microsoft/mssql-jdbc v13.5.0

13.5.0 [Preview Release]

Repository: microsoft/mssql-jdbc

Tag: v13.5.0

Published: 2026-05-15T03:16:21Z

Prerelease: yes

Release notes:

Added

• Add Enhanced Routing Support for Hyperscale Reader Endpoints #2935

What was added: Implemented TDS FEATUREEXT 0x0F negotiation and ENVCHANGE 0x21 parsing to support Hyperscale reader endpoints that load balance connections across named replicas, including routed database name propagation in Login7. Who benefits: Applications connecting to Azure SQL Hyperscale databases using reader endpoints for read scale-out. Impact: Enables automatic connection routing to named replicas with correct database context, while maintaining backward compatibility with servers that do not support enhanced routing.

• Add Support for JDK 26 #2939

What was added: New jre26 build profile for both Maven and Gradle, with updated compiler settings and test dependencies. Who benefits: Applications running on JDK 26. Impact: Enables building and testing the driver on JDK 26 without changing runtime behavior.

• Add defaultTransactionIsolation Connection Property #2918

What was added: New defaultTransactionIsolation connection property allowing users to specify the initial transaction isolation level via JDBC URL or SQLServerDataSource, with automatic execution of SET TRANSACTION ISOLATION LEVEL upon connection establishment. Who benefits: Applications requiring a specific isolation level at connection time, especially in connection pool and third-party tool environments. Impact: Simplifies configuration of isolation levels without requiring application code changes.

• Add Defense-in-Depth XML Secure Processing to SAXSource and StAXSource Paths #2915

What was added: Enabled FEATURE_SECURE_PROCESSING and DTD/external entity protections on SAXSource and StAXSource parser paths in SQLServerSQLXML, matching existing DOMSource hardening. Who benefits: All users of the SQLXML API. Impact: Uniformly hardens all three XML parser paths as defense-in-depth, complementing SQL Server's storage-layer DTD rejection.

• Add XA State Machine Test with Randomized Transaction Testing #2923

What was added: State-machine based randomized test coverage for XA transaction flows. Who benefits: Driver maintainers and CI stability efforts. Impact: Improves edge-case detection for XA transaction scenarios with reproducible failures.

• [Retire FX] Port Functional Test Scenarios for TVP #2901

What was added: Migrated legacy FX functional test scenarios for Table-Valued Parameters into JUnit 5. Who benefits: Contributors and CI validation pipelines. Impact: Advances FX test retirement with full behavioral parity.

• Port FX ResultSet Tests to State-Machine Based JUnit 5 Tests #2912

What was added: Migrated FX ResultSet regression tests to state-machine based JUnit 5 tests. Who benefits: Contributors and CI validation pipelines. Impact: Improves test reproducibility and edge-case detection for ResultSet operations.

• Port FX Statement Execution Scenarios to State-Machine Based Tests #2908

What was added: Migrated FX statement execution scenarios to state-machine based JUnit 5 tests. Who benefits: Contributors and CI validation pipelines. Impact: Completes state-machine coverage for statement execution paths.

• Port Functional Test Scenarios for Sparse Columns to JUnit #2922

What was added: Migrated legacy FX sparse column test scenarios into JUnit 5. Who benefits: Contributors and CI validation pipelines. Impact: Extends FX test retirement coverage to sparse column scenarios.

• [Retire FX] Port Functional Test Scenarios for Globalization #2924

What was added: Migrated legacy FX globalization test scenarios into JUnit 5. Who benefits: Contributors and CI validation pipelines. Impact: Extends FX test retirement coverage to globalization scenarios.

Changed

• Deprecate microsoft.sql.DateTimeOffset in Favor of java.time.OffsetDateTime #2920

What was changed: Deprecated the proprietary microsoft.sql.DateTimeOffset type and added new getOffsetDateTime(), setOffsetDateTime(), and updateOffsetDateTime() methods to promote java.time.OffsetDateTime (JSR-310) as the canonical Java mapping for SQL Server datetimeoffset columns. Who benefits: Applications seeking standards-based, vendor-neutral date/time handling. Impact: Improves portability and ORM/middleware interoperability while preserving full backward compatibility with existing DateTimeOffset APIs.

• Improve Class Validation in Util.newInstance() by Deferring Initialization #2914

What was changed: Updated Util.newInstance() to use Class.forName(className, false, classLoader) to defer class initialization until after isAssignableFrom() validation completes, with a classloader fallback strategy. Who benefits: Applications using connection properties such as trustManagerClass, socketFactoryClass, and accessTokenCallbackClass. Impact: Strengthens validation of user-supplied class names by ensuring type checks occur before any static initialization side effects.

Fixed

• Fix Integer Overflow When Reading PLP Chunk Sizes from TDS Stream #2916

What was fixed: Prevented CWE-190 integer overflow in readBytesInternal() when casting unsigned 32-bit PLP chunk sizes from long to int. Who benefits: Applications processing large PLP data streams. Impact: Ensures safe handling of chunk sizes exceeding Integer.MAX_VALUE in the TDS stream reader.

• Fix Socket Hang When socketTimeout Not Set During Federated Auth Login #2927

What was fixed: Corrected pre-connection socket…