Fixed issues

• Fix non-Unicode string literals in direct SQL execution #3076 (backported in #3084)

  • What was fixed: Character values are now preserved as character literals during direct execution when sendStringParametersAsUnicode=false, instead of being incorrectly formatted as binary (0x...) literals.
  • Who benefits: Applications using prepareMethod=none with non-Unicode string parameters.
  • Impact: Prevents conversion errors (for example 210, 402, 8114, 8115) and silent wrong results, and keeps VARCHAR semantics correct without changing normal prepared execution.

• Add prepareMethod=none RPC support for procedures #3085

  • What was fixed: Direct stored-procedure calls under prepareMethod=none now execute through RPC, including safe handling of temporal and decimal arguments.
  • Who benefits: Applications calling stored procedures with prepareMethod=none, including {call ...}, EXEC and {? = call ...} forms with DATE, DATETIME, TIME or high-precision DECIMAL arguments.
  • Impact: Prevents invalid EXEC argument formatting (such as SQL Server error 102) and improves compatibility for direct stored-procedure execution.

• Retry direct SQL execution as RPC when a parameter cannot be inlined #3086 (backported in #3087)

  • What was fixed: With prepareMethod=none, parameters that cannot be safely inlined as SQL literals (streams and readers, SQLXML, OUT parameters, TVPs and subnormal Double values) used to fail with an unsupported-parameter error. The driver now retries those statements through an unprepared sp_executesql RPC. Batches are retried as a whole.
  • Who benefits: Applications running prepareMethod=none statements that use stream, OUT or similar parameters.
  • Impact: Valid statements that previously errored on the direct SQL path now succeed. No prepared handle is created or cached, and statements that can be inlined are unchanged.

Added

• Enable Native uniqueidentifier Encoding for Bulk Copy #3041

  • What was added: Eligible GUID columns are sent using the native TDS uniqueidentifier representation instead of CHAR(n).
  • Who benefits: Applications using Bulk Copy with plaintext uniqueidentifier columns.
  • Impact: Avoids server-side character-to-GUID conversion while preserving tested GUID input acceptance, declared-precision constraints, encrypted-column handling, and character-destination fallbacks. Invalid GUIDs can now fail on the client instead of the server, so a subsequent commit() on a caller-owned transaction can commit earlier work that previously rolled back.
  • Application action required: Explicitly roll back caller-owned transactions after GUID conversion failures if earlier work must not be committed; do not rely on a server-side conversion error to trigger rollback. This also applies to eligible batches using useBulkCopyForBatchInsert=true.

• Add Configurable Kerberos Credential Delegation #3036

  • What was added: The enableKerberosCredentialDelegation connection property and corresponding SQLServerDataSource getter and setter for authenticationScheme=JavaKerberos.
  • Who benefits: Applications that require Kerberos delegation for trusted double-hop scenarios.
  • Impact: Credential delegation is now disabled by default and must be explicitly enabled with enableKerberosCredentialDelegation=true; standard Kerberos authentication is unchanged.
  • Application action required: Applications that relied on the previous default delegation behavior must explicitly set enableKerberosCredentialDelegation=true through the connection string or SQLServerDataSource.

Changed

• Strengthen JDBC URL Port and Instance-Name Validation #3031

  • What was changed: Validated port segments as non-empty numeric values in the range 0–65535 and rejected instance names containing =.
  • Who benefits: Applications constructing SQL Server JDBC URLs and users diagnosing malformed connection strings.
  • Impact: Malformed port and instance-name values now fail early with descriptive driver errors; well-formed URLs are unchanged.

• Harden Stored-Procedure Parameter Metadata Resolution #3033

  • What was changed: Normalized and quoted procedure-name parts as identifiers or string literals when constructing internal sp_sproc_columns metadata queries.
  • Who benefits: Applications using CallableStatement parameter metadata and named parameters with qualified, quoted, or special-character procedure names.
  • Impact: Makes metadata resolution more predictable and prevents procedure-name text from being interpreted as additional SQL. Applications relying on raw T-SQL fragments in procedure-name parts must migrate to separate procedure calls or explicit SQL batches.
  • Application action required: Applications that relied on raw T-SQL fragments or multiple-procedure text in a procedure name must use separate prepareCall() calls or execute an explicit SQL batch instead. For parameter metadata and named-parameter resolution, replace single-quoted names such as {call 'GetEmployee'(?)} with bare or bracketed names such as {call GetEmployee(?)} or {call [GetEmployee](?)}.

• Harden Always Encrypted AAS Attestation Token Validation #3042

  • What was changed: Validated the attestation token issuer against the configured provider, enforced exp/nbf lifetime claims with clock skew, and made rejected responses retry-safe before enclave session establishment.
  • Who benefits: Applications using Always Encrypted with secure enclaves and Azure Attestation Service.
  • Impact: Rejects tokens from a different provider or outside their validity window and prevents cached metadata from bypassing attestation on retry.

• Upgrade Azure HTTP Netty and Transitive Jackson Dependencies #3060

  • What was changed: Upgraded azure-core-http-netty to 1.16.7 and transitive Jackson dependencies to 2.18.9.
  • Who benefits: Applications using the optional Azure SDK integrations.
  • Impact: Addresses the reported Jackson vulnerabilities. netty-codec-dns remains at 4.1.135.Final pending an upstream Azure or Reactor Netty release.

• Improve Managed Identity Token Acquisition Error Reporting #3061

  • What was changed: Added distinct errors for timeout and interruption while acquiring tokens through ManagedIdentityCredential or DefaultAzureCredential, while preserving the original cause.
  • Who benefits: Applications using ActiveDirectoryManagedIdentity, ActiveDirectoryMSI, or ActiveDirectoryDefault.
  • Impact: Makes authentication failures easier to diagnose; other credential failures retain the existing behavior.

Fixed

• Prevent Silent Loss of Trailing SQL in Bulk Copy Batch Inserts #3037

  • What was fixed: Detected query hints, additional VALUES tuples, and other meaningful SQL after the first values tuple and persistently routed those statements through normal batch execution.
  • Who benefits: Applications using useBulkCopyForBatchInsert=true with query hints, multi-row inserts, or trailing comments.
  • Impact: Preserves the complete SQL statement, update counts, comments, and batch entries while retaining Bulk Copy for supported inserts.

• Fix Connection.isValid() Timeout on Unresponsive Sockets #3053

  • What was fixed: Temporarily bounded socket reads during validation when socketTimeout=0 and restored the original network timeout afterward.
  • Who benefits: Applications calling Connection.isValid(int) on connections whose TCP peer becomes unresponsive.
  • Impact: Validation now honors the caller-supplied timeout and returns false instead of blocking indefinitely.

• Restore acceptsURL() Rejection of Malformed URLs #3063

  • What was fixed: Restored SQLServerDriver.acceptsURL() returning false when URL parsing fails.
  • Who benefits: Applications and frameworks using acceptsURL() to identify SQL Server JDBC URLs.
  • Impact: Preserves established behavior for malformed URLs while connect() continues to report the specific parsing error.

• Fix Always Encrypted GUID Bulk Copy Test in Multi-Server Pipelines #3069

  • What was fixed: Reused the Always Encrypted connection for ciphertext verification so the test cannot query a different server in multi-server configurations.
  • Who benefits: Contributors and CI pipelines running Always Encrypted GUID bulk-copy coverage.
  • Impact: Improves test reliability without changing driver behavior or public APIs.

• Fix Callable Statements with prepareMethod=none #3070

  • What was fixed: Emitted procedure-safe literals for temporal and high-precision or high-scale decimal input parameters during direct stored-procedure execution.
  • Who benefits: Applications using CallableStatement with prepareMethod=none.
  • Impact: Prevents SQL Server error 102 for valid temporal and decimal procedure arguments while preserving CAST(...) formatting in ordinary expression positions.

• Fix Non-Unicode String Literals in Direct SQL Execution #3076

  • What was fixed: Kept character parameters as character values during direct SQL binding when sendStringParametersAsUnicode=false, rather than incorrectly formatting them as binary literals.
  • Who benefits: Applications using prepareMethod=none or direct scopeTempTablesToConnection execution with non-Unicode strings.
  • Impact: Preserves VARCHAR semantics and correct conversions while leaving binary parameters and normal prepared execution unchanged.

• Validate PLP Payload Lengths and Preserve Stream Accounting #3077

  • What was fixed: Validated declared and accumulated PLP lengths against Integer.MAX_VALUE, required known totals to match, and preserved accounting across mark() and reset().
  • Who benefits: Applications reading large character, binary, and XML values through TDS PLP streams.
  • Impact: Rejects invalid or overflowing payload lengths through the standard invalid-TDS error path without changing normal LOB allocation behavior.

• Correct Spelling in JDBC Error Messages #3051

  • What was fixed: Corrected occured to occurred in a fine-level log message and the AAS JWT error resource.
  • Who benefits: Users and tools that read driver diagnostics.
  • Impact: Documentation and message-only correction with no runtime behavior change.

• Parameterize the Database Compatibility-Level Query #3062

  • What was fixed: Bound the current catalog name with a PreparedStatement and closed the statement and result set with try-with-resources.
  • Who benefits: Applications querying database compatibility metadata, including catalogs containing quotes.
  • Impact: Handles catalog names consistently and avoids composing the catalog name into query text.

Fixed issue

• Fix Callable Statements with prepareMethod=none #3073
  • What was fixed: Procedure-call parameters for dates, times, timestamps, and decimals with precision greater than 18 or scale greater than 6 are now written as plain literals when prepareMethod=none is used.
  • Who benefits: Applications executing callable statements with prepareMethod=none and affected parameter types.
  • Impact: Prevents invalid CAST(...) expressions from being emitted in EXEC argument lists while preserving typed parameter handling for other statements.

Added

• Add FLOAT16 Vector Version Negotiation to the TVP Write Path #2997

  • What was added: Negotiated vector-version validation before writing VECTOR column metadata for table-valued parameters.
  • Who benefits: Applications sending vector columns through table-valued parameters.
  • Impact: Rejects all vectors on version 0 and FLOAT16 vectors on version 1 before data is written to the wire, with a clear driver error.

• Port Legacy FX Non-AE Test Scenarios to JUnit #3008

  • What was added: Forty-eight legacyFx-tagged JUnit tests covering previously unported non-Always-Encrypted functional scenarios.
  • Who benefits: Contributors and CI validation pipelines.
  • Impact: Improves regression coverage while advancing retirement of the legacy FX test suite.

• Add Cross-Driver Connection String Aliases for Unification #3011

  • What was added: Case-insensitive aliases for uid, trusted_connection, app, connectTimeout, columnEncryption, and quotedId, mapped to their canonical JDBC properties.
  • Who benefits: Applications sharing connection-string configuration across Microsoft data drivers.
  • Impact: Improves portability while preserving all existing JDBC property names and aliases.

• Add getCurrentApplicationName to PerformanceLogCallback #3018

  • What was added: A default getCurrentApplicationName() method that exposes the publishing connection's applicationName to performance callbacks.
  • Who benefits: Applications using connection pools and performance-event correlation.
  • Impact: Allows events to be associated with a pool or application without breaking existing callback implementations.

Changed

• Optimize MONEY, DECIMAL, and String Processing in the ResultSet Read Path #2991

  • What was changed: Removed intermediate allocations from MONEY/SMALLMONEY decoding, common BigDecimal encoding, short synchronous string reads, and NBCROW initialization.
  • Who benefits: Applications reading high-volume or wide result sets.
  • Impact: Reduces garbage-collection pressure and improves throughput while preserving decoded values and existing fallback behavior.

• Validate Reflective Class Names for Connection Properties #3004

  • What was changed: Added Java binary class-name validation before reflectively loading classes specified by properties such as socketFactoryClass and accessTokenCallbackClass.
  • Who benefits: Applications configuring custom callback, socket-factory, or related reflective classes.
  • Impact: Malformed class names now fail early with a dedicated driver error instead of producing confusing reflective-loading failures.

• Update Vector Tests for Server-Side FLOAT16/FLOAT32 Conversion #3005

  • What was changed: Updated and expanded vector tests for implicit and explicit conversion between FLOAT16 and FLOAT32 vector subtypes.
  • Who benefits: Contributors validating vector interoperability against servers supporting vector version 2.
  • Impact: Covers assignments, casts, conversions, bulk copy, routines, precision loss, nulls, and dimension mismatch behavior.

• Adjust License File to Enable GitHub Detection #3010

  • What was changed: Normalized the MIT license text formatting.
  • Who benefits: Repository users and automated tooling.
  • Impact: Enables GitHub to detect and display the repository license; there is no runtime impact.

• Suppress CodeQL False Positive for Protocol-Mandated MD5 #3014

  • What was changed: Documented and suppressed the CodeQL SM05136 finding for MD5 used by NTLM channel binding as required by MS-NLMP.
  • Who benefits: Contributors and security-scanning pipelines.
  • Impact: Reduces false-positive security findings without changing authentication behavior.

• Remove the Legacy sqljdbc_xa.dll Distribution #3017

  • What was changed: Removed references to and distribution of the legacy server-side sqljdbc_xa.dll and updated XA setup guidance.
  • Who benefits: Applications using supported SQL Server versions and maintainers of XA deployments.
  • Impact: XA now relies on the built-in procedures in SQL Server 2017 CU16 and later, enabled with sp_sqljdbc_xa_install.

• Cache sp_columns_170 Availability Per Connection in getColumns() #3019

  • What was changed: Cached sp_columns_170 availability as a per-connection tri-state and refined fallback handling.
  • Who benefits: Applications repeatedly calling getColumns(), especially on SQL Server versions earlier than 2025.
  • Impact: Avoids one failed procedure call per metadata request on unsupported servers while retaining sp_columns_100 fallback behavior.

• Enhance Table-Name Validation for Bulk Copy and Batch Insert #3020

  • What was changed: Added multi-part identifier escaping before destination table names are embedded in Bulk Copy and useBulkCopyForBatchInsert SQL.
  • Who benefits: Applications using Bulk Copy or the PreparedStatement bulk-copy batch path.
  • Impact: Valid identifiers remain supported while adversarial or malformed table-name input fails safely.

• Bump BouncyCastle to 1.84 and Pin azure-core-http-netty to 1.16.6 #3021

  • What was changed: Upgraded BouncyCastle from 1.79 to 1.84 and pinned azure-core-http-netty to 1.16.6.
  • Who benefits: Users of optional BouncyCastle and Azure SDK integrations.
  • Impact: Resolves Component Governance CVEs and selects patched Netty 4.1.137.Final without API or behavior changes.

• Pin GitHub Actions to Full-Length Commit SHAs #3022

  • What was changed: Replaced mutable action tags with full commit SHAs and configured a seven-day Dependabot cooldown for GitHub Actions.
  • Who benefits: Contributors and CI maintainers.
  • Impact: Improves CI supply-chain security and reproducibility without changing action behavior.

• Make setObject scaleOrLength an Advisory Hint #3026

  • What was changed: Character and binary setObject(..., scaleOrLength) hints now widen when too small; non-positive hints are ignored. defineParameterType() remains enforced.
  • Who benefits: Applications that pass string or binary length values to setObject().
  • Impact: Restores compatibility by preventing hint-related failures or truncation and validates byte-counted varchar/char lengths in server units.

• Update GitHub Actions Dependencies #3027

  • What was changed: Updated actions/checkout from 4.4.0 to 7.0.1 and github/codeql-action from 3.37.8 to 4.37.7.
  • Who benefits: Contributors and CI maintainers.
  • Impact: Keeps the repository's GitHub Actions dependencies current.

• Revert DateTimeOffset Deprecation for GA Compatibility #3035

  • What was changed: Restored microsoft.sql.DateTimeOffset and the existing getDateTimeOffset(), setDateTimeOffset(), and updateDateTimeOffset() APIs as non-deprecated, and removed the driver-specific OffsetDateTime APIs introduced in the 13.5.0 preview.
  • Who benefits: Existing applications that depend on the Microsoft-specific type and established datetimeoffset handling in prepared statements, callable statements, result sets, bulk copy, Always Encrypted, and metadata.
  • Impact: Preserves the established public API and prevents GA compatibility changes for applications expecting microsoft.sql.DateTimeOffset rather than OffsetDateTime or TIMESTAMP_WITH_TIMEZONE. Standard JDBC getObject(..., OffsetDateTime.class) support and existing conversions remain available.
  • Note: Migration toward OffsetDateTime will be reconsidered in the next preview release with a dedicated compatibility and migration plan.

Fixed

• Fix Closed-Statement NullPointerException in buildParamTypeDefinitions #2995

  • What was fixed: Checked the statement's closed state before accessing a null parameter array in buildParamTypeDefinitions().
  • Who benefits: Applications that invoke parameter-related methods after a prepared or callable statement is closed.
  • Impact: Produces the standard closed-statement SQLServerException instead of a NullPointerException.

• Return an Empty ResultSet When No Generated Key Exists #3002

  • What was fixed: Filtered the null SCOPE_IDENTITY() row returned after inserting into a table without generated keys.
  • Who benefits: Applications calling getGeneratedKeys() for inserts into tables without an identity column.
  • Impact: Returns an empty ResultSet instead of a one-row result containing NULL.

• Recover from Failed Cached Managed Identity Credentials #3003

  • What was fixed: Evicted a failed cached ManagedIdentityCredential or `DefaultAzureCr...

Added

• Add tls-unique Channel Binding Support for Kerberos and NTLM #2977

  • What was added: tls-unique channel binding support for Kerberos and NTLM authentication flows.
  • Who benefits: Applications using integrated Kerberos or NTLM authentication that require channel binding for enhanced protection against relay attacks.
  • Impact: Strengthens authentication security by binding the authentication exchange to the underlying TLS channel.
  • Note: This feature depends on a JDK API to retrieve the TLS channel binding token that is not yet available in current OpenJDK builds. It will become functional on a future OpenJDK build once that API ships — a change our team is actively contributing upstream to OpenJDK.

• Introduce Parameter Length Hints via defineParameterType and setObject #2960

  • What was added: New parameter length hints that can be supplied through defineParameterType and setObject to inform the driver of expected parameter sizes.
  • Who benefits: Applications executing parameterized varchar/nvarchar statements against the server, particularly under high concurrency or large result sets.
  • Impact: Improves performance by reducing server-side memory grants. Without a length hint the driver defaults string parameters to the maximum declared size (4000 for nvarchar, 8000 for varchar), which inflates the query's memory grant; specifying a sensible length via the new APIs lets the server size the grant to the actual data, reducing memory pressure and improving throughput. Default behavior is unchanged when no length is specified.

• Add Nanosecond Granularity Option to PerformanceLogCallback #2944

  • What was added: An option to report timing in the PerformanceLogCallback with nanosecond granularity.
  • Who benefits: Applications and tools performing fine-grained performance instrumentation of driver operations.
  • Impact: Enables higher-resolution performance measurements while preserving existing millisecond behavior by default.

• Introduce getCurrentUserSql and getCurrentStatementType in PerformanceLogCallback #2965

  • What was added: New getCurrentUserSql() and getCurrentStatementType() accessors on the PerformanceLogCallback.
  • Who benefits: Applications correlating performance telemetry with the executing SQL text and statement type.
  • Impact: Provides richer context for performance logging without affecting runtime behavior.

• Add Copilot Prompts and AI Agent Guidelines for Developer Workflows #2942

  • What was added: Reusable Copilot prompts and AI agent guidelines for common maintainer and contributor workflows.
  • Who benefits: Contributors and maintainers working in the repository.
  • Impact: Improves developer productivity and consistency; no runtime impact.

• FX-to-JUnit Migration Tests with Parallelization Tags #2938

  • What was added: Migrated FX test scenarios to JUnit 5 with parallelization tags.
  • Who benefits: Contributors and CI validation pipelines.
  • Impact: Advances FX test retirement and improves test parallelization.

• Enable Vector float16 Tests to Run on AzureDB #2985

  • What was added: Enabled vector(float16) tests to run on Azure SQL Database.
  • Who benefits: Contributors and CI validation pipelines.
  • Impact: Extends test coverage for vector(float16) scenarios on AzureDB.

Behavior Changes

• setObject parameter-length validation now throws instead of truncating silently #2960
  • What changed: The setObject overload that accepts a parameter length now validates the specified length against the actual parameter length.
  • Impact: If the value exceeds the specified length, the driver now throws an exception instead of silently truncating data.
  • Action required: Applications that relied on implicit truncation must provide a parameter length that is large enough for the actual value.

Changed

• Enhance Always Encrypted VSM/HGS Enclave Attestation Validation #2993

  • What was changed: Strengthened attestation validation for VSM/HGS enclaves in the Always Encrypted with secure enclaves flow.
  • Who benefits: Applications using Always Encrypted with secure enclaves and enclave attestation.
  • Impact: Improves the robustness of enclave attestation validation while preserving existing configuration semantics.

• Harden getReference() to Omit Sensitive Connection Properties from JNDI Reference #2992

  • What was changed: getReference() no longer includes sensitive connection properties in the emitted JNDI Reference.
  • Who benefits: Applications binding SQLServerDataSource instances into JNDI.
  • Impact: Reduces the risk of exposing credentials and other sensitive settings through JNDI references.

• Make Troubleshooting/Debugging custom accessTokenCallbackClass Possible #2990

  • What was changed: Preserved the original exception (instead of only its cause) when failures occur in custom accessTokenCallbackClass handling.
  • Who benefits: Applications using a custom accessTokenCallbackClass and teams diagnosing callback initialization/execution failures.
  • Impact: Improves diagnosability and error visibility for custom token callback failures, without changing authentication flow behavior.

• Harden ActiveDirectoryInteractive Callback with form_post #2956

  • What was changed: The ActiveDirectoryInteractive authentication callback now uses form_post response mode.
  • Who benefits: Applications using Active Directory Interactive authentication.
  • Impact: Improves the security of the interactive authentication redirect flow.

• Improve JAAS Configuration Handling in Kerberos Authentication #2961

  • What was changed: Improved handling of JAAS configuration during Kerberos authentication.
  • Who benefits: Applications using Kerberos authentication with custom JAAS configurations.
  • Impact: Provides more predictable JAAS configuration resolution without breaking existing setups.

• Optimize the ResultSet Read Path and Reduce Allocation Overhead #2974

  • What was changed: Reduced allocations along the ResultSet read path.
  • Who benefits: Applications reading large result sets.
  • Impact: Lowers memory pressure and improves throughput on the read hot path with no behavioral change.

• Allocation-Free readBigDecimal() Fast Path for Small DECIMAL/NUMERIC Values #2975

  • What was changed: Added an allocation-free fast path for reading small DECIMAL/NUMERIC values.
  • Who benefits: Applications reading many small decimal/numeric values.
  • Impact: Reduces allocation overhead for common decimal reads while preserving exact values.

• Guard loggerExternal.entering/exiting with isLoggable(FINER) Across the Driver #2955

  • What was changed: Guarded loggerExternal.entering/exiting calls with isLoggable(FINER) throughout the driver.
  • Who benefits: All applications, especially on performance-sensitive paths.
  • Impact: Avoids unnecessary logging work when FINER logging is disabled; no behavior change when logging is enabled.

• Bump azure-identity to 1.18.4 and azure-security-keyvault-keys to 4.11.1 #2984

  • What was changed: Upgraded the optional azure-identity and azure-security-keyvault-keys dependencies.
  • Who benefits: Applications using Azure AD authentication and Azure Key Vault features.
  • Impact: Picks up upstream fixes and improvements from the Azure SDK dependencies.

• Clarify JDBC 4.3 Partial Support in README Build Instructions #2967

  • What was changed: Documentation clarifying JDBC 4.3 partial support in the README build instructions.
  • Who benefits: Users building the driver and evaluating JDBC specification support.
  • Impact: Improves documentation clarity; no runtime impact.

Fixed

• Fix Regression: Missing Intermediate Update Counts in Multi-Statement PreparedStatement Execution #2941

  • What was fixed: Restored intermediate update counts when executing multi-statement prepared statements.
  • Who benefits: Applications relying on update counts from multi-statement batches.
  • Impact: Corrects a regression in reported update counts without affecting other execution paths.

• Avoid Extra Whitespace Around Prepared Statement Parameter Markers #2958

  • What was fixed: Removed extra whitespace injected around prepared statement parameter markers.
  • Who benefits: Applications sensitive to generated SQL text and prepared statement plan reuse.
  • Impact: Corrects a regression in generated parameter marker formatting.

• **Route Enclave AE CEK Lookup Through SQLServerSymm...

Added

• Add Enhanced Routing Support for Hyperscale Reader Endpoints #2935
  What was added: Implemented TDS FEATUREEXT 0x0F negotiation and ENVCHANGE 0x21 parsing to support Hyperscale reader endpoints that load balance connections across named replicas, including routed database name propagation in Login7.
  Who benefits: Applications connecting to Azure SQL Hyperscale databases using reader endpoints for read scale-out.
  Impact: Enables automatic connection routing to named replicas with correct database context, while maintaining backward compatibility with servers that do not support enhanced routing.

• Add Support for JDK 26 #2939
  What was added: New jre26 build profile for both Maven and Gradle, with updated compiler settings and test dependencies.
  Who benefits: Applications running on JDK 26.
  Impact: Enables building and testing the driver on JDK 26 without changing runtime behavior.

• Add defaultTransactionIsolation Connection Property #2918
  What was added: New defaultTransactionIsolation connection property allowing users to specify the initial transaction isolation level via JDBC URL or SQLServerDataSource, with automatic execution of SET TRANSACTION ISOLATION LEVEL upon connection establishment.
  Who benefits: Applications requiring a specific isolation level at connection time, especially in connection pool and third-party tool environments.
  Impact: Simplifies configuration of isolation levels without requiring application code changes.

• Add Defense-in-Depth XML Secure Processing to SAXSource and StAXSource Paths #2915
  What was added: Enabled FEATURE_SECURE_PROCESSING and DTD/external entity protections on SAXSource and StAXSource parser paths in SQLServerSQLXML, matching existing DOMSource hardening.
  Who benefits: All users of the SQLXML API.
  Impact: Uniformly hardens all three XML parser paths as defense-in-depth, complementing SQL Server's storage-layer DTD rejection.

• Add XA State Machine Test with Randomized Transaction Testing #2923
  What was added: State-machine based randomized test coverage for XA transaction flows.
  Who benefits: Driver maintainers and CI stability efforts.
  Impact: Improves edge-case detection for XA transaction scenarios with reproducible failures.

• [Retire FX] Port Functional Test Scenarios for TVP #2901
  What was added: Migrated legacy FX functional test scenarios for Table-Valued Parameters into JUnit 5.
  Who benefits: Contributors and CI validation pipelines.
  Impact: Advances FX test retirement with full behavioral parity.

• Port FX ResultSet Tests to State-Machine Based JUnit 5 Tests #2912
  What was added: Migrated FX ResultSet regression tests to state-machine based JUnit 5 tests.
  Who benefits: Contributors and CI validation pipelines.
  Impact: Improves test reproducibility and edge-case detection for ResultSet operations.

• Port FX Statement Execution Scenarios to State-Machine Based Tests #2908
  What was added: Migrated FX statement execution scenarios to state-machine based JUnit 5 tests.
  Who benefits: Contributors and CI validation pipelines.
  Impact: Completes state-machine coverage for statement execution paths.

• Port Functional Test Scenarios for Sparse Columns to JUnit #2922
  What was added: Migrated legacy FX sparse column test scenarios into JUnit 5.
  Who benefits: Contributors and CI validation pipelines.
  Impact: Extends FX test retirement coverage to sparse column scenarios.

• [Retire FX] Port Functional Test Scenarios for Globalization #2924
  What was added: Migrated legacy FX globalization test scenarios into JUnit 5.
  Who benefits: Contributors and CI validation pipelines.
  Impact: Extends FX test retirement coverage to globalization scenarios.

Changed

• Deprecate microsoft.sql.DateTimeOffset in Favor of java.time.OffsetDateTime #2920
  What was changed: Deprecated the proprietary microsoft.sql.DateTimeOffset type and added new getOffsetDateTime(), setOffsetDateTime(), and updateOffsetDateTime() methods to promote java.time.OffsetDateTime (JSR-310) as the canonical Java mapping for SQL Server datetimeoffset columns.
  Who benefits: Applications seeking standards-based, vendor-neutral date/time handling.
  Impact: Improves portability and ORM/middleware interoperability while preserving full backward compatibility with existing DateTimeOffset APIs.

• Improve Class Validation in Util.newInstance() by Deferring Initialization #2914
  What was changed: Updated Util.newInstance() to use Class.forName(className, false, classLoader) to defer class initialization until after isAssignableFrom() validation completes, with a classloader fallback strategy.
  Who benefits: Applications using connection properties such as trustManagerClass, socketFactoryClass, and accessTokenCallbackClass.
  Impact: Strengthens validation of user-supplied class names by ensuring type checks occur before any static initialization side effects.

Fixed

• Fix Integer Overflow When Reading PLP Chunk Sizes from TDS Stream #2916
  What was fixed: Prevented CWE-190 integer overflow in readBytesInternal() when casting unsigned 32-bit PLP chunk sizes from long to int.
  Who benefits: Applications processing large PLP data streams.
  Impact: Ensures safe handling of chunk sizes exceeding Integer.MAX_VALUE in the TDS stream reader.

• Fix Socket Hang When socketTimeout Not Set During Federated Auth Login #2927
  What was fixed: Corrected pre-connection socket timeout computation so that loginTimeout properly bounds socket I/O when socketTimeout defaults to 0 (unlimited).
  Who benefits: Applications using federated authentication (Managed Identity, Azure AD) without an explicit socketTimeout.
  Impact: Resolves indefinite connection hangs during federated auth login while preserving post-login unlimited socket timeout semantics.

• Fix User Agent String in Case of an Exception #2926
  What was fixed: User agent string fields are now populated with "Unknown" when an exception occurs during collection, preventing malformed telemetry data.
  Who benefits: All users of the driver's user agent telemetry feature.
  Impact: Ensures robust user agent string generation regardless of runtime environment errors.

• Fix getIndexInfo() Returning ORDINAL_POSITION=0 for INCLUDE Columns #2943
  What was fixed: Narrowed the supplemental columnstore index query to restrict results to columnstore index types only (i.type IN (5, 6)) and replaced ic.key_ordinal with ic.index_column_id for correct 1-based ordinal positions.
  Who benefits: Applications querying index metadata on tables with INCLUDE columns or columnstore indexes.
  Impact: Eliminates JDBC specification violations (ORDINAL_POSITION=0) and prevents downstream IndexOutOfBoundsException errors.

• Fix Flaky Randomized Statement Test #2930
  What was fixed: Aligned getGeneratedKeys() with the FX framework pattern in randomized Statement tests.
  Who benefits: Contributors and CI pipelines.
  Impact: Improves test stability without affecting runtime behavior.

• Fix XA Test Timeout Issue in testXAWithIsolationLevels #2933
  What was fixed: Resolved timeout issue in XA isolation level tests.
  Who benefits: Contributors and CI pipelines.
  Impact: Improves test reliability without affecting runtime behavior.

• Add legacyFxXa Tag in Exclude Group for build.gradle #2937
  What was fixed: Added the legacyFxXa test tag to the Gradle exclude group to prevent test execution conflicts.
  Who benefits: Contributors running tests via Gradle.
  Impact: Ensures correct test filtering in the Gradle build.

[13.4.0] Stable Release

Added

• Add Test Coverage for Mixed-Type Vector Columns (FLOAT32 and FLOAT16) 2907
  What was added: Expanded the vector test suite to validate scenarios where VECTOR(FLOAT32) and VECTOR(FLOAT16) columns coexist in the same schema, including coverage for JDBC operations and bulk copy workflows.
  Who benefits: Developers building vector-based workloads that mix float32 and float16 vector columns within the same database schema.
  Impact: Ensures reliable driver behavior and compatibility for mixed vector types across CRUD operations, bulk copy, metadata, and advanced database objects such as stored procedures and TVPs.

Added

• Add VECTOR(FLOAT16) Subtype Support #2899
  What was added: Introduced support for the VECTOR(FLOAT16) subtype, including feature negotiation and IEEE-754 compliant serialization/deserialization between Java Float[] and half-precision wire format.
  Who benefits: Applications building AI, embeddings, and vector search workloads that require reduced memory footprint and network payload.
  Impact: Enables efficient float16 vector storage and transmission while preserving backward compatibility and the existing Java programming model.

• Add prepareMethod=none Execution Path#2890
  What was added: New prepareMethod=none option that forces literal parameter substitution with SQL batch execution, bypassing server-side prepared statement handles (sp_prepexec / sp_prepare).
  Who benefits: Applications preferring SQL Server–managed plan caching without driver-managed prepared handle reuse.
  Impact: Executes prepared statements as plain SQL batches, maintaining connection-level temp tables and providing a simplified alternative execution model while leaving the default behavior unchanged.

• Statement-Level Performance Logger Metrics#2885
  What was added: Extended Performance Logger to capture detailed execution metrics for Statement and PreparedStatement (REQUEST_BUILD, FIRST_SERVER_RESPONSE, PREPARE, PREPEXEC, EXECUTE).
  Who benefits: Developers and performance engineers analyzing execution timing and driver behavior.
  Impact: Provides granular observability across all statement execution paths with minimal overhead.

• StateMachineTest Framework for JUnit 5#2887
  What was added: Lightweight, seed-reproducible state-machine testing framework for randomized JDBC state exploration.
  Who benefits: Driver maintainers and CI stability efforts.
  Impact: Improves edge-case detection with reproducible failures without third-party dependencies.

• Add AI-Assisted Development Context Files#2882
  What was added: ARCHITECTURE.md, GLOSSARY.md, and PATTERNS.md to guide AI-assisted development.
  Who benefits: Contributors using AI coding assistants.
  Impact: Improves code consistency and productivity by documenting architecture and established design patterns.

• Enhance Code Coverage (CallableStatement, DatabaseMetaData, PreparedStatement)#2875
  What was added: Expanded unit and integration test coverage for key driver components including SQLServerCallableStatement, SQLServerDatabaseMetaData, and SQLServerPreparedStatement.
  Who benefits: Driver maintainers and users relying on stable metadata, statement execution, and callable behavior.
  Impact: Improves regression detection and long-term stability.

• New Bug Regression Tests in JUnit#2888
  What was added: Migrated legacy FX regression tests (37 scenarios) covering statement execution, ResultSet behavior, batching, cursors, and transaction flows into JUnit with full behavioral parity.
  Who benefits: Contributors and CI validation pipelines.
  Impact: Achieves complete FX regression coverage with reproducible execution paths and improved long-term reliability.

Changed

• Remove ADAL Dependency – Migrate Windows AAD Integrated Auth to MSQA APIs#2864
  What was changed: Replaced deprecated ADAL-based adalsql.dll flow with MSQA (mssql-auth.dll, MSAL C++).
  Who benefits: Users of Windows Active Directory Integrated Authentication.
  Impact: Fully removes legacy ADAL dependency, aligns with Microsoft deprecation guidance, and modernizes authentication architecture.

• Refactor DatabaseMetaData.getColumns() to use sp_columns_170 with fallback#2883
  What was changed: getColumns() now prefers sp_columns_170 (SQL Server 2025) for accurate metadata on newer types such as VECTOR and enhanced JSON, with automatic fallback to sp_columns_100.
  Who benefits: Applications performing schema discovery against SQL Server 2025 and Azure environments.
  Impact: Ensures correct metadata for new engine features while preserving backward compatibility with older SQL Server versions.

• Version Bumps to Address CVEs in Transitive Dependencies#2894
  What was changed: Upgraded azure-identity to 1.18.2 and msal4j to 1.23.1, which in turn update transitive dependencies including Netty (4.1.130.Final), Reactor Netty (1.2.13), and Nimbus JOSE JWT (10.0.1).
  Who benefits: Applications using Azure Active Directory authentication and Azure Identity–based connection flows.
  Impact: Resolves security vulnerabilities in transitive dependencies, including CVE-2025-67735, CVE-2025-53864, CVE-2025-58056, CVE-2025-58057, CVE-2025-55163, CVE-2025-24970, CVE-2025-22227, and CVE-2025-25193, with no breaking API changes.

Fixed

• Fix Cross-Database Stored Procedure Execution with Named Parameters#2895
  What was fixed: Ensured sp_sproc_columns is fully qualified with database.sys to avoid context errors.
  Who benefits: Applications calling procedures across databases with named parameters.
  Impact: Resolves metadata lookup failures and eliminates schema name-squatting security risks.

• Exception Chaining for Nested Stored Procedure Errors#2886
  What was fixed: Multiple nested RAISERROR calls now surface correctly via SQLException.getNextException.
  Who benefits: Applications invoking nested stored procedures.
  Impact: Aligns driver behavior with SQL Server semantics while preserving backward compatibility through lazy exception chaining.

• Remove Outdated Regex Delimiter Comment (Bulk CSV)#2880
  What was fixed: Updated comment to clarify delimiters are treated as literal text in SQLServerBulkCSVFileRecord.
  Who benefits: Users of bulk CSV ingestion.
  Impact: Aligns documentation with actual driver behavior.

Added

• Introduce prepareMethod=scopeTempTablesToConnection for PreparedStatements with temp tables #2844
  What was added: New prepareMethod option that scopes temporary tables created in prepared statements to the connection by using literal parameter substitution instead of server-side prepared handles.
  Who benefits: Developers using temporary tables (#temp) inside PreparedStatement executions.
  Impact: Ensures temporary tables remain visible across executions of different prepared statements/statements within the same connection.

• Send User Agent Information via TDS Feature Extension #2848
  What was added: User agent telemetry is sent to SQL Server using a new LOGIN7 TDS Feature Extension (USERAGENT).
  Who benefits: Platform owners and maintainers analyzing driver usage patterns and runtime environments.
  Impact: Improves telemetry accuracy and enables data-driven testing and support decisions without affecting application behavior.

• Enable Vector and JSON Tests on SQL Server 2025 #2846
  What was added: Test coverage for vector and JSON features on SQL Server 2025 with a new xSQLv17 test tag.
  Who benefits: Contributors validating driver compatibility with the latest SQL Server release.
  Impact: More testing coverage increases confidence in SQL Server 2025 vector and JSON functionality.

• Enhance Code Coverage for SQLServerResultSet #2870
  What was added: Expanded unit test coverage for SQLServerResultSet.
  Who benefits: Driver maintainers and contributors.
  Impact: Improves long-term stability and regression detection.

Changed

• Update bundle-version in Manifest to Include JRE Suffix #2876
  What changed: Bundle-Version in the manifest now includes the jre8 / jre11 suffix to match the JAR file name.
  Who benefits: Users and tooling relying on OSGi metadata consistency.
  Impact: Aligns manifest metadata with published artifacts and avoids ambiguity.

Fixed

• SQL Server Integrity Enhancement Support in supportsIntegrityEnhancementFacility #2745
  What was fixed: Corrected metadata reporting to reflect SQL Server’s support for integrity constraints.
  Who benefits: Applications relying on JDBC metadata to determine database capabilities.
  Impact: Ensures accurate reporting of primary key, foreign key, check, unique, and NOT NULL constraint support.

• Fix Geography Coordinate Parsing with Scientific Notation #2837
  What was fixed: Prevented NumberFormatException when parsing Geography coordinates expressed in scientific notation.
  Who benefits: Applications working with very small spatial coordinate values.
  Impact: Enables correct handling of negative exponents in WKT parsing.

• Bulk Copy Batch Insert: Proper Fallback for SQL Functions #2845
  What was fixed: Automatic fallback to standard batch execution when SQL functions are used in bulk copy batch inserts.
  Who benefits: Users executing PreparedStatement.executeBatch() with expressions like len(?) or encryption functions.
  Impact: Prevents bulk copy failures while preserving performance for compatible statements.

• Fix Bulk Copy Batch Insert with Persisted Computed Columns #2855
  What was fixed: Corrected destination column validation logic to ignore computed persisted columns in bulk copy batch insert.
  Who benefits: Users performing bulk inserts into tables with computed columns.
  Impact: Prevents false “invalid column mapping” errors and restores bulk copy compatibility.

• Fix DatabaseMetaData.getIndexInfo() Collation Conflict in UNION ALL #2867
  What was fixed: Resolved collation conflicts when server and database collations differ in the query executed by getIndexInfo call.
  Who benefits: Applications querying index metadata in mixed-collation environments.
  Impact: Ensures reliable metadata retrieval by applying COLLATE DATABASE_DEFAULT consistently.

• Fix getSchemas() Returning NULL TABLE_CATALOG for Built-in Schemas #2872
  What was fixed: Corrected catalog resolution logic for built-in schemas like dbo, sys etc.
  Who benefits: Applications consuming schema metadata.
  Impact: Ensures JDBC-compliant catalog reporting for all schemas.

• Fix Statement.execute() Skipping Update Count After Batch Error #2866
  What was fixed: Prevented loss of valid update counts following an error in mixed batch execution.
  Who benefits: Applications using Statement.execute() with mixed DML and query batches.
  Impact: Restores correct JDBC result traversal semantics after exceptions.

• Support IP Address Validation in Certificate SAN #2873
  What was fixed: Added RFC 5280–compliant IP address validation in SSL certificate SAN checks.
  Who benefits: Users connecting via IP address over TLS.
  Impact: Removes need for hostname workarounds while preserving strict security guarantees.

• Fix TVP Type Name Collision in CallableStatement Tests #2869
  What was fixed: Eliminated test failures caused by table-valued parameter type name collisions.
  Who benefits: Contributors and CI pipelines.
  Impact: Improves test reliability without affecting runtime behavior.

Added

• Performance logger and callback handling mechanism #2706
  What was added: Introduced performance logging framework to track critical driver operations such as connection time, prelogin, login, and token acquisition.
  Who benefits: Developers and operators monitoring JDBC driver performance.
  Impact: Enables visibility into driver-level latencies via com.microsoft.sqlserver.jdbc.PerformanceMetrics.Connection logger and extensible callback infrastructure for future metrics.

• Test enhancements #2712
  What changed: Improved unit test coverage for SQLServerConnectionTest, SQLServerDatabaseMetaData and few more classes.
  Who benefits: Contributors and maintainers.
  Impact: Improves code coverage with junit tests.

Changed

• Java 25 (LTS) support and removal of non-LTS versions 22–24 #2821
  What changed: Added official support for Java 25 (LTS) and removed non-LTS Java versions (22–24) from Maven and Gradle build configurations.
  Who benefits: Developers aligning builds with long-term supported Java versions.
  Impact: Ensures continued compatibility and stability with LTS Java releases; simplifies build maintenance.

Fixed

• Bulk insert parsing of isolated quotes in tab-delimited data #2795
  What was fixed: Resolved IndexOutOfBoundsException caused by incorrect quote state handling during tab-delimited bulk copy operations.
  Who benefits: Users performing bulk inserts from tab-delimited data containing isolated quotes.
  Impact: Ensures isolated quotes are treated as literal characters; improves parsing reliability and consistency.

• PreparedStatement INSERT update Count with triggers and multi-Value inserts #2817
  What was fixed: Corrected inaccurate update counts returned by PreparedStatement for multi-value INSERT statements with triggers.
  Who benefits: Developers relying on accurate update counts in batch or trigger-based inserts.
  Impact: Ensures consistent and accurate update count behavior across all INSERT execution scenarios.

• Fix for fatal error handling in DONE tokens #2741
  What was fixed: Corrected TDS message handling to properly detect and propagate fatal severity (25+) errors.
  Who benefits: Applications needing reliable error propagation during critical SQL Server failures.
  Impact: Prevents silent failures and ensures robust TDS stream recovery during fatal error conditions.

• Fix for getParameterMetaData() crash with table-valued parameters #2746
  What was fixed: Prevented SQLServerException when calling getParameterMetaData() on statements using Table-Valued Parameters (TVPs).
  Who benefits: Developers using structured or table-valued parameters.
  Impact: Restores correct metadata extraction for TVP parameters, ensuring full JDBC metadata compatibility.

• supportsIntegrityEnhancementFacility() returns accurate value #2828
  What was fixed: Corrected DatabaseMetaData.supportsIntegrityEnhancementFacility() to return true for SQL Server.
  Who benefits: Applications querying database metadata for integrity constraint support.
  Impact: Accurately reports SQL Server’s full support for primary, foreign key, and check constraints.

• Fix bulk copy for batch insert to support InputStream data #2826
  What was fixed: Enabled setBinaryStream() to work correctly with Bulk Copy for Batch Insert into VARBINARY(MAX) columns.
  Who benefits: Developers inserting large binary data via streams.
  Impact: Prevents “invalid hex format” errors; ensures InputStream-based binary inserts work seamlessly.

• Addressed failure on Azure Synapse serverless SQL pool caused by the unsupported sp_statistics procedure #2839
  What changed: Added a try–catch fallback in getIndexInfoAzureDW() to query sys.indexes, sys.index_columns, sys.columns, and sys.tables when sp_statistics is unavailable.
  Who benefits: Applications retrieving index metadata from Azure Synapse serverless SQL pool or other environments lacking sp_statistics.
  Impact: Ensures reliable metadata retrieval through a sys.indexes fallback, consistent NON_UNIQUE mapping, and aligned behavior with Azure SQL Database.

• Test cleanup #2734
  What changed: Updated tests to clean up temporary objects post-execution.
  Who benefits: Contributors and maintainers.
  Impact: Reduces test flakiness and improves maintainability of the test suite.