@@ -41,6 +41,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Improved the robustness and correctness of OCSP revocation checking (SNOW-3675581).
     - When `SF_OCSP_RESPONSE_CACHE_SERVER_URL` is set, the connector uses it as the OCSP cache server, including on PrivateLink hosts.
     - A PrivateLink OCSP cache URL is derived only for hosts that consist of hostname characters, include a `.privatelink.` label, and end at `snowflakecomputing.com`, `.cn`, or `.mil`. Other hosts use the public default cache URL; set `SF_OCSP_RESPONSE_CACHE_SERVER_URL` to use a different cache server.
+    - Please review [Snowflake documentation](https://docs.snowflake.com/en/release-notes/clients-drivers/python-connector-2026#version-473-sep-3-2026) for possible implications to your workflow
   - Extended log secret masking coverage (SNOW-3675583). The connection-token pattern accepts `:` and `%` in the token value. Added patterns for OAuth access and refresh tokens in serialized JSON, for one-time passcodes, and for OAuth client identifiers and secrets. The passcode pattern accepts quoted values. The password pattern requires at least six characters in the value, so ordinary prose following the word "password" is not redacted.
   - Request headers are copied before mutation on the async path, and masking is applied to the `Authorization` header in error logs (SNOW-3675593).
   - Applied secret masking to the `snowflake.connector` loggers by default, independent of how application logging is configured. The same filter also covers the third-party loggers the connector uses (`botocore`, `boto3`, `aiohttp`, `aiobotocore`, `aioboto3`, vendored `urllib3`). Set `SNOWFLAKE_DISABLE_LOG_SECRET_MASKING=true` to opt out; it is honored at emit time, including after import (SNOW-3675583).