ODBC Driver release notes for 2026

This article contains the release notes for the ODBC Driver, including the following when applicable:

  • Behavior changes
  • New features
  • Customer-facing bug fixes

Snowflake uses semantic versioning for ODBC Driver updates.

See ODBC Driver for documentation.

Version 4.0.0-rc4 (Sep 17, 2026)

Fourth public preview release of the ODBC Driver built on the Universal Core. This is a new version line, distributed as a release candidate and downloaded separately from the 3.x driver. See Snowflake ODBC Driver built on the Universal Core for installation instructions, the curated list of behavior differences, and migration guidance.

Changes

  • Changed catalog functions so a NULL CatalogName is no longer replaced with the current database by default. Set UseCurrentCatalog=true (or enable CLIENT_METADATA_REQUEST_USE_CONNECTION_CTX) to restore that substitution. Unconstrained NULL-catalog searches issue account-wide SHOW statements.
  • Changed SQLDriverConnect to post a local 01S00 warning for connection-string keywords it does not recognize (native error 17, “N invalid keys are found in the connection string: <KEY>”); a keyword is recognized when the sf_core parameter registry resolves it or it names an ODBC structural keyword (DSN, DRIVER, FILEDSN, SAVEFILE). The connection still opens and the keyword is still forwarded to the server.
  • Removed the Tracing(0-6) field from the Windows ODBC DSN setup dialog; driver logging uses sf.odbc.ini (LogLevel, LogPath) instead. Legacy TRACING values in a DSN or connection string are ignored.
  • Changed client-local rejection of a non-credential connection parameter to report SQLSTATE HY000 instead of the warning-class 01S00; affected cases are an invalid PORT, an unparseable connection string, and any invalid or missing non-credential parameter. 01S00 is defined by the ODBC specification as a SQL_SUCCESS_WITH_INFO warning meaning the connection opened anyway, so returning it on SQL_ERROR led applications that branch on the SQLSTATE class to treat a failed connection as a warning. ODBC 3.x returned 28000 (native error 20032) for these cases.
  • Changed a missing key-pair credential (PRIVATE_KEY / PRIVATE_KEY_FILE) and a missing bearer token (TOKEN / TOKEN_FILE_PATH) to report SQLSTATE 28000 instead of 01S00, matching ODBC 3.x and the SQLSTATE already reported when either parameter is named on its own.
  • Changed rejection of a Workload Identity Federation parameter (WORKLOAD_IDENTITY_PROVIDER, WORKLOAD_IDENTITY_ENTRA_RESOURCE, WORKLOAD_IDENTITY_IMPERSONATION_PATH, WORKLOAD_IDENTITY_AWS_USE_OUTBOUND_TOKEN) to report SQLSTATE 28000 rather than a general error, so a missing or invalid one is reported as the authentication failure it is. ODBC 3.x reported 28000 for a missing WORKLOAD_IDENTITY_PROVIDER.
  • Changed the diagnostic message on a failed login to lead with the server’s own text: SQLGetDiagRec now reads Failed to login: Login error: <server text>, code: <code> on its first line, where the server sentence previously appeared only inside the error trace. SQLSTATE and native error code are unchanged.
  • Improved log output to mask OAuth client IDs and AWS access-key IDs.

New features and updates

  • Added a PUT_GET_MAX_ATTEMPTS connection parameter for the shared PUT/GET attempt limit, and accepted the 3.x PUT_MAXRETRIES / GET_MAXRETRIES spellings as aliases that warn (01000) on use.
  • Added the ODBC UseCurrentCatalog connection parameter (default false), matching the 3.x DSN key. When true, a NULL CatalogName on SQLTables, SQLColumns, SQLPrimaryKeys, SQLForeignKeys, SQLProcedures, and SQLProcedureColumns is the current database.
  • Added TRACE-level entry and exit logs for all public ODBC functions.

Customer-facing bug fixes

  • Fixed SQLGetTypeInfo to return type information matching the application’s configured ODBC version.
  • Fixed SQL_C_DEFAULT on catalog SMALLINT and INTEGER columns so SQLGetTypeInfo and SQLColumns return binary integers instead of failing with SQLSTATE 22003.
  • Fixed INTERVAL DAY-TIME result fetch for subtypes whose Arrow scale is not TIME precision (MINUTE TO SECOND, SECOND, and truncated DAY TO SECOND fractions).
  • Fixed SQLColumns sizes for GEOGRAPHY and GEOMETRY to follow the session VARCHAR maximum.

Version 3.21.0 (Sep 10, 2026)

New features and updates

  • Added the wif_host connection parameter to override the STS/IAM endpoint used for AWS and GCP Workload Identity Federation. This is independent of the WORKLOAD_IDENTITY_AUDIENCE parameter removed in this release.
  • Added CRL cache cleanup so expired CRLs no longer accumulate in long-lived processes. New environment variables control cache validity and cleanup:
  • Migrated Azure storage from azure-storage-cpplite to Azure SDK for C++ (azure-storage-blobs 12.18.0).
  • Updated curl to v8.21.0.
  • Upgraded libsnowflakeclient to version 2.10.0.

Changes

  • Restored SigV4 GetCallerIdentity as the default AWS Workload Identity Federation attestation method. The STS GetWebIdentityToken (JWT) flow introduced in version 3.18.0 is no longer used. Version 3.21.0 doesn’t provide a connection parameter to keep the JWT flow. If your IdP trust policy requires GetWebIdentityToken, stay on version 3.20.x until a later driver release exposes an opt-in.
  • Removed the WORKLOAD_IDENTITY_AUDIENCE connection parameter added in version 3.20.0. The configurable attestation audience was withdrawn; it isn’t replaced by wif_host. The driver now always uses the default audience snowflakecomputing.com. If you still set WORKLOAD_IDENTITY_AUDIENCE, the driver ignores it and logs a warning for an unexpected connection key.

Bug fixes

  • Fixed credentials appearing in diagnostic trace output.
  • Fixed the HTTP retry path so the request buffer is reset correctly.
  • Fixed a delay in the AWS identity detector.
  • Tightened string copy bounds checking after the Azure SDK migration to prevent a buffer overflow.

Version 4.0.0-rc3 (Sep 10, 2026)

Third public preview release of the ODBC Driver built on the Universal Core. This is a new version line, distributed as a release candidate and downloaded separately from the 3.x driver. See Snowflake ODBC Driver built on the Universal Core for installation instructions, the curated list of behavior differences, and migration guidance.

Changes

  • Changed SQLColumns BUFFER_LENGTH for DATE/TIME from COLUMN_SIZE (10 / 18 for TIME(9)) to 6 (sizeof(SQL_DATE_STRUCT) / sizeof(SQL_TIME_STRUCT)); query-result SQLColAttribute octet length for DATE/TIME remains 6.
  • Changed SQLBrowseConnect so an incomplete connection string returns SQL_NEED_DATA and keeps the handle available for further browse calls, matching the 3.x iterative protocol under iODBC.
  • Changed OAuth Authorization Code connections to default CLIENT_STORE_TEMPORARY_CREDENTIAL to true when the caller has not set it, matching ODBC 3.x token caching.
  • Changed SQLForeignKeys with SQL_ATTR_METADATA_ID=TRUE to return SQL_ERROR (HY009) for a NULL catalog, schema, or table pointer on either side.
  • Changed SQL_C_BINARY fetch of FLOAT/DOUBLE/REAL to return the native 8-byte IEEE 754 value instead of a 19-byte SQL_NUMERIC_STRUCT.
  • Changed SQL_BIT parameter binding so integer and SQL_C_NUMERIC sources accept only 0 and 1 (other magnitudes return 22003).
  • Changed SQL_C_CHAR/SQL_C_WCHAR binding of "Infinity", "-Infinity", and "NaN" to SQL_FLOAT/SQL_REAL/SQL_DOUBLE to forward the non-finite value instead of returning 22018.
  • Changed SQL_C_CHAR/SQL_C_WCHAR hex literals bound to SQL_BINARY so an odd-length hex string drops the leftover nibble and succeeds.
  • Changed SQLBindParameter with Snowflake vendor TIMESTAMP type codes (2000 / 2001 / 2002) to store those codes on the IPD so SQLDescribeParam returns them as bound.
  • Changed SQLSetStmtAttr(SQL_ROWSET_SIZE, 0) to return SQL_ERROR (HY024) instead of storing 0 or coercing to 1.
  • Changed PUT result source_compression / target_compression tokens to lowercase (for example, gzip), matching ODBC 3.x.
  • Changed gzip-compressed PUT uploads to omit the original filename from the gzip FNAME header, matching ODBC 3.x.
  • Changed PUT and GET to transfer several files at once, bounded by the statement PARALLEL value; result rows keep their original file order.
  • Changed an unreadable or empty TOKEN_FILE_PATH to report SQLSTATE 28000 instead of 01S00.
  • Improved GET to warn when a downloaded batch contains multiple files that resolve to the same local filename.
  • Improved external-browser callback handling to cap HTTP header size on the localhost listener.

New features and updates

  • Added INTERVAL YEAR TO MONTH and INTERVAL DAY TO SECOND result support: SQL_C_CHAR/SQL_C_WCHAR fetch returns the canonical ANSI literal ([-]Y-MM, [-]D HH:MM:SS[.f]), same-family SQL_C_INTERVAL_* targets receive the parsed interval struct, and scalar numeric targets receive total months or total whole seconds (reporting 01S07 when sub-second precision is dropped).
  • Added native AKS Workload Identity support for Azure: when the Azure Workload Identity webhook injects AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_FEDERATED_TOKEN_FILE into a pod and the projected token file exists on disk, WORKLOAD_IDENTITY_PROVIDER=AZURE exchanges that federated token for an Entra ID access token directly. WORKLOAD_IDENTITY_IMPERSONATION_PATH is not supported in this environment.
  • Added a WORKLOAD_IDENTITY_AWS_USE_OUTBOUND_TOKEN connection parameter for AWS Workload Identity Federation. When set to true, attestation uses outbound STS GetWebIdentityToken instead of the default pre-signed GetCallerIdentity token; the connection parameter takes precedence over SNOWFLAKE_ENABLE_AWS_WIF_OUTBOUND_TOKEN.
  • Added INCLUDE_RETRY_REASON (default true) so retried query requests send retryReason (the HTTP status that triggered the retry, or 0 for transport failures) alongside retryCount.

Customer-facing bug fixes

  • Fixed SQLGetDiagField return codes for three edge cases: a record field requested with RecNumber=0 now returns SQL_ERROR instead of SQL_NO_DATA, a header field requested with a positive RecNumber now returns SQL_SUCCESS instead of SQL_NO_DATA, and a negative BufferLength for a string field now returns SQL_ERROR.
  • Fixed array/batch parameter binding to retry the execute with inline JSON when the SYSTEM$BIND stage is disabled, instead of failing the statement.
  • Fixed the file-based token cache changing the mode of a cache file that is not 0600 and then using it anyway; such a file is now reported and left unused.
  • Fixed connections failing when CLIENT_SESSION_KEEP_ALIVE_HEARTBEAT_FREQUENCY falls outside the accepted range; the value is now clamped before login.
  • Fixed a Driver=-only connect with no other connection-string attributes to load the default connections.toml profile.
  • Fixed session-parameter reads used by SQLGetConnectAttr and decimal-as-int conversion to honor typed values returned by the server (for example, AUTOCOMMIT after ALTER SESSION).
  • Fixed queries returning a FILE column failing with Unsupported column type.
  • Fixed queries returning a MAP column failing with Unsupported column type.

Version 3.20.0 (Sep 3, 2026)

Security fixes

  • Improved validation of the ACCOUNT, SERVER, and PORT connection parameters before they are used to construct request URLs, so that none of the interpolated values can alter the resulting URL. Values that contain characters other than letters, digits, _, -, and . are rejected, as are port numbers outside the range 1–65535.

New features

  • Added the WORKLOAD_IDENTITY_AUDIENCE connection parameter to override the audience used when requesting a Workload Identity Federation attestation token. When omitted, the driver uses the default audience snowflakecomputing.com.

Version 4.0.0-rc2 (Sep 1, 2026)

Second public preview release of the ODBC Driver built on the Universal Core. This is a new version line, distributed as a release candidate and downloaded separately from the 3.x driver. See Snowflake ODBC Driver built on the Universal Core for installation instructions, the curated list of behavior differences, and migration guidance.

New features and updates

  • Implemented SQLFreeConnect (ODBC 2.x) as a thin wrapper around SQLFreeHandle(SQL_HANDLE_DBC, ...) for direct-link and ODBC 2.x applications that bypass the Driver Manager.
  • Implemented SQLFreeEnv (ODBC 2.x) as a thin wrapper around SQLFreeHandle(SQL_HANDLE_ENV, ...) for direct-link and ODBC 2.x applications that bypass the Driver Manager.
  • Changed SQLCancel to cancel through the core operation handle instead of issuing a separate server-side cancel call, so a cancelled statement is aborted server-side by the executing path itself. SQLCancel returns as soon as the cancel is signaled rather than waiting for the abort request to be processed; the statement’s own call still reports HY008 and does not return until the abort has been issued.

Customer-facing bug fixes

  • Fixed SQLColumns BUFFER_LENGTH for NUMBER/DECIMAL to return precision + 2 (ODBC transfer octet length); query-result SQLColAttribute octet/display for NUMBER remains 136.
  • Fixed SQLColumns COLUMN_SIZE and BUFFER_LENGTH for VARIANT/OBJECT/ARRAY to follow VARCHAR_AND_BINARY_MAX_SIZE_IN_RESULT instead of the 128 MB length from SHOW COLUMNS.
  • Fixed SQLColumns COLUMN_SIZE and BUFFER_LENGTH for unrecognized Snowflake types such as GEOGRAPHY/GEOMETRY to report the varchar metrics implied by their SQL_VARCHAR DATA_TYPE instead of NULL.
  • Fixed SQLProcedureColumns TYPE_NAME for unsupported types such as GEOGRAPHY/GEOMETRY to report the Snowflake type name while DATA_TYPE remains SQL_VARCHAR.
  • Fixed SQLColumns and SQLProcedureColumns CHAR_OCTET_LENGTH for unsupported types such as GEOGRAPHY/GEOMETRY to report a byte length instead of NULL, matching the SQL_VARCHAR they report as DATA_TYPE.
  • Fixed SQLGetTypeInfo string result columns (TYPE_NAME, LITERAL_PREFIX/SUFFIX, CREATE_PARAMS, LOCAL_TYPE_NAME) to report SQL_WVARCHAR as the IRD concise type, matching SQLTables/SQLColumns.
  • Fixed SQLGetTypeInfo INTERVAL_PRECISION to report SQL_SMALLINT as the IRD concise type, matching the ODBC spec and the reference driver; NUM_PREC_RADIX remains SQL_INTEGER.

Version 4.0.0-rc1 (Aug 19, 2026)

Initial public preview release of the ODBC Driver built on the Universal Core. This is a new version line, distributed as a release candidate and downloaded separately from the 3.x driver. See Snowflake ODBC Driver built on the Universal Core for installation instructions, the curated list of behavior differences, and migration guidance.

New features and updates

  • Rebuilt the driver on the Universal Core, a shared Rust library that implements networking, authentication, result-set fetching, and stage transfers for every Snowflake driver. The ODBC wrapper contains no protocol logic of its own.
  • Published the driver and Universal Core source in the Snowflake drivers repository on GitHub.
  • Replaced simba.snowflake.ini with sf.odbc.ini for process-wide logging and driver configuration.
  • Added connections.toml profile support for setting connection parameters outside the DSN or connection string.

Changes

  • Installing this version replaces the 3.x driver on the same machine. Validate it on a dedicated host, VM, or container.
  • Certificate revocation checking uses CRLs rather than OCSP, and is off by default. OCSP-specific connection parameters are not accepted. See Configuration differences.
  • This release contains breaking behavior changes relative to the 3.x driver. The most significant are summarized in Behavior differences, and the complete catalog is published as BehaviorDifferences.yaml.

Version 3.19.0 (Jul 23, 2026)

Customer-facing bug fixes

  • Fixed OCSP cache corruption that could occur under an inter-process race condition.
  • Improved validation of account, region, host, protocol, and port connection attributes used in request URLs.
  • Fixed a resource handling issue that could affect DNS resolution when address lookup fails.

Other updates and internal changes

  • Upgraded SimbaSDK to version 10.3.8.
  • Upgraded libsnowflakeclient to version 2.9.2.
  • Upgraded OpenSSL to version 3.5.7.

Version 3.18.0 (Jun 17, 2026)

New features

  • Added support for the BINARY_OUTPUT_FORMAT session parameter to control whether binary values are returned in BASE64 or HEX format.
  • Added the QUERY_TAG connection parameter to set a default query tag for the connection. Values longer than 2000 characters are truncated.
  • Added the SF_SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION environment variable as the namespaced replacement for SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION when reading JSON token files. The unprefixed variable still works but is now logged as deprecated.
  • Changed AWS Workload Identity Federation attestation from a base64-encoded signed STS GetCallerIdentity request to a JWT obtained from STS GetWebIdentityToken.

Customer-facing bug fixes

  • Fixed path handling in GET downloads by validating server-provided destination file names before writing locally. Unsafe names (path separators, . / .., NUL bytes, and on Windows \ / :) are now rejected instead of being used as download targets.
  • Fixed an infinite JWT renewal loop during login when renew_timeout elapses repeatedly (for example, behind a bad proxy or slow network). Renewal is now bound by the configured login retry count and overall login timeout.

Other updates and internal changes

  • Upgraded libsnowflakeclient to version 2.9.1.
  • Upgraded curl to version 8.20.0.
  • Upgraded OpenSSL to version 3.0.21.
  • Upgraded AWS SDK for C++ to version 1.11.806.
  • Updated client_environment telemetry to include libc family and version (LIBC_FAMILY and LIBC_VERSION) on Linux, detecting glibc or musl.

Version 3.17.0 (Apr 28, 2026)

New features

  • Added support for the CLIENT_SESSION_KEEP_ALIVE_HEARTBEAT_FREQUENCY session parameter to control how often the driver refreshes the session token when CLIENT_SESSION_KEEP_ALIVE is enabled.
  • Added platform detection during the login flow, along with the disablePlatformDetection and platformDetectionTimeoutMs connection parameters to control the behavior.
  • Added the LOG_QUERY_TEXT and LOG_QUERY_PARAMETERS connection parameters to opt in to logging of query text and bind parameter values for diagnostic purposes.
  • Added support for configuring the maximum CRL download size when CRL checking is enabled.
  • Added debug logging of HTTP request and response headers to help diagnose connectivity issues.

Customer-facing bug fixes

  • Fixed the OCSP mode not being propagated to the HTTP calls used by the OAuth authentication flows.
  • Fixed a crash when an empty MULTI_STMT DML response left the result set without a usable execute-stage result.
  • Fixed a segmentation fault during the OCSP check when the certificate or its issuer was NULL.
  • Fixed the query context not being updated when a query failed.

Other updates and internal changes

  • Upgraded libsnowflakeclient to version 2.8.0.
  • Upgraded curl to version 8.19.0.
  • Upgraded OpenSSL to version 3.0.20.
  • Updated the client_environment telemetry signals to include the certificate revocation check mode and the libc family and version (glibc or musl) on Linux.
  • Updated SPCS service identifier token (SPCS_TOKEN) injection to be enabled only when the SNOWFLAKE_RUNNING_INSIDE_SPCS environment variable is set, to trim whitespace from the token, and to read the token only from the default location. The token_file_path parameter is no longer used to override the SPCS token path.
  • Removed unnecessary log messages emitted during version validity checks.

Version 3.16.0 (Mar 11, 2026)

New features and updates

  • Upgraded SimbaSDK to version 10.3.7.
  • Upgraded libsnowflakeclient to version 2.7.1.
  • Upgraded OpenSSL to version 3.0.19.
  • Updated client_environment telemetry signals to provide more information about the environment.

Bug fixes

  • Fixed the incorrect return size for SQL_NUMERIC when SQL_DECIMAL to SQL_C_BINARY conversion takes place.
  • Fixed SQLProcedures not returning all procedures.
  • Fixed the OAuth Client Credentials flow not routing IdP token requests through the configured HTTP proxy.
  • Fixed the incorrect return of SQL_SUCCESS instead of SQL_SUCCESS_WITH_INFO when the buffer for the converted string is too small.

Version 3.15.0 (Feb 9, 2026)

New features and updates

  • Deprecated support for CentOS 7, Red Hat Enterprise Linux (RHEL) 7, and Ubuntu 18.04. The minimum supported operating systems are now Red Hat Enterprise Linux (RHEL) 8, Rocky Linux 8, CentOS 8, and Ubuntu 20.04.

  • Added the WORKLOAD_IDENTITY_IMPERSONATION_PATH connection parameter to support GCP and AWS Workload Identity Federation (WIF) impersonation.

  • Added the singleAuthenticationPrompt connection parameter to control the authentication flow.

  • Added the following operating system details from the /etc/os-release file as telemetry during the login request:

    • NAME
    • PRETTY_NAME
    • ID
    • BUILD_ID
    • IMAGE_ID
    • IMAGE_VERSION
    • VERSION
    • VERSION_ID

  • Updated curl to version 8.16.0.

  • Updated OpenSSL to version 3.0.18.

  • Set LOCAL_APPLICATION as the default value for client_id and client_secret in the OAuth authorization code flow.

Bug fixes

  • Fixed the expired file lock on Linux for secure storage.
  • Removed the username requirement for WIF authentication.

Version 3.14.0 (Jan 12, 2026)

New features and updates

  • Added support for Red Hat Enterprise Linux (RHEL) 9 for x86 and ARM64 architectures.

  • Introduced a shared library for extended telemetry to identify and prepare a testing platform for native Rust extensions.

  • Introduced warning log messages when HTTP is used for OAuth authorization and token endpoints.

  • Added support for injecting the SPCS service identifier token (SPCS_TOKEN) into login requests when present in SPCS containers.

    • Introduced the token_file_path parameter in the TOML configuration to specify the path to the file containing the token.
    • Introduced the SKIP_TOKEN_FILE_PERMISSIONS_VERIFICATION parameter. If set to true, the file permission check is omitted.

  • Introduced a specific error when exceeding the parameter limit in a query.

  • Improved logging.

  • Added support for specifying the Azure client ID.

  • Enabled handling of the 307 and 308 HTTP redirect codes.

Bug fixes

  • Fixed duplicate error message codes.
  • Fixed the default session scope for OAuth authentication.
  • Fixed the default CRL cache path creation on Windows.
  • Fixed session token leakage in the logs.