SNOW-1763673 python3.13 support (#2239)

Co-authored-by: Mark Keller <[email protected]>

(cherry picked from commit ac24917)

Author: sfc-gh-fpawlowski

.github/workflows/build_test.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: '3.8'
+          python-version: '3.9'
       - name: Display Python version
         run: python -c "import sys; import os; print(\"\n\".join(os.environ[\"PATH\"].split(os.pathsep))); print(sys.version); print(sys.executable);"
       - name: Upgrade setuptools, pip and wheel
@@ -53,7 +53,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
+        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
     steps:
       - uses: actions/checkout@v4
       - name: Set up Python
@@ -82,7 +82,7 @@ jobs:
             id: macosx_x86_64
           - image: macos-latest
             id: macosx_arm64
-        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
+        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
     name: Build ${{ matrix.os.id }}-py${{ matrix.python-version }}
     runs-on: ${{ matrix.os.image }}
     steps:
@@ -98,7 +98,7 @@ jobs:
           platforms: all
       - uses: actions/checkout@v4
       - name: Building wheel
-        uses: pypa/cibuildwheel@v2.16.5
+        uses: pypa/cibuildwheel@v2.21.3
         env:
           CIBW_BUILD: cp${{ env.shortver }}-${{ matrix.os.id }}
           MACOSX_DEPLOYMENT_TARGET: 10.14  # Should be kept in sync with ci/build_darwin.sh
@@ -127,8 +127,17 @@ jobs:
            download_name: macosx_x86_64
          - image_name: windows-latest
            download_name: win_amd64
-        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
+        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
         cloud-provider: [aws, azure, gcp]
+        # TODO: When there are prebuilt wheels accessible for our dependencies (i.e. numpy)
+        # for Python 3.13 windows runs can be re-enabled. Currently, according to numpy:
+        # "Numpy built with MINGW-W64 on Windows 64 bits is experimental, and only available for
+        # testing. You are advised not to use it for production."
+        exclude:
+          - os:
+              image_name: windows-latest
+              download_name: win_amd64
+            python-version: "3.13"
     steps:
       - uses: actions/checkout@v4
       - name: Set up Python
@@ -192,9 +201,11 @@ jobs:
       fail-fast: false
       matrix:
         os:
-         - image_name: ubuntu-latest
+         # Because old the version 3.0.2 of snowflake-connector-python depends on oscrypto which causes conflicts with higher versions of libssl
+         # TODO: It can be changed to ubuntu-latest, when python sf connector version in tox is above 3.4.0
+         - image_name: ubuntu-20.04
            download_name: linux
-        python-version: [3.8]
+        python-version: [3.9]
         cloud-provider: [aws]
     steps:
       - uses: actions/checkout@v4
@@ -233,7 +244,7 @@ jobs:
         os:
          - image_name: ubuntu-latest
            download_name: linux
-        python-version: [3.8]
+        python-version: [3.9]
         cloud-provider: [aws]
     steps:
       - uses: actions/checkout@v4
@@ -256,7 +267,7 @@ jobs:
         shell: bash
 
   test-fips:
-    name: Test FIPS linux-3.8-${{ matrix.cloud-provider }}
+    name: Test FIPS linux-3.9-${{ matrix.cloud-provider }}
     needs: build
     runs-on: ubuntu-latest
     strategy:
@@ -275,23 +286,23 @@ jobs:
       - name: Download wheel(s)
         uses: actions/download-artifact@v4
         with:
-          name: manylinux_x86_64_py3.8
+          name: manylinux_x86_64_py3.9
           path: dist
       - name: Show wheels downloaded
         run: ls -lh dist
         shell: bash
       - name: Run tests
         run: ./ci/test_fips_docker.sh
         env:
-          PYTHON_VERSION: 3.8
+          PYTHON_VERSION: 3.9
           cloud_provider: ${{ matrix.cloud-provider }}
           PYTEST_ADDOPTS: --color=yes --tb=short
           TOX_PARALLEL_NO_SPINNER: 1
         shell: bash
       - uses: actions/upload-artifact@v4
         with:
           include-hidden-files: true
-          name: coverage_linux-fips-3.8-${{ matrix.cloud-provider }}
+          name: coverage_linux-fips-3.9-${{ matrix.cloud-provider }}
           path: |
             .coverage
             coverage.xml
@@ -303,7 +314,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
+        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
         cloud-provider: [aws]
     steps:
       - name: Set shortver
@@ -447,7 +458,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: '3.8'
+          python-version: '3.9'
       - name: Display Python version
         run: python -c "import sys; print(sys.version)"
       - name: Upgrade setuptools and pip

.github/workflows/create_req_files.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.9", "3.10", "3.11", "3.12"]
+        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
     steps:
       - uses: actions/checkout@v3
       - name: Set up Python

DESCRIPTION.md

@@ -7,11 +7,50 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
+- v3.14.1(TBD)
+  - Added support for Python 3.13.
+    - NOTE: Windows 64 support is still experimental and should not yet be used for production environments.
+  - Dropped support for Python 3.8.
+  - Basic decimal floating-point type support.
+  - Added handling of PAT provided in `password` field.
+  - Improved error message for client-side query cancellations due to timeouts.
+  - Added support of GCS regional endpoints.
+  - Added `gcs_use_virtual_endpoints` connection property that forces the usage of the virtual GCS usage. See more: https://cloud.google.com/storage/docs/request-endpoints#xml-api
+  - Fixed a bug that caused driver to fail silently on `TO_DATE` arrow to python conversion when invalid date was followed by the correct one.
+  - Added `check_arrow_conversion_error_on_every_column` connection property that can be set to `False` to restore previous behaviour in which driver will ignore errors until it occurs in the last column. This flag's purpose is to unblock workflows that may be impacted by the bugfix and will be removed in later releases.
+
+- v3.14.0(March 03, 2025)
+  - Bumped pyOpenSSL dependency upper boundary from <25.0.0 to <26.0.0.
+  - Added a <19.0.0 pin to pyarrow as a workaround to a bug affecting Azure Batch.
+  - Optimized distribution package lookup to speed up import.
+  - Fixed a bug where privatelink OCSP Cache url could not be determined if privatelink account name was specified in uppercase.
+  - Added support for iceberg tables to `write_pandas`.
+  - Fixed base64 encoded private key tests.
+  - Fixed a bug where file permission check happened on Windows.
+  - Added support for File types.
+  - Added `unsafe_file_write` connection parameter that restores the previous behaviour of saving files downloaded with GET with 644 permissions.
+  - Deprecated `insecure_mode` connection property and replaced it with `disable_ocsp_checks` with the same behavior as the former property.
+
 - v3.13.2(January 29, 2025)
   - Changed not to use scoped temporary objects.
 
-- v3.12.4(TBD)
+- v3.13.1(January 29, 2025)
+  - Remedied SQL injection vulnerability in snowflake.connector.pandas_tools.write_pandas. See more https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-2vpq-fh52-j3wv
+  - Remedied vulnerability in deserialization of the OCSP response cache. See more: https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-m4f6-vcj4-w5mx
+  - Remedied vulnerability connected to cache files permissions. See more: https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-r2x6-cjg7-8r43
+
+- v3.13.0(January 23,2025)
+  - Added a feature to limit the sizes of IO-bound ThreadPoolExecutors during PUT and GET commands.
+  - Updated README.md to include instructions on how to verify package signatures using `cosign`.
+  - Updated the log level for cursor's chunk rowcount from INFO to DEBUG.
+  - Added a feature to verify if the connection is still good enough to send queries over.
+  - Added support for base64-encoded DER private key strings in the `private_key` authentication type.
+
+- v3.12.4(December 3,2024)
   - Fixed a bug where multipart uploads to Azure would be missing their MD5 hashes.
+  - Fixed a bug where OpenTelemetry header injection would sometimes cause Exceptions to be thrown.
+  - Fixed a bug where OCSP checks would throw TypeError and make mainly GCP blob storage unreachable.
+  - Bumped pyOpenSSL dependency from >=16.2.0,<25.0.0 to >=22.0.0,<25.0.0.
 
 - v3.12.3(October 25,2024)
   - Improved the error message for SSL-related issues to provide clearer guidance when an SSL error occurs.

Jenkinsfile

@@ -47,11 +47,13 @@ timestamps {
           println("Exception computing commit hash from: ${response}")
           }
         parallel (
-          'Test Python 38': { build job: 'RT-PyConnector38-PC',parameters: params},
           'Test Python 39': { build job: 'RT-PyConnector39-PC',parameters: params},
           'Test Python 310': { build job: 'RT-PyConnector310-PC',parameters: params},
           'Test Python 311': { build job: 'RT-PyConnector311-PC',parameters: params},
           'Test Python 312': { build job: 'RT-PyConnector312-PC',parameters: params},
+          'Test Python 313': { build job: 'RT-PyConnector313-PC',parameters: params},
+          'Test Python 39 OldDriver': { build job: 'RT-PyConnector39-OldDriver-PC',parameters: params},
+          'Test Python 39 FIPS': { build job: 'RT-FIPS-PyConnector39',parameters: params},
           )
         }
       }

README.md

@@ -15,7 +15,7 @@ using the Snowflake JDBC or ODBC drivers.
 
 The connector has **no** dependencies on JDBC or ODBC.
 It can be installed using ``pip`` on Linux, Mac OSX, and Windows platforms
-where Python 3.8.0 (or higher) is installed.
+where Python 3.9.0 (or higher) is installed.
 
 Snowflake Documentation is available at:
 https://docs.snowflake.com/
@@ -27,7 +27,7 @@ https://community.snowflake.com/s/article/How-To-Submit-a-Support-Case-in-Snowfl
 
 ### Locally
 
-Install Python 3.8.0 or higher. Clone the Snowflake Connector for Python repository, then run the following commands
+Install a supported Python version. Clone the Snowflake Connector for Python repository, then run the following commands
 to create a wheel package using PEP-517 build:
 
 ```shell
@@ -42,7 +42,7 @@ Find the `snowflake_connector_python*.whl` package in the `./dist` directory.
 ### In Docker
 Or use our Dockerized build script `ci/build_docker.sh` and find the built wheel files in `dist/repaired_wheels`.
 
-Note: `ci/build_docker.sh` can be used to compile only certain versions, like this: `ci/build_docker.sh "3.8 3.9"`
+Note: `ci/build_docker.sh` can be used to compile only certain versions, like this: `ci/build_docker.sh "3.9 3.10"`
 
 ## Code hygiene and other utilities
 These tools are integrated into `tox` to allow us to easily set them up universally on any computer.

ci/build_darwin.sh

@@ -2,13 +2,8 @@
 #
 # Build Snowflake Python Connector on Mac
 # NOTES:
-#   - To compile only a specific version(s) pass in versions like: `./build_darwin.sh "3.8 3.9"`
-arch=$(uname -m)
-if [[ "$arch" == "arm64" ]]; then
-  PYTHON_VERSIONS="${1:-3.8 3.9 3.10 3.11 3.12}"
-else
-  PYTHON_VERSIONS="${1:-3.8 3.9 3.10 3.11 3.12}"
-fi
+#   - To compile only a specific version(s) pass in versions like: `./build_darwin.sh "3.9 3.10"`
+PYTHON_VERSIONS="${1:-3.9 3.10 3.11 3.12 3.13}"
 
 THIS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 CONNECTOR_DIR="$(dirname "${THIS_DIR}")"

ci/build_docker.sh

@@ -2,7 +2,7 @@
 #
 # Build Snowflake Python Connector in Docker
 # NOTES:
-#   - To compile only a specific version(s) pass in versions like: `./build_docker.sh "3.8 3.9"`
+#   - To compile only a specific version(s) pass in versions like: `./build_docker.sh "3.9 3.10"`
 set -o pipefail
 
 THIS_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

ci/build_linux.sh

@@ -3,11 +3,11 @@
 # Build Snowflake Python Connector on Linux
 # NOTES:
 #   - This is designed to ONLY be called in our build docker image
-#   - To compile only a specific version(s) pass in versions like: `./build_linux.sh "3.8 3.9"`
+#   - To compile only a specific version(s) pass in versions like: `./build_linux.sh "3.9 3.10"`
 set -o pipefail
 
 U_WIDTH=16
-PYTHON_VERSIONS="${1:-3.8 3.9 3.10 3.11 3.12}"
+PYTHON_VERSIONS="${1:-3.9 3.10 3.11 3.12 3.13}"
 THIS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 CONNECTOR_DIR="$(dirname "${THIS_DIR}")"
 DIST_DIR="${CONNECTOR_DIR}/dist"

ci/build_windows.bat

@@ -6,14 +6,14 @@
 SET SCRIPT_DIR=%~dp0
 SET CONNECTOR_DIR=%~dp0\..\
 
-set python_versions= 3.8 3.9 3.10 3.11 3.12
+set python_versions= 3.9 3.10 3.11 3.12 3.13
 
 cd %CONNECTOR_DIR%
 
 set venv_dir=%WORKSPACE%\venv-flake8
 if %errorlevel% neq 0 goto :error
 
-py -3.8 -m venv %venv_dir%
+py -3.9 -m venv %venv_dir%
 if %errorlevel% neq 0 goto :error
 
 call %venv_dir%\scripts\activate

ci/docker/connector_build/Dockerfile

@@ -14,6 +14,4 @@ WORKDIR /home/user
 RUN chmod 777 /home/user
 RUN git clone https://github.com/matthew-brett/multibuild.git && cd /home/user/multibuild && git checkout bfc6d8b82d8c37b8ca1e386081fd800e81c6ab4a
 
-ENV PATH="${PATH}:/opt/python/cp37-cp37m/bin:/opt/python/cp38-cp38/bin:/opt/python/cp39-cp39/bin:/opt/python/cp310-cp310/bin:/opt/python/cp311-cp311/bin:/opt/python/cp312-cp312/bin"
-
 ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]