[RELEASE] ScyllaDB Java Driver 4.19.2.0

Release Notes
, ,
1

We are happy to announce the release of the ScyllaDB Java Driver 4.19.2.0! :tada:

:package: Download

The driver is available on Maven Central. Add the following dependency to your pom.xml:

<dependency>
    <groupId>com.scylladb</groupId>
    <artifactId>java-driver-core</artifactId>
    <version>4.19.2.0</version>
</dependency>

:rotating_light: Breaking Changes

  • Java 11 is now the minimum required runtime — Support for Java 8 has been dropped. Users still on Java 8 must upgrade their JDK before adopting this release. (#900)

:wrench: Bug Fixes

  • Fix prepare cache eviction under GC pressure — In high-throughput applications (23K+ ops/s) experiencing frequent young GC, up to 62% of session.prepare() calls could be cache misses, triggering a full PREPARE broadcast to all nodes and causing LWT write timeouts (CUSTOMER-372). The root cause was a defensive copy in CqlPrepareAsyncProcessor that prevented the caller from holding a strong reference to the cached CompletableFuture, allowing the weak-value cache entry to be GC’d prematurely. (#892)

  • Fix prepared statement cache invalidation on UDT changes — Prepared statements that reference a user-defined type could remain in the cache after ALTER TYPE, because the invalidation check compared UDT metadata with full field equality rather than by keyspace/type name. Stale cached statements are now correctly evicted. (#904)

  • Fix NPE and channel leak in ChannelPool during reconnection — Two related issues with uninitialized channel pools: (1) a NullPointerException thrown by Dropwizard Metrics reporters (JMX, Graphite, Prometheus bridge, etc.) when scraping per-node gauges during the reconnection window — fixed by guarding metric methods with the existing initialized flag; (2) a channel leak where a reconnect completing after closeAsync() could leave an open channel and incorrectly emit channelOpened after shutdown (CUSTOMER-413). (#928)

  • Fix: validate non-numeric subnet prefixes — Invalid subnet prefix strings passed to address translation configuration now produce a clear error at startup instead of being silently accepted.

:sparkles: New Features (Upstream 4.19.2)

This release synchronizes with upstream apache/cassandra-java-driver 4.19.2, the first upstream merge since 4.19.0. Key user-facing additions:

  • Custom request ID injection (CASSJAVA-97) — You can now provide a custom RequestIdGenerator to inject a per-request identifier into the request’s custom payload, enabling end-to-end request tracing through the server.

  • SubnetAddressTranslator — A new built-in address translator for IP-range-based address rewriting, useful in private network / NAT deployments where client-visible addresses differ from cluster-internal ones.

  • Lock-free ConcurrencyLimitingRequestThrottler — The concurrency-limiting throttler has been rewritten without locking, reducing contention on high-concurrency workloads.

  • Configurable SAN validation (CASSJAVA-80) — A new configuration option lets you disable DNS reverse-lookups during TLS SAN validation, useful for environments where reverse DNS is unavailable or unreliable.

  • Fix: RequestIdGenerator + Retry/Speculative Execution (CASSJAVA-116) — Resolved a “Duplicate Key” error thrown when a request with a custom ID was retried or speculatively executed.

(#895)

:lock: Security

  • Bump Netty to 4.1.135.Final — Remediates three CVEs affecting prior Netty versions:

    CVE CVSS Description
    CVE-2026-42583 7.5 (HIGH) Lz4FrameDecoder allocates up to 32 MB per crafted header before decompression — remote memory exhaustion (DoS)
    CVE-2026-44249 8.1 (HIGH) IpSubnetFilterRule.compareTo() incorrect masking allows bypass of IPv6 subnet ACL rules
    CVE-2026-45416 7.5 (HIGH) SslClientHelloHandler.decode() allocates up to 16 MiB on crafted TLS ClientHello — memory exhaustion (DoS)

    All users are encouraged to upgrade. (#925)

:link: Resources

As always, feedback and questions are welcome — feel free to reply to this thread!