blob and Put Block List), hashed in the same streaming pass as SHA-256 and over ciphertext when client-side encryption is on. (snowflakedb/drivers#2232)
-- Added an opt-in `fips-tls` build that routes TLS through AWS-LC-FIPS and fails closed if a non-FIPS crypto provider is active. (snowflakedb/drivers#2055)
+- Added an opt-in `fips` build that routes TLS through AWS-LC-FIPS and fails closed if a non-FIPS crypto provider is active. (snowflakedb/drivers#2055)
+- Added a Python source-distribution install with `SNOWFLAKE_FIPS=1` that links the FIPS module, so `snowflake.connector.get_fips_status()` reports `is_fips` as true. (snowflakedb/drivers#2489)
 - Added `IS_FIPS` to the login `CLIENT_ENVIRONMENT` payload so Snowflake can tell whether the driver's linked TLS provider is FIPS-approved. (snowflakedb/drivers#2384)
 - Added a `put_compress_level` connection setting that selects the gzip level (0–9) used when PUT AUTO_COMPRESS rewrites a file. (snowflakedb/drivers#2083)
 - Added a `put_tempdir` connection setting that selects the directory for gzip tempfiles created by PUT AUTO_COMPRESS. Unset and empty values keep the process temp directory. Nested directories are created. (snowflakedb/drivers#2084)
@@ -48,10 +52,20 @@ New features:
 - Added `RustTransport::database_driver()` so an in-process wrapper can call `result_set_get_async_stream` without boxing the result as a C stream pointer. (snowflakedb/drivers#1949)
 - Added file-level parallelism to PUT and GET: a multi-file transfer now uploads or downloads several files at once instead of one at a time, bounded by the statement's `PARALLEL` value, and result rows keep their original file order. Fail-fast now lets files already in flight (up to `PARALLEL` of them) finish and land on the stage after the first error, instead of stopping after only the current file. (snowflakedb/drivers#1451)
 - Added the `FILE` (18), `INTERVAL_YEAR_MONTH` (19) and `INTERVAL_DAY_TIME` (20) type codes to the Python type-code table, matching legacy `snowflake-connector-python`. Columns of these types previously reported as `TEXT` in `cursor.description`. (snowflakedb/drivers#1697)
+- Added `ApiError::terminates_session()` so an in-process wrapper can tell from the error alone that `connection_is_usable` now reports the connection as terminated. (snowflakedb/drivers#2696)
 
 Changes:
 
-- Changed a `fips-tls` build to reject a private key encrypted with 3DES-CBC and to name `openssl pkcs8 -topk8 -v2 aes-256-cbc` as the conversion, while a standard build still unwraps those keys (snowflakedb/drivers#2488).
+- Changed login to omit `CLIENT_SESSION_KEEP_ALIVE` and `CLIENT_PREFETCH_THREADS` unless the caller sets them. (snowflakedb/drivers#2728)
+- Changed login to send `CLIENT_SESSION_KEEP_ALIVE`, `CLIENT_PREFETCH_THREADS`, `QUERY_TAG`, and a heartbeat frequency clamped to 900–3600 seconds as session parameters, and to send a set `validate_default_parameters` value, true or false, as `CLIENT_VALIDATE_DEFAULT_PARAMETERS`, leaving that parameter off the login request when it is unset. (snowflakedb/drivers#2722)
+- Improved connection setup time by loading system root certificates once per driver instead of on every connection. OS trust changes after the first connection apply on process restart. (snowflakedb/drivers#2586)
+- Changed a Python build with `SNOWFLAKE_FIPS` set outside an unpacked source distribution to fail instead of linking the standard module. (snowflakedb/drivers#2489)
+- Standardized the opt-in build feature as `fips` and build/test environment variables as `SF_CORE_FIPS` and `SF_CORE_EXPECT_FIPS`. (SNOW-3927213)
+- Pinned `fips` builds to AWS-LC FIPS 3.6.0 (`aws-lc-fips-sys 0.13.17`) and added runtime module-version diagnostics and a FIPS smoke assertion. (SNOW-3927213)
+- Changed `fips` builds to reject `verify_certificates=false` and `tls_skip_verify=true`; standard builds still allow these insecure settings. Consequently, `NODE_TLS_REJECT_UNAUTHORIZED=0` now fails connection in FIPS Node builds. HTTPS CRL downloads now use the linked crypto module explicitly, preserving default trust and proxy behavior. (SNOW-3927213)
+- Changed a `fips` build to reject a private key encrypted with 3DES-CBC and to name `openssl pkcs8 -topk8 -v2 aes-256-cbc` as the conversion, while a standard build still unwraps those keys (snowflakedb/drivers#2488).
+- Expanded the `fips` smoke lane to cover in-module crypto unit paths, negotiated TLS suites, AES-encrypted key-pair login, rejection of 3DES and legacy PEM keys, and multi-chunk query downloads on AWS, Azure and GCP. (SNOW-3927213)
+- Changed the Python connector so it reads `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` unless `use_proxy_env` is set to false. (snowflakedb/drivers#2579)
 - Changed platform detection to run by default, once per driver in the background, and to report the result as in-band `platform_detection_status` telemetry when a session closes instead of in the login request. Connect never waits for detection, and a session that closes before detection finishes reports nothing. Each probe is limited to 2 seconds, so `platform_detection_timeout_seconds` is still accepted but no longer has an effect. `SNOWFLAKE_EXPERIMENTAL_ENABLE_PLATFORM_DETECTION` is removed; `SNOWFLAKE_DISABLE_PLATFORM_DETECTION` still turns detection off. (snowflakedb/drivers#2399)
 - Changed verified connection and cloud-storage TLS clients to select the configured crypto module's rustls provider explicitly, including CRL-enabled clients, instead of depending on process-global provider initialization order. Inverted TLS version bounds now fail rather than restoring default protocols. (snowflakedb/drivers#1356)
 - Routed first-party SHA-256 hashing for CRL cache filenames, token-cache keys, S3 credential fingerprints, and certificate-name map keys through AWS-LC. Their stored key formats remain unchanged. (snowflakedb/drivers#1352)
@@ -61,10 +75,17 @@ Changes:
 - Changed `client_store_temporary_credential` to default to true when the caller has not set it. An explicit value always wins. (snowflakedb/drivers#2057)
 - Added a `validate_session_token` wrapper preset, on for every wrapper but Node.js. When off, a login with pre-acquired session and master tokens adopts the pair as handed over instead of proving it with a token-request RENEW first, so the pair is not rotated and adopting it costs no round-trip. Such a connection has no server-reported session id and therefore emits no per-operation telemetry; authentication, queries and logout are unaffected. This restores the legacy `snowflake-connector-nodejs` `deserializeConnection` contract. (snowflakedb/drivers#2042)
 - Changed the session-parameter cache to read `ALTER SESSION SET` values out of the submitted SQL for Python only. Every other wrapper now updates the cache from the parameters a query response carries, so `ConnectionGetParameter` and `ConnectionGetAllParameters` no longer report a parameter the server did not echo back. (snowflakedb/drivers#2080)
+- Changed TLS certificate checks for RUSTSEC-2026-0382 by updating bundled root certificates and distrusting compromised intermediate Certificate Authority (CA) certificates. (snowflakedb/drivers#2859)
 - Changed the message on a failed login to carry the server's own text: `ApiError::Login` renders as `Failed to login: <server text>` instead of a bare `Failed to login`, and for coded server errors as `Failed to login: Login error: <server text>, code: <code>`. The server sentence previously reached applications only through the error trace. This is what `DriverException.message` carries; error kinds, vendor codes and SQLSTATEs are unchanged. (snowflakedb/drivers#1881)
 
 Bug fixes:
 
+- Fixed statement-level TIMEZONE overrides so a registered TIMEZONE can be set on a statement and is sent on the query request. (snowflakedb/drivers#2753)
+- Fixed Python `Cursor.request_id` to return a `uuid.UUID` when a request id is present and `None` otherwise. `Cursor._request_id` returns that same value and warns on use. (snowflakedb/drivers#2594)
+- Fixed PAT_WITH_EXTERNAL_SESSION connections always failing `connection_heartbeat` / `isValid` checks because the driver sent a Snowflake session-token heartbeat instead of `Authorization: Bearer` and `X-Snowflake-External-Session-ID`. (snowflakedb/drivers#2600)
+- Fixed Python `cursor.executemany()` so it accepts `num_statements` and applies that count to each statement, matching the v4 driver. (snowflakedb/drivers#2541)
+- Fixed `sf.odbc.ini` discovery treating a candidate path that is a directory (or otherwise not a regular file) as a match and aborting the search, instead of skipping it and trying the next candidate; a `SF_ODBC_INI` pointing at a directory no longer hides the standard per-user `sf.odbc.ini`. (snowflakedb/drivers#2591)
+- Fixed UNLOAD and PARTITIONED_UNLOAD so they are classified as cursor results. ODBC and Python report the file count as `rows_affected`. JDBC and Node.js store 0 on that field; JDBC `getUpdateCount` stays 0 for a plain unload, and Node.js `getNumUpdatedRows` stays -1. (snowflakedb/drivers#2625)
 - Fixed JDBC I/O errors so a failed stage upload, a failed stage download, a full local disk during a transfer, and a network failure each report the vendor code and SQLState the previous JDBC driver uses for that failure. A disabled file transfer still reports no vendor code. (snowflakedb/drivers#2507)
 - Improved configuration errors for PAT with external session so an invalid `external_session_id` is reported without echoing the supplied identifier. (snowflakedb/drivers#1996)
 - Fixed Python `cursor.description` reporting GEOGRAPHY and GEOMETRY columns as OBJECT when the server sent those names in a separate extended type field. (snowflakedb/drivers#2326)
@@ -121,11 +142,21 @@ Internal improvements:
 - Raised the default multipart block size for PUT uploads to internal Azure stages from 4 MiB to 8 MiB, matching the S3/GCS default and improving throughput for typical file sizes.
 - Response-body reads for the OAuth token exchange and GCP metadata server now stream against a fixed size limit using a running byte count (shared `read_body_capped` helper) rather than relying on the advertised `Content-Length`. (snowflakedb/drivers#1053)
 - Improved on-disk CRL cache file handling: cache files are written with owner-only permissions and each cache entry is read through a single file handle. (snowflakedb/drivers#1056)
-- Changed `SessionTokens.session_id` to `Option<i64>` so a token pair the server has not yet reported a session id for is no longer carried as `0`. A connection without a session id is left out of the telemetry registry instead of being filed under a placeholder id. (snowflakedb/drivers#2041)
+- Changed `SessionTokens.session_id` to `Option<i64>` so a token pair the server has not yet reported a session id for is no longer carried as `0`. (snowflakedb/drivers#2041)
 
 Internal changes:
 
+- Applied an omitted `use_proxy_env` from the wrapper preset, true for Python and Node.js and false otherwise, so a connection profile or an explicit value wins over that preset. (snowflakedb/drivers#2650)
+- Added hot-swappable file logging: `LogManager` exposes a `LogReloadHandle` that re-applies the core and troubleshooting file sinks (log level and destination path) in place, without rebuilding the tracing dispatch, session registry, or negotiated encoding, so a wrapper can re-read its logging configuration at runtime. (snowflakedb/drivers#2588)
 - Moved CRL cache and background refresh onto the driver so the last driver drop cancels and joins the `crl-refresh` thread. (snowflakedb/drivers#2429)
+- Keyed telemetry by connection handle instead of session id and added the session id to span entries at send time, so a connection that adopted session tokens without a session id now sends telemetry. (snowflakedb/drivers#2607)
+- Removed OCSP_MODE from the login CLIENT_ENVIRONMENT payload and from connection diagnostics. The driver does not perform OCSP; certificate revocation continues to be reported as CERT_REVOCATION_CHECK_MODE. (snowflakedb/drivers#2724)
+- Changed the platform-detection and Workload Identity attestation clients to reuse the driver's cached system root certificates, and stopped the plain-HTTP IMDS region lookup from loading the OS trust store. (snowflakedb/drivers#2690)
+- Removed the synchronous default-TLS client builder. Auxiliary clients build from a root-store snapshot. (snowflakedb/drivers#2690)
+- Narrowed platform detection's config and entry point to crate visibility. (snowflakedb/drivers#2690)
+- Changed the CRL download client to reuse the driver's cached system root certificates. (snowflakedb/drivers#2691)
+- Changed custom-CA revocation checks to load system root certificates on a blocking thread, and only for the first CRL cache. (snowflakedb/drivers#2691)
+- Changed storage clients to retry a failed system root certificate load on a blocking thread. (snowflakedb/drivers#2706)
 
 Test improvements: