@@ -7,7 +7,7 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v4.7.6 (Unreleased)
+- v4.8.0(Sep 30,2026)
   - Fixed external-browser (SSO) authentication to validate the `Origin` header on the local callback server, rejecting tokens delivered from unexpected origins. A trailing slash in the origin (e.g. `https://account.snowflakecomputing.com/`) is now accepted on par with the bare origin, matching JDBC and other driver behaviour. Preconnect probe connections (empty recv) no longer count against the retry budget and no longer abort the login flow.
   - Added the `SNOWFLAKE_TLS_CIPHERS` environment variable to restrict which TLS ciphers the connector offers. It takes a colon-separated list; names beginning with `TLS_` are applied as TLS 1.3 cipher suites and the remainder as the cipher list for TLS 1.2 and below, so a single variable covers both. Leaving it unset keeps OpenSSL's defaults unchanged, and an unrecognized cipher name is rejected rather than silently ignored. The restriction covers Snowflake API traffic, cloud-storage (stage) transfers, OCSP/CRL fetches and IdP requests. Requests issued by the AWS and Azure SDKs, and asynchronous connections, are not covered — for TLS 1.3 suites specifically they cannot be, because the Python standard library exposes no API for restricting them.
   - Raised the minimum `pyOpenSSL` requirement to 25.3.0, the first version providing `set_tls13_ciphersuites`. This does not narrow the set of installable versions in practice: earlier releases cap `cryptography` below 46 and so were already uninstallable alongside the connector's own `cryptography>=46.0.5` requirement.
 
@@ -1,3 +1,3 @@
 # Update this for the versions
 # Don't change the fourth version number from None
-VERSION = (4, 7, 5, None)
+VERSION = (4, 8, 0, None)
@@ -71,6 +71,23 @@
 logger = logging.getLogger(__name__)
 
 
+@pytest.fixture
+def isolate_feature_ocsp_mode():
+    """Reset process-global FEATURE_OCSP_MODE around OCSP mode tests.
+
+    FEATURE_OCSP_MODE is sticky: a prior opt-in (FAIL_OPEN/FAIL_CLOSED) in the
+    same pytest-xdist worker is not overwritten by a later DISABLE connection,
+    which makes disable/insecure_mode integ assertions flake under -n auto.
+    """
+    from snowflake.connector import ssl_wrap_socket
+
+    ssl_wrap_socket.FEATURE_OCSP_MODE = ssl_wrap_socket.DEFAULT_OCSP_MODE
+    try:
+        yield
+    finally:
+        ssl_wrap_socket.FEATURE_OCSP_MODE = ssl_wrap_socket.DEFAULT_OCSP_MODE
+
+
 def test_basic(conn_testaccount):
     """Basic Connection test."""
     assert conn_testaccount, "invalid cnx"
@@ -1449,7 +1466,7 @@ def test_server_session_keep_alive(conn_cnx):
 
 @pytest.mark.skipolddriver
 def test_ocsp_mode_disable_ocsp_checks(
-    conn_cnx, is_public_test, is_local_dev_setup, caplog
+    conn_cnx, is_public_test, is_local_dev_setup, caplog, isolate_feature_ocsp_mode
 ):
     caplog.set_level(logging.DEBUG, "snowflake.connector.ocsp_snowflake")
     with conn_cnx(disable_ocsp_checks=True) as conn, conn.cursor() as cur:
@@ -1474,7 +1491,13 @@ def test_ocsp_mode_disable_ocsp_checks(
     "ocsp_fail_open,expected_mode", [(True, "FAIL_OPEN"), (False, "FAIL_CLOSED")]
 )
 def test_ocsp_mode_opt_in_fail_open(
-    conn_cnx, is_public_test, is_local_dev_setup, caplog, ocsp_fail_open, expected_mode
+    conn_cnx,
+    is_public_test,
+    is_local_dev_setup,
+    caplog,
+    ocsp_fail_open,
+    expected_mode,
+    isolate_feature_ocsp_mode,
 ):
     caplog.set_level(logging.DEBUG, "snowflake.connector.ocsp_snowflake")
     with conn_cnx(ocsp_fail_open=ocsp_fail_open) as conn, conn.cursor() as cur:
@@ -1489,7 +1512,9 @@ def test_ocsp_mode_opt_in_fail_open(
 
 
 @pytest.mark.skipolddriver
-def test_ocsp_cache_filename_ignored_when_ocsp_off(conn_cnx, tmp_path, caplog):
+def test_ocsp_cache_filename_ignored_when_ocsp_off(
+    conn_cnx, tmp_path, caplog, isolate_feature_ocsp_mode
+):
     caplog.set_level(logging.WARNING, "snowflake.connector.connection")
     cache_file = tmp_path / "ocsp_cache.json"
     with (
@@ -1503,7 +1528,9 @@ def test_ocsp_cache_filename_ignored_when_ocsp_off(conn_cnx, tmp_path, caplog):
 
 
 @pytest.mark.skipolddriver
-def test_ocsp_mode_insecure_mode(conn_cnx, is_public_test, is_local_dev_setup, caplog):
+def test_ocsp_mode_insecure_mode(
+    conn_cnx, is_public_test, is_local_dev_setup, caplog, isolate_feature_ocsp_mode
+):
     caplog.set_level(logging.DEBUG, "snowflake.connector.ocsp_snowflake")
     with conn_cnx(insecure_mode=True) as conn, conn.cursor() as cur:
         assert cur.execute("select 1").fetchall() == [(1,)]
@@ -1514,7 +1541,7 @@ def test_ocsp_mode_insecure_mode(conn_cnx, is_public_test, is_local_dev_setup, c
 
 @pytest.mark.skipolddriver
 def test_ocsp_mode_insecure_mode_and_disable_ocsp_checks_match(
-    conn_cnx, is_public_test, is_local_dev_setup, caplog
+    conn_cnx, is_public_test, is_local_dev_setup, caplog, isolate_feature_ocsp_mode
 ):
     caplog.set_level(logging.DEBUG, "snowflake.connector.ocsp_snowflake")
     with (
@@ -1533,7 +1560,7 @@ def test_ocsp_mode_insecure_mode_and_disable_ocsp_checks_match(
 
 @pytest.mark.skipolddriver
 def test_ocsp_mode_insecure_mode_and_disable_ocsp_checks_mismatch_ocsp_disabled(
-    conn_cnx, is_public_test, is_local_dev_setup, caplog
+    conn_cnx, is_public_test, is_local_dev_setup, caplog, isolate_feature_ocsp_mode
 ):
     caplog.set_level(logging.DEBUG, "snowflake.connector.ocsp_snowflake")
     with (
@@ -1722,7 +1749,7 @@ def test_no_new_warnings_or_errors_on_successful_basic_select(conn_cnx, caplog):
 
 @pytest.mark.skipolddriver
 def test_ocsp_mode_insecure_mode_and_disable_ocsp_checks_mismatch_ocsp_enabled(
-    conn_cnx, is_public_test, is_local_dev_setup, caplog
+    conn_cnx, is_public_test, is_local_dev_setup, caplog, isolate_feature_ocsp_mode
 ):
     caplog.set_level(logging.DEBUG, "snowflake.connector.ocsp_snowflake")
     with (
 
@@ -1,26 +1,26 @@
-# Generated on: Python 3.10.21
+# Generated on: Python 3.10.11
 asn1crypto==1.5.1
-boto3==1.43.86
-botocore==1.43.86
+boto3==1.43.105
+botocore==1.43.105
 certifi==2026.7.22
 cffi==2.1.1
-charset-normalizer==3.5.1
+charset-normalizer==3.5.2
 cryptography==50.0.1
-filelock==3.32.5
-idna==3.19
+filelock==3.32.7
+idna==3.20
 jmespath==1.1.0
 packaging==26.3
-platformdirs==4.11.7
+platformdirs==4.12.2
 pycparser==3.0
-PyJWT==2.13.0
+PyJWT==2.15.1
 pyOpenSSL==26.4.0
 python-dateutil==2.9.0.post0
-pytz==2026.3.post1
+pytz==2026.4
 requests==2.34.2
 s3transfer==0.19.2
 six==1.17.0
 sortedcontainers==2.4.0
 tomlkit==0.15.1
 typing_extensions==4.16.0
-urllib3==2.7.0
-snowflake-connector-python==4.7.5
+urllib3==2.8.0
+snowflake-connector-python==4.8.0
@@ -1,26 +1,26 @@
-# Generated on: Python 3.11.16
+# Generated on: Python 3.11.6
 asn1crypto==1.5.1
-boto3==1.43.86
-botocore==1.43.86
+boto3==1.43.105
+botocore==1.43.105
 certifi==2026.7.22
 cffi==2.1.1
-charset-normalizer==3.5.1
+charset-normalizer==3.5.2
 cryptography==50.0.1
-filelock==3.32.5
-idna==3.19
+filelock==3.32.7
+idna==3.20
 jmespath==1.1.0
 packaging==26.3
-platformdirs==4.11.7
+platformdirs==4.12.2
 pycparser==3.0
-PyJWT==2.13.0
+PyJWT==2.15.1
 pyOpenSSL==26.4.0
 python-dateutil==2.9.0.post0
-pytz==2026.3.post1
+pytz==2026.4
 requests==2.34.2
 s3transfer==0.19.2
 six==1.17.0
 sortedcontainers==2.4.0
 tomlkit==0.15.1
 typing_extensions==4.16.0
-urllib3==2.7.0
-snowflake-connector-python==4.7.5
+urllib3==2.8.0
+snowflake-connector-python==4.8.0
@@ -1,28 +1,28 @@
-# Generated on: Python 3.12.14
+# Generated on: Python 3.12.9
 asn1crypto==1.5.1
-boto3==1.43.86
-botocore==1.43.86
+boto3==1.43.105
+botocore==1.43.105
 certifi==2026.7.22
 cffi==2.1.1
-charset-normalizer==3.5.1
+charset-normalizer==3.5.2
 cryptography==50.0.1
-filelock==3.32.5
-idna==3.19
+filelock==3.32.7
+idna==3.20
 jmespath==1.1.0
 packaging==26.3
-platformdirs==4.11.7
+platformdirs==4.12.2
 pycparser==3.0
-PyJWT==2.13.0
+PyJWT==2.15.1
 pyOpenSSL==26.4.0
 python-dateutil==2.9.0.post0
-pytz==2026.3.post1
+pytz==2026.4
 requests==2.34.2
 s3transfer==0.19.2
 setuptools==84.0.0
 six==1.17.0
 sortedcontainers==2.4.0
 tomlkit==0.15.1
 typing_extensions==4.16.0
-urllib3==2.7.0
+urllib3==2.8.0
 wheel==0.48.0
-snowflake-connector-python==4.7.5
+snowflake-connector-python==4.8.0
@@ -1,28 +1,28 @@
-# Generated on: Python 3.13.15
+# Generated on: Python 3.13.2
 asn1crypto==1.5.1
-boto3==1.43.86
-botocore==1.43.86
+boto3==1.43.105
+botocore==1.43.105
 certifi==2026.7.22
 cffi==2.1.1
-charset-normalizer==3.5.1
+charset-normalizer==3.5.2
 cryptography==50.0.1
-filelock==3.32.5
-idna==3.19
+filelock==3.32.7
+idna==3.20
 jmespath==1.1.0
 packaging==26.3
-platformdirs==4.11.7
+platformdirs==4.12.2
 pycparser==3.0
-PyJWT==2.13.0
+PyJWT==2.15.1
 pyOpenSSL==26.4.0
 python-dateutil==2.9.0.post0
-pytz==2026.3.post1
+pytz==2026.4
 requests==2.34.2
 s3transfer==0.19.2
 setuptools==84.0.0
 six==1.17.0
 sortedcontainers==2.4.0
 tomlkit==0.15.1
 typing_extensions==4.16.0
-urllib3==2.7.0
+urllib3==2.8.0
 wheel==0.48.0
-snowflake-connector-python==4.7.5
+snowflake-connector-python==4.8.0
@@ -1,28 +1,28 @@
-# Generated on: Python 3.14.7
+# Generated on: Python 3.14.0
 asn1crypto==1.5.1
-boto3==1.43.86
-botocore==1.43.86
+boto3==1.43.105
+botocore==1.43.105
 certifi==2026.7.22
 cffi==2.1.1
-charset-normalizer==3.5.1
+charset-normalizer==3.5.2
 cryptography==50.0.1
-filelock==3.32.5
-idna==3.19
+filelock==3.32.7
+idna==3.20
 jmespath==1.1.0
 packaging==26.3
-platformdirs==4.11.7
+platformdirs==4.12.2
 pycparser==3.0
-PyJWT==2.13.0
+PyJWT==2.15.1
 pyOpenSSL==26.4.0
 python-dateutil==2.9.0.post0
-pytz==2026.3.post1
+pytz==2026.4
 requests==2.34.2
 s3transfer==0.19.2
 setuptools==84.0.0
 six==1.17.0
 sortedcontainers==2.4.0
 tomlkit==0.15.1
 typing_extensions==4.16.0
-urllib3==2.7.0
+urllib3==2.8.0
 wheel==0.48.0
-snowflake-connector-python==4.7.5
+snowflake-connector-python==4.8.0