SNOWFLAKE DOCS DIFF
本日は全8531ページのうち、改訂46件と削除8件があり、破壊的変更8件が目立ちました。特に User Guide では、パートナー、データ統合、セキュリティ、BI などの大規模なカテゴリーページが削除されています。機能面では Coding Agent の SQL 対応、Snowpark Container Services のセッショントークン設定、Go ドライバーのセキュリティ強化が進みました。Data Connectivity Proxy では証明書発行や30分以上の待機など、接続構築手順の具体化も行われています。
AGENT_RUN により SQL から実行可能になりましたが、SQL 実行ではストリーミング出力を利用できません。mountSessionToken と sessionTokenConfig が追加され、OAuth セッショントークンの配置先や POSIX 権限を制御できるようになりました。SYSTEM$ISSUE_PER_ACCOUNT_CERTIFICATES() による証明書発行後、少なくとも30分待機する手順と PrivateLink 非対応が明記されました。対象ページ「All Partners & Technologies (Alphabetical)」が削除された変更ですが、提示された unified diff は空のため、削除対象の詳細や代替ページは diff からは詳細不明です。 影響: 当該ページの参照ができなくなりますが、実務上の移行手段はdiff からは詳細不明です。
判定根拠: ページ削除
diff は保存されていません（削除ページなど）。
Data Integration ページが削除された変更ですが、unified diff が空のため、削除された具体的な機能や構文は diff からは詳細不明です。 影響: 対象ページを参照していた利用者は内容を確認できなくなる可能性がありますが、移行手段は diff からは不明です。
判定根拠: ページ削除
diff は保存されていません（削除ページなど）。
対象ページ「Security, Governance & Observability」がページ削除となりました。unified diff が空のため、削除された具体的な機能・パラメータ・構文はdiff からは詳細不明です。 影響: 当該ページを参照していた利用者は、移行手段や代替ページの有無をdiffから確認できません。
判定根拠: ページ削除
diff は保存されていません（削除ページなど）。
「Business Intelligence (BI)」ページが削除されたと判定されていますが、提示された unified diff は空のため、削除内容や移行手段などの詳細は diff からは詳細不明です。 影響: 該当ページの参照に影響する可能性がありますが、具体的な実務影響は diff からは詳細不明です。
判定根拠: ページ削除
diff は保存されていません（削除ページなど）。
対象ページ「Snowflake Partner Connect」の変更差分は空で、具体的な削除内容は diff からは詳細不明 です。変更種別は ページ削除 と判定されています。 影響: ページ全体が削除されたため、従来の公式ドキュメントを参照できなくなる可能性がありますが、移行手段は diff からは詳細不明 です。
判定根拠: ページ削除
diff は保存されていません（削除ページなど）。
対象ページ Machine Learning & Data Science が削除されたと判定されています。unified diff は空のため、削除された具体的な機能や構文の詳細は diff からは詳細不明 です。 影響: 該当ドキュメントを参照していた利用者はページへアクセスできなくなる可能性がありますが、実務上の代替手段は diff からは詳細不明 です。
判定根拠: ページ削除
diff は保存されていません（削除ページなど）。
対象ページ SQL Development & Management（User Guide）が削除されました。unified diff が空のため、個別の機能・パラメータ・構文の変更内容は diff からは詳細不明です。 影響: ページへのリンクやブックマークから参照できなくなる可能性があります。
判定根拠: ページ削除
diff は保存されていません（削除ページなど）。
提示された unified diff は空であり、Native Programmatic Interfaces ページの削除を含む具体的な変更内容は diff からは詳細不明 です。
判定根拠: ページ削除
diff は保存されていません（削除ページなど）。
SQL の呼び出し手段として AGENT_RUN（agent_run-snowflake-cortex）が追加され、Coding Agent は REST API に加えて SQL からも実行可能になりました。Quickstart が追加され、REST API は既定で SSE ストリーミング（stream: false で単一 JSON）、SQL は単一 JSON 文字列を返しストリーミング非対応であることが明記されています。
影響: クエリ・ストアドプロシージャ・タスク内で Coding Agent を利用できる一方、SQL 実行では stream による逐次出力が利用できないため、用途に応じて REST API と SQL を使い分ける必要があります。
判定根拠: SQL 構文/コードブロックの増減 (+7/-0)
--- ahttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-coding-agent+++ bhttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-coding-agent@@ -2,8 +2,10 @@ - [](/user-guide/snowflake-cortex/cortex-agents)+- [](/user-guide/snowflake-cortex/cortex-agents-run) - [](/user-guide/snowflake-cortex/cortex-agents-skills) - [](/user-guide/snowflake-cortex/cortex-agents-code-execution-tool)--A Coding Agent is a managed agent that brings Snowflake CoCo's coding capabilities into your own applications through the Cortex Agents REST API. You add the `code_toolset_all` tool type to a Cortex Agent, and Snowflake provisions and manages a sandbox backed by the same runtime that powers CoCo (bash, file read/write/edit, grep, glob, web search, SQL execution, and skills), executes the tools, and streams results back to your application, so you don't build or host an agent loop yourself. Any query that requires code generation, SQL execution, data transformation, or pipeline automation is handled inside the sandboxed runtime.+- [](/sql-reference/functions/agent_run-snowflake-cortex)++A Coding Agent is a managed agent that brings Snowflake CoCo's coding capabilities into your own applications through the Cortex Agents REST API or SQL. You add the `code_toolset_all` tool type to a Cortex Agent, and Snowflake provisions and manages a sandbox backed by the same runtime that powers CoCo (bash, file read/write/edit, grep, glob, web search, SQL execution, and skills), executes the tools, and streams results back to your application, so you don't build or host an agent loop yourself. Any query that requires code generation, SQL execution, data transformation, or pipeline automation is handled inside the sandboxed runtime. Use `code_toolset_all` when you want an autonomous coding agent with the full suite of development tools. It differs from two related surfaces:@@ -13,4 +15,177 @@ `code_toolset_all` and `code_execution` are **mutually exclusive**: a single request can declare at most one of them. Specifying both returns an error.++<a id="label-coding-agent-quickstart"></a>++## Quickstart++You can call a Coding Agent from two surfaces. Both accept the same core agent configuration — `messages`, `models`, `instructions`, `tools`, and `tool_resources` — so that part of the body is portable between them. Transport-specific fields are not: the REST API streams by default and accepts `stream`, while `AGENT_RUN` rejects `"stream": true` and always returns a single JSON value.++ <thead>+ <tr>+ <th>Surface</th>+ <th>Call</th>+ <th>Response</th>+ </tr>+ </thead>+ <tbody>+ <tr>+ <td>REST API</td>+ <td>`POST /api/v2/cortex/agent:run`</td>+ <td>Streams server-sent events (SSE) by default. Set `stream` to `false` for a single JSON response.</td>+ </tr>+ <tr>+ <td>SQL</td>+ <td>[](/sql-reference/functions/agent_run-snowflake-cortex)</td>+ <td>A single JSON string. Streaming isn't supported.</td>+ </tr>+ </tbody>++Use the REST API when your application displays the agent's tool calls and output as they happen. Use SQL when you want a coding agent inside a query, a stored procedure, or a scheduled task and don't need incremental output.++To call either surface, use a role that has been granted the `SNOWFLAKE.CORTEX_USER` or `SNOWFLAKE.CORTEX_AGENT_USER` database role. See [](/user-guide/snowflake-cortex/cortex-agents-setup#label-cortex-agents-access-control). The REST API also requires an authorization token, such as a programmatic access token (PAT). In the example, `$SNOWFLAKE_ACCOUNT_BASE_URL` is your account URL (`https://<orgname>-<account_name>.snowflakecomputing.com`) and `$PAT` is that token.++The following examples need no agent object and no workspace: the entire configuration is in the request body, and the sandbox starts with an empty file system. They set the orchestration model to `auto`, which lets Snowflake select the highest-quality model available to your account. To pin a specific model instead, see [Orchestration model and instructions](#label-coding-agent-instructions).++**REST API:**++```bash+curl -X POST "$SNOWFLAKE_ACCOUNT_BASE_URL/api/v2/cortex/agent:run" \+ --header 'Content-Type: application/json' \+ --header 'Accept: text/event-stream' \+ --header "Authorization: Bearer $PAT" \+ --data '{+ "models": { "orchestration": "auto" },+ "messages": [+ {+ "role": "user",+ "content": [+ {+ "type": "text",+ "text": "Write a Python script that prints the first 10 Fibonacci numbers, run it, and show me the output."+ }+ ]+ }+ ],+ "tools": [+ { "tool_spec": { "type": "code_toolset_all", "name": "code_toolset_all" } }+ ],+ "tool_resources": {+ "code_toolset_all": {+ "permission_policy": { "type": "always_allow" }+ }+ }+ }'+```++**SQL:**++```sql+SELECT TRY_PARSE_JSON(+ SNOWFLAKE.CORTEX.AGENT_RUN(+ $${+ "models": { "orchestration": "auto" },+ "messages": [+ {+ "role": "user",+ "content": [+ {+ "type": "text",+ "text": "Write a Python script that prints the first 10 Fibonacci numbers, run it, and show me the output."+ }+ ]+ }+ ],+ "tools": [+ { "tool_spec": { "type": "code_toolset_all", "name": "code_toolset_all" } }+ ],+ "tool_resources": {+ "code_toolset_all": {+ "permission_policy": { "type": "always_allow" }+ }+ }+ }$$,+ TRUE+ )+) AS resp;+```++The second argument creates a thread automatically and returns its `thread_id`, which you pass back in the next+request body to continue the conversation.++The response carries a `tool_use` and `tool_result` pair for each sandbox tool call the agent made, followed by a+final `text` block with its answer.++Both examples set `permission_policy` to `always_allow` so that a single call runs start to finish. The default,+`always_ask`, keeps an approval gate in front of state-modifying tool calls; the next two sections describe how each+surface handles it.++<a id="label-coding-agent-approve-rest"></a>++### Approve a tool call over the REST API++Under `always_ask`, the agent doesn't execute a state-modifying tool call right away. It emits a `tool_use` event whose+`permission.options` array lists the choices available to the caller, and stops there.++To resume the turn, send another `agent:run` request that appends a `permission_decision` content block to the+conversation:++```json+{+ "role": "user",+ "content": [+ {+ "type": "permission_decision",+ "permission_decision": {+ "tool_use_id": "toolu_abc123",+ "decision": "Allow Once"+ }+ }+ ]+}+```++`tool_use_id` is the ID from the `tool_use` event, and `decision` must match one of the strings in that event's+`permission.options` array. When you deny, add a `reason` explaining why: the agent receives it as the tool's error+message and can adjust. For the field-level reference, see [](#label-snowflake-agent-run-permissiondecision).++This is the approval loop an interactive application should implement: it keeps the gate in place and gives the user+the decision, so you don't need `always_allow`.++<a id="label-coding-agent-approve-sql"></a>++### Approve a tool call from SQL++`AGENT_RUN` returns one JSON value per statement and can't prompt, so it offers no interactive approval loop within a+single call. Under `always_ask`, the permission request comes back in the response and the statement ends without the+tool having run. Unattended callers — scheduled tasks, stored procedures — therefore need `always_allow`.++`always_allow` removes the execution gate: the agent runs any command and modifies any resource its role can re... (truncated)
差分が長いため、途中まで表示しています。
コンテナ仕様に mountSessionToken と sessionTokenConfig が追加され、OAuthセッショントークンのマウント可否、配置先、POSIX権限（既定値 "0644"）、connections.toml の生成・マウントを設定できるようになりました。mountSessionToken の既定値は true で、false の場合は sessionTokenConfig を指定できません。
影響: コンテナ内のトークン配置や権限を明示的に制御できるため、既存仕様では既定の /snowflake/session/token と権限が適用され、新設定を使う場合はパスの重複や YAML での権限値の引用に注意が必要です。
判定根拠: SQL 構文/コードブロックの増減 (+2/-0)
--- ahttps://docs.snowflake.com/en/developer-guide/snowpark-container-services/specification-reference+++ bhttps://docs.snowflake.com/en/developer-guide/snowpark-container-services/specification-reference@@ -51,4 +51,9 @@ nvidia.com/gpu: <count> cpu: <cpu-units>+ mountSessionToken: <true / false> # optional, defaults to true+ sessionTokenConfig: # optional+ path: <absolute-directory-path> # optional+ permission: "<octal-permission>" # optional, requires path, defaults to "0644"+ mountConnectionConfig: <true / false> # optional, defaults to false secrets: # optional list - snowflakeSecret:@@ -554,4 +559,72 @@ service instances on two separate compute pool nodes. +<a id="label-spcs-spec-ref-containers-mount-session-token"></a>++### `containers.mountSessionToken` field++Use the `containers.mountSessionToken` field to control whether Snowflake mounts the service user's OAuth session token in a container.++The default is `true`: when you omit this field, Snowflake mounts the session token. When you set the field to `false`, Snowflake doesn't mount the session token in that container.++You can't specify [`sessionTokenConfig`](#label-spcs-spec-ref-containers-session-token-config) on a container when `mountSessionToken` is `false`.++<a id="label-spcs-spec-ref-containers-session-token-config"></a>++### `containers.sessionTokenConfig` field++Use the `containers.sessionTokenConfig` field to configure the service user's OAuth session token and generated connection configuration for a container.++Snowflake mounts the session token as a file named `token`. By default, the file is mounted at `/snowflake/session/token`. If you specify a custom `path`, Snowflake instead mounts the file at `<path>/token`. For examples of container code that reads this token, see [Snowpark Container Services: SQL execution](/developer-guide/snowpark-container-services/spcs-execute-sql).++Use the following fields in `sessionTokenConfig`:++- `path` (optional): An absolute directory path where Snowflake mounts the session token file. The path must meet the following requirements:++ - The path must be normalized. It can't contain `.` or `..` as a path segment, such as `/app/./session` or `/app/../session`, and it can't contain redundant slashes or a trailing slash.+ - The path can contain only alphanumeric characters, `/`, `-`, `_`, and `.`. A `.` character is allowed in a filename, such as `/app/token.dir`.+ - The path can't overlap a location reserved by Snowflake or another volume or secret mount in the same container.++- `permission` (optional): A quoted four-digit octal POSIX file mode for the session token file, for example, `"0600"`. You can specify this field only when `path` is set in the same container. Default is `"0644"`.++ The leading `0` is required. The remaining three digits set owner, group, and other permissions, where `4` is read, `2` is write, and `1` is execute. Quote the value in YAML, as in `permission: "0600"`. An unquoted value such as `0600` is parsed as an integer and is rejected.++ The mode can't grant more access than the default and must retain owner read access. The following table lists the commonly used values:++ | Mode | Access |+ | -------- | ------------------------------------------ |+ | `"0400"` | Owner read only |+ | `"0600"` | Owner read and write |+ | `"0640"` | Owner read and write, group read |+ | `"0644"` | Owner read and write, group and other read |++- `mountConnectionConfig` (optional): When set to `true`, Snowflake generates and mounts a `connections.toml` file for the container and sets `SNOWFLAKE_HOME` to the directory that contains the file. The file includes a `[default]` connection whose `token_file_path` setting points to the effective session token location. The `connections.toml` file always has the same permission mode as the session token file, whether or not you specify `permission`. Default is `false`.++Note the following:++- `sessionTokenConfig` must contain at least one field.+- You can't specify `sessionTokenConfig` when [`mountSessionToken`](#label-spcs-spec-ref-containers-mount-session-token) is set to `false` for the same container.+- In a service with multiple containers, each container can use a different session token configuration.+- A container that omits `sessionTokenConfig` receives the token at `/snowflake/session/token` with the default permission mode, and no `connections.toml` file.++**Example**++The following specification mounts the session token at a custom path with a more restrictive permission mode and generates connection configuration for the `app` container:++```yaml+spec:+ containers:+ - name: app+ image: /my_db/my_schema/my_repo/my_app:latest+ sessionTokenConfig:+ path: /app/snowflake/session+ permission: "0600"+ mountConnectionConfig: true+```++In this example:++- The `app` container reads the session token from `/app/snowflake/session/token` with file mode `0600`.+- Snowflake generates a `connections.toml` file with a `[default]` connection whose `token_file_path` points to that token, and sets `SNOWFLAKE_HOME` to the directory that contains the file.+ <a id="label-spcs-spec-ref-containers-secrets"></a>
Go ドライバー 2.2.0（2026年9月3日）で、WORKLOAD_IDENTITY の接続先制限、Azure リクエストやログの秘密情報マスキング、URL・OCSP 検証などのセキュリティ対策が強化されました。CleanupTimeout、SNOWFLAKE_MIN_TLS_VERSION、AWS 認証方式の WorkloadIdentityAwsUseOutboundToken などが追加され、Go 1.27 に対応する一方、Go 1.24 のサポートが終了し最小バージョンは 1.25 になりました。
影響: Go 1.24 以下を使用している環境は Go 1.25 以上への更新が必要で、新しい認証・TLS・クリーンアップ設定を DSN や環境変数で利用できます。
判定根拠: 追加行に「deprecated」
--- ahttps://docs.snowflake.com/en/release-notes/clients-drivers/golang-2026+++ bhttps://docs.snowflake.com/en/release-notes/clients-drivers/golang-2026@@ -14,4 +14,55 @@ See [](/developer-guide/golang/go-driver) for documentation.++## Version 2.2.0 (Sep 03, 2026)++### Security fixes++- Restricted the `WORKLOAD_IDENTITY` authenticator to recognized Snowflake hosts (`*.snowflakecomputing.com`, `*.snowflakecomputing.cn`, and `*.snowflakecomputing.mil`), normalizing the host before matching. The `SNOWFLAKE_WIF_ALLOWED_HOST_SUFFIXES` environment variable can additively extend the list of recognized hosts.+- Azure workload identity federation requests now URL-encode the resource and client ID query parameters, so their values can't alter the rest of the request URL.+- The Azure `IDENTITY_ENDPOINT` must now resolve to a loopback or link-local address before the driver attaches the `IDENTITY_HEADER` value to the request.+- Account identifier and region values supplied in the DSN are now validated as well-formed URL-authority components before being used to construct driver URLs. OCSP cache-server and retry URLs are now built using Go's `net/url` package instead of direct string formatting.+- Improved OCSP response validation to correctly distinguish transient network failures from definitive certificate status results, so a definitive result is always honored regardless of the `ocspFailOpen` setting.+- Extended secret masking in debug logs to cover the S3 SSE-C customer-key header and the `X-Amz-Credential` and `X-Amz-Security-Token` URL query parameters.+- HTTP response headers, including the chunk-header debug line, are now logged as header names only, without their values, everywhere the driver previously logged full header collections. This prevents session tokens, storage credentials, and SSE-C customer keys from appearing in debug logs.+- The TOML connection configuration loader now logs only setting names, not their values, when reporting a parsing error.+- Corrected the SAS token masking pattern in debug logs so signed URL query parameters are fully masked.+- Corrected the connection token masking pattern in debug logs to properly match and mask Snowflake session tokens that contain a colon (for example, `ver:1-hint:...`).++### New features and updates++- Added the `WorkloadIdentityAwsUseOutboundToken` configuration option (DSN field `workloadIdentityAwsUseOutboundToken`) to produce the AWS workload identity federation attestation as an STS `GetWebIdentityToken` JWT instead of the default signed `GetCallerIdentity` request envelope.+- Added the `CleanupTimeout` configuration option (DSN field `cleanupTimeout`, in seconds) to bound how long post-cancellation cleanup can run.+- Increased the CRL disk cache removal delay to 7 days.+- Added support for loading a private key from a `connections.toml` file.+- Added support for Go 1.27.+- Dropped support for Go 1.24. The minimum supported Go version is now 1.25.+- Added the `SNOWFLAKE_MIN_TLS_VERSION` environment variable to enforce a minimum TLS version for all connections.++### Bug fixes++- Fixed token cache key collisions that could occur across multiple accounts sharing an identity provider, or across multiple roles, by switching to a versioned, SHA-256-hashed cache key that includes the token type.+- Fixed a nil pointer dereference panic when the driver encountered a corrupt or malformed OCSP cache key, whether from the remote OCSP cache server or the local cache file.+- Fixed `WithFileGetStream` returning corrupt or wrong-file bytes when a `GET` pattern matched more than one file. A multi-file match now returns the new `ErrGetStreamMultipleFiles` error instead of an unpredictable mix of file contents.+- The driver no longer attempts to fetch S3 bucket accelerate configuration for Snowflake-internal stages, since that permission isn't granted for those stages.+- Fixed gosnowflake creating a `gosnowflake-cgo` directory under the system temp directory at package import time, even when the driver was never used (for example, when imported only as a transitive dependency). Minicore now loads lazily when the driver is first referenced instead of at package initialization.+- Fixed `GET` from a `LOCAL_FS` stage downloading 0 files and returning a `264011: not implemented` error. Downloads from cloud stages were unaffected.+- Fixed `NUMBER` columns with a non-zero scale losing precision when a value needed more significant digits than a binary float's mantissa could hold. For example, a `NUMBER(20,10)` column holding `1234567890.1234567890` returned `1234567890.1234567889`. The `WithHigherPrecision` option is unaffected and continues to return a 64-bit `*big.Float`.+- Fixed `ArrowBatch.WithContext` being able to unintentionally change the conversion options (timestamp handling, higher precision, UTF-8 validation) applied to an already-created batch. These options are now captured when the batch is created and are no longer re-read from a later `WithContext` call.+- Fixed proxy configuration for a literal IPv6 `ProxyHost`, which previously produced an unparseable proxy URL.+- Fixed the `region` parameter overriding an explicitly provided `host` value (for example, `host=myacct.snowflakecomputing.com` combined with `region=us-east-1` incorrectly became `myacct.us-east-1.snowflakecomputing.com`). An explicit host now takes precedence.++### Internal changes++- Migrated from the deprecated `github.com/aws/aws-sdk-go-v2/feature/s3/manager` package to `github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager`.+- Modernized Go syntax idioms throughout the codebase now that the minimum supported Go version is 1.25.+- Updated AWS SDK dependencies:+ - `github.com/aws/aws-sdk-go-v2` from v1.38.1 to v1.43.0+ - `github.com/aws/aws-sdk-go-v2/config` from v1.27.11 to v1.32.31+ - `github.com/aws/aws-sdk-go-v2/credentials` from v1.17.11 to v1.19.30+ - `github.com/aws/aws-sdk-go-v2/feature/ec2/imds` from v1.16.1 to v1.18.31+ - `github.com/aws/aws-sdk-go-v2/service/s3` from v1.53.1 to v1.106.0+ - `github.com/aws/aws-sdk-go-v2/service/sts` from v1.28.6 to v1.45.0+ - `github.com/aws/smithy-go` from v1.22.5 to v1.27.4 ## Version 2.1.0 (Jun 08, 2026)
TLS handshake が DCP ホスト名と証明書の不一致で失敗する場合のトラブルシューティングを追加。公開 DCP ホスト名の使用確認と、SYSTEM$ISSUE_PER_ACCOUNT_CERTIFICATES() によるアカウント単位の証明書発行後、30分以上待って再試行する手順を示した。 影響: 該当する接続障害では、PrivateLink 経由を避け、アカウントレベル証明書の発行が必要になる。
判定根拠: SQL 構文/コードブロックの増減 (+3/-0)
--- ahttps://docs.snowflake.com/en/user-guide/data-connectivity-proxy-troubleshoot+++ bhttps://docs.snowflake.com/en/user-guide/data-connectivity-proxy-troubleshoot@@ -17,4 +17,27 @@ **Resolution:** Regenerate the token using `SYSTEM$GENERATE_DATA_CONNECTIVITY_PROXY_BOOTSTRAP_TOKEN` and write the output (not a PAT) to the credentials file.++<a id="label-dcp-ts-tls-cert-mismatch"></a>++## TLS handshake fails: certificate doesn't match the DCP hostname++**Symptom:** DNS for `dcp.<org>-<account>.<region>.<cloud>.snowflake.com` resolves and TCP to port 443 succeeds, but the TLS handshake+fails. The server presents a certificate whose common name doesn't match the DCP hostname, often `*.privatelink.snowflakecomputing.com`.++**Cause:** The account doesn't yet have TLS certificates for nested `snowflake.com` hostnames, or the agent is reaching a PrivateLink+endpoint instead of the public DCP control plane.++**Resolution:**++1. Confirm the agent uses the public DCP hostname from [SYSTEM$ALLOWLIST](/sql-reference/functions/system_allowlist), not a PrivateLink+ hostname or a PrivateLink DNS override. Connecting the DCP agent through a PrivateLink endpoint isn't supported.+2. Issue account-level certificates, then wait at least 30 minutes before retrying the agent:++ ```sql+ SELECT SYSTEM$ISSUE_PER_ACCOUNT_CERTIFICATES();+ ```++ For more information, see [](/sql-reference/functions/system_issue_per_account_certificates) and the+ [note in the setup topic](/user-guide/data-connectivity-proxy-setup#label-dcp-setup-issue-certificates). <a id="label-dcp-ts-disconnected"></a>
SYSTEM$ISSUE_PER_ACCOUNT_CERTIFICATES() を実行してアカウントレベルの TLS 証明書を発行する手順が追加され、初回実行後は 少なくとも30分 待ってからエージェントを起動する必要があります。DNS は標準のパブリック DNS を使用し、PrivateLink 経由の DCP エージェント接続は非対応であることが明記されました。 影響: DCP 構築時に証明書発行と30分以上の待機を組み込み、Snowflake エンドポイントを PrivateLink のホスト名や IP アドレスへ上書きしない運用が必要です。
判定根拠: SQL 構文/コードブロックの増減 (+3/-0)
--- ahttps://docs.snowflake.com/en/user-guide/data-connectivity-proxy-setup+++ bhttps://docs.snowflake.com/en/user-guide/data-connectivity-proxy-setup@@ -9,4 +9,6 @@ - [](/sql-reference/sql/create-network-rule) +- [](/sql-reference/functions/system_issue_per_account_certificates)+ Complete these steps to create a Data Connectivity Proxy (DCP) object, deploy an agent on your network, and route Openflow connector traffic to a private data source.@@ -35,4 +37,17 @@ You can also attach or change the policy later with `ALTER DATA CONNECTIVITY PROXY ... SET NETWORK_POLICY`. For more information, see [](/user-guide/network-policies).++<a id="label-dcp-setup-issue-certificates"></a>++After you create the DCP object, issue account-level TLS certificates:++```sql+SELECT SYSTEM$ISSUE_PER_ACCOUNT_CERTIFICATES();+```++A successful call returns `Certificates will be issued.` Issuance is asynchronous. Wait at least 30 minutes after the first call in the+account before you start the agent. Calling the function again has no additional effect.++For more information, see [](/sql-reference/functions/system_issue_per_account_certificates). <a id="label-dcp-setup-bootstrap-token"></a>@@ -253,5 +268,6 @@ ### DNS -The agent resolves Snowflake endpoint hostnames using standard DNS. No special DNS configuration is required.+The agent resolves Snowflake endpoint hostnames using standard public DNS. Don't override those names to PrivateLink hostnames or+PrivateLink IP addresses. Connecting the DCP agent through a PrivateLink endpoint isn't supported. <a id="label-dcp-telemetry-endpoints"></a>
リリースノートの対象月がAugust 2026 から September 2026へ更新され、Go 2.2.0、JDBC 4.3.4、Node.js 3.3.0、ODBC 3.20.0、Python 4.7.3（いずれも03-Sep-2026）が追加された。.NET と Snowflake CLI は TBDに戻され、August 2026欄にはIngest Java SDK 4.4.5/4.4.4やCLI 3.26.0〜3.24.0などの実績が反映された。 影響: 利用者は03-Sep-2026付けの各ドライバー／ライブラリの新バージョンを確認できる一方、.NETとSnowflake CLIのSeptember 2026リリース時期はdiffからは詳細不明。
変更内容: 本文を更新（313行追加・170行削除）
--- ahttps://docs.snowflake.com/en/release-notes/clients-drivers/monthly-releases+++ bhttps://docs.snowflake.com/en/release-notes/clients-drivers/monthly-releases@@ -15,5 +15,5 @@ [All release notes](/release-notes/all-release-notes). -## August 2026 release notes+## September 2026 release notes <div className="colwidths-given">@@ -36,12 +36,12 @@ <tr> <td>%dotnet-rn%</td>- <td>6.0.0</td>- <td>10-Aug-2026</td>+ <td>TBD</td>+ <td>TBD</td> <td></td> </tr> <tr> <td>%golang-rn%</td>- <td>TBD</td>- <td>TBD</td>+ <td>2.2.0</td>+ <td>03-Sep-2026</td> <td></td> </tr>@@ -54,18 +54,18 @@ <tr> <td>%jdbc-rn%</td>- <td>4.3.3</td>- <td>18-Aug-2026</td>+ <td>4.3.4</td>+ <td>03-Sep-2026</td> <td></td> </tr> <tr> <td>%nodejs-rn%</td>- <td>3.2.0</td>- <td>18-Aug-2026</td>+ <td>3.3.0</td>+ <td>03-Sep-2026</td> <td></td> </tr> <tr> <td>%odbc-rn%</td>- <td>TBD</td>- <td>TBD</td>+ <td>3.20.0</td>+ <td>03-Sep-2026</td> <td></td> </tr>@@ -78,24 +78,6 @@ <tr> <td>%snowflake-cli-rn%</td>- <td>3.26.0</td>- <td>31-Aug-2026</td>- <td></td>- </tr>- <tr>- <td>%snowflake-cli-rn%</td>- <td>3.25.0</td>- <td>24-Aug-2026</td>- <td></td>- </tr>- <tr>- <td>%snowflake-cli-rn%</td>- <td>3.24.1</td>- <td>06-Aug-2026</td>- <td></td>- </tr>- <tr>- <td>%snowflake-cli-rn%</td>- <td>3.24.0</td>- <td>04-Aug-2026</td>+ <td>TBD</td>+ <td>TBD</td> <td></td> </tr>@@ -108,6 +90,6 @@ <tr> <td>%python-rn%</td>- <td>TBD</td>- <td>TBD</td>+ <td>4.7.3</td>+ <td>03-Sep-2026</td> <td></td> </tr>@@ -170,5 +152,5 @@ </div> -## July 2026 release notes+## August 2026 release notes <div className="colwidths-given">@@ -191,6 +173,6 @@ <tr> <td>%dotnet-rn%</td>- <td>TBD</td>- <td>TBD</td>+ <td>6.0.0</td>+ <td>10-Aug-2026</td> <td></td> </tr>@@ -203,46 +185,60 @@ <tr> <td>%ingest-java-sdk-rn%</td>- <td>TBD</td>- <td>TBD</td>+ <td>4.4.5</td>+ <td>31-Aug-2026</td>+ <td></td>+ </tr>+ <tr>+ <td>%ingest-java-sdk-rn%</td>+ <td>4.4.4</td>+ <td>25-Aug-2026</td> <td></td> </tr> <tr> <td>%jdbc-rn%</td>- <td>4.3.2</td>- <td>16-Jul-2026</td>+ <td>4.3.3</td>+ <td>18-Aug-2026</td> <td></td> </tr> <tr> <td>%nodejs-rn%</td>- <td>3.1.0</td>- <td>09-Jul-2026</td>+ <td>3.2.0</td>+ <td>18-Aug-2026</td> <td></td> </tr> <tr> <td>%odbc-rn%</td>- <td>3.19.0</td>- <td>23-Jul-2026</td>+ <td>TBD</td>+ <td>TBD</td> <td></td> </tr> <tr> <td>%php-rn%</td>- <td>4.1.0</td>- <td>23-Jul-2026</td>- <td></td>- </tr>- <tr>- <td rowSpan={3}>%snowflake-cli-rn%</td>- <td>3.22.0</td>- <td>07-Jul-2026</td>- <td></td>- </tr>- <tr>- <td>3.22.1</td>- <td>14-Jul-2026</td>- <td></td>- </tr>- <tr>- <td>3.23.0</td>- <td>16-Jul-2026</td>+ <td>TBD</td>+ <td>TBD</td>+ <td></td>+ </tr>+ <tr>+ <td>%snowflake-cli-rn%</td>+ <td>3.26.0</td>+ <td>31-Aug-2026</td>+ <td></td>+ </tr>+ <tr>+ <td>%snowflake-cli-rn%</td>+ <td>3.25.0</td>+ <td>24-Aug-2026</td>+ <td></td>+ </tr>+ <tr>+ <td>%snowflake-cli-rn%</td>+ <td>3.24.1</td>+ <td>06-Aug-2026</td>+ <td></td>+ </tr>+ <tr>+ <td>%snowflake-cli-rn%</td>+ <td>3.24.0</td>+ <td>04-Aug-2026</td> <td></td> </tr>@@ -255,12 +251,12 @@ <tr> <td>%python-rn%</td>- <td>4.7.1</td>- <td>15-Jul-2026</td>+ <td>TBD</td>+ <td>TBD</td> <td></td> </tr> <tr> <td>%spark-rn%</td>- <td>3.2.1</td>- <td>08-Jul-2026</td>+ <td>TBD</td>+ <td>TBD</td> <td></td> </tr>@@ -317,5 +313,5 @@ </div> -## June 2026 release notes+## July 2026 release notes <div className="colwidths-given">@@ -338,12 +334,12 @@ <tr> <td>%dotnet-rn%</td>- <td>5.7.0</td>- <td>12-Jun-2026</td>+ <td>TBD</td>+ <td>TBD</td> <td></td> </tr> <tr> <td>%golang-rn%</td>- <td>2.1.0</td>- <td>08-Jun-2026</td>+ <td>TBD</td>+ <td>TBD</td> <td></td> </tr>@@ -355,41 +351,41 @@ </tr> <tr>- <td rowSpan={2}>%jdbc-rn%</td>- <td>4.3.0</td>- <td>08-Jun-2026</td>- <td></td>- </tr>- <tr>- <td>4.3.1</td>- <td>16-Jun-2026</td>+ <td>%jdbc-rn%</td>+ <td>4.3.2</td>+ <td>16-Jul-2026</td> <td></td> </tr> <tr> <td>%nodejs-rn%</td>- <td>3.0.0</td>- <td>17-Jun-2026</td>- <td>**Y**</td>+ <td>3.1.0</td>+ <td>09-Jul-2026</td>+ <td></td> </tr> <tr> <td>%odbc-rn%</td>- <td>3.18.0</td>- <td>17-Jun-2026</td>+ <td>3.19.0</td>+ <td>23-Jul-2026</td> <td></td> </tr> <tr> <td>%php-rn%</td>- <td>4.0.0</td>- <td>16-Jun-2026</td>- <td>**Y**</td>- </tr>- <tr>- <td rowSpan={2}>%snowflake-cli-rn%</td>- <td>3.20.0</td>- <td>08-Jun-2026</td>- <td></td>- </tr>- <tr>- <td>3.21.0</td>- <td>24-Jun-2026</td>+ <td>4.1.0</td>+ <td>23-Jul-2026</td>+ <td></td>+ </tr>+ <tr>+ <td rowSpan={3}>%snowflake-cli-rn%</td>+ <td>3.22.0</td>+ <td>07-Jul-2026</td>+ <td></td>+ </tr>+ <tr>+ <td>3.22.1</td>+ <td>14-Jul-2026</td>+ <td></td>+ </tr>+ <tr>+ <td>3.23.0</td>+ <td>16-Jul-2026</td> <td></td> </tr>@@ -402,13 +398,13 @@ <tr> <td>%python-rn%</td>- <td>TBD</td>- <td>TBD</td>+ <td>4.7.1</td>+ <td>15-Jul-2026</td> <td></td> </tr> <tr> <td>%spark-rn%</td>- <td>3.2.0</td>- <td>23-Jun-2026</td>- <td>**Y**</td>+ <td>3.2.1</td>+ <td>08-Jul-2026</td>+ <td></td> </tr> <tr>@@ -464,5 +460,5 @@ </div> -## May 2026 release notes+## June 2026 release notes <div className="colwidths-given">@@ -485,12 +481,12 @@ <tr> <td>%dotnet-rn%</td>- <td>5.6.0</td>- <td>20-May-2026</td>+ <td>5.7.0</td>+ <td>12-Jun-2026</td> <td></td> </tr> <tr> <td>%golang-rn%</td>- <td>TBD</td>- <td>TBD</td>+ <td>2.1.0</td>+ <td>08-Jun-2026</td> <td></td> </tr>@@ -502,56 +498,41 @@ </tr> <tr>- <td>%jdbc-rn%</td>- <td>4.2.0</td>- <td>06-May-2026</td>- <td></td>- </tr>- <tr>- <td rowSpan={3}>%nodejs-rn%</td>- <td>2.4.1</td>- <td>12-May-2026</td>- <td></td>- </tr>- <tr>- <td>2.4.2</td>- <td>19-May-2026</td>- <td></td>- </tr>- <tr>- <td>2.4.3</td>- <td>26-May-2026</td>- <td></td>+ <td rowSpan={2}>%jdbc-rn%</td>+ <td>4.3.0</td>+ <td>08-Jun-2026</td>+ <td></td>+ </tr>+ <tr>+ <td>4.3.1</td>+ <td>16-Jun-2026</td>+ <td></td>+ </tr>+ <tr>+ <td>%nodejs-rn%</td>+ <td>3.0.0</td>+ <td>17-Jun-2026</td>+ <td>**Y**</td> </tr> <tr> <td>%odbc-rn%</td>- <td>TBD</td>- <td>TBD</td>+ <td>3.18.0</td>+ <td>17-Jun-2026</td> <td></td> </tr> <tr> <td>%php-rn%</td>- <td>TBD</td>- <td>TBD</td>- <td></td>- ... (truncated)
差分が長いため、途中まで表示しています。
Git を Snowflake 管理コンピュート上で実行できる機能として追加し、対応クライアントから Cortex Code Desktop を削除して、Visual Studio Code と Cursor に限定しました。前提条件の対象エディタもこの2製品に変更されています。 影響: Cortex Code Desktop の利用者は本機能の対象外となり、Git を含む開発環境を使うには Snowflake Extension v1.38 以降と対応エディタが必要です。
変更内容: 本文を更新（121行追加・38行削除）
--- ahttps://docs.snowflake.com/en/user-guide/vscode-ext-remote-development+++ bhttps://docs.snowflake.com/en/user-guide/vscode-ext-remote-development@@ -8,7 +8,7 @@ - [](/user-guide/ui-snowsight/notebooks) -Remote Development lets you create a Snowflake-backed development environment, connect to it over [Remote - SSH](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-ssh), and run Python notebooks, SQL, scripts, and terminals on Snowflake-managed compute. The environment is backed by Snowflake Notebook and includes Python, Jupyter, and Snowflake libraries.--You can use these capabilities in **Visual Studio Code**, **Cursor**, or **Cortex Code Desktop**. All three are built on the same Visual Studio Code extension model, so you install and run the %sf-vscext% the same way in each of them.+Remote Development lets you create a Snowflake-backed development environment, connect to it over [Remote - SSH](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-ssh), and run Python notebooks, SQL, scripts, terminals, and Git on Snowflake-managed compute. The environment is backed by Snowflake Notebook and includes Python, Jupyter, and Snowflake libraries.++You can use these capabilities in **Visual Studio Code** or **Cursor**. Both are built on the same Visual Studio Code extension model, so you install and run the %sf-vscext% the same way in each of them. To use Remote Development, install version 1.38 or later of the %sf-vscext% and make sure your account meets the requirements in [Prerequisites](#prerequisites).@@ -18,12 +18,12 @@ Before you start, make sure you have: -| Requirement | Details |-| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |-| %sf-vscext% | Install version 1.38 or later of the Snowflake extension from the Visual Studio Code Marketplace, or from the extensions UI in Cursor or Cortex Code Desktop. |-| Editor version | Use the latest version of Visual Studio Code, Cursor, or Cortex Code Desktop for the best Jupyter kernel picker experience. |-| Remote - SSH extension | Install `ms-vscode-remote.remote-ssh` from the Visual Studio Code Marketplace. |-| Account parameter | The `ENABLE_NOTEBOOK_SERVICE_REMOTE_VS_CODE_ACCESS` account parameter must be enabled. It's enabled by default, and an account administrator can disable it. |-| Snowflake privileges | Your role must be able to create and run notebook services: the `USAGE` privilege on the target compute pool, and the compute pool must allow the `NOTEBOOK` workload type (the `ALLOWED_SPCS_WORKLOAD_TYPES` parameter). Your role must also be able to use any external access integrations you select for the service. |-| Local SSH tools | The extension uses your local OpenSSH client and `nc` (netcat). `nc` is preinstalled on macOS and many Linux distributions. On Windows, install a netcat-compatible executable named `nc` and make sure it's on your `PATH`. |+| Requirement | Details |+| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |+| %sf-vscext% | Install version 1.38 or later of the Snowflake extension from the Visual Studio Code Marketplace, or from the extensions UI in Cursor. Persistent storage and Git require version 1.39 or later. |+| Editor version | Use the latest version of Visual Studio Code or Cursor for the best Jupyter kernel picker experience. |+| Remote - SSH extension | Install `ms-vscode-remote.remote-ssh` from the Visual Studio Code Marketplace. |+| Account parameter | The `ENABLE_NOTEBOOK_SERVICE_REMOTE_VS_CODE_ACCESS` account parameter must be enabled. It's enabled by default, and an account administrator can disable it. |+| Snowflake privileges | Your role must be able to create and run notebook services: the `USAGE` privilege on the target compute pool, and the compute pool must allow the `NOTEBOOK` workload type (the `ALLOWED_SPCS_WORKLOAD_TYPES` parameter). Your role must also be able to use any external access integrations or secrets you select for the service. |+| Local SSH tools | The extension uses your local OpenSSH client and `nc` (netcat). `nc` is preinstalled on macOS and many Linux distributions. On Windows, install a netcat-compatible executable named `nc` and make sure it's on your `PATH`. | ## Enable and manage access@@ -57,9 +57,8 @@ ## Supported editors -Remote Development works in three Snowflake-supported editors that share the Visual Studio Code extension model:+Remote Development works in two Snowflake-supported editors that share the Visual Studio Code extension model: - **Visual Studio Code**: Install the %sf-vscext% from the Visual Studio Code Marketplace.-- **Cursor**: Install the %sf-vscext% from the extensions UI the same way you install other compatible extensions.-- **Cortex Code Desktop**: Install the %sf-vscext% into Cortex Code Desktop. Even though Cortex Code Desktop is itself a Snowflake client, Remote Development ships in the extension today, so you still install the %sf-vscext% to use these capabi... (truncated)
差分が長いため、途中まで表示しています。
ENFORCE_TAG_PROPAGATION_FOR_DATA_MOVEMENT_POLICIES パラメータが追加され、データ移動ポリシーを付加したタグの伝播レベル要件を制御できるようになりました。既定値は TRUE で、ON_DEPENDENCY_AND_DATA_MOVEMENT を必須とし、FALSE では伝播レベルにかかわらず付加できます。
影響: 既定値が TRUE のため、データ移動ポリシーをタグに付加する際は、伝播レベルの設定が必要になります。
変更内容: 本文を更新（43行追加・0行削除）
--- ahttps://docs.snowflake.com/en/sql-reference/parameters+++ bhttps://docs.snowflake.com/en/sql-reference/parameters@@ -164,4 +164,8 @@ <td>[ENFORCE_NETWORK_RULES_FOR_SNOWFLAKE_MANAGED_STORAGE_VOLUME](#enforce-network-rules-for-snowflake-managed-storage-volume)</td> <td></td>+ </tr>+ <tr>+ <td>[ENFORCE_TAG_PROPAGATION_FOR_DATA_MOVEMENT_POLICIES](#enforce-tag-propagation-for-data-movement-policies)</td>+ <td>Controls whether tags with a data movement policy attached are required to have their propagation level set to `ON_DEPENDENCY_AND_DATA_MOVEMENT`.</td> </tr> <tr>@@ -4336,4 +4340,43 @@ </dl> +<a id="label-enforce-tag-propagation-for-data-movement-policies"></a>++## ENFORCE_TAG_PROPAGATION_FOR_DATA_MOVEMENT_POLICIES++<dl className="field-list">+<dt>Type<span className="colon">:</span></dt>+<dd>++Account — Can be set only for Account++</dd>+<dt>Data Type<span className="colon">:</span></dt>+<dd>++Boolean++</dd>+<dt>Description<span className="colon">:</span></dt>+<dd>++Controls whether tags with a [data movement policy](/user-guide/data-movement-policies) attached are required to have their propagation level set to `ON_DEPENDENCY_AND_DATA_MOVEMENT`.++</dd>+<dt>Values<span className="colon">:</span></dt>+<dd>++`TRUE`: Tags with a data movement policy attached must have their propagation level set to `ON_DEPENDENCY_AND_DATA_MOVEMENT`.++`FALSE`: A data movement policy can be attached to a tag regardless of its propagation level.++</dd>+<dt>Default<span className="colon">:</span></dt>+<dd>++`TRUE`++</dd>+</dl>+ <a id="label-error-on-nondeterministic-merge"></a>
従来のエコシステム概要図、カテゴリ別のソリューション一覧、各詳細ページへのリンクを削除し、認定テクノロジーパートナーの検索先を Snowflake Partner Network に一本化しました。Snowflake ネイティブのコネクターやドライバー、開発者向けツールは Developer Guide、Snowflake から直接利用できるパートナーアプリの無料トライアルは Trial SaaS applications from listings へ案内する構成に変更されています。 影響: このページ内でコネクターや連携製品をカテゴリ別に探せなくなったため、目的に応じて Snowflake Partner Network、Developer Guide、無料トライアル案内を使い分ける必要があります。
変更内容: 本文を更新（8行追加・24行削除）
--- ahttps://docs.snowflake.com/en/user-guide/ecosystem+++ bhttps://docs.snowflake.com/en/user-guide/ecosystem@@ -1,28 +1,12 @@ # Snowflake Ecosystem -Snowflake works with a wide array of industry-leading tools and technologies, enabling you to access Snowflake through an extensive network-of connectors, drivers, programming languages, and utilities, including:+Snowflake works with an extensive network of certified technology partners across data+integration, business intelligence, machine learning, security, and more. To find a+partner solution, visit the [Snowflake Partner Network](https://www.snowflake.com/en/why-snowflake/partners/all-partners/)+on the Snowflake website. -- Certified partners who have developed cloud-based and on-premises solutions for connecting to Snowflake.-- Other 3rd-party tools and technologies that are known to work with Snowflake.-- Snowflake-provided clients, including the [](/developer-guide/snowflake-cli/index) and [SnowSQL](/user-guide/snowsql) command line tools, connectors for- [Python](/developer-guide/python-connector/python-connector) and [Spark](/user-guide/spark-connector), and drivers for- [Node.js](/developer-guide/node-js/nodejs-driver), [JDBC](/developer-guide/jdbc/jdbc), [ODBC](/developer-guide/odbc/odbc), and more.+For native Snowflake connectors, drivers, and developer tools, see the+[Developer Guide](/developer-guide/). ---The next topics describe the solutions in more detail. The solutions are listed both alphabetically and grouped according to the categories-shown in the diagram above.--If you don't find a solution here that works for you, we have an extensive network of partners who can help you integrate with Snowflake.-For more details, see [Solutions Partners](https://www.snowflake.com/partners/solutions-partners/) (Snowflake website).--**Next Topics:**--- [](/user-guide/ecosystem-all)-- [](/user-guide/ecosystem-etl)-- [](/user-guide/ecosystem-bi)-- [](/user-guide/ecosystem-analytics)-- [](/user-guide/ecosystem-security)-- [](/user-guide/ecosystem-editors)-- [](/user-guide/ecosystem-lang)+For free trials of partner applications directly from Snowflake, see+[Trial SaaS applications from listings](/collaboration/consumer-saas-trials).
Version 4.3.4（2026年9月3日）が追加され、WORKLOAD_IDENTITY の接続先ホスト制限（例外設定は SNOWFLAKE_WIF_ALLOWED_HOST_SUFFIXES）、PrivateLink・OCSP・connections.toml の入力検証、機密情報のログマスキング、getTablePrivileges() のSQLインジェクション対策などのセキュリティ修正が行われました。加えて grpc-java 1.84.0／jsoup 1.23.2への更新、リトライや構造化型NULL処理、WIF・PAT認証時のパスワード必須問題の修正、DECFLOATのResultSet.getString()形式変更（120E+198から1.2e200）などが含まれます。
影響: 接続設定やホスト許可リストの見直しが必要になるほか、DECFLOATの文字列表現変更に依存するアプリケーションではパーサーの調整が必要で、ログの詳細度も低下します。
変更内容: 本文を更新（29行追加・0行削除）
--- ahttps://docs.snowflake.com/en/release-notes/clients-drivers/jdbc-2026+++ bhttps://docs.snowflake.com/en/release-notes/clients-drivers/jdbc-2026@@ -14,4 +14,33 @@ See [](/developer-guide/jdbc/jdbc) for documentation.++## Version 4.3.4 (Sep 03, 2026)++### Security fixes++- Restricted `WORKLOAD_IDENTITY` authentication to recognized Snowflake hosts: the attestation flow now verifies the target host before any ambient cloud credential is fetched and otherwise fails with `WORKLOAD_IDENTITY_FLOW_ERROR` naming the rejected host. Additional host suffixes can be permitted for local or test setups through the `SNOWFLAKE_WIF_ALLOWED_HOST_SUFFIXES` environment variable.+- Fixed PrivateLink host detection accepting a hostname that contained `.privatelink.snowflakecomputing.` anywhere in it rather than ending in a recognized Snowflake domain. A hostname must now end with `.snowflakecomputing.<tld>`. The OCSP response cache server URL is also rejected when its host isn't a Snowflake host; because that URL is held process-wide, a value accepted from one connection previously applied to every later connection in the same JVM.+- Added validation of `account`, `port`, and `protocol` in the auto-configuration (`connections.toml`) path, where the connect string's host is synthesized from `account`, so that none of the interpolated components can alter the resulting URL authority. Each dot-separated label of `account` may contain only letters, digits, underscores, and hyphens (mirroring the Python connector), `port` must be a number in 1-65535, and `protocol` must be `http` or `https`. As defense in depth, the `ACCOUNT` connection property now also rejects values containing `/`, `\`, `?`, `#`, `:`, `[`, `]`, or whitespace.+- Improved robustness of OCSP revocation checking: a definitive revocation result is now authoritative regardless of OCSP mode instead of being downgraded to a tolerable failure under the default `FAIL_OPEN` mode, each OCSP response entry is verified against the certificate being validated, and the cache entry is evicted on a definitive failure so it isn't retained indefinitely.+- Reduced sensitive detail in debug and response logging: the chunk result-master key is logged as a presence flag instead of its value, HTTP response header values are no longer logged (only header names), and chunk-download responses are rendered as a status line plus header names instead of the full response. `SecretDetector` additionally masks the `X-Amz-Credential` and `X-Amz-Security-Token` URL parameters, `qrmk`-labelled values, and the SSE-C customer key header.+- Fixed `DatabaseMetaData.getTablePrivileges()` concatenating unescaped table and schema names into SQL string literals, so a name containing a quote character could alter the generated statement.++### New features and updates++- Changed session-open property dump, GLOBAL/CHINA domain connection, and OAuth authentication-flow start messages from INFO to DEBUG to reduce log noise.+- Bumped grpc-java to 1.84.0.+- Bumped jsoup to 1.23.2.++### Bug fixes++- Fixed `DecorrelatedJitterBackoff.nextSleepTime` throwing `IllegalArgumentException: bound must be greater than origin` during HTTP request retries when the retry-timeout branch trimmed the backoff below the minimum.+- Changed DECFLOAT `ResultSet.getString()` from engineering notation (`120E+198`) to normalized scientific notation (`1.2e200`), matching the ODBC driver's `format_decfloat` behavior. Values whose unsigned plain form fits in 38 characters stay in plain decimal. Applications that parse this output may need to handle the new format.+- Fixed null nested structured-type fields throwing `NullPointerException` in `JsonSqlOutput` when binding via `SQLOutput` reference writers such as `writeObject`, `writeBigDecimal`, `writeBytes`, `writeDate`, and `writeTimestamp`.+- Fixed `SnowflakeBasicDataSource` requiring a password for Workload Identity Federation and Programmatic Access Token authentication.+- Fixed `SFFormatter` omitting the associated stack trace when a log record has a thrown exception.+- Fixed Linux credential cache parsing checking the root JSON node type a second time instead of the `tokens` child, which could fail the cache load when `tokens` was present but not an object.+- Fixed `DatabaseMetaData.getColumns()` discarding `trim()` on column default values and throwing `NullPointerException` when SHOW COLUMNS returns a SQL NULL default.+- Fixed `PreparedStatement.setObject(parameterIndex, byte[], Types.BINARY)` (and `Types.VARBINARY`/`Types.LONGVARBINARY`) binding the array's object reference (`[B@..`) instead of its hex value, causing a server-side `Invalid bind value ... for type (BINARY)` error. `byte[]` is now hex-encoded as `setBytes` does.+- Fixed slow PUT uploads to client-side-encrypted internal and temporary stages on the AWS SDK v2 async upload path (S3, and the GCS `GCSAccessStrategyAwsSdk` strategy), where the `CipherInputStream` source's ~512-byte reads throttled the transfer. The encrypted stream is now wrapped to fill each read fully. ## Version 4.3.3 (Aug 18, 2026)
ページ構成が見直され、Defense in depth セクションが新設されました。Data movement policies と Multi-party Approval はこのセクション内に移動され、既存の説明文は変更されていません。 影響: 機能仕様の変更ではなく、セキュリティ関連ガイドの分類とナビゲーションが整理された変更です。
変更内容: 本文を更新（15行追加・10行削除）
--- ahttps://docs.snowflake.com/en/guides-overview-secure+++ bhttps://docs.snowflake.com/en/guides-overview-secure@@ -134,16 +134,9 @@ </dd>-<dt>[](/user-guide/data-movement-policies)</dt>-<dd>+</dl> -Using data movement policies to proactively prevent data exfiltration across various movement channels in Snowflake.+## Defense in depth -</dd>-<dt>[](/user-guide/multi-party-approval)</dt>-<dd>--Using Multi-party Approval for a second-person review of security-sensitive and operationally risky critical operations.--</dd>+<dl> <dt>[End-to-End Encryption](/user-guide/security-encryption-end-to-end)</dt> <dd>@@ -152,3 +145,15 @@ </dd>+<dt>[Data movement policies](/user-guide/data-movement-policies)</dt>+<dd>++Using data movement policies to proactively prevent data exfiltration across various movement channels in Snowflake.++</dd>+<dt>[Multi-party Approval](/user-guide/multi-party-approval)</dt>+<dd>++Using Multi-party Approval for a second-person review of security-sensitive and operationally risky critical operations.++</dd> </dl>
Version 4.7.3（2026年9月3日）が追加され、WORKLOAD_IDENTITY の許可ホスト制限、SNOWFLAKE_WIF_ALLOWED_HOST_SUFFIXES による拡張、ログのシークレットおよびSQLマスキングなど、セキュリティ対策が強化されました。Python 3.14t向け実験版wheelの公開に加え、TLS検証、接続速度、split_statements のURL解析、OCSPキャッシュなどの不具合も修正されています。
影響: ログに含まれる機密情報のマスキングが既定で適用され、SNOWFLAKE_DISABLE_LOG_SECRET_MASKING=true で無効化できますが、Python 3.14t用wheelは本番利用非対象です。
変更内容: 本文を更新（23行追加・0行削除）
--- ahttps://docs.snowflake.com/en/release-notes/clients-drivers/python-connector-2026+++ bhttps://docs.snowflake.com/en/release-notes/clients-drivers/python-connector-2026@@ -14,4 +14,27 @@ See [](/developer-guide/python-connector/python-connector) for documentation.++## Version 4.7.3 (Sep 3, 2026)++### Security fixes++- Restricted the `WORKLOAD_IDENTITY` authentication flow to recognized Snowflake hosts ending in `snowflakecomputing.com`, `snowflakecomputing.cn`, or `snowflakecomputing.mil`. You can add recognized host suffixes with the `SNOWFLAKE_WIF_ALLOWED_HOST_SUFFIXES` environment variable.+- Applied secret masking by default to the `snowflake.connector` loggers and to the third-party loggers used by the connector: `botocore`, `boto3`, `aiohttp`, `aiobotocore`, `aioboto3`, and vendored `urllib3`. Set `SNOWFLAKE_DISABLE_LOG_SECRET_MASKING=true` to opt out.+- Extended masking to cover additional connection token formats, OAuth access and refresh tokens, one-time passcodes, OAuth client identifiers and secrets, and `Authorization` headers in error logs. The asynchronous path copies request headers before modifying them.+- Masked SQL text before it is written to DEBUG logs. Masking is deferred until a handler emits the log record to avoid unnecessary processing when DEBUG logging is disabled.+- Removed query result master key (`qrmk`) values, chunk-header values, and malformed response contents from result batch logs. Logs instead report whether a key is present and include structural metadata useful for debugging.+- Improved the robustness and correctness of OCSP revocation checking. `SF_OCSP_RESPONSE_CACHE_SERVER_URL` now takes precedence over connector-derived cache URLs, including for PrivateLink hosts, and PrivateLink OCSP cache URLs are derived only for valid hosts that contain a `.privatelink.` label and end in a recognized Snowflake domain. Other hosts use the public default cache URL.++### New features and updates++- Published experimental wheels for Python 3.14t (free-threaded CPython). These wheels are not intended for production use.++### Bug fixes++- Fixed TLS hostname verification rejecting a matching certificate subject alternative name when a Snowflake account locator contains an underscore.+- Fixed a significant `connect()` slowdown on deep call stacks. The connector now walks frame references directly instead of reading and parsing the source file for every frame.+- Fixed `split_statements` truncating unquoted URLs containing `://` by interpreting the `//` as a line comment. URL schemes are now recognized in both line-comment and block-comment parsing.+- Corrected the invalid account identifier error message to state that periods are allowed as label separators.+- Fixed the on-disk OCSP response validation cache failing when written from a forked child process. The cache file lock is now re-created when the owning process changes. ## Version 5.0.0rc1 (Aug 19, 2026)
2026年4月29日〜8月31日の更新として、Parquet read-back verificationを追加し、enable_parquet_readback_verificationで任意に有効化できるようになりました（既定値はオフ、処理時間は約7%増加）。また、Snowflake JDBCのランタイム依存を削除し、4.4.5ではParquet検証時のクラス欠落や例外処理、圧縮チェックの最大3回リトライを修正しました。
影響: 検証機能を使う場合はenable_parquet_readback_verificationによる処理時間増加を考慮し、JDBCも利用するアプリケーションは自身でJDBC依存関係を宣言する必要があります。
変更内容: 本文を更新（23行追加・0行削除）
--- ahttps://docs.snowflake.com/en/release-notes/clients-drivers/ingest-java-sdk-2026+++ bhttps://docs.snowflake.com/en/release-notes/clients-drivers/ingest-java-sdk-2026@@ -13,4 +13,27 @@ Snowflake uses semantic versioning for %client-name% updates. +## Version 4.4.5 (August 31, 2026)++### Bug fixes++- Fixed a missing-class error (`FileInputFormat`) that occurred when Parquet read-back verification was enabled with the shaded SDK jar.+- Parquet read-back verification now reports decode failures as an SDK exception instead of a raw Parquet exception, and retries a failed compression check up to three times.++## Version 4.4.4 (August 25, 2026)++### New features and updates++- Added optional Parquet read-back verification. After each file is written and before it is uploaded, the SDK can decompress and re-read the file to catch compression corruption on the client. This check is off by default. To enable it, set `enable_parquet_readback_verification` to `true` in the client profile. Enabling the check increases end-to-end flush time by about 7%.++## Version 4.4.3 (April 29, 2026)++### New features and updates++- The SDK no longer ships Snowflake JDBC as a runtime dependency. Ingestion APIs and behavior are unchanged. Applications that also use JDBC should declare their own JDBC dependency.++### Bug fixes++- Security update: Removed unused Snowflake JDBC runtime dependencies and excluded vulnerable transitive libraries.+ ## Version 4.4.2 (January 12, 2026)
Microsoft Teams／Microsoft 365 Copilot 連携では、転送されたクライアント IP の評価に user-level または account-level の network policy が使われ、security integration に設定したネットワークポリシーは適用されないことが明記されました。IP 制限を行う場合は、ユーザーレベルまたはアカウントレベルにポリシーを設定する必要があります。 影響: 既存の integration-level ポリシーではアクセス制限できないため、IP allowlist の確認・設定先を user-level または account-level に変更する必要があります。
変更内容: 本文を更新（20行追加・2行削除）
--- ahttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-teams-integration+++ bhttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-teams-integration@@ -460,4 +460,12 @@ Customers that require strict IP allowlisting should validate this behavior in their Microsoft tenant before rollout. +When the integration forwards the client IP address to Snowflake, Snowflake evaluates the request against the+**user-level** or **account-level** network policy, not the network policy attached to the security integration.+As a result, a network policy that you set on the security integration doesn't govern traffic from this integration.++To restrict access based on IP address for the Cortex Agents integration for Microsoft Teams and Microsoft 365 Copilot,+apply the network policy at the user level or the account level. For more information about the scopes at which a+network policy can be applied, see [Network policies](/user-guide/network-policies).+ ## Current limitations @@ -481,4 +489,12 @@ for the agent to function correctly. While Snowflake's [secondary roles](/user-guide/security-access-control-overview#label-access-control-role-enforcement) feature can help to broaden data access, the primary execution context is governed by the user's default role.++</dd>+<dt>Integration-level network policies aren't enforced</dt>+<dd>++Network policies attached to the security integration don't govern traffic from this integration. Snowflake evaluates+the forwarded client IP address against the user-level or account-level network policy instead. To restrict access based+on IP address, apply the network policy at the user level or the account level. </dd>@@ -588,6 +604,8 @@ 1. **Verify that the user's IP address is allowlisted.** Confirm that the user's current IP address is included in the- account's network policy. A simple way to test this is to have the user log in to their Snowflake account directly at- [Snowflake](https://app.snowflake.com/). If the user can log in successfully, their IP address is allowlisted.+ user-level or account-level network policy. This integration doesn't enforce network policies attached to the security+ integration, so verify the allowlist at the user level or the account level. A simple way to test this is to have the+ user log in to their Snowflake account directly at [Snowflake](https://app.snowflake.com/). If the user can log in+ successfully, their IP address is allowlisted. 2. **Check for IPv6 addresses.** If you encounter an IPv6 address in an error related to a network policy, this indicates that Microsoft is sending an IPv6 address as a claim within the authentication token.
全アカウントで利用可能になり、Interactive warehouses がすべてのテーブルタイプをサポートする旨に更新されました。各ステータスが明記され、Interactive tables は GA、Standard・Dynamic・Iceberg・Hybrid tables は Preview と整理されています。 影響: 全アカウントで利用できる一方、本番利用では GA の Interactive tables と Preview の各テーブルタイプを区別して選択する必要があります。
変更内容: 本文を更新（8行追加・6行削除）
--- ahttps://docs.snowflake.com/en/user-guide/interactive+++ bhttps://docs.snowflake.com/en/user-guide/interactive@@ -37,5 +37,7 @@ ### All table format support (Preview) -Interactive warehouses now support all table types on Snowflake (Preview), where support for Interactive table is GA:+Available to all accounts.++Interactive warehouses now support all table types. Please see the below table for the Preview/GA status of each: <div className="colwidths-given">@@ -53,21 +55,21 @@ <tbody> <tr>- <td>Standard tables</td>+ <td>Standard tables (Preview)</td> <td>Best default, same performance as Interactive tables</td> </tr> <tr>- <td>Dynamic tables</td>+ <td>Dynamic tables (Preview)</td> <td>Similar to Standard tables in terms of performance, supports dynamic updates</td> </tr> <tr>- <td>Interactive tables</td>+ <td>Interactive tables (GA)</td> <td>Best for consistenty query latency, reserved for future capabilities</td> </tr> <tr>- <td>Iceberg tables</td>+ <td>Iceberg tables (Preview)</td> <td>Most flexible, worse query performance than other options</td> </tr> <tr>- <td>Hybrid tables</td>+ <td>Hybrid tables (Preview)</td> <td>Supported only for data portability reasons, should not be used in production</td> </tr>
リリースノートがプレビュー版から最終版に更新され、タイトルに適用期間 Aug 29, 2026 - Sep 2, 2026 が追加されました。リリース完了の案内と最終公開日（Sep 2, 2026）が追記され、機能・構文などの実質的な変更はありません。 影響: リリースノートの確定状態と公開日が明確になっただけで、利用者側の機能や設定への影響はありません。
変更内容: 本文を更新（4行追加・8行削除）
--- ahttps://docs.snowflake.com/en/release-notes/2026/10_31+++ bhttps://docs.snowflake.com/en/release-notes/2026/10_31@@ -11,13 +11,8 @@ <a id="about-listing-consumers"></a> -# 10.31 Release Notes (no announcements) (Preview)+# 10.31 Release Notes (no announcements): Aug 29, 2026 - Sep 2, 2026 -Content on this page is available in advance of the completion of the 10.31 release, which is currently-either *pending* or *in progress* and is scheduled for completion on Sep 1, 2026 (subject to change).--Features, updates, or behavior changes described on this page might not be available in your accounts-until the release is complete.--For updates to these release notes, see [](#label-rel-notes-change-log-10-31).+This release has completed. For differences between the in-advance and final versions of these release+notes, see [](#label-rel-notes-change-log-10-31). This release contains no significant features, updates, or enhancements to announce.@@ -30,2 +25,3 @@ | ------------- | ----------------------------- | ------------ | | Release notes | Initial publication (preview) | Aug 29, 2026 |+| Release notes | Final publication | Sep 2, 2026 |
承認済みリクエストは1回 בלבד再実行可能となり、成功したリプレイ後はExecuted状態へ移行し、再実行には新しいリクエストと承認が必要になりました。さらに、正当化理由の提出と承認後のリプレイが必要なため、保護対象操作をtasks・stored procedures・SCIM actionsから実行できないことが明記されました。
影響: 自動実行やストアドプロシージャ、SCIM経由で保護対象操作を実行している場合は失敗するため、手動で新規リクエストと承認を取得する運用が必要です。
変更内容: 本文を更新（9行追加・2行削除）
--- ahttps://docs.snowflake.com/en/user-guide/multi-party-approval+++ bhttps://docs.snowflake.com/en/user-guide/multi-party-approval@@ -145,6 +145,13 @@ Once the required approvals are received, the Requester must replay the exact original SQL statement to execute it. The replay window is 3 days after the-request is approved. The Requester can also self-cancel any of their own-pending requests at any time.+request is approved. Each approved request can be re-executed only once: after a+successful replay, the request moves to the `Executed` state, and running the+operation again requires a new request and new approvals. The Requester can also+self-cancel any of their own pending requests at any time.++Because this flow requires a user to submit a justification and replay the+statement after approval, protected operations fail if they are executed from+tasks or stored procedures. For the same reason, SCIM actions that attempt a+protected operation fail. ### Approver
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（10行追加・0行削除）
--- ahttps://docs.snowflake.com/en/release-notes/clients-drivers/nodejs-2026+++ bhttps://docs.snowflake.com/en/release-notes/clients-drivers/nodejs-2026@@ -14,4 +14,14 @@ See [](/developer-guide/node-js/nodejs-driver) for documentation.++## Version 3.3.0 (September 3, 2026)++### Security fixes++- Restricted the `WORKLOAD_IDENTITY` authenticator to recognized Snowflake hosts (`*.snowflakecomputing.com`, `*.snowflakecomputing.cn`, and `*.snowflakecomputing.mil`). To extend the list of allowed hosts, use the `SNOWFLAKE_WIF_ALLOWED_HOST_SUFFIXES` environment variable.+- Improved OCSP response validation so that a response must correspond to the certificate being checked. Verification now selects the matching single response from the OCSP message instead of using the first one, and fails with `ERR_OCSP_RESPONSE_CERT_MISMATCH` when none matches. This applies to both live checks and cached responses.+- Fixed PrivateLink host detection using a substring match that could misclassify a host as a PrivateLink host.+- Changed cloud storage response logs to list header names instead of full header objects, which keeps header values out of the logs. Query strings are also trimmed from cloud storage URLs before they reach debug logs.+- Corrected the SAS token masking rule in debug logs and extended masking to cover the `X-Amz-Credential` and `X-Amz-Security-Token` URL parameters and the S3 SSE-C customer-key header. ## Version 3.2.0 (August 18, 2026)
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（10行追加・0行削除）
--- ahttps://docs.snowflake.com/en/release-notes/clients-drivers/odbc-2026+++ bhttps://docs.snowflake.com/en/release-notes/clients-drivers/odbc-2026@@ -14,4 +14,14 @@ See [](/developer-guide/odbc/odbc) for documentation.++## Version 3.20.0 (Sep 3, 2026)++### Security fixes++- Improved validation of the `ACCOUNT`, `SERVER`, and `PORT` connection parameters before they are used to construct request URLs, so that none of the interpolated values can alter the resulting URL. Values that contain characters other than letters, digits, `_`, `-`, and `.` are rejected, as are port numbers outside the range 1–65535.++### New features++- Added the `WORKLOAD_IDENTITY_AUDIENCE` connection parameter to override the audience used when requesting a Workload Identity Federation attestation token. When omitted, the driver uses the default audience `snowflakecomputing.com`. ## Version 4.0.0-rc2 (Sep 1, 2026)
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（7行追加・1行削除）
--- ahttps://docs.snowflake.com/en/sql-reference/sql/create-feature-policy+++ bhttps://docs.snowflake.com/en/sql-reference/sql/create-feature-policy@@ -142,5 +142,11 @@ blocked_creation_rules: - object_type: TABLE- block_when: "SYS_CONTEXT('SNOWFLAKE$REQUEST', 'GET_OBJECT_PROPERTY', 'IS_TEMPORARY') = 'TRUE'"+ block_when: "$IS_TEMPORARY" $$; ```++A `block_when` expression can read request attributes through the `$` variable shorthand,+as shown, or through the equivalent+`SYS_CONTEXT('SNOWFLAKE$REQUEST', 'GET_OBJECT_PROPERTY', 'IS_TEMPORARY') = 'TRUE'`. For the+available properties and the differences between the two forms, see+[Available context](/user-guide/feature-policies#label-feature-policy-rules-available-context).
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（6行追加・0行削除）
--- ahttps://docs.snowflake.com/en/sql-reference/functions/ai_complete-prompt-object+++ bhttps://docs.snowflake.com/en/sql-reference/functions/ai_complete-prompt-object@@ -96,6 +96,9 @@ - `claude-opus-4-6` - `claude-opus-4-7`+- `claude-opus-4-8`+- `claude-opus-5` - `claude-sonnet-4-5` - `claude-sonnet-4-6`+- `claude-sonnet-5` - `gemini-2.5-flash` - `gemini-2.5-flash-lite`@@ -122,6 +125,9 @@ - `claude-opus-4-6` - `claude-opus-4-7`+- `claude-opus-4-8`+- `claude-opus-5` - `claude-sonnet-4-5` - `claude-sonnet-4-6`+- `claude-sonnet-5` - `gemini-2.5-flash` - `gemini-2.5-flash-lite`
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（6行追加・0行削除）
--- ahttps://docs.snowflake.com/en/developer-guide/odbc/odbc-parameters+++ bhttps://docs.snowflake.com/en/developer-guide/odbc/odbc-parameters@@ -1082,4 +1082,10 @@ This argument is supported for AWS and Google Cloud workloads and only applies when `authenticator=WORKLOAD_IDENTITY`.++</dd>+<dt>`WORKLOAD_IDENTITY_AUDIENCE`</dt>+<dd>++Audience value to request when creating a Workload Identity Federation attestation token. When omitted, the driver uses `snowflakecomputing.com`. This parameter only applies when `authenticator=WORKLOAD_IDENTITY`. </dd>
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（5行追加・1行削除）
--- ahttps://docs.snowflake.com/en/sql-reference/sql/alter-feature-policy+++ bhttps://docs.snowflake.com/en/sql-reference/sql/alter-feature-policy@@ -192,7 +192,11 @@ blocked_creation_rules: - object_type: TABLE- block_when: "SYS_CONTEXT('SNOWFLAKE$REQUEST', 'GET_OBJECT_PROPERTY', 'IS_TEMPORARY') = 'TRUE'"+ block_when: "$IS_TEMPORARY" $$; ```++The `block_when` expression uses the `$` variable shorthand. For the available properties+and the equivalent `SYS_CONTEXT` form, see+[Available context](/user-guide/feature-policies#label-feature-policy-rules-available-context). The following example removes the YAML body but keeps any blocked object types:
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（2行追加・2行削除）
--- ahttps://docs.snowflake.com/en/release-notes/2026/other/2026-08-25-remote-development-vscode-preview+++ bhttps://docs.snowflake.com/en/release-notes/2026/other/2026-08-25-remote-development-vscode-preview@@ -16,5 +16,5 @@ Remote Development lets you create a Snowflake-backed development environment and connect to it over-Remote - SSH from Visual Studio Code, Cursor, or Cortex Code Desktop. You can run Python notebooks, SQL,+Remote - SSH from Visual Studio Code or Cursor. You can run Python notebooks, SQL, scripts, terminals, and Cortex Code on Snowflake-managed compute. @@ -24,5 +24,5 @@ in Workspaces, so Python and SQL cells run the same way they do in the %sf-web-interface% Workspaces UI. - Select multiple workspaces for a remote environment and change the selection at any time.-- Use Cortex Code in the remote session in Visual Studio Code, Cursor, and Cortex Code Desktop.+- Use Cortex Code in the remote session in Visual Studio Code and Cursor. Remote Development requires version 1.38 or later of the %sf-vscext%. It's enabled by default through the
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・1行削除）
--- ahttps://docs.snowflake.com/en/developer-guide/snowpark-container-services/spcs-execute-sql+++ bhttps://docs.snowflake.com/en/developer-guide/snowpark-container-services/spcs-execute-sql@@ -45,4 +45,6 @@ When you create a connection to Snowflake as the service user, container code must use SNOWFLAKE_HOST, SNOWFLAKE_ACCOUNT, and the OAuth token. The OAuth token can't be used without also using SNOWFLAKE_HOST.++Configure [`sessionTokenConfig`](/developer-guide/snowpark-container-services/specification-reference#label-spcs-spec-ref-containers-session-token-config) in the service specification to mount the token at a different path, restrict the file permission mode of the token, or generate a `connections.toml` file. When you specify a custom `path`, Snowflake mounts the token at `<path>/token`. **Example**@@ -179,5 +181,5 @@ In the example above: -- The `get_login_token` function reads the file where Snowflake copied the OAuth token for the container to use.+- The `get_login_token` function reads the file where Snowflake copied the OAuth token for the container to use. If you configure a custom session token path, open `<path>/token` instead of `/snowflake/session/token`. - The `get_connection_params` function constructs a token by concatenating the OAuth token and the user token from the `Sf-Context-Current-User-Token` header. The function includes this token in a dictionary of parameters that the application uses to
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（2行追加・2行削除）
--- ahttps://docs.snowflake.com/en/user-guide/ui-snowsight-quick-tour+++ bhttps://docs.snowflake.com/en/user-guide/ui-snowsight-quick-tour@@ -193,5 +193,5 @@ Manage cost and billing, configure account settings, set up integrations with external systems and services,-and connect with partner tools through Partner Connect.+and connect with partner tools through the Snowflake Marketplace. For more information, see:@@ -199,5 +199,5 @@ - [](/user-guide/cost-exploring-overall) - [](/user-guide/ui-snowsight-integrations)-- [](/user-guide/ecosystem-partner-connect)+- [](/collaboration/consumer-saas-trials) <a id="label-snowsight-quick-tour-user-menu"></a>
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（4行追加・0行削除）
--- ahttps://docs.snowflake.com/en/user-guide/tables-iceberg-default-metadata-format+++ bhttps://docs.snowflake.com/en/user-guide/tables-iceberg-default-metadata-format@@ -96,4 +96,8 @@ ## Considerations and limitations +- Setting `DEFAULT_METADATA_WRITE_FORMAT` to `ICEBERG` doesn't convert existing standard Snowflake tables in the database or schema+ into %iceberg-tm% tables. It only affects how Snowflake resolves DDL commands: `CREATE TABLE` creates an %iceberg-tm% table, and+ `ALTER TABLE` assumes the target is an %iceberg-tm% table. Existing standard Snowflake tables remain unchanged and can't be altered+ while the parameter is set to `ICEBERG`. To alter existing standard tables, temporarily set the parameter back to `SNOWFLAKE`. - When `DEFAULT_METADATA_WRITE_FORMAT` is `ICEBERG`, you can't create standard Snowflake tables with `CREATE TABLE` in that scope unless you change the parameter back to `SNOWFLAKE`. Snowflake doesn't support `CREATE SNOWFLAKE TABLE` syntax.
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/data-connectivity-proxy+++ bhttps://docs.snowflake.com/en/user-guide/data-connectivity-proxy@@ -100,5 +100,6 @@ DCP and PrivateLink aren't mutually exclusive. If your Snowflake account uses PrivateLink for inbound access, you can still use DCP for-outbound connectivity to private data sources.+outbound connectivity to private data sources. The DCP agent itself must connect to the public DCP hostnames on port 443. Connecting the+agent through a PrivateLink endpoint isn't supported. <a id="label-dcp-architecture"></a>
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/data-connectivity-proxy-reference+++ bhttps://docs.snowflake.com/en/user-guide/data-connectivity-proxy-reference@@ -81,4 +81,7 @@ ## SQL functions +Setup also requires [](/sql-reference/functions/system_issue_per_account_certificates). See the+[note in the setup topic](/user-guide/data-connectivity-proxy-setup#label-dcp-setup-issue-certificates).+ <a id="label-dcp-bootstrap-token-fn"></a>
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/sql-reference/functions/ai_complete-single-file+++ bhttps://docs.snowflake.com/en/sql-reference/functions/ai_complete-single-file@@ -46,6 +46,9 @@ - `claude-opus-4-6` - `claude-opus-4-7`+- `claude-opus-4-8`+- `claude-opus-5` - `claude-sonnet-4-5` - `claude-sonnet-4-6`+- `claude-sonnet-5` - `gemini-3.1-pro` - `llama4-maverick`
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/sql-reference/functions/explain_privileges+++ bhttps://docs.snowflake.com/en/sql-reference/functions/explain_privileges@@ -127,4 +127,7 @@ ## Usage notes +- `"authorized": true` means the current role, or the role specified in `for_role`, has+ sufficient privileges to execute the statement. The operation can still fail for other+ reasons; for example, [feature policies](/user-guide/feature-policies) can block it. - The `statement` argument must be a constant expression. You cannot pass column values or other non-constant expressions.
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/sql-reference/functions/system_issue_per_account_certificates+++ bhttps://docs.snowflake.com/en/sql-reference/functions/system_issue_per_account_certificates@@ -25,4 +25,7 @@ Calling this function when the certificates are already being maintained has no additional effect, so it's safe to call more than once.++Data Connectivity Proxy (DCP) setup uses this function. See the+[note in the DCP setup topic](/user-guide/data-connectivity-proxy-setup#label-dcp-setup-issue-certificates). This system function may be removed in the future.
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/release-notes/preview-features+++ bhttps://docs.snowflake.com/en/release-notes/preview-features@@ -106,5 +106,5 @@ <td>August 2026</td> <td>[](/user-guide/vscode-ext-remote-development)</td>- <td>Connect to a Snowflake-backed remote development environment from Visual Studio Code, Cursor, or Cortex Code Desktop to run notebooks, SQL, scripts, terminals, and Cortex Code on Snowflake-managed compute.</td>+ <td>Connect to a Snowflake-backed remote development environment from Visual Studio Code or Cursor to run notebooks, SQL, scripts, terminals, Git, and Cortex Code on Snowflake-managed compute.</td> </tr> <tr>
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/data-movement-policies+++ bhttps://docs.snowflake.com/en/user-guide/data-movement-policies@@ -29,5 +29,5 @@ - You identify sensitive data domains and classify data where needed. - Your protected data is covered by tags. Tags can be applied at column, table, schema, or database scope.-- Tag propagation is configured correctly for movement use cases. Use `ON_DATA_MOVEMENT` or `ON_DEPENDENCY_AND_DATA_MOVEMENT` as needed.+- Tag propagation is configured correctly for movement use cases. By default, tags with a data movement policy attached must have their propagation level set to `ON_DEPENDENCY_AND_DATA_MOVEMENT`. To disable this requirement, set the [ENFORCE_TAG_PROPAGATION_FOR_DATA_MOVEMENT_POLICIES](/sql-reference/parameters#enforce-tag-propagation-for-data-movement-policies) account parameter to `FALSE`. When disabled, a data movement policy can be applied to tags with any propagation level, meaning the policy won't follow and protect data through tag propagation. For more details, see [Tag propagation](/user-guide/object-tagging/propagation). - You define approved exception roles for business workflows that need controlled movement access. - You validate movement workflows in a non-production environment before rollout.
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/intro-supported-features+++ bhttps://docs.snowflake.com/en/user-guide/intro-supported-features@@ -117,5 +117,5 @@ - Broad [ecosystem](/user-guide/ecosystem) of supported 3rd-party partners and technologies.-- Support for using free trials to [connect to selected partners](/user-guide/ecosystem-partner-connect).+- Support for using free trials to [trial partner applications](/collaboration/consumer-saas-trials). ## Data import and export
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/intro-key-concepts+++ bhttps://docs.snowflake.com/en/user-guide/intro-key-concepts@@ -308,5 +308,5 @@ - Native [connectors](/user-guide/connectors) that you can use to develop applications for connecting to Snowflake; for example, Apache Kafka and Apache Spark.-- [Third-party technologies](/user-guide/ecosystem-all) that you can use to connect applications to Snowflake;+- [Third-party technologies](https://www.snowflake.com/en/why-snowflake/partners/all-partners/) that you can use to connect applications to Snowflake; for example, extract, transform, load (ETL) tools such as Informatica, and business intelligence (BI) tools such as ThoughtSpot.
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/tables-iceberg-externally-managed-writes+++ bhttps://docs.snowflake.com/en/user-guide/tables-iceberg-externally-managed-writes@@ -21,5 +21,5 @@ allows you to use Snowpark or Snowflake SQL to build complex pipelines that ingest, transform, and process data for Iceberg tables. You can query the data by using Snowflake or other engines.- Similarly, you can use Snowflake [partner tools](/user-guide/ecosystem-all) to build your Iceberg data engineering pipelines.+ Similarly, you can use Snowflake [partner tools](https://www.snowflake.com/en/why-snowflake/partners/all-partners/) to build your Iceberg data engineering pipelines. - **Making your data available to the Iceberg ecosystem**: The ability to write to Iceberg tables in external catalogs lets you make your data available to the Iceberg ecosystem. You can query data that's already in Snowflake and write it to Iceberg tables.
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/sql-reference/functions/complete-snowflake-cortex-multimodal+++ bhttps://docs.snowflake.com/en/sql-reference/functions/complete-snowflake-cortex-multimodal@@ -92,5 +92,5 @@ - Only text and images are supported. Video and audio files are not supported. - Images with filename extensions `.jpg`, `.jpeg`, `.png`, `.gif`, and `.webp` are supported. `pixtral-large` also supports `.bmp`.-- Maximum image size is 10 MB for `pixtral-large` and 3.75 MB for `claude-sonnet-4-6`. Additionally, `claude-sonnet-4-6` does not support images with a resolution greater than 8000x8000.+- Maximum image size is 10 MB for `pixtral-large` and 3.75 MB for Claude models. Additionally, Claude models do not support images with a resolution greater than 8000x8000. - The stage containing the images must have server-side encryption enabled. Client-side encrypted stages are not supported. - The function does not support custom network policies.
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/connectors/informatica-cloud-connector+++ bhttps://docs.snowflake.com/en/connectors/informatica-cloud-connector@@ -3,5 +3,5 @@ This version of the Snowflake Connector has been deprecated. Use the latest version of the connector (provided by Informatica) instead. -For more details, see [](/user-guide/ecosystem-etl).+For more details, see the [Snowflake Partner Network](https://www.snowflake.com/en/why-snowflake/partners/all-partners/). This topic contains information about how to set up and use version 1.x of the Snowflake Connector. It explains how Informatica Cloud organization administrators and business users can use the Snowflake
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/tutorials/getting-started-with-hybrid-tables-tutorial+++ bhttps://docs.snowflake.com/en/user-guide/tutorials/getting-started-with-hybrid-tables-tutorial@@ -725,5 +725,5 @@ In this step, you will run two security-related examples to demonstrate that Snowflake-[security and governance](/user-guide/ecosystem-security) functionality applies equally to standard tables+security and governance functionality applies equally to standard tables and hybrid tables.
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/intro-editions+++ bhttps://docs.snowflake.com/en/user-guide/intro-editions@@ -765,5 +765,5 @@ </tr> <tr>- <td>[](/user-guide/ecosystem-partner-connect) for initiating free software/service trials with a growing network of partners in the Snowflake ecosystem.</td>+ <td>[](/collaboration/consumer-saas-trials) for initiating free software/service trials with a growing network of partners in the Snowflake ecosystem.</td> <td>%cm%</td> <td>%cm%</td>
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/setup+++ bhttps://docs.snowflake.com/en/user-guide/setup@@ -23,5 +23,5 @@ Your organization might create an application and make it available to you, or you might use a third-party application available on the [Snowflake Marketplace](/collaboration/collaboration-marketplace-about) or in the- [Snowflake ecosystem](/user-guide/ecosystem-all).+ [Snowflake Partner Network](https://www.snowflake.com/en/why-snowflake/partners/all-partners/). For information about these tools and interfaces, see [](/guides-overview-connecting).
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/guides-overview-loading-data+++ bhttps://docs.snowflake.com/en/guides-overview-loading-data@@ -4,5 +4,5 @@ The following topics provide an overview of data loading concepts, tasks, tools, and techniques to quick and easily load data into your Snowflake database. -- [](/user-guide/ecosystem-partner-connect)+- [](/collaboration/consumer-saas-trials) - [](/user-guide/data-unload-overview) - [](/sql-reference/sql-dml)
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/feature-policies+++ bhttps://docs.snowflake.com/en/user-guide/feature-policies@@ -421,4 +421,6 @@ written as a quoted string. The expression is validated when the policy is created or altered.++<a id="label-feature-policy-rules-available-context"></a> #### Available context
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/sql-reference/service-types+++ bhttps://docs.snowflake.com/en/sql-reference/service-types@@ -33,4 +33,5 @@ | DATA_TRANSFER | DATA TRANSFER | Network egress charges for data transferred out of Snowflake. | Networking | TiB | | EGRESS_COST_OPTIMIZER | EGRESS COST OPTIMIZER | Service that optimizes and reduces data egress costs. | Management and Governance | TiB-Months |+| EXTERNAL_GOVERNANCE | EXTERNAL GOVERNANCE | Compute used for external-governance (data policy) enforcement. | Management and Governance | Credits | | FAILSAFE_RECOVERY | FAILSAFE RECOVERY | Charges for recovering data from Fail-safe storage. | Databases | Credits | | HYBRID_TABLE_DEDICATED_STORAGE_MODE | HYBRID TABLE DEDICATED STORAGE MODE | Dedicated storage mode for Hybrid Tables. | Storage | Days |
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/sql-reference/sql/alter-account+++ bhttps://docs.snowflake.com/en/sql-reference/sql/alter-account@@ -90,4 +90,5 @@ ENFORCE_NETWORK_RULES_FOR_INTERNAL_STAGES = TRUE | FALSE ENFORCE_NETWORK_RULES_FOR_SNOWFLAKE_MANAGED_STORAGE_VOLUME = TRUE | FALSE+ ENFORCE_TAG_PROPAGATION_FOR_DATA_MOVEMENT_POLICIES = TRUE | FALSE ENABLE_NOTEBOOK_CREATION_IN_PERSONAL_DB = TRUE | FALSE ENABLE_SPCS_BLOCK_STORAGE_SNOWFLAKE_FULL_ENCRYPTION_ENFORCEMENT = TRUE | FALSE
| セクション | S | A | B | C | 計 |
|---|---|---|---|---|---|
| User Guide | 8 | 2 | 6 | 10 | 26 |
| Release Notes | 0 | 1 | 8 | 1 | 10 |
| SQL Functions | 0 | 0 | 1 | 4 | 5 |
| SQL Commands | 0 | 0 | 2 | 1 | 3 |
| Snowflake Cortex (AI & ML) | 0 | 1 | 1 | 0 | 2 |
| Snowpark Container Services | 0 | 1 | 1 | 0 | 2 |
| SQL General Reference | 0 | 0 | 1 | 1 | 2 |
| General | 0 | 0 | 1 | 1 | 2 |
| Developer Guide | 0 | 0 | 1 | 0 | 1 |
| Connectors & Drivers | 0 | 0 | 0 | 1 | 1 |