Sourced from com.microsoft.sqlserver:mssql-jdbc's releases.

[12.8.2] Hotfix & Stable Release

Fixed issues

• Address a hostname validation vulnerability by securely parsing certificate common names. microsoft/mssql-jdbc#2804 What was fixed: Secure hostname validation is enforced by replacing the vulnerable CN parsing logic in SQLServerCertificateUtils.java, preventing spoofing attacks. Who benefits: All users of the SQL Server JDBC driver, especially those relying on TLS for secure connections, benefit from improved certificate validation.

[12.10.1] Stable Release

Fixed issues

• Make ibm security module optional #2679
• Invalidate existing enclave session during connection (re)connect #2680
• Update readFromFile() in ConfigurableRetryLogic to handle filePath #2681
• Increased the max noOfRedirections and updated the message. #2682
• Fixed New Type Param Definitions logic in doExecutePreparedStatement #2683
• Fixed session recovery for Azure SQL DB in redirect mode connected #2684

[12.10.0] Stable Release

Added

• Added provision to set SQLServerBulkCopy options in PreparedStatement #2555

Changed

• Changed the scope of BULK_COPY_OPERATION_CACHE to connection #2594
• Added "requireSecret" exclude tag for tests which require adding a secret to app registration #2596
• Added com.ibm.security.auth.module and com.sun.security.auth.module as option import #2609
• Updated driver dependency versions #2614

Fixed issues

• Introduced timeouts for MSAL calls #2562
• Fixed getGeneratedKeys functionality for execute API #2554
• Fixed ISQLServerConnection java doc reference #2560
• Fixed OffsetDateTime conversion for pre-Gregorian dates #2568
• Fix for driver cutting out the question mark from columns labels (aliases) #2569
• Fixed issue with SQLServerBulkCopy from CSV with setEscapeColumnDelimerts set to true #2575
• Fixed issue for finding mssql-jdbc.properties location in test environments #2579
• Fixed issue for IBM Semeru Runtime Certified Edition for z/OS and Kerberos #2581
• Set appropriate value to requestedEncryptionLevel for encrypt=STRICT #2597
• Add test for ManagedIdentityWithEncryptStrict #2599
• Check for null when getting DTV values (JDBC spec compliance - getBinaryStream /getAsciiStream will return null when the value is null) #2600
• Removed scheme from URI before fetching path for CRL path check #2622

[12.9.0] Preview Release

Added

• Added configurable retry logic feature, supporting both statement, and connection, retry #2396#2519
• Added JDK 23 support #2515

Changed

• Reverted "Execute Stored Procedures Directly" feature, as well as subsequent changes related to the feature #2488
• Changed MSAL logging from FINEST to FINER #2489
• Updated project pom file to pull dependencies from public Azure Artifacts Feed #2504
• Changed how Kerberos authentication acquires subject to provide compatibility for Kerberos with Java 23 and above #2539
• Removed user and password check for AccessTokenCallback #2549

Fixed issues

... (truncated)

• See full diff in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)