snowflake-snowpark-python 1.51.1__tar.gz → 1.53.0__tar.gz

{snowflake_snowpark_python-1.51.1 → snowflake_snowpark_python-1.53.0}/CHANGELOG.md

@@ -1,5 +1,52 @@
 # Release History
 
+## 1.53.0 (2026-07-09)
+
+### Snowpark Python API Updates
+
+#### New Features
+
+- Added the `udf_init_once` decorator in `snowflake.snowpark.functions` for marking functions to be executed once during pre-fork initialization on Snowflake workers, matching the server-side `_snowflake.udf_init_once` API.
+
+#### Bug Fixes
+
+- Fixed a bug where stage paths and file format names that contain single quotes were not consistently escaped when generating SQL, which could produce malformed statements. This affects `INFER_SCHEMA` (used by `DataFrameReader.csv`/`json`/`parquet`/`orc`/`avro`) and `COPY FILES` (used by `FileOperation.copy_files`).
+- Fixed a bug where single quotes and backslashes in stage/file paths were not correctly escaped when generating `COPY INTO` / `PUT` / `GET` SQL, which could produce malformed statements. This affects `DataFrame.write.csv`/`copy_into_location` and the Snowpark-pandas `DataFrame.to_csv` stage path.
+- Fixed a bug where column names containing quote characters returned by an external database were not correctly escaped when generating the `SELECT` query for `DataFrameReader.dbapi`, which could produce malformed SQL. Embedded quote characters in identifiers are now doubled (backticks for Databricks/MySQL, double quotes for Oracle/PostgreSQL/SQL Server).
+- Fixed a bug where the destination passed to `DataFrameWriter.copy_into_location` (and `csv`/`json`/`parquet`/`save`) was embedded into the generated `COPY INTO` statement without quoting, which could produce malformed SQL for locations containing single quotes. The location is now consistently quoted and escaped, and a string that merely starts and ends with a single quote but contains unescaped interior quotes is no longer treated as an already-quoted literal; it is fully escaped so it stays a single SQL string literal.
+- Fixed a bug where UDF default argument values reconstructed from a source file in `register_from_file` were evaluated with `eval()`; they are now evaluated only against the documented set of supported default-value types, and unsupported expressions are ignored.
+- Fixed a bug where `object_name`, `object_domain`, or `object_version` values containing single quotes or backslashes in `session.lineage.trace()` caused incorrect SQL generation. These values are now properly escaped before being embedded in the `SYSTEM$DGQL` call.
+- Fixed a bug where single quotes and backslashes in `comment` (`create_or_replace_view` / dynamic table / `save_as_table`), collation specs (`Column.collate`), VARIANT/OBJECT subfield keys (`Column[...]`), and `DataFrame`/`Session.flatten` paths were not correctly escaped when generating SQL, which could produce malformed statements. Backslash sequences (e.g. `\t`, `\n`) in these values are now applied literally rather than interpreted.
+- Fixed a bug where string values in the AI functions (`ai_extract`, `ai_classify`, `ai_similarity`, `ai_parse_document`, `ai_transcribe`, `ai_complete`) configuration and `response_format` were not correctly escaped when generating the SQL object literal, which could produce malformed statements when a value contained single quotes or backslashes (for example, an apostrophe in a natural-language question).
+
+#### Dependency Updates
+
+- Lifted `protobuf` restriction for Python 3.14 from `==5.29.3` to `>=5.29.3,<6.34`.
+- Capped `pandas` to `<3.0.0` for the `[pandas]` install extra, as Snowpark Python pandas-related features may not be fully compatible with pandas 3.0 or later.
+
+## 1.52.0 (2026-06-10)
+
+### Snowpark Python API Updates
+
+#### New Features
+
+- Added `get_wif_token` to `snowflake.snowpark.secrets` for workload identity federation tokens on the Snowflake server (not available in SPCS file-based secret environments).
+
+#### Bug Fixes
+
+- Fixed a bug where copying a `DataFrame` via `copy.copy()` lost post-aggregate state, causing subsequent `.limit()` or `.sort()` to generate incorrect SQL.
+- Fixed a bug where calling `DataFrame.alias()` twice on the same DataFrame (e.g. for a self-join) caused both aliases to share the same internal column-mapping dictionary. This made `col("R", "col")` resolve to the same column as `col("L", "col")`, producing incorrect join conditions and filter expressions.
+- Fixed a bug where `cloudpickle` could not be resolved when registering a Python stored procedure or UDF with `runtime_version='3.13'`.
+
+#### Improvements
+
+- Improved CTE optimization to deduplicate identical subtrees in self-joins, which were previously emitted as repeated subqueries.
+- Reduced the size of generated query text for repeated join operations.
+
+#### Deprecations
+
+- Removed support for Python 3.9.
+
 ## 1.51.1 (2026-05-28)
 
 #### Documentation

{snowflake_snowpark_python-1.51.1/src/snowflake_snowpark_python.egg-info → snowflake_snowpark_python-1.53.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-snowpark-python
-Version: 1.51.1
+Version: 1.53.0
 Summary: Snowflake Snowpark for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -22,7 +22,6 @@ Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: SQL
 Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
@@ -33,7 +32,7 @@ Classifier: Topic :: Software Development :: Libraries
 Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Scientific/Engineering :: Information Analysis
-Requires-Python: >=3.9, <3.15
+Requires-Python: >=3.10, <3.15
 Description-Content-Type: text/markdown
 License-File: LICENSE.txt
 Requires-Dist: setuptools>=40.6.0
@@ -42,13 +41,16 @@ Requires-Dist: snowflake-connector-python<5.0.0,>=3.17.0
 Requires-Dist: typing-extensions<5.0.0,>=4.1.0
 Requires-Dist: pyyaml
 Requires-Dist: cloudpickle!=2.1.0,!=2.2.0,<=3.1.1,>=1.6.0
-Requires-Dist: protobuf<6.34,>=3.20
+Requires-Dist: protobuf<6.34,>=3.20; python_version < "3.14"
+Requires-Dist: protobuf<6.34,>=5.29.0; python_version >= "3.14"
 Requires-Dist: python-dateutil
 Requires-Dist: tzlocal
 Provides-Extra: pandas
 Requires-Dist: snowflake-connector-python[pandas]<5.0.0,>=3.17.0; extra == "pandas"
+Requires-Dist: pandas<3.0.0; extra == "pandas"
 Provides-Extra: modin
 Requires-Dist: snowflake-connector-python[pandas]<5.0.0,>=3.17.0; extra == "modin"
+Requires-Dist: pandas<3.0.0; extra == "modin"
 Requires-Dist: modin<0.38.0,>=0.36.0; extra == "modin"
 Requires-Dist: pandas<=2.4; extra == "modin"
 Requires-Dist: tqdm; extra == "modin"
@@ -77,6 +79,7 @@ Requires-Dist: lxml; extra == "development"
 Requires-Dist: pyarrow; extra == "development"
 Provides-Extra: modin-development
 Requires-Dist: snowflake-connector-python[pandas]<5.0.0,>=3.17.0; extra == "modin-development"
+Requires-Dist: pandas<3.0.0; extra == "modin-development"
 Requires-Dist: modin<0.38.0,>=0.36.0; extra == "modin-development"
 Requires-Dist: pandas<=2.4; extra == "modin-development"
 Requires-Dist: tqdm; extra == "modin-development"
@@ -149,9 +152,9 @@ If you don't have a Snowflake account yet, you can [sign up for a 30-day free tr
 
 ### Create a Python virtual environment
 You can use [miniconda][miniconda], [anaconda][anaconda], or [virtualenv][virtualenv]
-to create a Python 3.9, 3.10, 3.11, 3.12 or 3.13 virtual environment.
+to create a Python 3.10, 3.11, 3.12 or 3.13 virtual environment.
 
-For Snowpark pandas, only Python 3.9, 3.10, or 3.11 is supported.
+For Snowpark pandas, only Python 3.10 or 3.11 is supported.
 
 To have the best experience when using it with UDFs, [creating a local conda environment with the Snowflake channel][use snowflake channel] is recommended.
 

{snowflake_snowpark_python-1.51.1 → snowflake_snowpark_python-1.53.0}/README.md

@@ -18,9 +18,9 @@ If you don't have a Snowflake account yet, you can [sign up for a 30-day free tr
 
 ### Create a Python virtual environment
 You can use [miniconda][miniconda], [anaconda][anaconda], or [virtualenv][virtualenv]
-to create a Python 3.9, 3.10, 3.11, 3.12 or 3.13 virtual environment.
+to create a Python 3.10, 3.11, 3.12 or 3.13 virtual environment.
 
-For Snowpark pandas, only Python 3.9, 3.10, or 3.11 is supported.
+For Snowpark pandas, only Python 3.10 or 3.11 is supported.
 
 To have the best experience when using it with UDFs, [creating a local conda environment with the Snowflake channel][use snowflake channel] is recommended.
 

snowflake_snowpark_python-1.53.0/pyproject.toml

@@ -0,0 +1,13 @@
+[build-system]
+requires = [
+    "setuptools",
+    # py>=3.14: protoc-wheel-0 has no cp314 wheel on PyPI, so it cannot be installed
+    # in pip's build isolation venv. setup.py falls back to shutil.which("protoc").
+    "protoc-wheel-0==21.1; python_version < '3.14'", # Protocol buffer compiler for Snowpark IR
+    # py>=3.14: pin <=3.6.0 so the build isolation venv does not install mypy-protobuf 5.x,
+    # whose extensions_pb2.py was generated with protobuf 6.x gencode and fails at import
+    # time when the isolated venv resolves protobuf 5.x (Snowflake internal channel).
+    "mypy-protobuf<=3.6.0; python_version >= '3.14'",
+    "mypy-protobuf; python_version < '3.14'", # used in generating typed Python code from protobuf for Snowpark IR
+]
+build-backend = "setuptools.build_meta"

{snowflake_snowpark_python-1.51.1 → snowflake_snowpark_python-1.53.0}/setup.py

@@ -28,17 +28,23 @@ INSTALL_REQ_LIST = [
     "pyyaml",
     "cloudpickle>=1.6.0,<=3.1.1,!=2.1.0,!=2.2.0",
     # `protoc` < 3.20 is not able to generate protobuf code compatible with protobuf >= 3.20.
-    "protobuf>=3.20, <6.34",  # Snowpark IR
+    "protobuf>=3.20, <6.34; python_version < '3.14'",  # Snowpark IR
+    # py314: protoc-wheel-0 has no cp314 wheel; setup.py uses libprotobuf's protoc from PATH.
+    # The pre-generated ast_pb2.py in the tarball has no ValidateProtobufRuntimeVersion call
+    # (built with protoc 3.21), so 5.29.0+ is sufficient. Conda recipes may regenerate with
+    # a different protoc version and override this constraint via their run deps.
+    "protobuf>=5.29.0,<6.34; python_version >= '3.14'",  # Snowpark IR
     "python-dateutil",  # Snowpark IR
     "tzlocal",  # Snowpark IR
 ]
-REQUIRED_PYTHON_VERSION = ">=3.9, <3.15"
+REQUIRED_PYTHON_VERSION = ">=3.10, <3.15"
 
 if os.getenv("SNOWFLAKE_IS_PYTHON_RUNTIME_TEST", False):
-    REQUIRED_PYTHON_VERSION = ">=3.9"
+    REQUIRED_PYTHON_VERSION = ">=3.10"
 
 PANDAS_REQUIREMENTS = [
     f"snowflake-connector-python[pandas]{CONNECTOR_DEPENDENCY_VERSION}",
+    "pandas<3.0.0",
 ]
 MODIN_REQUIREMENTS = [
     *PANDAS_REQUIREMENTS,
@@ -246,7 +252,6 @@ setup(
         "Operating System :: OS Independent",
         "Programming Language :: SQL",
         "Programming Language :: Python :: 3 :: Only",
-        "Programming Language :: Python :: 3.9",
         "Programming Language :: Python :: 3.10",
         "Programming Language :: Python :: 3.11",
         "Programming Language :: Python :: 3.12",

{snowflake_snowpark_python-1.51.1 → snowflake_snowpark_python-1.53.0}/src/snowflake/snowpark/_internal/analyzer/analyzer_utils.py

@@ -6,7 +6,7 @@
 import json
 import math
 import os
-import sys
+import re
 import tempfile
 from typing import Any, Dict, List, Optional, Tuple, Union, Literal, Sequence
 
@@ -41,7 +41,8 @@ from snowflake.snowpark._internal.utils import (
     EMPTY_STRING,
     TempObjectType,
     escape_quotes,
-    escape_single_quotes,
+    escape_quotes_and_backslashes,
+    escape_subfield_key,
     get_temp_type_for_object,
     is_single_quoted,
     is_sql_select_statement,
@@ -52,13 +53,7 @@ from snowflake.snowpark._internal.utils import (
 from snowflake.snowpark.row import Row
 from snowflake.snowpark.types import DataType
 
-# Python 3.8 needs to use typing.Iterable because collections.abc.Iterable is not subscriptable
-# Python 3.9 can use both
-# Python 3.10 needs to use collections.abc.Iterable because typing.Iterable is removed
-if sys.version_info <= (3, 9):
-    from typing import Iterable
-else:
-    from collections.abc import Iterable
+from collections.abc import Iterable
 
 LEFT_PARENTHESIS = "("
 RIGHT_PARENTHESIS = ")"
@@ -409,7 +404,26 @@ def regexp_expression(expr: str, pattern: str, parameters: Optional[str] = None)
 
 
 def collate_expression(expr: str, collation_spec: str) -> str:
-    return expr + COLLATE + single_quote(collation_spec)
+    # Escape the collation spec so a value containing single quotes or
+    # backslashes does not terminate the single-quoted literal early and produce
+    # invalid SQL.
+    #
+    # Preserve the historical behavior of single_quote(): a spec that is already
+    # wrapped in single quotes (e.g. "'en_US'") is treated as pre-quoted, so we
+    # strip the outer quotes, escape the interior, and re-wrap. An unquoted spec
+    # is escaped and wrapped. Specs (quoted or unquoted) with no interior quotes
+    # or backslashes therefore produce identical SQL to before.
+    if is_single_quoted(collation_spec):
+        inner = collation_spec[1:-1]
+    else:
+        inner = collation_spec
+    return (
+        expr
+        + COLLATE
+        + SINGLE_QUOTE
+        + escape_quotes_and_backslashes(inner)
+        + SINGLE_QUOTE
+    )
 
 
 def subfield_expression(expr: str, field: Union[str, int]) -> str:
@@ -417,7 +431,12 @@ def subfield_expression(expr: str, field: Union[str, int]) -> str:
         expr
         + LEFT_BRACKET
         + (
-            SINGLE_QUOTE + field + SINGLE_QUOTE
+            # Escape the field so a VARIANT/OBJECT key containing single quotes
+            # or backslashes does not terminate the literal early. A key whose
+            # single quotes are already doubled is preserved unchanged (minus
+            # backslash normalization) to keep the historical "double your own
+            # quotes" contract non-breaking.
+            SINGLE_QUOTE + escape_subfield_key(field) + SINGLE_QUOTE
             if isinstance(field, str)
             else str(field)
         )
@@ -438,7 +457,10 @@ def flatten_expression(
         + PATH
         + RIGHT_ARROW
         + SINGLE_QUOTE
-        + (path or EMPTY_STRING)
+        # Escape the JSON path so a value containing single quotes or
+        # backslashes does not terminate the literal early and produce invalid
+        # SQL in the FLATTEN argument list.
+        + (escape_quotes_and_backslashes(path) if path else EMPTY_STRING)
         + SINGLE_QUOTE
         + COMMA
         + OUTER
@@ -968,6 +990,33 @@ def lateral_join_statement(
     )
 
 
+_SELECT_STAR_FROM_PREFIX = SELECT + STAR + NEW_LINE + FROM + LEFT_PARENTHESIS + NEW_LINE
+_SELECT_STAR_FROM_SUFFIX = NEW_LINE + RIGHT_PARENTHESIS
+
+
+def _unwrap_select_star_from(sql: str) -> Optional[str]:
+    """If sql is a join-produced `SELECT * FROM (\n<join_source>\n)` (the
+    output of project_statement([], join_source)), return <join_source>.
+    Only unwraps when the inner content starts with '(' (possibly preceded
+    by UUID trace comments) which indicates a parenthesized join operand
+    rather than a wrapped SELECT statement."""
+    if sql.startswith(_SELECT_STAR_FROM_PREFIX) and sql.endswith(
+        _SELECT_STAR_FROM_SUFFIX
+    ):
+        inner = sql[len(_SELECT_STAR_FROM_PREFIX) : -len(_SELECT_STAR_FROM_SUFFIX)]
+        # In trace-SQL mode, UUID comments (\n-- <uuid>\n) may precede the
+        # opening parenthesis. Strip them before checking.
+        check = inner.lstrip("\n")
+        if check.startswith("--"):
+            # Skip the comment line and any trailing newline
+            newline_pos = check.find("\n")
+            if newline_pos != -1:
+                check = check[newline_pos + 1 :]
+        if check.startswith(LEFT_PARENTHESIS) or inner.startswith(LEFT_PARENTHESIS):
+            return inner
+    return None
+
+
 def snowflake_supported_join_statement(
     left: str,
     right: str,
@@ -978,17 +1027,30 @@ def snowflake_supported_join_statement(
     left_uuid: Optional[str] = None,
     right_uuid: Optional[str] = None,
     directed: bool = False,
+    left_is_join: bool = False,
 ) -> str:
     LEFT_UUID = format_uuid(left_uuid)
     RIGHT_UUID = format_uuid(right_uuid)
-    left_alias = (
-        "SNOWPARK_LEFT"
-        if use_constant_subquery_alias
-        else random_name_for_temp_object(TempObjectType.TABLE)
-    )
+
+    # If left is the output of a previous join, flatten into a multi-way join
+    # by unwrapping the SELECT * FROM (...) envelope and appending the new
+    # right operand directly to the existing join source. This avoids nested
+    # SELECT * layers that inflate query text without changing semantics.
+    #
+    # Though it is technically less efficient than constructing the join sub-queries
+    # without the SELECT in the first place, the structure of our SQL processing code
+    # needs top-level projections to be wrapped by a select to be well-formed, so we
+    # must strip it here instead.
+    #
+    # We only unwrap the left side because it is simpler to deal with than unwrapping
+    # both left and right, and left-deep chains are more common, as they're produced
+    # by calls like df1.join(df2).join(df3) etc.
+    unwrapped_left = _unwrap_select_star_from(left) if left_is_join else None
     right_alias = (
         "SNOWPARK_RIGHT"
-        if use_constant_subquery_alias
+        if use_constant_subquery_alias and unwrapped_left is None
+        # Multi-way join: right alias must be unique to avoid collisions
+        # with aliases already present in the flattened join source.
         else random_name_for_temp_object(TempObjectType.TABLE)
     )
 
@@ -1024,18 +1086,31 @@ def snowflake_supported_join_statement(
 
     maybe_directed_sql = DIRECTED_JOIN if directed else JOIN
 
+    if unwrapped_left is not None:
+        # No need for additional parentheses around the left expression here, since it
+        # should already be parenthesized
+        left_expr = LEFT_UUID + unwrapped_left + NEW_LINE + LEFT_UUID
+    else:
+        left_alias = (
+            "SNOWPARK_LEFT"
+            if use_constant_subquery_alias
+            else random_name_for_temp_object(TempObjectType.TABLE)
+        )
+        left_expr = (
+            LEFT_PARENTHESIS
+            + NEW_LINE
+            + LEFT_UUID
+            + left
+            + NEW_LINE
+            + LEFT_UUID
+            + RIGHT_PARENTHESIS
+            + AS
+            + left_alias
+            + SPACE
+            + NEW_LINE
+        )
     source = (
-        LEFT_PARENTHESIS
-        + NEW_LINE
-        + LEFT_UUID
-        + left
-        + NEW_LINE
-        + LEFT_UUID
-        + RIGHT_PARENTHESIS
-        + AS
-        + left_alias
-        + SPACE
-        + NEW_LINE
+        left_expr
         + join_sql
         + maybe_directed_sql
         + NEW_LINE
@@ -1067,6 +1142,7 @@ def join_statement(
     left_uuid: Optional[str] = None,
     right_uuid: Optional[str] = None,
     directed: bool = False,
+    left_is_join: bool = False,
 ) -> str:
     if isinstance(join_type, (LeftSemi, LeftAnti)):
         return left_semi_or_anti_join_statement(
@@ -1094,12 +1170,18 @@ def join_statement(
         left_uuid=left_uuid,
         right_uuid=right_uuid,
         directed=directed,
+        left_is_join=left_is_join,
     )
 
 
 def get_comment_sql(comment: Optional[str]) -> str:
     return (
-        COMMENT + EQUALS + SINGLE_QUOTE + escape_single_quotes(comment) + SINGLE_QUOTE
+        COMMENT + EQUALS + SINGLE_QUOTE
+        # Escape backslashes and single quotes so a comment containing those
+        # characters does not terminate the single-quoted literal early and
+        # produce invalid SQL. A comment with no backslash/quote is emitted
+        # unchanged.
+        + escape_quotes_and_backslashes(comment) + SINGLE_QUOTE
         if comment
         else EMPTY_STRING
     )
@@ -1323,13 +1405,11 @@ def infer_schema_statement(
         + LEFT_PARENTHESIS
         + LOCATION
         + RIGHT_ARROW
-        + (path if is_single_quoted(path) else SINGLE_QUOTE + path + SINGLE_QUOTE)
+        + single_quote(path)
         + COMMA
         + FILE_FORMAT
         + RIGHT_ARROW
-        + SINGLE_QUOTE
-        + file_format_name
-        + SINGLE_QUOTE
+        + single_quote(file_format_name)
         + (
             ", "
             + ", ".join(
@@ -1358,7 +1438,14 @@ def file_operation_statement(
         return f"{REMOVE}{stage_location}{get_options_statement(options)}"
     if command.lower() == "copy_files":
         # For COPY FILES, file_name stores the value of the source stage location or subquery (from a DataFrame)
-        return f"{COPY_FILES}{INTO}{stage_location}{FROM}{file_name}{get_options_statement(options)}"
+        # Quote stage_location; file_name may be a subquery that must not be quoted
+        quoted_target = single_quote(stage_location)
+        # If file_name is a subquery (starts with '('), don't quote it
+        if file_name.strip().startswith("("):
+            source = file_name
+        else:
+            source = single_quote(file_name)
+        return f"{COPY_FILES}{INTO}{quoted_target}{FROM}{source}{get_options_statement(options)}"
     raise ValueError(f"Unsupported file operation type {command}")
 
 
@@ -1878,7 +1965,7 @@ def copy_into_location(
     return (
         COPY
         + INTO
-        + stage_location
+        + escape_location_literal(stage_location)
         + FROM
         + LEFT_PARENTHESIS
         + query
@@ -2086,12 +2173,47 @@ def table(content: str) -> str:
 
 
 def single_quote(value: str) -> str:
-    if value.startswith(SINGLE_QUOTE) and value.endswith(SINGLE_QUOTE):
+    if is_single_quoted(value):
         return value
     else:
+        # Double any embedded single quotes so the value stays a single literal
+        value = value.replace("'", "''")
         return SINGLE_QUOTE + value + SINGLE_QUOTE
 
 
+# Matches a complete, well-formed single-quoted SQL literal. The three body
+# alternatives each start with a different character (non-quote/non-backslash,
+# ', \), so every input character fits exactly one branch -- the engine never
+# backtracks, giving linear-time matching even on adversarial input.
+# Matches:     "'@stage/o''clock/'"    (interior quote is doubled -> one literal)
+# No match:    "'@x' UNION SELECT --'"  (bare interior quote ends the literal early)
+_WELL_FORMED_SINGLE_QUOTED_LITERAL = re.compile(
+    r"""
+    '                # opening single quote
+    (                # body: zero or more of...
+        [^'\\]       #   any char that is neither a quote nor a backslash
+        | ''         #   or a doubled (escaped) quote
+        | \\.        #   or a backslash followed by any char (backslash escape)
+    )*
+    '                # closing single quote
+    """,
+    re.VERBOSE | re.DOTALL,
+)
+
+
+def escape_location_literal(value: str) -> str:
+    """Return ``value`` as a single, well-formed single-quoted SQL literal.
+
+    Unlike :func:`single_quote`, a value that merely starts and ends with a
+    single quote but contains unescaped interior quotes is treated as unquoted
+    and fully escaped. This prevents a caller-controlled location from breaking
+    out of the string literal in the generated ``COPY INTO`` statement.
+    """
+    if _WELL_FORMED_SINGLE_QUOTED_LITERAL.fullmatch(value):
+        return value
+    return SINGLE_QUOTE + value.replace("'", "''") + SINGLE_QUOTE
+
+
 def quote_name_without_upper_casing(name: str) -> str:
     return DOUBLE_QUOTE + escape_quotes(name) + DOUBLE_QUOTE
 

{snowflake_snowpark_python-1.51.1 → snowflake_snowpark_python-1.53.0}/src/snowflake/snowpark/_internal/analyzer/select_statement.py

@@ -2,7 +2,6 @@
 # Copyright (c) 2012-2025 Snowflake Computing Inc. All rights reserved.
 #
 
-import sys
 import uuid
 import re
 from abc import ABC, abstractmethod
@@ -90,13 +89,7 @@ from snowflake.snowpark._internal.utils import (
 )
 import snowflake.snowpark.context as context
 
-# Python 3.8 needs to use typing.Iterable because collections.abc.Iterable is not subscriptable
-# Python 3.9 can use both
-# Python 3.10 needs to use collections.abc.Iterable because typing.Iterable is removed
-if sys.version_info <= (3, 9):
-    from typing import Iterable
-else:
-    from collections.abc import Iterable
+from collections.abc import Iterable
 
 SET_UNION = analyzer_utils.UNION
 SET_UNION_ALL = analyzer_utils.UNION_ALL
@@ -276,6 +269,7 @@ class Selectable(LogicalPlan, ABC):
         self.pre_actions: Optional[List["Query"]] = None
         self.post_actions: Optional[List["Query"]] = None
         self.flatten_disabled: bool = False
+        self.protect_dropped_new_columns: bool = False
         self._column_states: Optional[ColumnStateDict] = None
         self._snowflake_plan: Optional[SnowflakePlan] = None
         self.expr_to_alias = (
@@ -451,6 +445,19 @@ class Selectable(LogicalPlan, ABC):
                 # Add the last df ast id to the snowflake plan as the most recent
                 # dataframe operation to create this plan.
                 self._snowflake_plan.df_ast_ids = self.df_ast_ids
+            # Propagate join output flag through passthrough SelectStatements
+            # so chained joins can flatten into multi-way joins.
+            # Only SelectStatement has has_clause/has_projection; other
+            # Selectable subclasses (SelectSQL, SetStatement, etc.) skip this.
+            if (
+                isinstance(self, SelectStatement)
+                and not self.has_clause
+                and not self.has_projection
+                and isinstance(self.from_, SelectSnowflakePlan)
+            ):
+                self._snowflake_plan._is_join_output = (
+                    self.from_._snowflake_plan._is_join_output
+                )
         return self._snowflake_plan
 
     @property
@@ -597,7 +604,11 @@ class SelectableEntity(Selectable):
         # Metadata/Attributes for the plan
         self._attributes: Optional[List[Attribute]] = None
         self.table_reference = self.entity.name
-        if self.entity.time_travel_config is not None:
+        if self.entity.iceberg_changes_config is not None:
+            self.table_reference += (
+                self.entity.iceberg_changes_config.generate_sql_clause()
+            )
+        elif self.entity.time_travel_config is not None:
             self.table_reference += self.entity.time_travel_config.generate_sql_clause()
 
     def __deepcopy__(self, memodict={}) -> "SelectableEntity":  # noqa: B006
@@ -963,7 +974,7 @@ class SelectStatement(Selectable):
         new._snowflake_plan = None
         new.flatten_disabled = False  # by default a SelectStatement can be flattened.
         new._api_calls = self._api_calls.copy() if self._api_calls is not None else None
-        new.df_aliased_col_name_to_real_col_name = (
+        new.df_aliased_col_name_to_real_col_name = deepcopy(
             self.df_aliased_col_name_to_real_col_name
         )
         new._merge_projection_complexity_with_subquery = (
@@ -1493,7 +1504,7 @@ class SelectStatement(Selectable):
             can_be_flattened = False
         else:
             can_be_flattened = can_select_statement_be_flattened(
-                self.column_states, new_column_states
+                self.column_states, new_column_states, self.protect_dropped_new_columns
             )
 
         if can_be_flattened:
@@ -2190,7 +2201,9 @@ def parse_column_name(
 
 
 def can_select_statement_be_flattened(
-    subquery_column_states: ColumnStateDict, new_column_states: ColumnStateDict
+    subquery_column_states: ColumnStateDict,
+    new_column_states: ColumnStateDict,
+    protect_dropped_new_columns: bool = False,
 ) -> bool:
     for col, state in new_column_states.items():
         dependent_columns = state.dependent_columns
@@ -2213,7 +2226,13 @@ def can_select_statement_be_flattened(
             state.change_state == ColumnChangeState.DROPPED
             and (subquery_state := subquery_column_states.get(col))
             and subquery_state.change_state == ColumnChangeState.NEW
-            and subquery_state.is_referenced_by_same_level_column
+            and (
+                subquery_state.is_referenced_by_same_level_column
+                # If the subquery was explicitly marked (e.g. by the SCOS withColumn
+                # path), preserve it so that future filter/sort clauses can still
+                # reference the dropped NEW column.
+                or protect_dropped_new_columns
+            )
         ):
             return False
     return True