Upgrade to snowflake-connector-python 4.0.0 and use ocsp_root_certs_dict_lock_timeout=10

wiggzz · wiggzz · commit 6047713ae2ed · 2025-10-10T09:54:12.000-05:00
diff --git a/dbt-snowflake/pyproject.toml b/dbt-snowflake/pyproject.toml
@@ -26,7 +26,7 @@ dependencies = [
     "dbt-common>=1.10,<2.0",
     "dbt-adapters>=1.16.6,<2.0",
     # lower bound pin due to CVE-2025-24794
-    "snowflake-connector-python[secure-local-storage]>=3.13.1,<4.0.0",
+    "snowflake-connector-python[secure-local-storage]>=4.0.0,<5.0.0",
     "certifi<2025.4.26",
     # add dbt-core to ensure backwards compatibility of installation, this is not a functional dependency
     "dbt-core>=1.10.0rc0",
diff --git a/dbt-snowflake/src/dbt/adapters/snowflake/connections.py b/dbt-snowflake/src/dbt/adapters/snowflake/connections.py
@@ -394,7 +394,7 @@ def connect():
                     application="dbt",
                     insecure_mode=creds.insecure_mode,
                     session_parameters=session_parameters,
-                    client_prefetch_threads=1,  # disable client prefetch because it can cause deadlock at exit, see https://github.com/snowflakedb/snowflake-connector-python/issues/2213
+                    ocsp_root_certs_dict_lock_timeout=10, # cert lock can cause deadlock without timeout, see https://github.com/snowflakedb/snowflake-connector-python/issues/2213
                     **creds.auth_args(),
                 )
 
diff --git a/dbt-snowflake/tests/unit/test_snowflake_adapter.py b/dbt-snowflake/tests/unit/test_snowflake_adapter.py
@@ -292,7 +292,7 @@ def test_client_session_keep_alive_false_by_default(self):
                     insecure_mode=False,
                     session_parameters={},
                     reuse_connections=True,
-                    client_prefetch_threads=1,
+                    ocsp_root_certs_dict_lock_timeout=10,
                 ),
             ]
         )
@@ -326,7 +326,7 @@ def test_client_session_keep_alive_true(self):
                     insecure_mode=False,
                     session_parameters={},
                     reuse_connections=None,
-                    client_prefetch_threads=1,
+                    ocsp_root_certs_dict_lock_timeout=10,
                 )
             ]
         )
@@ -354,7 +354,7 @@ def test_client_has_query_tag(self):
                     application="dbt",
                     insecure_mode=False,
                     session_parameters={"QUERY_TAG": "test_query_tag"},
-                    client_prefetch_threads=1,
+                    ocsp_root_certs_dict_lock_timeout=10,
                 )
             ]
         )
@@ -390,7 +390,7 @@ def test_user_pass_authentication(self):
                     insecure_mode=False,
                     session_parameters={},
                     reuse_connections=True,
-                    client_prefetch_threads=1,
+                    ocsp_root_certs_dict_lock_timeout=10,
                 )
             ]
         )
@@ -425,7 +425,7 @@ def test_authenticator_user_pass_authentication(self):
                     insecure_mode=False,
                     session_parameters={},
                     reuse_connections=True,
-                    client_prefetch_threads=1,
+                    ocsp_root_certs_dict_lock_timeout=10,
                 )
             ]
         )
@@ -456,7 +456,7 @@ def test_authenticator_externalbrowser_authentication(self):
                     insecure_mode=False,
                     session_parameters={},
                     reuse_connections=True,
-                    client_prefetch_threads=1,
+                    ocsp_root_certs_dict_lock_timeout=10,
                 )
             ]
         )
@@ -491,7 +491,7 @@ def test_authenticator_oauth_authentication(self):
                     insecure_mode=False,
                     session_parameters={},
                     reuse_connections=True,
-                    client_prefetch_threads=1,
+                    ocsp_root_certs_dict_lock_timeout=10,
                 )
             ]
         )
@@ -526,7 +526,7 @@ def test_authenticator_private_key_authentication(self, mock_get_private_key):
                     insecure_mode=False,
                     session_parameters={},
                     reuse_connections=True,
-                    client_prefetch_threads=1,
+                    ocsp_root_certs_dict_lock_timeout=10,
                 )
             ]
         )
@@ -561,7 +561,7 @@ def test_authenticator_private_key_authentication_no_passphrase(self, mock_get_p
                     insecure_mode=False,
                     session_parameters={},
                     reuse_connections=True,
-                    client_prefetch_threads=1,
+                    ocsp_root_certs_dict_lock_timeout=10,
                 )
             ]
         )
@@ -594,7 +594,7 @@ def test_authenticator_jwt_authentication(self):
                     insecure_mode=False,
                     session_parameters={},
                     reuse_connections=True,
-                    client_prefetch_threads=1,
+                    ocsp_root_certs_dict_lock_timeout=10,
                 )
             ]
         )
@@ -625,7 +625,7 @@ def test_query_tag(self):
                     insecure_mode=False,
                     session_parameters={"QUERY_TAG": "test_query_tag"},
                     reuse_connections=True,
-                    client_prefetch_threads=1,
+                    ocsp_root_certs_dict_lock_timeout=10,
                 )
             ]
         )
@@ -655,7 +655,7 @@ def test_reuse_connections_with_keep_alive(self):
                     insecure_mode=False,
                     session_parameters={},
                     reuse_connections=True,
-                    client_prefetch_threads=1,
+                    ocsp_root_certs_dict_lock_timeout=10,
                 )
             ]
         )
@@ -690,7 +690,7 @@ def test_authenticator_private_key_string_authentication(self, mock_get_private_
                     insecure_mode=False,
                     session_parameters={},
                     reuse_connections=True,
-                    client_prefetch_threads=1,
+                    ocsp_root_certs_dict_lock_timeout=10,
                 )
             ]
         )
@@ -727,7 +727,7 @@ def test_authenticator_private_key_string_authentication_no_passphrase(
                     insecure_mode=False,
                     session_parameters={},
                     reuse_connections=True,
-                    client_prefetch_threads=1,
+                    ocsp_root_certs_dict_lock_timeout=10,
                 )
             ]
         )

Original file line number	Diff line number	Diff line change
`@@ -394,7 +394,7 @@ def connect():`
`394`	`394`	`application="dbt",`
`395`	`395`	`insecure_mode=creds.insecure_mode,`
`396`	`396`	`session_parameters=session_parameters,`
`397`		`- client_prefetch_threads=1, # disable client prefetch because it can cause deadlock at exit, see https://github.com/snowflakedb/snowflake-connector-python/issues/2213`
	`397`	`+ ocsp_root_certs_dict_lock_timeout=10, # cert lock can cause deadlock without timeout, see https://github.com/snowflakedb/snowflake-connector-python/issues/2213`
`398`	`398`	`**creds.auth_args(),`
`399`	`399`	`)`
`400`	`400`
Original file line number	Diff line number	Diff line change
`@@ -292,7 +292,7 @@ def test_client_session_keep_alive_false_by_default(self):`
`292`	`292`	`insecure_mode=False,`
`293`	`293`	`session_parameters={},`
`294`	`294`	`reuse_connections=True,`
`295`		`- client_prefetch_threads=1,`
	`295`	`+ ocsp_root_certs_dict_lock_timeout=10,`
`296`	`296`	`),`
`297`	`297`	`]`
`298`	`298`	`)`
`@@ -326,7 +326,7 @@ def test_client_session_keep_alive_true(self):`
`326`	`326`	`insecure_mode=False,`
`327`	`327`	`session_parameters={},`
`328`	`328`	`reuse_connections=None,`
`329`		`- client_prefetch_threads=1,`
	`329`	`+ ocsp_root_certs_dict_lock_timeout=10,`
`330`	`330`	`)`
`331`	`331`	`]`
`332`	`332`	`)`
`@@ -354,7 +354,7 @@ def test_client_has_query_tag(self):`
`354`	`354`	`application="dbt",`
`355`	`355`	`insecure_mode=False,`
`356`	`356`	`session_parameters={"QUERY_TAG": "test_query_tag"},`
`357`		`- client_prefetch_threads=1,`
	`357`	`+ ocsp_root_certs_dict_lock_timeout=10,`
`358`	`358`	`)`
`359`	`359`	`]`
`360`	`360`	`)`
`@@ -390,7 +390,7 @@ def test_user_pass_authentication(self):`
`390`	`390`	`insecure_mode=False,`
`391`	`391`	`session_parameters={},`
`392`	`392`	`reuse_connections=True,`
`393`		`- client_prefetch_threads=1,`
	`393`	`+ ocsp_root_certs_dict_lock_timeout=10,`
`394`	`394`	`)`
`395`	`395`	`]`
`396`	`396`	`)`
`@@ -425,7 +425,7 @@ def test_authenticator_user_pass_authentication(self):`
`425`	`425`	`insecure_mode=False,`
`426`	`426`	`session_parameters={},`
`427`	`427`	`reuse_connections=True,`
`428`		`- client_prefetch_threads=1,`
	`428`	`+ ocsp_root_certs_dict_lock_timeout=10,`
`429`	`429`	`)`
`430`	`430`	`]`
`431`	`431`	`)`
`@@ -456,7 +456,7 @@ def test_authenticator_externalbrowser_authentication(self):`
`456`	`456`	`insecure_mode=False,`
`457`	`457`	`session_parameters={},`
`458`	`458`	`reuse_connections=True,`
`459`		`- client_prefetch_threads=1,`
	`459`	`+ ocsp_root_certs_dict_lock_timeout=10,`
`460`	`460`	`)`
`461`	`461`	`]`
`462`	`462`	`)`
`@@ -491,7 +491,7 @@ def test_authenticator_oauth_authentication(self):`
`491`	`491`	`insecure_mode=False,`
`492`	`492`	`session_parameters={},`
`493`	`493`	`reuse_connections=True,`
`494`		`- client_prefetch_threads=1,`
	`494`	`+ ocsp_root_certs_dict_lock_timeout=10,`
`495`	`495`	`)`
`496`	`496`	`]`
`497`	`497`	`)`
`@@ -526,7 +526,7 @@ def test_authenticator_private_key_authentication(self, mock_get_private_key):`
`526`	`526`	`insecure_mode=False,`
`527`	`527`	`session_parameters={},`
`528`	`528`	`reuse_connections=True,`
`529`		`- client_prefetch_threads=1,`
	`529`	`+ ocsp_root_certs_dict_lock_timeout=10,`
`530`	`530`	`)`
`531`	`531`	`]`
`532`	`532`	`)`
`@@ -561,7 +561,7 @@ def test_authenticator_private_key_authentication_no_passphrase(self, mock_get_p`
`561`	`561`	`insecure_mode=False,`
`562`	`562`	`session_parameters={},`
`563`	`563`	`reuse_connections=True,`
`564`		`- client_prefetch_threads=1,`
	`564`	`+ ocsp_root_certs_dict_lock_timeout=10,`
`565`	`565`	`)`
`566`	`566`	`]`
`567`	`567`	`)`
`@@ -594,7 +594,7 @@ def test_authenticator_jwt_authentication(self):`
`594`	`594`	`insecure_mode=False,`
`595`	`595`	`session_parameters={},`
`596`	`596`	`reuse_connections=True,`
`597`		`- client_prefetch_threads=1,`
	`597`	`+ ocsp_root_certs_dict_lock_timeout=10,`
`598`	`598`	`)`
`599`	`599`	`]`
`600`	`600`	`)`
`@@ -625,7 +625,7 @@ def test_query_tag(self):`
`625`	`625`	`insecure_mode=False,`
`626`	`626`	`session_parameters={"QUERY_TAG": "test_query_tag"},`
`627`	`627`	`reuse_connections=True,`
`628`		`- client_prefetch_threads=1,`
	`628`	`+ ocsp_root_certs_dict_lock_timeout=10,`
`629`	`629`	`)`
`630`	`630`	`]`
`631`	`631`	`)`
`@@ -655,7 +655,7 @@ def test_reuse_connections_with_keep_alive(self):`
`655`	`655`	`insecure_mode=False,`
`656`	`656`	`session_parameters={},`
`657`	`657`	`reuse_connections=True,`
`658`		`- client_prefetch_threads=1,`
	`658`	`+ ocsp_root_certs_dict_lock_timeout=10,`
`659`	`659`	`)`
`660`	`660`	`]`
`661`	`661`	`)`
`@@ -690,7 +690,7 @@ def test_authenticator_private_key_string_authentication(self, mock_get_private_`
`690`	`690`	`insecure_mode=False,`
`691`	`691`	`session_parameters={},`
`692`	`692`	`reuse_connections=True,`
`693`		`- client_prefetch_threads=1,`
	`693`	`+ ocsp_root_certs_dict_lock_timeout=10,`
`694`	`694`	`)`
`695`	`695`	`]`
`696`	`696`	`)`
`@@ -727,7 +727,7 @@ def test_authenticator_private_key_string_authentication_no_passphrase(`
`727`	`727`	`insecure_mode=False,`
`728`	`728`	`session_parameters={},`
`729`	`729`	`reuse_connections=True,`
`730`		`- client_prefetch_threads=1,`
	`730`	`+ ocsp_root_certs_dict_lock_timeout=10,`
`731`	`731`	`)`
`732`	`732`	`]`
`733`	`733`	`)`