mariadb-corporation/mariadb-connector-j 4.0.0

MariaDB Connector/Java 4.0.0

on GitHub

4.0.0 (Oct 2026)

Full Changelog

4.0.0 includes every fix of 3.5.11, listed below.

Major Changes

• CONJ-1361 - Java 17 is the minimum runtime, Java 8 and 11 are no longer supported (the 3.5 branch remains available for Java 8)
• CONJ-1321 - TLS enabled by default: sslMode now defaults to verify-full
• CONJ-1384 - AWS IAM authentication moves to the separate artifact mariadb-java-client-aws, the connector no longer
  depends on the AWS SDK; the plugin gains STS assume role support (CONJ-877, report by Adrian Samatan) and ships
  the RDS root certificates so that the default sslMode validates an RDS endpoint without configuration
• CONJ-1306 - PreparedStatement.executeQuery() rejects statements that return no result set, as the JDBC
  specification requires; the permitNoResults option restores the former behavior (report by Christopher Schultz)
• CONJ-651 - Stream LOB columns from the socket instead of loading them in memory (report by Ilya Zhavoronkov)

Key Enhancements

• CONJ-1386 - New sslMode=allow: verify-full when the server announces TLS, unencrypted otherwise, for a mix of
  servers with and without TLS behind one connection string
• CONJ-1347 - setSavepoint() throws in auto-commit mode instead of silently succeeding
• CONJ-1262 - cachedCodecs option now defaults to true
• CONJ-1370 - JNA dependency removed, Unix domain sockets use the JDK implementation
• CONJ-1371 - useReadAheadInput option and ReadAheadBufferedStream removed
• CONJ-1366 - First-class module-info.java (module org.mariadb.jdbc)
• CONJ-1367 - Virtual threads: no carrier pinning in driver locks, verified by a JFR-based test
• CONJ-1354 - GSSAPI authentication uses the native GSS-API where available
• CONJ-1308 - Support MariaDB 12.3 XML data type
• CONJ-1220 - Unix domain sockets on Windows, for SSH tunnels (report by DAIKOZ)
• CONJ-1378 - Try every IP address a hostname resolves to when opening the socket
• CONJ-1369 - Performance work on the Java 17 code base: packet reader and writer buffers, readNBytes, ranged
  Arrays.equals, no String.format on data paths
• CONJ-1365 - Performance: VarHandle little-endian access in packet buffers
• CONJ-1373 - Performance: JDK UTF-8 encoder for long strings in Writer.writeString / writeStringEscaped
• CONJ-1375 - Performance: cache codec resolution for getObject(index, Class) and setObject
• CONJ-1377 - Performance: faster client-side query parsing in ClientParser and NativeSql
• CONJ-1368 - Build and test tooling: tests run against the built jar, GraalVM metadata refreshed, CI matrix on
  Java 17, 21 and 25

Issues Resolved

• CONJ-1383 - Connection init rebuilds session_track_system_variables from @@global, discarding the session-level
  last_gtid set by MaxScale (report by Sawan Patel)
• CONJ-1379 - Set an explicit session tracking list and guard character_set_results like character_set_client
  (report by fg0x0)
• CONJ-1381 - Bound server-declared lengths by the packet before allocating and reading from them (report by fg0x0)
• CONJ-1374 - Redirect URL password partially logged when containing '@'
• CONJ-1372 - caching_sha2_password full authentication fails over a Unix socket when SSL is disabled (report by
  工藤航)
• CONJ-1360 - Incorrect dependency check in AwsIamCredentialPlugin (report by Dheeraj Nalluri)
• CONJ-1344 - DatabaseMetaData imported/exported keys ignore lower_case_table_names when using SHOW CREATE TABLE
  (report by plantegg ren)