microsoft/mssql-jdbc v13.5.0

13.5.0 [Preview Release]

on GitHub

Added

• Add Enhanced Routing Support for Hyperscale Reader Endpoints #2935
  What was added: Implemented TDS FEATUREEXT 0x0F negotiation and ENVCHANGE 0x21 parsing to support Hyperscale reader endpoints that load balance connections across named replicas, including routed database name propagation in Login7.
  Who benefits: Applications connecting to Azure SQL Hyperscale databases using reader endpoints for read scale-out.
  Impact: Enables automatic connection routing to named replicas with correct database context, while maintaining backward compatibility with servers that do not support enhanced routing.

• Add Support for JDK 26 #2939
  What was added: New jre26 build profile for both Maven and Gradle, with updated compiler settings and test dependencies.
  Who benefits: Applications running on JDK 26.
  Impact: Enables building and testing the driver on JDK 26 without changing runtime behavior.

• Add defaultTransactionIsolation Connection Property #2918
  What was added: New defaultTransactionIsolation connection property allowing users to specify the initial transaction isolation level via JDBC URL or SQLServerDataSource, with automatic execution of SET TRANSACTION ISOLATION LEVEL upon connection establishment.
  Who benefits: Applications requiring a specific isolation level at connection time, especially in connection pool and third-party tool environments.
  Impact: Simplifies configuration of isolation levels without requiring application code changes.

• Add Defense-in-Depth XML Secure Processing to SAXSource and StAXSource Paths #2915
  What was added: Enabled FEATURE_SECURE_PROCESSING and DTD/external entity protections on SAXSource and StAXSource parser paths in SQLServerSQLXML, matching existing DOMSource hardening.
  Who benefits: All users of the SQLXML API.
  Impact: Uniformly hardens all three XML parser paths as defense-in-depth, complementing SQL Server's storage-layer DTD rejection.

• Add XA State Machine Test with Randomized Transaction Testing #2923
  What was added: State-machine based randomized test coverage for XA transaction flows.
  Who benefits: Driver maintainers and CI stability efforts.
  Impact: Improves edge-case detection for XA transaction scenarios with reproducible failures.

• [Retire FX] Port Functional Test Scenarios for TVP #2901
  What was added: Migrated legacy FX functional test scenarios for Table-Valued Parameters into JUnit 5.
  Who benefits: Contributors and CI validation pipelines.
  Impact: Advances FX test retirement with full behavioral parity.

• Port FX ResultSet Tests to State-Machine Based JUnit 5 Tests #2912
  What was added: Migrated FX ResultSet regression tests to state-machine based JUnit 5 tests.
  Who benefits: Contributors and CI validation pipelines.
  Impact: Improves test reproducibility and edge-case detection for ResultSet operations.

• Port FX Statement Execution Scenarios to State-Machine Based Tests #2908
  What was added: Migrated FX statement execution scenarios to state-machine based JUnit 5 tests.
  Who benefits: Contributors and CI validation pipelines.
  Impact: Completes state-machine coverage for statement execution paths.

• Port Functional Test Scenarios for Sparse Columns to JUnit #2922
  What was added: Migrated legacy FX sparse column test scenarios into JUnit 5.
  Who benefits: Contributors and CI validation pipelines.
  Impact: Extends FX test retirement coverage to sparse column scenarios.

• [Retire FX] Port Functional Test Scenarios for Globalization #2924
  What was added: Migrated legacy FX globalization test scenarios into JUnit 5.
  Who benefits: Contributors and CI validation pipelines.
  Impact: Extends FX test retirement coverage to globalization scenarios.

Changed

• Deprecate microsoft.sql.DateTimeOffset in Favor of java.time.OffsetDateTime #2920
  What was changed: Deprecated the proprietary microsoft.sql.DateTimeOffset type and added new getOffsetDateTime(), setOffsetDateTime(), and updateOffsetDateTime() methods to promote java.time.OffsetDateTime (JSR-310) as the canonical Java mapping for SQL Server datetimeoffset columns.
  Who benefits: Applications seeking standards-based, vendor-neutral date/time handling.
  Impact: Improves portability and ORM/middleware interoperability while preserving full backward compatibility with existing DateTimeOffset APIs.

• Improve Class Validation in Util.newInstance() by Deferring Initialization #2914
  What was changed: Updated Util.newInstance() to use Class.forName(className, false, classLoader) to defer class initialization until after isAssignableFrom() validation completes, with a classloader fallback strategy.
  Who benefits: Applications using connection properties such as trustManagerClass, socketFactoryClass, and accessTokenCallbackClass.
  Impact: Strengthens validation of user-supplied class names by ensuring type checks occur before any static initialization side effects.

Fixed

• Fix Integer Overflow When Reading PLP Chunk Sizes from TDS Stream #2916
  What was fixed: Prevented CWE-190 integer overflow in readBytesInternal() when casting unsigned 32-bit PLP chunk sizes from long to int.
  Who benefits: Applications processing large PLP data streams.
  Impact: Ensures safe handling of chunk sizes exceeding Integer.MAX_VALUE in the TDS stream reader.

• Fix Socket Hang When socketTimeout Not Set During Federated Auth Login #2927
  What was fixed: Corrected pre-connection socket timeout computation so that loginTimeout properly bounds socket I/O when socketTimeout defaults to 0 (unlimited).
  Who benefits: Applications using federated authentication (Managed Identity, Azure AD) without an explicit socketTimeout.
  Impact: Resolves indefinite connection hangs during federated auth login while preserving post-login unlimited socket timeout semantics.

• Fix User Agent String in Case of an Exception #2926
  What was fixed: User agent string fields are now populated with "Unknown" when an exception occurs during collection, preventing malformed telemetry data.
  Who benefits: All users of the driver's user agent telemetry feature.
  Impact: Ensures robust user agent string generation regardless of runtime environment errors.

• Fix getIndexInfo() Returning ORDINAL_POSITION=0 for INCLUDE Columns #2943
  What was fixed: Narrowed the supplemental columnstore index query to restrict results to columnstore index types only (i.type IN (5, 6)) and replaced ic.key_ordinal with ic.index_column_id for correct 1-based ordinal positions.
  Who benefits: Applications querying index metadata on tables with INCLUDE columns or columnstore indexes.
  Impact: Eliminates JDBC specification violations (ORDINAL_POSITION=0) and prevents downstream IndexOutOfBoundsException errors.

• Fix Flaky Randomized Statement Test #2930
  What was fixed: Aligned getGeneratedKeys() with the FX framework pattern in randomized Statement tests.
  Who benefits: Contributors and CI pipelines.
  Impact: Improves test stability without affecting runtime behavior.

• Fix XA Test Timeout Issue in testXAWithIsolationLevels #2933
  What was fixed: Resolved timeout issue in XA isolation level tests.
  Who benefits: Contributors and CI pipelines.
  Impact: Improves test reliability without affecting runtime behavior.

• Add legacyFxXa Tag in Exclude Group for build.gradle #2937
  What was fixed: Added the legacyFxXa test tag to the Gradle exclude group to prevent test execution conflicts.
  Who benefits: Contributors running tests via Gradle.
  Impact: Ensures correct test filtering in the Gradle build.