1.17.0

Security (non-breaking): clears the non-breaking OSV-Scanner findings via a package.json overrides block plus a coherent dev-toolchain bump (mocha, eslint) — 2 CRITICAL (basic-ftp, form-data) plus the transitively-fixable HIGH/MED/LOW (ws, @75lb/deep-merge, ip-address, and the mocha-tree deps braces/micromatch/cross-spawn/minimatch/glob/@babel/*/js-yaml/path-to-regexp). No engine or runtime-API changes — a drop-in patch so consumers can clear critical/high scanner alerts without adopting the breaking 2.0.0 bump.

Known residual findings, all deferred because they can't be fixed without a breaking change (addressed in 2.0.0, #390):

• thrift and uuid (HIGH) — direct runtime deps whose fixes are SemVer-major bumps (thrift 0.16→0.23, uuid 9→11).
• serialize-javascript (dev-only) — its only patched versions (7.0.3+) require Node ≥20, which this release's non-breaking >=14 floor can't adopt. Dev-only: it's a test-reporter dependency, never present in the published tarball, never runs on a consumer machine.

Closes #386, #263.

1.16.0

• New: optional kernel backend (useKernel: true). Adds an alternative connection path backed by the native @databricks/databricks-sql-kernel client (a Rust core exposed via napi-rs), shipped as prebuilt per-platform packages (linux x64/arm64 gnu+musl, macOS x64/arm64, Windows x64/arm64) pulled in automatically as optional dependencies. The kernel talks to Databricks over the SEA (Statement Execution API) HTTP transport — not Thrift — with CloudFetch and inline-Arrow result fetching, through the same DBSQLClient surface. Supports PAT and OAuth (M2M/U2M) auth. Requires Node >= 18; on older Node the binding is not loaded and useKernel: true raises a clear error directing you to the Thrift backend. The default backend remains Thrift — opt in per connection. (#378, #380, #409, #410, #411, #412, #416, #428, #434 by @msrathore-db)
• Kernel backend behavior is aligned with Thrift so application code works the same either way: named/positional query parameters, metadata calls, TLS/mTLS with a custom CA, custom headers and user-agent, HTTP/SOCKS proxy and socket timeout, configurable retry/backoff, session query tags, async submit + cancel(), operation id/schema, and INTERVAL/type parity. Kernel logs surface through the same DBSQLLogger sink. (#417, #420, #421, #426, #430, #431 by @msrathore-db)
• Make retry-policy knobs (max attempts, min/max backoff, overall timeout) configurable via connect() for both backends (#433 by @msrathore-db)
• Retry transient network errors and fix a CloudFetch prefetch promise-rejection leak (#424 by @msrathore-db)
• Telemetry: emit sql_operation, auth_type, and driver_connection_params (#396 by @samikshya-db)

1.16.0-rc.1

::warning::No changelog entry found for version '1.16.0-rc.1' in CHANGELOG.md
Release 1.16.0-rc.1

1.15.0

• Add SPOG routing support: parse ?o=<workspaceId> from httpPath and inject x-databricks-org-id on Thrift, telemetry, and feature-flag requests. Expose customHeaders on ConnectionOptions for caller-supplied headers (#391 by @samikshya-db)
• Telemetry: enable by default with feature-flag-controlled priority, and fix final-flush dropping on client.close() due to a close-ordering bug (#327, #391 by @samikshya-db)
• Fix Azure AD OAuth: tenant-aware discovery URL and correct scope resource (#363 by @msrathore-db)
• Fix: use a valid SPDX license identifier in package.json (#389 by @sreekanth-db)

1.14.0

• Add statement-level query tag support (#366 by @sreekanth-db)
• Add AI coding agent detection to User-Agent header (#333 by @vikrantpuppala)
• Internal: telemetry infrastructure improvements — circuit breaker, feature flag cache, telemetry client management (off by default) (#325, #326, #362)

1.13.0

What's Changed

• Add token federation support with custom token providers (#318, #319, #320 by @madhav-db)
• Add metric view metadata support (#312 by @shivam2680)
• Fix: Avoid calling require('lz4') if it's really not required (#316 by @ikkala)
• Fix flaky Iterator tests by making metadata fetching async-safe (#313 by @shivam2680)
• Remove notification spam when someone opens a PR (#322 by @samikshya-db)
• Add telemetry foundation (off by default) (#324 by @samikshya-db)

New Contributors

• @ikkala made their first contribution in #316
• @madhav-db made their first contribution in #318

Full Changelog: 1.12.0...1.13.0

1.12.0

What's Changed

• Support for session parameters (#307 by @sreekanth-db)
• Add metric logging for cloud fetch (#305 by @shivam2680)

Full Changelog: 1.11.0...1.12.0

1.11.0

What's Changed

• Enable cloud fetch by default by @shivam2680 in #287
• Added useLZ4Compression in ExecuteStatementOptions making compression configurable by @shivam2680 in #288
• Improve handling of extra / in URLs by @vikrantpuppala in #290
• Add thrift protocol version handling for driver features by @shivam2680 in #292
• Cleanup fields as they might be deprecated/removed/change in the future by @vikrantpuppala in #295
• Add lenient LZ4 check to handle dependecy errors gracefully. by @samikshya-db in #298

New Contributors

• @vikrantpuppala made their first contribution in #290
• @samikshya-db made their first contribution in #298

Full Changelog: 1.10.0...1.11.0

1.10.0

What's Changed

• renamed clientId to userAgentHeader in connect args by @shivam2680 in #281
• Give warning for deprecated clientId param by @shivam2680 in #282

New Contributors

• @shivam2680 made their first contribution in #278

Full Changelog: 1.9.0...1.10.0

1.9.0

What's Changed

• Fix: Fix the type check in polyfills.ts by @kravets-levko in #254
• Allow any number type by @kravets-levko in #255
• Support iterable interface for IOperation by @kravets-levko in #252
• Support streaming query results via Node.js streams by @kravets-levko in #262
• Add custom auth headers into cloud fetch request by @jackyhu-db in #267
• Support OAuth on databricks.azure.cn by @jackyhu-db in #271

Full Changelog: 1.8.4...1.9.0