SNOW-2350569: snowflake-connector-python can't be installed with the latest version of cryptography

[gibsondan]

Python version

Python 3.12.11 (main, Sep 8 2025, 21:45:14) [GCC 14.2.0]

Operating system and processor architecture

Linux-5.10.240-238.966.amzn2.x86_64-x86_64-with-glibc2.41

Installed packages

snowflake-connector-python==3.17.3
cryptography==46.0.0

What did you do?

pip install cryptography==46.0.1 snowflake-connector-python==3.17.3

ERROR: Cannot install cryptography==46.0.1 and snowflake-connector-python==3.17.3 because these package versions have conflicting dependencies.

The conflict is caused by:
    cryptography 46.0.1 depends on cffi>=2.0.0; python_full_version >= "3.9" and platform_python_implementation != "PyPy"
    snowflake-connector-python 3.17.3 depends on cffi<2.0.0 and >=1.9

Is it possible to relax the cffi pin so that users can use the latest version of cryptography?

What did you expect to see?

an installed package

Can you set logging to DEBUG and collect the logs?

[ngoldbaum]

Out of curiosity, why is CFFI pinned to <2.0? It doesn't use semantic versioning in that manner and in fact 2.0 is not a breaking change so the pin did more harm than good in this case.

[alex]

Very cursory grep suggests that snowflake-connector-python does not use cffi itself and is pinning it as a transitive dependency.

My personal recommendation would be that snowflake-connector-python shouldn't list cffi as a dependency at all.

[sfc-gh-dszmolka]

hi folks thanks for reporting. cryptography==46.0.0 still allows for cffi<2 so perhaps could be a workaround while this is sorted. Tested on python 3.12

edit: created #2542, let's see how tests go

[reaperhulk]

If this library is not directly using cffi (and, like Alex, I can't find any place in the codebase where it's consumed) then you shouldn't raise the pin, you should delete the dependency entirely.