What's Changed

• ci: pin Maven 3.9.16 for docs publishing (3.x) by @nikagra in #1341
• fix(ci): make the GitHub Release step work on a real release by @nikagra in #1339
• fix(ci): keep commas out of release-blocker links by @nikagra in #1335
• chore: merge upstream apache 3.13.0 by @nikagra in #1295
• fix: bump lz4-java to 1.12.1 to remediate CVE-2026-106451 by @nikagra in #1352

Full Changelog: 3.12.1.0...3.13.0.0

What's Changed

• Update dependency net.bytebuddy:byte-buddy to v1.18.15-jdk5 by @renovate[bot] in #1276
• Update dependency org.apache.maven.plugins:maven-jar-plugin to v3.5.1 by @renovate[bot] in #1277
• Update dependency org.codehaus.mojo:build-helper-maven-plugin to v3.6.2 by @renovate[bot] in #1288
• Protect 4.x releases with validation and scoped signing by @dkropachev in #1302
• Match validation to the 4.x release integration-test policy by @dkropachev in #1304
• Verify 4.x staged releases before publication by @dkropachev in #1305
• Publish immutable GitHub Releases for 4.x by @dkropachev in #1307
• Update dependency org.slf4j:slf4j-api to v2.0.20 by @renovate[bot] in #1292
• Update dependency org.jacoco:jacoco-maven-plugin to v0.8.15 by @renovate[bot] in #1289
• ci: flag upstream syncs that lose apache's ancestry by @nikagra in #1283
• Update urllib3 to 2.7.0 (GHSA-mf9v-mfxr-j63j) by @roydahan with @Copilot in #884
• Update dependency io.projectreactor.tools:blockhound to v1.0.18.RELEASE by @renovate[bot] in #1309
• Update dependency io.projectreactor.tools:blockhound-junit-platform to v1.0.18.RELEASE by @renovate[bot] in #1310
• Update dependency net.bytebuddy:byte-buddy to v1.18.16-jdk5 by @renovate[bot] in #1311
• Update dependency org.xerial.snappy:snappy-java to v1.1.10.12 by @renovate[bot] in #1312
• Skip DSE versions during protocol negotiation by @arnabnandy7 in #985
• Update actions/checkout action to v5.1.0 by @renovate[bot] in #1314
• build(deps): bump sphinx-multiversion-scylla from 0.3.8 to 0.3.9 in /docs by @dependabot[bot] in #1324
• Update actions/setup-java action to v6.1.0 by @renovate[bot] in #1316
• Update actions/checkout action to v6.1.0 by @renovate[bot] in #1315
• chore: merge upstream apache 4.19.4 by @nikagra in #1291
• build(deps-dev): bump com.google.guava:guava from 33.6.0-jre to 33.7.1-jre by @dependabot[bot] in #1325
• Update dependency org.jacoco:jacoco-maven-plugin to v0.8.16 by @renovate[bot] in #1327
• Update actions/setup-python action to v6.3.0 by @renovate[bot] in #1329
• Update astral-sh/setup-uv action to v8.3.2 by @renovate[bot] in #1331
• Update dependency at.yawk.lz4:lz4-java to v1.12.1 by @renovate[bot] in #1332
• fix(ci): keep commas out of release-blocker links by @nikagra in #1336
• 4.x: Stabilize AdvancedShardAwarenessIT by @dkropachev in #1337
• fix(ci): make the GitHub Release step work on a real release by @nikagra in #1340
• docs: publish 3.12.1.x as the current 3.x line by @nikagra in #1342
• docs: fail the build when a newer release line is unregistered by @nikagra in #1343
• chore: record upstream 4.19.4 ancestry by @nikagra in #1344
• chore: record upstream 4.19.4 ancestry (do not squash) by @nikagra in #1346
• Update dependency com.github.jnr:jnr-posix to v3.2.5 by @renovate[bot] in #1334
• Update dependency ch.qos.logback:logback-classic to v1.6.6 by @renovate[bot] in #1333
• Update Guava to 33.7.2-jre by @dkropachev in #1330
• docs: publish 4.19.4.x as the current 4.x line by @nikagra in #1348

New Contributors

• @arnabnandy7 made their first contribution in #985

Full Changelog: 4.19.2.3...4.19.4.0

What's Changed

• ci: run the driver matrix before releasing (scylla-3.x) by @nikagra in #898
• build: exclude byteman's tools.jar to fix JDK 8 on Maven 3.10 by @nikagra in #1224
• fix(test): gate SSLSessionTicketsTest on Scylla 2025.2 per class by @nikagra in #1221
• fix(test): apply method version gates before starting CCM by @nikagra in #1226
• ci: name MAVEN_GPG_PASSPHRASE as setup-java's GPG passphrase env (3.x) by @nikagra in #1249
• build: bump central-publishing-maven-plugin to 0.12.0 (3.x) by @nikagra in #1257
• ci: drop -X and log artifact from 3.x release workflow by @nikagra in #1258
• [DRIVER-787] Validate SELECT without FROM support by @dkropachev in #955
• ci: scope release blockers to the line being released (3.x) by @nikagra in #1264
• ci: protect 3.x release credentials and preserve sanitized logs by @dkropachev in #1254
• Sign 3.x releases with the repository publisher key by @dkropachev in #1287
• Protect 3.x releases with validation and scoped signing by @dkropachev in #1303
• Verify 3.x staged releases before publication by @dkropachev in #1306
• Publish immutable GitHub Releases for 3.x by @dkropachev in #1308
• chore: merge upstream apache 3.12.1 by @nikagra in #1322

Full Changelog: 3.11.5.20...3.12.1.0

What's Changed

• fix: raise default request timeout to 11 seconds by @dkropachev in #1194
• fix: align CQL metric caps with request timeout by @dkropachev in #1210
• Remove unused DataStax Astra support by @dkropachev in #1034
• Remove DSE Graph runtime with deprecated compatibility stubs by @dkropachev in #1036
• Remove unused DataStax Insights monitoring by @dkropachev in #1035
• Remove unused DSE authentication support by @dkropachev in #1038
• Stabilize channel pool resize tests during reconnection by @dkropachev in #1231
• Remove unused DSE metadata support by @dkropachev in #1040
• Remove residual DSE compatibility and build wiring by @dkropachev in #1042
• Document DSE geometry and DateRange removal by @dkropachev in #1039
• Clarify OptionsMap serialization upgrade guidance by @dkropachev in #1041
• Rate-limit recurring driver warnings and errors by @dkropachev in #1235
• Restore deprecated Graph mailbox service API by @dkropachev in #1241
• Restore deprecated Astra API compatibility stubs by @dkropachev in #1236
• Protect release credentials and sanitize Maven logs by @dkropachev in #1242
• Restore deprecated DSE metadata and query builder API types by @dkropachev in #1238
• Avoid warning when broadcast RPC port columns are absent by @dkropachev in #1243
• Restore deprecated DSE authentication API stubs by @dkropachev in #1237
• Prepare SSL engines outside Netty I/O threads by @dkropachev in #1247
• Resume buffered responses after recoverable frame decoding errors by @dkropachev in #1251
• Prevent Dropwizard metrics from hanging session initialization by @dkropachev in #1267
• Restore deprecated Graph and geometry compatibility APIs by @dkropachev in #1239
• Preserve driver API compatibility with release 4.19.2.2 by @dkropachev in #1268
• Update dependency com.fasterxml.jackson:jackson-bom to v2.22.4 by @renovate[bot] in #1270
• Update dependency com.typesafe:config to v1.4.9 by @renovate[bot] in #1271
• Update dependency io.projectreactor:reactor-bom to v2024.0.18 by @renovate[bot] in #1273
• Restore legacy CCM and DSE graph API compatibility by @dkropachev in #1269
• build: resolve four-component Revapi baselines by @dkropachev in #1053
• Update dependency io.dropwizard.metrics:metrics-core to v4.2.40 by @renovate[bot] in #1272
• Update dependency io.projectreactor.tools:blockhound-junit-platform to v1.0.17.RELEASE by @renovate[bot] in #1275
• Update dependency io.projectreactor.tools:blockhound to v1.0.17.RELEASE by @renovate[bot] in #1274
• fix: release stream ids on request setup failure by @dkropachev in #1008

Full Changelog: 4.19.2.2...4.19.2.3

Signing key

This release uses the Java driver's repository-specific publisher certificate.

• Primary fingerprint: FA5BF24FD656DB6172B6DEDA92CDA600C75CA820
• Signing subkey fingerprint: 6633DD12AC5A67675513E2EA998E34B10468CB5B
• Public certificate

Package signatures, release commits, and the annotated release tag use this signing subkey. Earlier releases retain their original signatures and verification keys.

What's Changed

• docs: point 3.x readers at the 4.x migration guide by @nikagra in #1001
• 3.x: preserve OVERLOADED during authentication (DRIVER-1121) by @dkropachev in #1160
• fix: bump jackson to 2.18.11 for CVE-2026-68497 by @nikagra in #1172
• docs: advertise 3.11.5.19 in the 3.x README by @nikagra in #1168
• docs: add a Maven Central badge to the 3.x README by @nikagra in #1198

Full Changelog: 3.11.5.19...3.11.5.20

What's Changed

• fix: release pre-acquired stream ids by @dkropachev in #965
• docs: stop recommending synthesized bind-variable names (DRIVER-902) by @nikagra in #1020
• docs: deprecate the 3.x doc versions and route their readers to 4.x by @nikagra in #997
• build: bump simulacron to 0.14.0.1 by @nikagra in #1050
• refactor: remove dead local-DC contact-point check (DRIVER-201) by @nikagra in #1059
• fix: stop mutating the control reconnection query plan (DRIVER-201) by @nikagra in #1060
• feat: fall back to contact points on control reconnect (DRIVER-201) by @nikagra in #1065
• feat: add resolveAll through Netty's configured resolver (DRIVER-201) by @nikagra in #1073
• fix: bump netty to 4.1.138.Final to remediate CVE-2026-75595 and CVE-2026-75596 by @nikagra in #1097
• docs: build each documented branch's javadoc with the JDK it needs by @dgarcia360 in #1004
• fix: skip an unusable client-route row, keep the refresh (DRIVER-201) by @nikagra in #1061
• docs: add a connectivity section to the core manual by @nikagra in #1130
• docs: publish only 4.18.1.x, 4.19.0.x, 4.19.2.x and 3.11.5.x by @nikagra in #1146
• docs: build scylla-3.11.5.x and scylla-4.19.2.x with MyST by @nikagra in #1156
• docs: fix ScyllaDB Cloud TLS and client routes details by @nikagra in #1151
• docs: stop rewriting links to /stable/ to the built version by @nikagra in #1157
• docs: link the 3.x deprecation banner to the migration page by @nikagra in #1158
• docs: enable TLS in the ScyllaDB Cloud connection example by @nikagra in #1163

Full Changelog: 4.19.2.1...4.19.2.2

What's Changed

• fix: stop depending on synthesized bind-variable names (DRIVER-903) by @nikagra in #1021
• docs: deprecate Java Driver 3.x and announce maintenance mode by @nikagra in #919
• fix: bump netty to 4.1.138.Final for CVE-2026-75595/-75596 by @nikagra in #1098
• docs: note that client routes are 4.x-only (DRIVER-1043) by @nikagra in #1081
• docs: add a connectivity section to the 3.x manual by @nikagra in #1150

Full Changelog: 3.11.5.18...3.11.5.19

What's Changed

• fix(deps): update jackson-databind.version [security] by @renovate[bot] in #934
• build(deps): bump io.netty:netty-handler from 4.1.133.Final to 4.1.135.Final by @dependabot[bot] in #921
• Client config reporting — stage 1 (groundwork): SESSION_ID + DRIVER_CONFIG plumbing by @nikagra in #967
• fix(deps): update dependency at.yawk.lz4:lz4-java to v1.11.1 [security] by @renovate[bot] in #976
• fix(deps): update dependency com.fasterxml.jackson.core:jackson-core to v2.21.4 [security] by @renovate[bot] in #972
• [Snyk] Security upgrade io.netty:netty-handler from 4.1.135.Final to 4.1.136.Final by @dkropachev in #978
• build(deps-dev): bump com.fasterxml.jackson.core:jackson-databind from 2.22.0 to 2.22.1 by @dependabot[bot] in #970
• fix(deps): align Jackson modules with BOM by @dkropachev in #987
• docs: update theme 1.9.3 by @dgarcia360 in #977
• fix(deps): update dependency io.micrometer:micrometer-core to v1.15.12 [security] by @renovate[bot] in #995
• build(deps): bump io.micrometer:micrometer-core from 1.15.4 to 1.15.12 by @dependabot[bot] in #994
• docs: fix multiversion build on old branches (javadoc errors) by @dgarcia360 in #991
• Driver config reporting — stage 2: full DRIVER_CONFIG report by @nikagra in #968

New Contributors

• @annastuchlik made their first contribution in #930

Full Changelog: 4.19.2.0...4.19.2.1

What's Changed

• Client config reporting (3.x) — stage 1 (groundwork): SESSION_ID + DRIVER_CONFIG plumbing by @nikagra in #973
• fix(deps): align Jackson modules with BOM by @dkropachev in #988
• fix: bump netty to 4.1.136.Final and lz4-java to 1.11.1 to remediate CVE-2026-59901 and CVE-2026-59949 by @nikagra in #990
• Client config reporting (3.x) — stage 2: full DRIVER_CONFIG report by @nikagra in #974

Full Changelog: 3.11.5.17...3.11.5.18

What's Changed

• fix: bump jackson from 2.18.6 to 2.18.9 to remediate CVE-2026-54512 through CVE-2026-54518 by @nikagra in #956

Full Changelog: 3.11.5.16...3.11.5.17