Bump snowflake-connector-python from 4.6.0 to 4.7.3 in /Admin UI

[dependabot]

Bumps snowflake-connector-python from 4.6.0 to 4.7.3.

Release notes

Sourced from snowflake-connector-python's releases.

4.7.3

• v4.7.3(Sep 3,2026)
  • Added experimental Python 3.14t (free-threaded CPython) wheel support. Experimental — not intended for production use.
  • Fixed TLS hostname verification rejecting matching certificate SANs when a Snowflake account locator contains an underscore (SNOW-4011646).
  • Fixed connect() being significantly slower on deep call stacks (e.g. Django apps with several middleware/decorator layers) because get_application_path() used inspect.stack(), which reads and parses the source file of every frame on the stack. It now walks frame references directly instead (SNOW-3691001, #2908).
  • Fixed split_statements truncating unquoted URLs containing :// at the //, misreading it as a line comment. The guards added alongside // comment support in 4.7.2 (SNOW-3772985) only recognized file://, so every other scheme (http://, https://, s3://, snow://, azure://) was cut short. Any scheme:// is now recognized, on both the line-comment and block-comment paths (the latter affected globs such as s3://bucket/*.csv) (SNOW-3930192).
  • Fixed the on-disk OCSP response validation cache failing with RuntimeError: UnixFileLock on ... was inherited across fork; construct a new instance when it was written from a forked child process. This could surface on fork-based platforms when fetching results with client_fetch_use_mp=True, where chunk downloads run in worker processes that perform their own certificate revocation checks. The cache's file lock is now re-created when the owning process changes, matching what already happened for the spawn start method.
  • Result batch construction now logs only whether a qrmk is present, for both the sync and async result paths (SNOW-3675590).
  • DEBUG logging in create_batches_from_response() reports chunk-header names with type/length value metadata (SNOW-3675590).
  • The malformed-response ERROR log in create_batches_from_response() reports a structural summary of the response (SNOW-3675590).
  • SQL text is masked before it is written to DEBUG logs: _format_query_for_log() runs the query through SecretDetector, covering the cursor and connection paths on both sync and async. The cancel-query log paths use the same masking (SNOW-3675590).
  • Deferred the SQL-masking cost to log emit-time: query DEBUG lines pass a lazy _format_query_for_log_lazy() wrapper whose __str__ masks only whena handler emits the record (SNOW-3675590).
  • Corrected the invalid-account-identifier error message so it matches the validator, which allows '.' as a label separator.
  • The WORKLOAD_IDENTITY authenticator runs only against recognized Snowflake hosts: the connection host is normalized and suffix-anchored against snowflakecomputing.com, .cn, and .mil before the workload-identity flow proceeds. The SNOWFLAKE_WIF_ALLOWED_HOST_SUFFIXES environment variable additively extends the recognized-host list (SNOW-3675580).
  • Improved the robustness and correctness of OCSP revocation checking (SNOW-3675581).
    • When SF_OCSP_RESPONSE_CACHE_SERVER_URL is set, the connector uses it as the OCSP cache server, including on PrivateLink hosts.
    • A PrivateLink OCSP cache URL is derived only for hosts that consist of hostname characters, include a .privatelink. label, and end at snowflakecomputing.com, .cn, or .mil. Other hosts use the public default cache URL; set SF_OCSP_RESPONSE_CACHE_SERVER_URL to use a different cache server.
  • Extended log secret masking coverage (SNOW-3675583). The connection-token pattern accepts : and % in the token value. Added patterns for OAuth access and refresh tokens in serialized JSON, for one-time passcodes, and for OAuth client identifiers and secrets. The passcode pattern accepts quoted values. The password pattern requires at least six characters in the value, so ordinary prose following the word "password" is not redacted.
  • Request headers are copied before mutation on the async path, and masking is applied to the Authorization header in error logs (SNOW-3675593).
  • Applied secret masking to the snowflake.connector loggers by default, independent of how application logging is configured. The same filter also covers the third-party loggers the connector uses (botocore, boto3, aiohttp, aiobotocore, aioboto3, vendored urllib3). Set SNOWFLAKE_DISABLE_LOG_SECRET_MASKING=true to opt out; it is honored at emit time, including after import (SNOW-3675583).

4.7.2

• v4.7.2(Aug 6,2026)
  • Fixed a thread leak in the file transfer agent by properly shutting down ThreadPoolExecutors after PUT/GET transfers (SNOW-3556240, #2878).
  • Fixed split_statements treating // as SQL instead of a line comment, which could merge multiple statements when a // comment contained an apostrophe (SNOW-3772985).
  • Fixed large-file PUT uploads to internal Azure stages failing against the Azure 50,000-block-per-blob limit. The Azure multipart chunk size is now scaled up dynamically for very large files (mirroring the existing S3 behavior), and the default Azure chunk size was raised from 4 MB to 8 MB (consistent with S3) for better throughput (SNOW-3839943).
  • Fixed OAuth cached-credential connections failing with 250001 Invalid OAuth access token when the cached token was invalid (GS code 390303); the connector now reauthenticates silently (via refresh token if available, otherwise browser) instead of hard-failing. Also fixed fresh processes holding only a cached refresh token going straight to an interactive browser prompt instead of attempting a silent refresh first.
  • Fixed Okta/SAML authentication reporting an exhausted login_timeout as 250003: Failed to execute request: Attempted to set connect timeout to <negative value>. Obtaining the one-time token in step 4 can overshoot the login deadline, which made the remaining budget negative; it was then passed to the HTTP layer, which rejected it with an opaque ValueError. A timed-out SAML login now raises 250006 with a message naming login_timeout. Running out of budget while retrying on RefreshTokenError reports the same error instead of failing later with an AttributeError on an empty response (SNOW-3891419).
  • Fixed OAuth authorization code flow failing for accounts with uppercase letters in the account name. urlparse().hostname always returns lowercase, but the host was compared case-sensitively in _is_snowflake_as_idp, causing Snowflake-as-IdP detection to return False and raising error 251013 (client_id is empty) even for connections that don't require a client ID.

4.7.1

• v4.7.1(Jul 15,2026)
  • Added support for Python 3.14t (free-threaded).
    • Note: Python 3.14t CI testing excludes win_arm64 (no cryptography wheels available) and mitmproxy proxy tests on all platforms (transitive dependencies aioquic/pylsqpack lack free-threaded-compatible wheels).
  • Improved verification of TLS connections (SNOW-3675579).
  • Fixed python-connector.log not rotating on Windows, and every record being logged twice, when easy logging is enabled via config.toml (SNOW-3680325).
    • Note: As part of this fix, easy logging no longer calls logging.basicConfig() and therefore no longer configures the root logger. python-connector.log now captures only the snowflake.connector, botocore, and boto3.
  • Improved URL validation reliability by replacing the hand-rolled regex in is_valid_url() with urllib.parse.urlparse (SNOW-3392651).
  • Fixed OAuth infinite loop when tokens expire by ensuring reauthenticate() calls _request_tokens() directly instead of looping through prepare(). Token cache is now read exactly once per connection, and _store_tokens() preserves macOS Keychain ACL by never calling remove(). The async OAuth reauthenticate() now runs the synchronous OAuth flow on a worker thread instead of blocking the event loop.
  • Fixed OAuth scope handling for Snowflake custom OAuth: when refresh tokens are enabled, the connector no longer appends the OIDC offline_access scope for token endpoints on *.snowflakecomputing.com or *.snowflakecomputing.cn, which caused invalid_scope errors. Snowflake custom OAuth expects refresh_token in scope instead. External IdP behavior is unchanged.
  • Fixed input validation for scale metadata in Arrow result set processing for TIME, TIMESTAMP_NTZ, TIMESTAMP_LTZ, and TIMESTAMP_TZ columns (SNOW-3388299).
  • Fixed S3 storage client to correctly handle 307/308 (method-preserving) and 301/302 (GET/HEAD only) redirects by disabling automatic redirect following and re-signing each request with AWS SigV4 credentials for the redirect target. The region is updated from the x-amz-bucket-region response header on each redirect. Redirects are capped at 5 hops.
  • Added native AKS (Azure Kubernetes Service) workload identity support. When running on AKS with workload identity configured, the connector automatically uses WorkloadIdentityCredential to authenticate via the injected service account credentials. OIDC backward compatibility is also supported.
  • Added the workload_identity_aws_use_outbound_token connection option (default false) to opt into AWS WIF JWT attestation via STS GetWebIdentityToken instead of the default SigV4 GetCallerIdentity method.
  • Fixed a bug where a fully-qualified DDL statement (e.g. CREATE VIEW db.schema.obj) on a session with no current schema would populate the connector's cached _schema/_database from the referenced object's namespace. This made get_current_schema() diverge from the server's CURRENT_SCHEMA() and mis-qualified Snowpark temp objects (SNOW-3665226).

4.7.0

• v4.7.0(Jul 2,2026)
  • Fixed python-connector.log not rotating on Windows, and every record being logged twice, when easy logging is enabled via config.toml (SNOW-3680325).
    • Note: As part of this fix, easy logging no longer calls logging.basicConfig() and therefore no longer configures the root logger. python-connector.log now captures only the snowflake.connector, botocore, and boto3.

... (truncated)

Commits

• e4ef96f NO-SNOW: fix the Wiremock harness on Windows (#3023)
• 721d745 NO-SNOW: make SFDictFileCache's file lock fork-safe (#3017)
• e723ebf NO-SNOW: Let Wiremock allocate its own ports to fix a startup bind race (#3018)
• 9e0cbda Fix test setup after OCSP fix (#3016)
• afcfed9 update test requirements for 4.7.3
• 68f5698 Bump up version to 4.7.3
• 84ea185 SNOW-3675583: enable secret masking on connector loggers by default
• fa40fa7 SNOW-3675593: copy headers before mutation on the async path and apply maskin...
• 0d220ee SNOW-3675583: extend SecretDetector patterns for tokens, passcodes, and relat...
• dda0a8d SNOW-3675581: improve OCSP revocation checking robustness and correctness
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)