SNOW-3569023: bump vendored urllib3 to 2.7.0 (#2888)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sfc-gh-pczajka

DESCRIPTION.md

@@ -11,6 +11,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Dropped support for Python 3.9. The minimum supported version is now Python 3.10.
   - Fixed sdist to only install the minicore binary matching the current platform (SNOW-3526469). Previous 4.x releases copied every platform's minicore `.so`/`.dylib`/`.dll` into the install prefix, breaking downstream packagers (e.g. Homebrew) whose audits reject foreign-arch binaries.
   - Added one in-band telemetry record per successful login describing which connection-identifier fields the user supplied (`account_provided`, `account_with_region`, `account_org_provided`, `region_provided`, `host_provided`). No hostname or account value is included. This is gated by the existing server-side `CLIENT_TELEMETRY_ENABLED` parameter and can additionally be disabled locally by setting `SF_TELEMETRY_DISABLE_CONNECTION_SHAPE=true`. The telemetry collection is time-boxed and will be removed in a future release.
+  - Bumped up vendored `urllib3` to `2.7.0`
 
 - v4.5.0(May 12,2026)
   - Fixed `write_pandas` temp stage name collisions (SNOW-3481510). The old PRNG could produce identical name sequences in forked processes (e.g. Notebook kernels), causing `CREATE TEMPORARY STAGE` to fail with "Object already exists".

src/snowflake/connector/vendored/urllib3/_base_connection.py

@@ -6,7 +6,9 @@
 from .util.timeout import _DEFAULT_TIMEOUT, _TYPE_TIMEOUT
 from .util.url import Url
 
-_TYPE_BODY = typing.Union[bytes, typing.IO[typing.Any], typing.Iterable[bytes], str]
+_TYPE_BODY = typing.Union[
+    bytes, typing.IO[typing.Any], typing.Iterable[bytes | str], str
+]
 
 
 class ProxyConfig(typing.NamedTuple):

src/snowflake/connector/vendored/urllib3/_collections.py

@@ -356,7 +356,6 @@ def extend(self, *args: ValidHTTPHeaderSource, **kwargs: str) -> None:
             for key, val in other.items():
                 self.add(key, val)
         elif isinstance(other, typing.Iterable):
-            other = typing.cast(typing.Iterable[tuple[str, str]], other)
             for key, value in other:
                 self.add(key, value)
         elif hasattr(other, "keys") and hasattr(other, "__getitem__"):

src/snowflake/connector/vendored/urllib3/_version.py

@@ -1,5 +1,6 @@
-# file generated by setuptools-scm
+# file generated by vcs-versioning
 # don't change, don't track in version control
+from __future__ import annotations
 
 __all__ = [
     "__version__",
@@ -10,25 +11,14 @@
     "commit_id",
 ]
 
-TYPE_CHECKING = False
-if TYPE_CHECKING:
-    from typing import Tuple
-    from typing import Union
-
-    VERSION_TUPLE = Tuple[Union[int, str], ...]
-    COMMIT_ID = Union[str, None]
-else:
-    VERSION_TUPLE = object
-    COMMIT_ID = object
-
 version: str
 __version__: str
-__version_tuple__: VERSION_TUPLE
-version_tuple: VERSION_TUPLE
-commit_id: COMMIT_ID
-__commit_id__: COMMIT_ID
+__version_tuple__: tuple[int | str, ...]
+version_tuple: tuple[int | str, ...]
+commit_id: str | None
+__commit_id__: str | None
 
-__version__ = version = '2.6.3'
-__version_tuple__ = version_tuple = (2, 6, 3)
+__version__ = version = '2.7.0'
+__version_tuple__ = version_tuple = (2, 7, 0)
 
 __commit_id__ = commit_id = None

src/snowflake/connector/vendored/urllib3/connection.py

@@ -540,8 +540,8 @@ def request_chunked(
         """
         warnings.warn(
             "HTTPConnection.request_chunked() is deprecated and will be removed "
-            "in urllib3 v2.1.0. Instead use HTTPConnection.request(..., chunked=True).",
-            category=DeprecationWarning,
+            "in urllib3 v3.0. Instead use HTTPConnection.request(..., chunked=True).",
+            category=FutureWarning,
             stacklevel=2,
         )
         self.request(method, url, body=body, headers=headers, chunked=True)
@@ -706,9 +706,9 @@ def set_cert(
         """
         warnings.warn(
             "HTTPSConnection.set_cert() is deprecated and will be removed "
-            "in urllib3 v2.1.0. Instead provide the parameters to the "
+            "in urllib3 v3.0. Instead provide the parameters to the "
             "HTTPSConnection constructor.",
-            category=DeprecationWarning,
+            category=FutureWarning,
             stacklevel=2,
         )
 

src/snowflake/connector/vendored/urllib3/connectionpool.py

@@ -216,8 +216,8 @@ def __init__(
 
         if self.proxy:
             # Enable Nagle's algorithm for proxies, to avoid packet fragmentation.
-            # We cannot know if the user has added default socket options, so we cannot replace the
-            # list.
+            # Defaulting `socket_options` to an empty list avoids it defaulting to
+            # ``HTTPConnection.default_socket_options``.
             self.conn_kw.setdefault("socket_options", [])
 
             self.conn_kw["proxy"] = self.proxy
@@ -702,8 +702,15 @@ def urlopen(  # type: ignore[override]
             redirect. Typically this won't need to be set because urllib3 will
             auto-populate the value when needed.
         """
-        parsed_url = parse_url(url)
-        destination_scheme = parsed_url.scheme
+        # Ensure that the URL we're connecting to is properly encoded
+        if url.startswith("/"):
+            # URLs starting with / are inherently schemeless.
+            url = to_str(_encode_target(url))
+            destination_scheme = None
+        else:
+            parsed_url = parse_url(url)
+            destination_scheme = parsed_url.scheme
+            url = to_str(parsed_url.url)
 
         if headers is None:
             headers = self.headers
@@ -718,12 +725,6 @@ def urlopen(  # type: ignore[override]
         if assert_same_host and not self.is_same_host(url):
             raise HostChangedError(self, url, retries)
 
-        # Ensure that the URL we're connecting to is properly encoded
-        if url.startswith("/"):
-            url = to_str(_encode_target(url))
-        else:
-            url = to_str(parsed_url.url)
-
         conn = None
 
         # Track whether `conn` needs to be released before
@@ -896,6 +897,18 @@ def urlopen(  # type: ignore[override]
                 body = None
                 headers = HTTPHeaderDict(headers)._prepare_for_method_change()
 
+            # Strip headers marked as unsafe to forward to the redirected location.
+            # Check remove_headers_on_redirect to avoid a potential network call within
+            # self.is_same_host() which may use socket.gethostbyname() in the future.
+            if retries.remove_headers_on_redirect and not self.is_same_host(
+                redirect_location
+            ):
+                new_headers = headers.copy()  # type: ignore[union-attr]
+                for header in headers:
+                    if header.lower() in retries.remove_headers_on_redirect:
+                        new_headers.pop(header, None)
+                headers = new_headers
+
             try:
                 retries = retries.increment(method, url, response=response, _pool=self)
             except MaxRetryError:

src/snowflake/connector/vendored/urllib3/contrib/emscripten/response.py

@@ -36,6 +36,7 @@ def __init__(
     ):
         self._pool = None  # set by pool class
         self._body = None
+        self._uncached_read_occurred = False
         self._response = internal_response
         self._url = url
         self._connection = connection
@@ -160,10 +161,13 @@ def read(
                 # don't cache partial content
                 cache_content = False
                 data = self._response.body.read(amt)
+                self._uncached_read_occurred = True
             else:  # read all we can (and cache it)
                 data = self._response.body.read()
-                if cache_content:
+                if cache_content and not self._uncached_read_occurred:
                     self._body = data
+                else:
+                    self._uncached_read_occurred = True
             if self.length_remaining is not None:
                 self.length_remaining = max(self.length_remaining - len(data), 0)
             if len(data) == 0 or (

src/snowflake/connector/vendored/urllib3/contrib/pyopenssl.py

@@ -6,9 +6,9 @@
 
 This needs the following packages installed:
 
-* `pyOpenSSL`_ (tested with 16.0.0)
-* `cryptography`_ (minimum 1.3.4, from pyopenssl)
-* `idna`_ (minimum 2.0)
+* `pyOpenSSL`_ (tested with 19.0.0)
+* `cryptography`_ (minimum 2.3, from pyopenssl)
+* `idna`_ (minimum 2.1, from cryptography)
 
 However, pyOpenSSL depends on cryptography, so while we use all three directly here we
 end up having relatively few packages required.
@@ -56,7 +56,6 @@ class UnsupportedExtension(Exception):  # type: ignore[no-redef]
 import typing
 from io import BytesIO
 from socket import socket as socket_cls
-from socket import timeout
 
 from .. import util
 
@@ -311,7 +310,7 @@ def recv(self, *args: typing.Any, **kwargs: typing.Any) -> bytes:
                 raise
         except OpenSSL.SSL.WantReadError as e:
             if not util.wait_for_read(self.socket, self.socket.gettimeout()):
-                raise timeout("The read operation timed out") from e
+                raise TimeoutError("The read operation timed out") from e
             else:
                 return self.recv(*args, **kwargs)
 
@@ -336,7 +335,7 @@ def recv_into(self, *args: typing.Any, **kwargs: typing.Any) -> int:
                 raise
         except OpenSSL.SSL.WantReadError as e:
             if not util.wait_for_read(self.socket, self.socket.gettimeout()):
-                raise timeout("The read operation timed out") from e
+                raise TimeoutError("The read operation timed out") from e
             else:
                 return self.recv_into(*args, **kwargs)
 
@@ -353,7 +352,7 @@ def _send_until_done(self, data: bytes) -> int:
                 return self.connection.send(data)  # type: ignore[no-any-return]
             except OpenSSL.SSL.WantWriteError as e:
                 if not util.wait_for_write(self.socket, self.socket.gettimeout()):
-                    raise timeout() from e
+                    raise TimeoutError() from e
                 continue
             except OpenSSL.SSL.SysCallError as e:
                 raise OSError(e.args[0], str(e)) from e
@@ -520,7 +519,7 @@ def wrap_socket(
                 cnx.do_handshake()
             except OpenSSL.SSL.WantReadError as e:
                 if not util.wait_for_read(sock, sock.gettimeout()):
-                    raise timeout("select timed out") from e
+                    raise TimeoutError("select timed out") from e
                 continue
             except OpenSSL.SSL.Error as e:
                 raise ssl.SSLError(f"bad handshake: {e!r}") from e

src/snowflake/connector/vendored/urllib3/contrib/socks.py

@@ -141,7 +141,7 @@ def _new_conn(self) -> socks.socksocket:
                     raise NewConnectionError(
                         self, f"Failed to establish a new connection: {error}"
                     )
-            else:
+            else:  # Defensive: see https://github.com/urllib3/urllib3/pull/3728#pullrequestreview-3816302703
                 raise NewConnectionError(
                     self, f"Failed to establish a new connection: {e}"
                 ) from e

src/snowflake/connector/vendored/urllib3/exceptions.py

@@ -155,8 +155,8 @@ def __reduce__(self) -> _TYPE_REDUCE_RESULT:
     def pool(self) -> HTTPConnection:
         warnings.warn(
             "The 'pool' property is deprecated and will be removed "
-            "in urllib3 v2.1.0. Use 'conn' instead.",
-            DeprecationWarning,
+            "in urllib3 v3.0. Use 'conn' instead.",
+            FutureWarning,
             stacklevel=2,
         )