13.5.1 [Preview Release]

Added

• Add tls-unique Channel Binding Support for Kerberos and NTLM #2977

  • What was added: tls-unique channel binding support for Kerberos and NTLM authentication flows.
  • Who benefits: Applications using integrated Kerberos or NTLM authentication that require channel binding for enhanced protection against relay attacks.
  • Impact: Strengthens authentication security by binding the authentication exchange to the underlying TLS channel.
  • Note: This feature depends on a JDK API to retrieve the TLS channel binding token that is not yet available in current OpenJDK builds. It will become functional on a future OpenJDK build once that API ships — a change our team is actively contributing upstream to OpenJDK.

• Introduce Parameter Length Hints via defineParameterType and setObject #2960

  • What was added: New parameter length hints that can be supplied through defineParameterType and setObject to inform the driver of expected parameter sizes.
  • Who benefits: Applications executing parameterized varchar/nvarchar statements against the server, particularly under high concurrency or large result sets.
  • Impact: Improves performance by reducing server-side memory grants. Without a length hint the driver defaults string parameters to the maximum declared size (4000 for nvarchar, 8000 for varchar), which inflates the query's memory grant; specifying a sensible length via the new APIs lets the server size the grant to the actual data, reducing memory pressure and improving throughput. Default behavior is unchanged when no length is specified.

• Add Nanosecond Granularity Option to PerformanceLogCallback #2944

  • What was added: An option to report timing in the PerformanceLogCallback with nanosecond granularity.
  • Who benefits: Applications and tools performing fine-grained performance instrumentation of driver operations.
  • Impact: Enables higher-resolution performance measurements while preserving existing millisecond behavior by default.

• Introduce getCurrentUserSql and getCurrentStatementType in PerformanceLogCallback #2965

  • What was added: New getCurrentUserSql() and getCurrentStatementType() accessors on the PerformanceLogCallback.
  • Who benefits: Applications correlating performance telemetry with the executing SQL text and statement type.
  • Impact: Provides richer context for performance logging without affecting runtime behavior.

• Add Copilot Prompts and AI Agent Guidelines for Developer Workflows #2942

  • What was added: Reusable Copilot prompts and AI agent guidelines for common maintainer and contributor workflows.
  • Who benefits: Contributors and maintainers working in the repository.
  • Impact: Improves developer productivity and consistency; no runtime impact.

• FX-to-JUnit Migration Tests with Parallelization Tags #2938

  • What was added: Migrated FX test scenarios to JUnit 5 with parallelization tags.
  • Who benefits: Contributors and CI validation pipelines.
  • Impact: Advances FX test retirement and improves test parallelization.

• Enable Vector float16 Tests to Run on AzureDB #2985

  • What was added: Enabled vector(float16) tests to run on Azure SQL Database.
  • Who benefits: Contributors and CI validation pipelines.
  • Impact: Extends test coverage for vector(float16) scenarios on AzureDB.

Behavior Changes

• setObject parameter-length validation now throws instead of truncating silently #2960
  • What changed: The setObject overload that accepts a parameter length now validates the specified length against the actual parameter length.
  • Impact: If the value exceeds the specified length, the driver now throws an exception instead of silently truncating data.
  • Action required: Applications that relied on implicit truncation must provide a parameter length that is large enough for the actual value.

Changed

• Enhance Always Encrypted VSM/HGS Enclave Attestation Validation #2993

  • What was changed: Strengthened attestation validation for VSM/HGS enclaves in the Always Encrypted with secure enclaves flow.
  • Who benefits: Applications using Always Encrypted with secure enclaves and enclave attestation.
  • Impact: Improves the robustness of enclave attestation validation while preserving existing configuration semantics.

• Harden getReference() to Omit Sensitive Connection Properties from JNDI Reference #2992

  • What was changed: getReference() no longer includes sensitive connection properties in the emitted JNDI Reference.
  • Who benefits: Applications binding SQLServerDataSource instances into JNDI.
  • Impact: Reduces the risk of exposing credentials and other sensitive settings through JNDI references.

• Make Troubleshooting/Debugging custom accessTokenCallbackClass Possible #2990

  • What was changed: Preserved the original exception (instead of only its cause) when failures occur in custom accessTokenCallbackClass handling.
  • Who benefits: Applications using a custom accessTokenCallbackClass and teams diagnosing callback initialization/execution failures.
  • Impact: Improves diagnosability and error visibility for custom token callback failures, without changing authentication flow behavior.

• Harden ActiveDirectoryInteractive Callback with form_post #2956

  • What was changed: The ActiveDirectoryInteractive authentication callback now uses form_post response mode.
  • Who benefits: Applications using Active Directory Interactive authentication.
  • Impact: Improves the security of the interactive authentication redirect flow.

• Improve JAAS Configuration Handling in Kerberos Authentication #2961

  • What was changed: Improved handling of JAAS configuration during Kerberos authentication.
  • Who benefits: Applications using Kerberos authentication with custom JAAS configurations.
  • Impact: Provides more predictable JAAS configuration resolution without breaking existing setups.

• Optimize the ResultSet Read Path and Reduce Allocation Overhead #2974

  • What was changed: Reduced allocations along the ResultSet read path.
  • Who benefits: Applications reading large result sets.
  • Impact: Lowers memory pressure and improves throughput on the read hot path with no behavioral change.

• Allocation-Free readBigDecimal() Fast Path for Small DECIMAL/NUMERIC Values #2975

  • What was changed: Added an allocation-free fast path for reading small DECIMAL/NUMERIC values.
  • Who benefits: Applications reading many small decimal/numeric values.
  • Impact: Reduces allocation overhead for common decimal reads while preserving exact values.

• Guard loggerExternal.entering/exiting with isLoggable(FINER) Across the Driver #2955

  • What was changed: Guarded loggerExternal.entering/exiting calls with isLoggable(FINER) throughout the driver.
  • Who benefits: All applications, especially on performance-sensitive paths.
  • Impact: Avoids unnecessary logging work when FINER logging is disabled; no behavior change when logging is enabled.

• Bump azure-identity to 1.18.4 and azure-security-keyvault-keys to 4.11.1 #2984

  • What was changed: Upgraded the optional azure-identity and azure-security-keyvault-keys dependencies.
  • Who benefits: Applications using Azure AD authentication and Azure Key Vault features.
  • Impact: Picks up upstream fixes and improvements from the Azure SDK dependencies.

• Clarify JDBC 4.3 Partial Support in README Build Instructions #2967

  • What was changed: Documentation clarifying JDBC 4.3 partial support in the README build instructions.
  • Who benefits: Users building the driver and evaluating JDBC specification support.
  • Impact: Improves documentation clarity; no runtime impact.

Fixed

• Fix Regression: Missing Intermediate Update Counts in Multi-Statement PreparedStatement Execution #2941

  • What was fixed: Restored intermediate update counts when executing multi-statement prepared statements.
  • Who benefits: Applications relying on update counts from multi-statement batches.
  • Impact: Corrects a regression in reported update counts without affecting other execution paths.

• Avoid Extra Whitespace Around Prepared Statement Parameter Markers #2958

  • What was fixed: Removed extra whitespace injected around prepared statement parameter markers.
  • Who benefits: Applications sensitive to generated SQL text and prepared statement plan reuse.
  • Impact: Corrects a regression in generated parameter marker formatting.

• Route Enclave AE CEK Lookup Through SQLServerSymmetricKeyCache #2964

  • What was fixed: Routed enclave Always Encrypted CEK lookups through SQLServerSymmetricKeyCache (#2957) so repeated enclave queries reuse the cached plaintext CEK instead of resolving it from the key store on every execution.
  • Who benefits: Applications using Always Encrypted with secure enclaves (AE v2), especially with a remote CMK store such as Azure Key Vault.
  • Impact: Significantly reduces per-query latency and key-store round-trips (avoiding AKV throttling / 429 Too Many Requests under load) by hitting the key store once per CEK within the cache TTL, aligning enclave caching behavior with the non-enclave path.

• Preserve Original Exception Cause Chain in Socket/IO Error Paths #2970

  • What was fixed: Preserved the original exception cause chain in socket/IO error paths (#2969).
  • Who benefits: Applications diagnosing connection and I/O failures.
  • Impact: Improves diagnosability by retaining the underlying cause of socket/IO errors.

• Prevent Infinite Recursion in SQLServerError Bean Serialization #2971

  • What was fixed: Prevented infinite recursion during SQLServerError bean serialization (#2968).
  • Who benefits: Applications and frameworks that serialize SQLServerError as a bean.
  • Impact: Eliminates a StackOverflowError during serialization.

• Fix Login TLS Handshake Hangs on Android (Conscrypt) #2980

  • What was fixed: Read up to maxBytes during the SSL handshake to prevent login TLS handshake hangs on Android (Conscrypt).
  • Who benefits: Applications connecting from Android environments using the Conscrypt security provider.
  • Impact: Resolves connection hangs during the TLS handshake on affected platforms.

• Fix Trigger Name Collision in StatementTest #2950

  • What was fixed: Resolved a trigger name collision in StatementTest.
  • Who benefits: Contributors and CI pipelines.
  • Impact: Improves test reliability without affecting runtime behavior.

• Fix CI-MACOS Flakiness in Connection-Timeout Tests #2953

  • What was fixed: Gave the login phase adequate headroom to reduce flakiness in connection-timeout tests on macOS CI.
  • Who benefits: Contributors and CI pipelines.
  • Impact: Improves test stability without affecting runtime behavior.

• Fix Flaky Tests: RequestBoundaryMethodsTest.testThreads Hang and MessageHandlerTest Timing Bounds #2981

  • What was fixed: Addressed a hang in RequestBoundaryMethodsTest.testThreads and tightened timing bounds in MessageHandlerTest.
  • Who benefits: Contributors and CI pipelines.
  • Impact: Improves test stability without affecting runtime behavior.