snowflake-connector-python 5.1.0__tar.gz → 5.2.0__tar.gz

{snowflake_connector_python-5.1.0 → snowflake_connector_python-5.2.0}/Cargo.lock

@@ -1980,9 +1980,9 @@ checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
 
 [[package]]
 name = "h2"
-version = "0.4.12"
+version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c0b69cfcb4e1b9f1bf2f53f95f766e4661169728ec61cd3fe5a0166f2d1386"
+checksum = "839c0e8a181239723652be9062bb56ca5bf5f64011f73b623f6f4fc59086a228"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -4441,6 +4441,7 @@ dependencies = [
  "fs2",
  "futures",
  "glob",
+ "h2",
  "hex",
  "html-escape",
  "http 1.3.1",

{snowflake_connector_python-5.1.0 → snowflake_connector_python-5.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: snowflake-connector-python
-Version: 5.1.0
+Version: 5.2.0
 Summary: Snowflake DB driver for Python
 Project-URL: Homepage, https://github.com/snowflakedb/drivers
 Project-URL: Bug Reports, https://github.com/snowflakedb/drivers/issues
@@ -16,6 +16,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Classifier: Programming Language :: Python :: Free Threading :: 2 - Beta
 Classifier: Topic :: Database
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
@@ -32,8 +33,9 @@ Requires-Dist: ruff; extra == 'dev'
 Requires-Dist: types-protobuf; extra == 'dev'
 Requires-Dist: types-pytz; extra == 'dev'
 Provides-Extra: pandas
-Requires-Dist: pandas<3.0.0,>=1.0.0; (python_version < '3.13') and extra == 'pandas'
-Requires-Dist: pandas<3.0.0,>=2.1.2; (python_version >= '3.13') and extra == 'pandas'
+Requires-Dist: pandas>=1.0.0; (python_version < '3.13') and extra == 'pandas'
+Requires-Dist: pandas>=2.1.2; (python_version >= '3.13' and python_version < '3.15') and extra == 'pandas'
+Requires-Dist: pandas>=3.0.0; (python_version >= '3.15') and extra == 'pandas'
 Requires-Dist: pyarrow>=14.0.1; extra == 'pandas'
 Provides-Extra: pyarrow
 Requires-Dist: pyarrow>=14.0.1; extra == 'pyarrow'
@@ -113,7 +115,7 @@ The `dev` environment is designed for **human developers** during active develop
 - Installs from sources (`skip-install = false`)
 - Editable mode enabled (`dev-mode = true`)
 - Changes to source code are immediately available
-- Supports Python matrix: 3.11, 3.12, 3.13, 3.14
+- Supports Python matrix: 3.11, 3.12, 3.13, 3.14, 3.15, 3.15t
 
 **Usage:**
 ```bash

{snowflake_connector_python-5.1.0 → snowflake_connector_python-5.2.0}/README.md

@@ -54,7 +54,7 @@ The `dev` environment is designed for **human developers** during active develop
 - Installs from sources (`skip-install = false`)
 - Editable mode enabled (`dev-mode = true`)
 - Changes to source code are immediately available
-- Supports Python matrix: 3.11, 3.12, 3.13, 3.14
+- Supports Python matrix: 3.11, 3.12, 3.13, 3.14, 3.15, 3.15t
 
 **Usage:**
 ```bash

{snowflake_connector_python-5.1.0 → snowflake_connector_python-5.2.0}/proto_generator/src/protoc_installer.rs

@@ -76,34 +76,24 @@ fn download_and_install(dest: &Path) {
     std::fs::create_dir_all(dest).expect("Failed to create protoc cache directory");
     let zip_path = dest.join("protoc.zip");
 
-    // Two layers of retry guard the build against transient GitHub Releases failures
-    // (recurring HTTP 5xx, slow connect, partial download):
+    // Two layers of retry guard the build against transient GitHub Releases
+    // failures (HTTP 5xx, 403 under `--fail`, slow connect, partial download):
     //
-    //   1. `curl --retry 5` already covers the failure mode we actually see —
-    //      curl's documented default treats HTTP 408/429/500/502/503/504 as
-    //      transient and retries them with its own backoff, so a 504 from
-    //      releases.githubusercontent.com is absorbed inside a single curl
-    //      invocation without any extra flags. We intentionally do NOT pass
-    //      `--retry-all-errors` (added in curl 7.71): the manylinux build
-    //      container ships an older curl that hard-errors on unknown options
-    //      (exit 2), which would push every attempt into the outer loop and
-    //      effectively disable retries. Sticking to flags supported back to
-    //      ~7.52 (`--retry`, `--retry-delay`, `--retry-max-time`, plus the
-    //      connect/total timeouts) keeps every CI runner (macOS-15, ubuntu-24,
-    //      Windows-2022, manylinux_2_*) on the same code path.
+    //   1. `curl --retry 5` covers curl's default retry set (408/429/5xx).
+    //      SNOW-4350375: a GitHub Releases 403 exits 22 under `--fail` and is
+    //      not in that set. `--retry-all-errors` (curl >= 7.71) covers it.
+    //      manylinux's older curl hard-errors on unknown options (exit 2), so
+    //      the flag is passed only when `curl --version` reports >= 7.71.
     //
-    //   2. An outer exponential-backoff loop (1s → 2s → 4s → 8s, 5 attempts total)
-    //      catches the failures curl's own retry doesn't: partial downloads that
-    //      leave a corrupt zip on disk, transient DNS/SSL handshake errors that
-    //      curl exits on without retrying, and any future failure class we
-    //      haven't enumerated. Each outer attempt starts by deleting the
-    //      previous zip so extract_zip never sees a half-written file.
-    //
-    // Total worst-case stall ≈ 1+2+4+8 = 15s of outer backoff plus curl's
-    // internal retry budget (capped by --retry-max-time at 120s) — well under
-    // any CI job budget, and far cheaper than rerunning the whole release
-    // pipeline on a 504.
+    //   2. An outer exponential-backoff loop (1s → 2s → 4s → 8s, 5 attempts)
+    //      catches partial downloads, DNS/SSL handshake errors, and 403s that
+    //      still exhaust curl's inner retry. Each outer attempt deletes the
+    //      previous zip so extract_zip never sees a half-written file. On
+    //      failure, response headers are printed so a rate-limit (or not) is
+    //      visible in the log.
     const MAX_ATTEMPTS: u32 = 5;
+    let retry_all_errors = curl_version_at_least_7_71();
+    let headers_path = dest.join("curl-headers.txt");
     let mut last_status = None;
     for attempt in 1..=MAX_ATTEMPTS {
         eprintln!(
@@ -113,23 +103,30 @@ fn download_and_install(dest: &Path) {
         // Best-effort cleanup of any partial download from the previous attempt.
         // A corrupt zip would otherwise survive into extract_zip() and fail there.
         let _ = std::fs::remove_file(&zip_path);
-
-        let status = std::process::Command::new("curl")
-            .args([
-                "-sSL",
-                "--fail",
-                "--retry",
-                "5",
-                "--retry-delay",
-                "2",
-                "--retry-max-time",
-                "120",
-                "--connect-timeout",
-                "30",
-                "--max-time",
-                "300",
-                "-o",
-            ])
+        let _ = std::fs::remove_file(&headers_path);
+
+        let mut curl = std::process::Command::new("curl");
+        curl.args([
+            "-sSL",
+            "--fail",
+            "--retry",
+            "5",
+            "--retry-delay",
+            "2",
+            "--retry-max-time",
+            "120",
+            "--connect-timeout",
+            "30",
+            "--max-time",
+            "300",
+            "-D",
+        ]);
+        curl.arg(&headers_path);
+        if retry_all_errors {
+            curl.arg("--retry-all-errors");
+        }
+        let status = curl
+            .arg("-o")
             .arg(&zip_path)
             .arg(&url)
             .status()
@@ -140,6 +137,9 @@ fn download_and_install(dest: &Path) {
             break;
         }
         last_status = Some(status);
+        if let Ok(headers) = std::fs::read_to_string(&headers_path) {
+            eprintln!("curl response headers:\n{headers}");
+        }
 
         if attempt < MAX_ATTEMPTS {
             let backoff_ms = 1_000u64 * (1u64 << (attempt - 1));
@@ -171,9 +171,32 @@ fn download_and_install(dest: &Path) {
     }
 
     let _ = std::fs::remove_file(&zip_path);
+    let _ = std::fs::remove_file(&headers_path);
     eprintln!("protoc v{PROTOC_VERSION} installed to {}", dest.display());
 }
 
+fn curl_version_at_least_7_71() -> bool {
+    // `curl --help` on 8.x is a short summary and does not list
+    // `--retry-all-errors`. `curl --version` is stable on old and new curl.
+    let output = std::process::Command::new("curl").arg("--version").output();
+    let Ok(output) = output else {
+        return false;
+    };
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    // First line: `curl 8.5.0 (x86_64-pc-linux-gnu) ...`
+    let Some(version) = stdout.split_whitespace().nth(1) else {
+        return false;
+    };
+    let mut parts = version.split('.');
+    let Ok(major) = parts.next().unwrap_or("").parse::<u32>() else {
+        return false;
+    };
+    let Ok(minor) = parts.next().unwrap_or("0").parse::<u32>() else {
+        return false;
+    };
+    major > 7 || (major == 7 && minor >= 71)
+}
+
 #[cfg(unix)]
 fn extract_zip(zip_path: &Path, dest: &Path) {
     let status = std::process::Command::new("unzip")

{snowflake_connector_python-5.1.0 → snowflake_connector_python-5.2.0}/pyproject.toml

@@ -20,6 +20,7 @@ classifiers = [
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
     "Programming Language :: Python :: 3.14",
+    "Programming Language :: Python :: 3.15",
     "Programming Language :: Python :: Free Threading :: 2 - Beta",
 ]
 requires-python = ">=3.11"
@@ -47,8 +48,9 @@ pyarrow = [
 ]
 pandas = [
     "pyarrow>=14.0.1",
-    "pandas>=1.0.0,<3.0.0; python_version < '3.13'",
-    "pandas>=2.1.2,<3.0.0; python_version >= '3.13'",
+    "pandas>=1.0.0; python_version < '3.13'",
+    "pandas>=2.1.2; python_version >= '3.13' and python_version < '3.15'",
+    "pandas>=3.0.0; python_version >= '3.15'",
 ]
 test = [
     "pytest>=8",
@@ -78,6 +80,10 @@ dev = [
     "types-protobuf",
 ]
 
+# 0.13.4 removes the compromised eMudhra root. 0.13.5 also rejects those intermediate keys.
+[tool.uv]
+required-version = ">=0.13.5"
+
 [tool.hatch.version]
 path = "src/snowflake/connector/version.py"
 
@@ -162,7 +168,8 @@ addopts = [
     "-p", "pytest_junit_retry_plugin",
     # Flaky tests are excluded by default; the python_flaky_tests CI job
     # overrides this with `-m flaky` to run them in isolation.
-    "-m", "not flaky and not requires_no_mfa",
+    # Slow tests are on demand (`-m slow`). Packaging overrides this filter.
+    "-m", "not flaky and not requires_no_mfa and not slow",
 ]
 # Default timeout for tests (2 minutes) - prevents hanging tests on CI
 timeout = 120
@@ -170,7 +177,7 @@ markers = [
     "skip_reference(reason: str=''): skip when --connector=reference",
     "skip_universal(reason: str=''): skip when --connector=universal",
     "skip_unless_native_arrow(reason: str=''): skip unless sf_core_python.native_arrow_enabled() (Cython/reference Arrow converter)",
-    "slow: marks tests as slow (e.g., full sdist install with Rust compilation)",
+    "slow: excluded from the default suite; run with -m slow (large results, full builds)",
     "skip_for_json_result_set(reason: str=''): skip when QUERY_RESULT_FORMAT=JSON (tests requiring Arrow precision)",
     "require_vpn: test requires VPN access (skipped outside Jenkins CI)",
     "requires_browser: test requires headless browser container (skipped unless SF_TEST_HEADLESS_BROWSER=true)",
@@ -306,7 +313,7 @@ PARAMETER_PATH = "{env:PARAMETER_PATH:../parameters.json}"
 SKIP_CORE_BUILD = "{env:SKIP_CORE_BUILD:1}"
 
 [[tool.hatch.envs.dev.matrix]]
-python = ["3.11", "3.12", "3.13", "3.14", "3.14t"]
+python = ["3.11", "3.12", "3.13", "3.14", "3.15", "3.15t"]
 
 [tool.hatch.envs.dev.scripts]
 # Per-test retries come from addopts --reruns 2 (not a second whole-suite run).
@@ -329,7 +336,7 @@ skip-install = true
 dev-mode = false
 
 [[tool.hatch.envs.test.matrix]]
-python = ["3.11", "3.12", "3.13", "3.14", "3.14t"]
+python = ["3.11", "3.12", "3.13", "3.14", "3.15", "3.15t"]
 
 [tool.hatch.envs.test.scripts]
 # Install from wheel
@@ -351,7 +358,7 @@ no_mfa = "pytest tests/e2e/authentication/test_user_password.py -m requires_no_m
 template = "test"
 
 [[tool.hatch.envs.test-native-arrow.matrix]]
-python = ["3.13", "3.14t"]
+python = ["3.13", "3.15t"]
 
 [tool.hatch.envs.test-native-arrow.env-vars]
 SNOWFLAKE_TEST_USE_CORE_ARROW = "1"
@@ -362,7 +369,7 @@ template = "test"
 features = ["test", "dev", "pandas"]
 
 [[tool.hatch.envs.test-pandas.matrix]]
-python = ["3.11", "3.12", "3.13", "3.14", "3.14t"]
+python = ["3.11", "3.12", "3.13", "3.14", "3.15", "3.15t"]
 
 [tool.hatch.envs.test-pandas.scripts]
 cov = "pytest tests/e2e/pandas tests/e2e/numpy --cov=src/snowflake --cov-report=xml --cov-report=html {args}"
@@ -379,7 +386,7 @@ python = ["3.13"]
 [tool.hatch.envs.packaging.scripts]
 # no parallelism - each packaging test does a full Rust compile; runing them concurrently can thrash the runner
 # {args:...}: default to the whole packaging suite; CI passes a single file
-test = "pytest -n 0 {args:tests/packaging}"
+test = "pytest -n 0 -m \"not flaky and not requires_no_mfa\" {args:tests/packaging}"
 
 # Reference connector environments install only the reference connector.
 # UD driver is uninstalled; only the old driver is present.

{snowflake_connector_python-5.1.0 → snowflake_connector_python-5.2.0}/python_bridge/src/lib.rs

@@ -262,6 +262,34 @@ fn native_arrow_enabled() -> bool {
     cfg!(feature = "native-arrow")
 }
 
+/// Split a SQL script into statements.
+///
+/// Each item is the statement text and a PUT/GET flag: `True` for `PUT` and
+/// `GET`, `False` for other statements and `!` commands, and `None` when the
+/// text is empty or comment-only. The delimiter is rewritten as `;`.
+///
+/// An unterminated quote, block comment, or dollar quote keeps the rest of
+/// the script in that statement. An empty delimiter raises `ValueError`.
+#[pyfunction]
+fn split_sql_script(
+    sql: &str,
+    delimiter: &str,
+    remove_comments: bool,
+) -> PyResult<Vec<(String, Option<bool>)>> {
+    let options = sf_core::sql_script::SplitOptions {
+        delimiter: delimiter.to_owned(),
+        remove_comments,
+    };
+    sf_core::sql_script::split_sql_script(sql, &options)
+        .map(|spans| {
+            spans
+                .into_iter()
+                .map(|span| (span.text, span.is_file_transfer))
+                .collect()
+        })
+        .map_err(|err| pyo3::exceptions::PyValueError::new_err(err.to_string()))
+}
+
 #[pymodule(gil_used = false)]
 fn sf_core_python(m: &Bound<'_, PyModule>) -> PyResult<()> {
     m.add_function(wrap_pyfunction!(init, m)?)?;
@@ -272,6 +300,7 @@ fn sf_core_python(m: &Bound<'_, PyModule>) -> PyResult<()> {
     m.add_function(wrap_pyfunction!(get_perf_data, m)?)?;
     m.add_function(wrap_pyfunction!(reset_perf_metrics, m)?)?;
     m.add_function(wrap_pyfunction!(native_arrow_enabled, m)?)?;
+    m.add_function(wrap_pyfunction!(split_sql_script, m)?)?;
     #[cfg(feature = "native-arrow")]
     m.add_class::<ArrowStreamIterator>()?;
     #[cfg(feature = "native-arrow")]

snowflake_connector_python-5.2.0/sf_core/CHANGELOG.md

@@ -0,0 +1,5 @@
+# Changelog
+
+## Upcoming Release
+
+In-progress notes are files under `changelog/unreleased/`.

{snowflake_connector_python-5.1.0 → snowflake_connector_python-5.2.0}/sf_core/Cargo.toml

@@ -86,6 +86,19 @@ bytes = "1"
 # panics ("No provider set"), which is why every client construction path calls
 # `tls::ensure_crypto_provider()` first.
 reqwest = { version = "0.12.23", default-features = false, features = ["json", "rustls-tls-no-provider", "rustls-tls-native-roots-no-provider", "rustls-tls-webpki-roots-no-provider", "gzip", "stream", "http2", "charset", "macos-system-configuration"] }
+# Exact pin. reqwest's `http2` feature pulls `h2` transitively, and result
+# chunks from GCS download over HTTP/2. GCS pads its DATA frames today and
+# often sends frames that carry only padding.
+# - h2 0.4.12 leaves padding out of the connection flow-control window, so
+#   after about 0.5 GB on one connection it stops sending WINDOW_UPDATE and
+#   the download stalls until GCS resets the stream.
+# - From 0.4.19, h2 counts a padding-only frame as an empty DATA frame and
+#   closes the connection with GOAWAY(ENHANCE_YOUR_CALM,
+#   "too_many_data_frames") after 100 of them. The count never resets and
+#   no builder option changes the limit.
+# 0.4.18 has neither problem. A later release, including a security update,
+# keeps the empty-frame limit unless upstream changes it.
+h2 = "=0.4.18"
 serde = { version = "1.0.219", features = ["derive"] }
 serde_json = { version = "1.0.143", features = ["raw_value"] }
 futures = "0.3"

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/a-cancellation-error-now-reports-what.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- A cancellation error now reports what its abort-request achieved: `DriverException.cancellation_abort_outcome` is `ABORTED` (server acknowledged), `NOT_RUNNING` (nothing was running), or `NOT_CONFIRMED` (issued, outcome unknown), and is left unset when no abort was issued at all — the operation was cancelled before its query reached the server. This is the acknowledgement `StatementCancel` used to return to the canceller, delivered instead to the caller whose query was cancelled. (snowflakedb/drivers#1491)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/a-statementexecuteasync-whose-submission-is-acce.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- A `StatementExecuteAsync` whose submission is accepted but which returns no usable query ID now aborts that query and reports an internal error, instead of reporting an invalid-argument error and leaving a query running that the caller has no ID for. (snowflakedb/drivers#1549)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-a-connection-free-status-call.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added a connection-free status call that reports whether this process is the FIPS driver. Python `get_fips_status()`, JDBC `getFipsStatus()`, Node.js `getFipsStatus()`, .NET `GetFipsStatus()`, and ODBC `SFGetFipsStatus` return the same `is_fips` value. (snowflakedb/drivers#2562)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-a-connection-is-usable-driver.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added a `connection_is_usable` driver API that reports whether a connection can take a request, and distinguishes a connection that has yet to log in from one whose session is gone. It answers under a single lock what `connection_is_closed`, `connection_is_expired` and `connection_is_initialized` answer under three. (snowflakedb/drivers#2096)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-a-cwd-statement-option-that.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added a `cwd` statement option that resolves relative local paths in PUT and GET against a caller-supplied directory. (snowflakedb/drivers#1932)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-a-description-internal-property-on.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added a `_description_internal` property on the Python cursor, exposing the new-format `ResultMetadataV2` metadata for the last executed statement. Callers that probe for it (Snowpark) previously fell back to the PEP 249 `description`, losing `fields` and `vector_dimension`. (snowflakedb/drivers#1627)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-a-driverproviders-injection-point-for.md

@@ -0,0 +1,5 @@
+---
+category: internal
+---
+
+- Added a `DriverProviders` injection point for the token cache so a wrapper can supply its own `TokenCache` instead of the default keyring store. (snowflakedb/drivers#2166)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-a-per-statement-cloud-request.md

@@ -0,0 +1,5 @@
+---
+category: internal
+---
+
+- Added a per-statement cloud-request budget for PUT/GET: every request that moves object bytes or reads object metadata takes a slot from one shared `TransferScheduler` sized from the server's `PARALLEL`, so part-level and file-level concurrency cannot multiply into `PARALLEL²` simultaneous requests now that file fan-out has landed. (snowflakedb/drivers#1449)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-a-proxy-scheme-connection-parameter.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added a `proxy_scheme` connection parameter so the hop to the proxy can use HTTPS. An `https://` proxy URL and JDBC `proxyProtocol=https` now open TLS to the proxy instead of HTTP. (snowflakedb/drivers#2013)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-a-put-compress-level-connection.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added a `put_compress_level` connection setting that selects the gzip level (0–9) used when PUT AUTO_COMPRESS rewrites a file. (snowflakedb/drivers#2083)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-a-put-tempdir-connection-setting.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added a `put_tempdir` connection setting that selects the directory for gzip tempfiles created by PUT AUTO_COMPRESS. Unset and empty values keep the process temp directory. Nested directories are created. (snowflakedb/drivers#2084)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-a-python-platform-detection-timeout.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added a Python `platform_detection_timeout_seconds` connection parameter that limits each cloud-metadata platform check. Setting it to `0` skips those HTTP and STS queries and keeps only environment-based detection, matching the legacy Python connector. (snowflakedb/drivers#2186)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-a-python-source-distribution-install.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added a Python source-distribution install with `SNOWFLAKE_FIPS=1` that links the FIPS module, so `snowflake.connector.get_fips_status()` reports `is_fips` as true. (snowflakedb/drivers#2489)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-a-secondary-roles-connection-parameter.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added a `secondary_roles` connection parameter that lets a client control secondary-role activation at login (e.g. `ALL` or `NONE`) without relying on the user's `DEFAULT_SECONDARY_ROLES` setting, ported from legacy snowflake-connector-python. Also restores parity with legacy ODBC's `SecondaryRoles` connection attribute, and is newly available (with no legacy equivalent) for JDBC. (snowflakedb/drivers#954)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-a-shared-operation-cancellation-registry.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added a shared operation-cancellation registry and `RustTransport::handle_message_cancellable`, letting a bridge cancel an in-flight RPC by handle from any thread and surface cancellation as `DriverException` with `ERROR_KIND_CANCELLED`; the async C API now cancels through this registry. (snowflakedb/drivers#TBD)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-a-stage-binding-disabled-telemetry.md

@@ -0,0 +1,5 @@
+---
+category: internal
+---
+
+- Added a `stage_binding_disabled` telemetry event recorded once per connection, the first time `CREATE STAGE` fails for the session-scoped array-bind stage. Previously ODBC alone reported a similar event on every statement that subsequently retried with inline JSON bindings. (snowflakedb/drivers#2205)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-a-token-file-path-connection.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added a `token_file_path` connection parameter that loads a PAT, legacy OAuth, or OIDC bearer token from a file (including from `connections.toml`), matching the legacy Python connector. If both `token` and `token_file_path` are set, the file contents are used. (snowflakedb/drivers#1445)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-a-validate-session-token-wrapper.md

@@ -0,0 +1,5 @@
+---
+category: change
+---
+
+- Added a `validate_session_token` wrapper preset, on for every wrapper but Node.js. When off, a login with pre-acquired session and master tokens adopts the pair as handed over instead of proving it with a token-request RENEW first, so the pair is not rotated and adopting it costs no round-trip. Such a connection has no server-reported session id and therefore emits no per-operation telemetry; authentication, queries and logout are unaffected. This restores the legacy `snowflake-connector-nodejs` `deserializeConnection` contract. (snowflakedb/drivers#2042)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-a-wif-host-connection-parameter.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added a `wif_host` connection parameter that sets the AWS STS endpoint for Workload Identity Federation, including the pre-signed GetCallerIdentity request, AssumeRole impersonation, and outbound GetWebIdentityToken; unset keeps the AWS SDK regional STS hostname. (snowflakedb/drivers#2439)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-an-extra-root-store-path.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added an `extra_root_store_path` connection parameter that extends the default TLS root store with certificates from a PEM bundle while preserving `custom_root_store_path` replacement behavior. (snowflakedb/drivers#1827)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-an-opt-in-fips-build.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added an opt-in `fips` build that routes TLS through AWS-LC-FIPS and fails closed if a non-FIPS crypto provider is active. (snowflakedb/drivers#2055)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-apierror-terminates-session-so-an.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added `ApiError::terminates_session()` so an in-process wrapper can tell from the error alone that `connection_is_usable` now reports the connection as terminated. (snowflakedb/drivers#2696)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-application-path-to-the-login.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added `APPLICATION_PATH` to the login `CLIENT_ENVIRONMENT` payload. Wrappers pass it through `WrapperIdentity.application_path`. An unset or blank path is reported as `UNKNOWN`. (snowflakedb/drivers#2535)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-async-first-rpcs-an-rpc.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added async-first RPCs: an RPC marked `async_first` in the proto generates a `Future`-returning client method, and JDBC's `ConnectionInit` now uses it via new `nativeSubmitMessage`/`nativeAwaitMessage`/`nativeCancel` JNI entries. (snowflakedb/drivers#TBD)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-asyncarrowbatchfetcher-from-batches-so-an.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added `AsyncArrowBatchFetcher::from_batches` so an in-process wrapper can build a fetcher from already-materialized Arrow batches. (snowflakedb/drivers#2003)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-azure-blob-content-md5-on.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added Azure blob Content-MD5 on PUT (single Put Blob and Put Block List), hashed in the same streaming pass as SHA-256 and over ciphertext when client-side encryption is on. (snowflakedb/drivers#2232)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-client-crl-stats-on-the-connection.md

@@ -0,0 +1,5 @@
+---
+category: internal
+---
+
+- Added a `client_crl_stats` in-band telemetry event for each CRL download attempt, buffered on the connection until that session is registered. (snowflakedb/drivers#3035)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-configurable-key-pair-jwt-lifetime.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added a `jwt_timeout` connection parameter, exposed in Node.js as `jwtTimeout`, to configure the lifetime in seconds of each key-pair authentication JWT, including tokens re-signed on login retry. The default remains 120 seconds; `0` selects the default and negative or non-integer values are rejected (snowflakedb/drivers#3141).

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-duo-push-continuation-for-username.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added Duo push continuation for username/password MFA so a pending Duo challenge can wait for device approval and then finish login. (snowflakedb/drivers#2021)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-file-level-parallelism-to-put.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added file-level parallelism to PUT and GET: a multi-file transfer now uploads or downloads several files at once instead of one at a time, bounded by the statement's `PARALLEL` value, and result rows keep their original file order. Fail-fast now lets files already in flight (up to `PARALLEL` of them) finish and land on the stage after the first error, instead of stopping after only the current file. (snowflakedb/drivers#1451)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-hot-swappable-file-logging-logmanager.md

@@ -0,0 +1,5 @@
+---
+category: internal
+---
+
+- Added hot-swappable file logging: `LogManager` exposes a `LogReloadHandle` that re-applies the core and troubleshooting file sinks (log level and destination path) in place, without rebuilding the tracing dispatch, session registry, or negotiated encoding, so a wrapper can re-read its logging configuration at runtime. (snowflakedb/drivers#2588)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-impersonation-chain-support-to-the.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added impersonation-chain support to the standalone `create_attestation` RPC, so callers can acquire a Workload Identity Federation attestation for an assumed AWS role, delegated GCP service account, or impersonated Azure service principal without an active connection. (snowflakedb/drivers#1027)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-is-fips-to-the-login.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added `IS_FIPS` to the login `CLIENT_ENVIRONMENT` payload so Snowflake can tell whether the driver's linked TLS provider is FIPS-approved. (snowflakedb/drivers#2384)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-jdbc-aliases-wifhost-workloadidentityhost.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added JDBC aliases `wifHost`, `workloadIdentityHost`, and `workload_identity_host`, a Python alias `workload_identity_host`, and a Node.js alias `wifHost` for the `wif_host` connection parameter. (snowflakedb/drivers#2439)

snowflake_connector_python-5.2.0/sf_core/changelog/unreleased/added-native-aks-workload-identity-support.md

@@ -0,0 +1,5 @@
+---
+category: feature
+---
+
+- Added native AKS Workload Identity support for Azure: when the Azure Workload Identity webhook injects `AZURE_CLIENT_ID`, `AZURE_TENANT_ID` and `AZURE_FEDERATED_TOKEN_FILE` into a pod and the projected token file exists on disk, `workload_identity_provider="AZURE"` now exchanges that federated token for an Entra ID access token directly, instead of requiring the projected-volume/OIDC workaround. `workload_identity_impersonation_path` is not supported in this environment. (snowflakedb/drivers#1367)