Snowflake ODBC Driver: baixar versions anteriors

Security fixes
- Updated the bundled root certificates and distrusted compromised intermediate certificate authority (CA) certificates for TLS checks.
New features and updates
- Added the WORKLOAD_IDENTITY_AWS_USE_OUTBOUND_TOKEN connection parameter for AWS Workload Identity Federation. When set to true, attestation uses outbound STS GetWebIdentityToken instead of the default pre-signed GetCallerIdentity token. The connection parameter takes precedence over the SNOWFLAKE_ENABLE_AWS_WIF_OUTBOUND_TOKEN environment variable.
- Added the PrivateLinkHostnameSuffix connection parameter to override the hostname suffix that the driver uses to detect a private connectivity host.
- Added the DisableResponseCacheOverride connection parameter. When set to true, the driver doesn’t set SF_OCSP_RESPONSE_CACHE_SERVER_URL when it detects a private connectivity host.
- Updated the Simba SDK to version 10.3.8.1007.
- Upgraded libsnowflakeclient to version 2.12.0, which updates the AWS SDK for C++ to version 1.11.806.5 and the Azure SDK for C++ to version 12.18.0.3.
Changes
- Changed OCSP certificate revocation checking to be off by default. To turn it on, set OCSP_FAIL_OPEN in the connection string or DSN, or OCSPFailOpen in the simba.snowflake.ini file or the Windows registry: true selects fail-open and false selects fail-close. An OCSPFailOpen value left over from an earlier version still turns OCSP on. DisableOCSPCheck=false no longer turns OCSP on. See OCSP Configuration.
- Changed DisableOCSPCheck=true so it no longer turns off fail-close checking. When OCSP_FAIL_OPEN=false is also set, fail-close checking stays on. With OCSP_FAIL_OPEN=true or no OCSP_FAIL_OPEN value, DisableOCSPCheck=true still turns OCSP off.
- Changed the driver to ignore the SF_OCSP_RESPONSE_CACHE_SERVER_URL, SF_OCSP_RESPONSE_CACHE_SERVER_ENABLED, and SF_OCSP_FAIL_OPEN environment variables while OCSP is off. The driver logs a warning for each one that is set.
- Changed CRL_CHECK=true so it no longer requires DisableOCSPCheck=true, because OCSP is off by default. A connection that turns on both OCSP and certificate revocation list (CRL) checking still fails.
Customer-facing bug fixes
- Fixed the SSLVersion and SSLVersionMax settings so they apply to all connections the driver opens, including the cloud storage connections used by PUT and GET.
- Fixed single-part PUT uploads to Amazon S3 that sent an empty body when the AWS SDK retried the request.

New features and updates
- Added the wif_host connection parameter to override the STS/IAM endpoint used for AWS and GCP Workload Identity Federation. This is independent of the WORKLOAD_IDENTITY_AUDIENCE parameter removed in this release.
- Added CRL cache cleanup so expired CRLs no longer accumulate in long-lived processes. New environment variables control cache validity and cleanup:
- SF_CRL_CACHE_CLEANUP_INTERVAL (default 3600 seconds; set to 0 to disable)
- SF_CRL_CACHE_VALIDITY_TIME (default 86400 seconds)
- SF_CRL_ON_DISK_CACHE_REMOVAL_DELAY (default 604800 seconds)
- Migrated Azure storage from azure-storage-cpplite to Azure SDK for C++ (azure-storage-blobs 12.18.0).
- Updated curl to v8.21.0.
- Upgraded libsnowflakeclient to version 2.10.0.
Changes
- Restored SigV4 GetCallerIdentity as the default AWS Workload Identity Federation attestation method. The STS GetWebIdentityToken (JWT) flow introduced in version 3.18.0 is no longer used. Version 3.21.0 doesn’t provide a connection parameter to keep the JWT flow. If your IdP trust policy requires GetWebIdentityToken, stay on version 3.20.x until a later driver release exposes an opt-in.
- Removed the WORKLOAD_IDENTITY_AUDIENCE connection parameter added in version 3.20.0. The configurable attestation audience was withdrawn; it isn’t replaced by wif_host. The driver now always uses the default audience snowflakecomputing.com. If you still set WORKLOAD_IDENTITY_AUDIENCE, the driver ignores it and logs a warning for an unexpected connection key.
Bug fixes
- Fixed credentials appearing in diagnostic trace output.
- Fixed the HTTP retry path so the request buffer is reset correctly.
- Fixed a delay in the AWS identity detector.
- Tightened string copy bounds checking after the Azure SDK migration to prevent a buffer overflow.

Customer-facing bug fixes
- Fixed OCSP cache corruption that could occur under an inter-process race condition.
- Improved validation of account, region, host, protocol, and port connection attributes used in request URLs.
- Fixed a resource handling issue that could affect DNS resolution when address lookup fails.
Other updates and internal changes
- Upgraded SimbaSDK to version 10.3.8.
- Upgraded libsnowflakeclient to version 2.9.2.
- Upgraded OpenSSL to version 3.5.7.

New features
- Added support for the BINARY_OUTPUT_FORMAT session parameter to control whether binary values are returned in BASE64 or HEX format.
- Added the QUERY_TAG connection parameter to set a default query tag for the connection. Values longer than 2000 characters are truncated.
- Added the SF_SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION environment variable as the namespaced replacement for SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION when reading JSON token files. The unprefixed variable still works but is now logged as deprecated.
- Changed AWS Workload Identity Federation attestation from a base64-encoded signed STS GetCallerIdentity request to a JWT obtained from STS GetWebIdentityToken.
Customer-facing bug fixes
- Fixed path handling in GET downloads by validating server-provided destination file names before writing locally. Unsafe names (path separators, . / .., NUL bytes, and on Windows \ / :) are now rejected instead of being used as download targets.
- Fixed an infinite JWT renewal loop during login when renew_timeout elapses repeatedly (for example, behind a bad proxy or slow network). Renewal is now bound by the configured login retry count and overall login timeout.
Other updates and internal changes
- Upgraded libsnowflakeclient to version 2.9.1.
- Upgraded curl to version 8.20.0.
- Upgraded OpenSSL to version 3.0.21.
- Upgraded AWS SDK for C++ to version 1.11.806.
- Updated client_environment telemetry to include libc family and version (LIBC_FAMILY and LIBC_VERSION) on Linux, detecting glibc or musl.

New features
- Added support for the CLIENT_SESSION_KEEP_ALIVE_HEARTBEAT_FREQUENCY session parameter to control how often the driver refreshes the session token when CLIENT_SESSION_KEEP_ALIVE is enabled.
- Added platform detection during the login flow, along with the disablePlatformDetection and platformDetectionTimeoutMs connection parameters to control the behavior.
- Added the LOG_QUERY_TEXT and LOG_QUERY_PARAMETERS connection parameters to opt in to logging of query text and bind parameter values for diagnostic purposes.
- Added support for configuring the maximum CRL download size when CRL checking is enabled.
- Added debug logging of HTTP request and response headers to help diagnose connectivity issues.
Customer-facing bug fixes
- Fixed the OCSP mode not being propagated to the HTTP calls used by the OAuth authentication flows.
- Fixed a crash when an empty MULTI_STMT DML response left the result set without a usable execute-stage result.
- Fixed a segmentation fault during the OCSP check when the certificate or its issuer was NULL.
- Fixed the query context not being updated when a query failed.
Other updates and internal changes
- Upgraded libsnowflakeclient to version 2.8.0.
- Upgraded curl to version 8.19.0.
- Upgraded OpenSSL to version 3.0.20.
- Updated the client_environment telemetry signals to include the certificate revocation check mode and the libc family and version (glibc or musl) on Linux.
- Updated SPCS service identifier token (SPCS_TOKEN) injection to be enabled only when the SNOWFLAKE_RUNNING_INSIDE_SPCS environment variable is set, to trim whitespace from the token, and to read the token only from the default location. The token_file_path parameter is no longer used to override the SPCS token path.
- Removed unnecessary log messages emitted during version validity checks.

New features and updates
- Upgraded SimbaSDK to version 10.3.7.
- Upgraded libsnowflakeclient to version 2.7.1.
- Upgraded OpenSSL to version 3.0.19.
- Updated client_environment telemetry signals to provide more information about the environment.
Bug fixes
- Fixed the incorrect return size for SQL_NUMERIC when SQL_DECIMAL to SQL_C_BINARY conversion takes place.
- Fixed SQLProcedures not returning all procedures.
- Fixed the OAuth Client Credentials flow not routing IdP token requests through the configured HTTP proxy.
- Fixed the incorrect return of SQL_SUCCESS instead of SQL_SUCCESS_WITH_INFO when the buffer for the converted string is too small.

New features and updates
- Deprecated support for CentOS 7. The minimum supported operating systems are now Red Hat Enterprise Linux (RHEL) 8 and Rocky Linux 8.
- Added the WORKLOAD_IDENTITY_IMPERSONATION_PATH connection parameter to support GCP and AWS Workload Identity Federation (WIF) impersonation.
- Added the singleAuthenticationPrompt connection parameter to control the authentication flow.
- Added the following operating system details from the /etc/os-release file as telemetry during the login request:
- NAME
- PRETTY_NAME
- ID
- BUILD_ID
- IMAGE_ID
- IMAGE_VERSION
- VERSION
- VERSION_ID
- Updated curl to version 8.16.0.
- Updated OpenSSL to version 3.0.18.
- Set LOCAL_APPLICATION as the default value for client_id and client_secret in the OAuth authorization code flow.
Bug fixes
- Fixed the expired file lock on Linux for secure storage.
- Removed the username requirement for WIF authentication.

New features and updates
- Added support for Red Hat Enterprise Linux (RHEL) 9 for x86 and ARM64 architectures.
- Introduced a shared library for extended telemetry to identify and prepare a testing platform for native Rust extensions.
- Introduced warning log messages when HTTP is used for OAuth authorization and token endpoints.
- Added support for injecting the SPCS service identifier token (SPCS_TOKEN) into login requests when present in SPCS containers.
- Introduced the token_file_path parameter in the TOML configuration to specify the path to the file containing the token.
- Introduced the SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION parameter. If set to true, the file permission check is omitted.
- Introduced a specific error when exceeding the parameter limit in a query.
- Improved logging.
- Added support for specifying the Azure client ID.
- Enabled handling of the 307 and 308 HTTP redirect codes.
Bug fixes
- Fixed duplicate error message codes.
- Fixed the default session scope for OAuth authentication.
- Fixed the default CRL cache path creation on Windows.
- Fixed session token leakage in the logs.

New features and updates
- Added support for Decfloat types.
- Support cross-signed chains during OCSP check.
- Implemented a new CRL (Certificate Revocation List) checking mechanism.
Enabling CRLs improves security by checking for revoked certificates during the TLS handshake process. For more information, see the Replacing OCSP with CRL as the method of certificate revocation checking Knowledge Base article.
This feature is disabled by default. For information on enabling this feature, see Certificate revocation list (CRL) options. Snowflake recommends that you test this feature before enabling it in production.
Bug fixes
- Removed the trailing null termination character from the JWT header and payload.

New features and updates
- Improved performance of the multi-threaded bulk fetching workflow.
Bug fixes
- Fixed a bug that, during OIDC usage, the token was not required, causing errors.
- Fixed the MacOS release to include the x86_64 architecture.
- Fix a bug with DEFAULT_VARCHAR_SIZE in configuration of the default varchar length parameter.
- Fixed a bug with numeric data conversion when using bulk fetching.

New features and updates
- Added support for workload identity federation in the AWS, Azure, Google Cloud, and Kubernetes platforms.
- Added the workload_identity_provider connection parameter.
- Added WORKLOAD_IDENTITY to the values for the authenticator connection parameter.
- Added the following configuration parameters:
- DisableTelemetry to disable telemetry.
- SSLVersionMax to specify the maximum SSL version.
- Added the PRIV_KEY_BASE64 and PRIV_KEY_PWD connection parameters that allow passing a base64-encoded private key.
Bug fixes
- Fixed an issue with the in-band telemetry event handler to properly reset the events.
- Fixed the HTTP headers used to authenticate via OKTA.
- Removed the trailing slash from the default RedirectUri within the OAuth Authorization process.

Private Preview (PrPr) features
- Added support for Workflow Identity Federation in the AWS, Azure, GCP, and Kubernetes platforms.
- These features can only be accessed by setting the SF_ENABLE_EXPERIMENTAL_AUTHENTICATION environment variable to true.
- You should use these features only with non-production data.
- Support is unavailable for these PrPr features. However, the Product and Engineering teams are available for consultation during PrPr.
- Contact your account team for participation and documentation.
New features and updates
- Added the LOCAL_APPLICATION default for the oauth_client_id and oauth_client_secret OAUTH parameters.
- Extended the Windows UI of the ODBC driver with key-pair authentication parameters PRIV_KEY_FILE and PRIV_KEY_FILE_PWD.
- Added support virtual-style domains.
- Added the DriverManagerOverride configuration parameter, which allows specifying the driver manager on Linux and MacOS.
Bug fixes
- Fixed the incorrect error thrown by fetching the cancellation request.
- Fixed the issue triggered by using bulk fetching first (retrieve multiple rows per fetch call), then switching to single row mode.
- Fixed the issue when handling easy-logging configuration could break the connection.
- Fixed an OCSP validation issue on session resuming that could lead to out of memory problem.

Private Preview (PrPr) features
Added support for PAT (Personal Access Token), OAuth 2.0 Authorization Code Flow, OAuth 2.0 Client Credentials Flow, and OAuth Token caching in Private Preview:
- For PAT:
- Added the PROGRAMMATIC_ACCESS_TOKEN parameter for the parameter authenticator.
- For OAuth 2.0 Authorization Code Flow:
- Added the oauth_client_id, oauth_client_secret, oauth_authorization_url, oauth_token_request_url, and oauth_scope DSN parameters.
- Added the OAUTH_AUTHORIZATION_CODE parameter for the parameter authenticator.
- For OAuth 2.0 Client Credentials Flow:
- Added the oauth_clientId, oauth_client_secret, oauth_token_request_url, and oauth_scope DSN parameters.
- Added the OAUTH_CLIENT_CREDENTIALS parameter for the parameter authenticator.
- For OAuth Token caching:
- Passing the UID (username) to the driver configuration is required, and clientStoreTemporaryCredential property cannot be set to false.
Disclaimer:
- These features can only be accessed by setting the SF_ENABLE_EXPERIMENTAL_AUTHENTICATION environment variable to true.
- You should use these features only with non-production data.
- Support is unavailable for these PrPr features. However, the Product and Engineering teams are available for consultation during PrPr.
- Contact your account team for participation and documentation.
New features and updates
- Updated the curl library (libcurl) from version 8.10.1 to 8.12.1.
Bug fixes
- Enabled the Address Space Layout Randomization (ASLR) security compiler option for Windows.

New features and updates
- Added support for regional Google Cloud Storage endpoints.
Bug fixes
- Fixed an issue with the driver crashing when basic_string::_M_construct is null or not valid or when a segmentation fault because the HOME environment variable is unset.
- Fixed an issue with the MacOS Secure Storage helper.
- Fixed issues with lowercasing URL when using OKTA authentication.
- Fixed a logging issue with the test button.
- Fixed an issue when a query response omits its length.
- Fixed an issue with the HTTP Date header format depending on the locale.