[RELEASE] ScyllaDB Java Driver 4.19.2.1

Release Notes
, , ,
1

Hi everyone,

We’re happy to announce the release of ScyllaDB Java Driver 4.19.2.1. This is a patch release focused on security dependency updates, plus the first two stages of client config reporting and a few documentation build fixes.

What’s Changed

Security

  • CVE-2026-59901 (Netty, HIGH): an infinite loop in Bzip2Decoder can hang the event-loop thread it runs on, stalling request processing for every connection on that thread. Fixed by moving Netty to 4.1.136.Final (#978, following #921).
  • CVE-2026-59949 (lz4-java, MEDIUM): unvalidated arguments on the XXHash JNI entry points let out-of-range offsets or lengths reach native code, crashing the JVM. Fixed by bumping lz4-java to 1.11.1 (#976).
  • Jackson security updates: jackson-databind (#934) and jackson-core to 2.21.4 (#972).
  • Micrometer security update: micrometer-core to 1.15.12 (#995, #994).

Improvements

  • Client config reporting — stage 1 (groundwork): SESSION_ID and DRIVER_CONFIG plumbing (#967).
  • Client config reporting — stage 2: the driver now sends a full DRIVER_CONFIG report, making its effective configuration visible cluster-side for diagnostics (#968).

Dependencies

  • Jackson modules aligned with the BOM, preventing mixed-version Jackson on the classpath (#987).
  • jackson-databind test dependency 2.22.0 → 2.22.1 (#970).

Documentation

  • Docs theme updated to 1.9.3 (#977).
  • Fixed the multiversion docs build failing with javadoc errors on older branches (#991).

New contributors

Welcome to @annastuchlik, who made their first contribution in #930. :tada:

Who should upgrade

Recommended for all 4.x users. Everything here is a drop-in patch update — no API changes — and it clears the Netty, lz4-java, Jackson, and Micrometer findings in one step.

Download / Coordinates

xml

<dependency>
  <groupId>com.scylladb</groupId>
  <artifactId>java-driver-core</artifactId>
  <version>4.19.2.1</version>
</dependency>

Links

Thanks to @nikagra, @dkropachev, @dgarcia360, @annastuchlik, and our Renovate/Dependabot bots.

As always, feel free to report any issues on GitHub.