Security Update for SQL Server 2025 RTM CU8
The Security Update for SQL Server 2025 RTM CU8 is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2025 RTM CUs, plus it includes the new security fixes detailed in the KB Article. Security Bulletins: CVE-2026-67378 - Security Update Guide - Microsoft - Microsoft SQL Server Denial of Service Vulnerability Security Update of SQL Server 2025 RTM CU8 KB Article: KB5122769 Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=65b5f47b-53bf-4b54-89e7-6aefaad8dc51 Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5122769 Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updatesSecurity Update for SQL Server 2025 RTM
The Security Update for SQL Server 2025 RTM GDR is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2025 RTM, plus it includes the new security fixes detailed in the KB Article. Security Bulletins: CVE-2026-67378 - Security Update Guide - Microsoft - Microsoft SQL Server Denial of Service Vulnerability Security Update of SQL Server 2025 RTM GDR KB Article: KB5122770 Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=0d644af6-717c-45d7-bf71-ce7e309d2ad7 Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5122770 Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updatesSecurity Update for SQL Server 2022 RTM CU26
The Security Update for SQL Server 2022 RTM CU26 is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2022 RTM CUs, plus it includes the new security fixes detailed in the KB Article. Security Bulletins: CVE-2026-67378 - Security Update Guide - Microsoft - Microsoft SQL Server Denial of Service Vulnerability Security Update of SQL Server 2022 RTM CU26 KB Article: KB5122768 Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=d682ec86-56e1-45c3-a0fa-552f89f6e51e Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5122768 Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updatesSecurity Update for SQL Server 2022 RTM
The Security Update for SQL Server 2022 RTM GDR is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2022 RTM, plus it includes the new security fixes detailed in the KB Article. Security Bulletins: CVE-2026-67378 - Security Update Guide - Microsoft - Microsoft SQL Server Denial of Service Vulnerability Security Update of SQL Server 2022 RTM GDR KB Article: KB5122771 Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=7ce0ba48-9a1e-4298-b300-79f251385092 Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5122771 Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updatesSecurity Update for SQL Server 2019 RTM CU32
The Security Update for SQL Server 2019 RTM CU32 is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2019 RTM CUs, plus it includes the new security fixes detailed in the KB Article. Security Bulletins: CVE-2026-67378 - Security Update Guide - Microsoft - Microsoft SQL Server Denial of Service Vulnerability Security Update of SQL Server 2019 RTM CU32 KB Article: KB5122772 Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=cee52a4a-832a-447e-909d-0f629cab835f Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5122772 Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updatesSecurity Update for SQL Server 2019 RTM
The Security Update for SQL Server 2019 RTM GDR is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2019 RTM, plus it includes the new security fixes detailed in the KB Article. Security Bulletins: CVE-2026-67378 - Security Update Guide - Microsoft - Microsoft SQL Server Denial of Service Vulnerability Security Update of SQL Server 2019 RTM GDR KB Article: KB5122773 Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=e668fe5f-ea1e-41fb-97f7-1bc12e91150b Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5122773 Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updatesSecurity Update for SQL Server 2017 RTM CU31
The Security Update for SQL Server 2017 RTM CU31 is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2017 RTM CUs, plus it includes the new security fixes detailed in the KB Article. Security Bulletins: CVE-2026-67378 - Security Update Guide - Microsoft - Microsoft SQL Server Denial of Service Vulnerability Security Update of SQL Server 2017 RTM CU31 KB Article: KB5122774 Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=a2440065-e61a-43ec-96a2-a5ee18f7fc19 Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5122774 Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updatesSecurity Update for SQL Server 2017 RTM
The Security Update for SQL Server 2017 RTM GDR is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2017 RTM, plus it includes the new security fixes detailed in the KB Article. Security Bulletins: CVE-2026-67378 - Security Update Guide - Microsoft - Microsoft SQL Server Denial of Service Vulnerability Security Update of SQL Server 2017 RTM GDR KB Article: KB5122775 Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=bd775fa7-3414-4aeb-9309-4e0b90d4d1ee Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5122775 Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updatesCumulative Update #8 for SQL Server 2025 RTM
The 8th cumulative update release for SQL Server 2025 RTM is now available for download at the Microsoft Downloads site. Please note that registration is no longer required to download Cumulative updates. To learn more about the release or servicing model, please visit: CU8 KB Article: https://support.microsoft.com/help/5104822 Starting with SQL Server 2017, we adopted a new modern servicing model. Please refer to our blog for more details on Modern Servicing Model for SQL Server Microsoft® SQL Server® 2025 RTM Latest Cumulative Update: https://www.microsoft.com/download/details.aspx?familyid=10a21237-8b59-4fcd-b878-bfe8fcabdc7a Update Center for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updatesmssql-python 1.13.0: Arrow Bulk Copy, Smarter Tokens, Slimmer Wheels
mssql-python 1.13.0 is now available on PyPI. This release adds an Apache Arrow fast path for bulk copy, first-class support for azure-identity credential objects, identity-aware connection pooling, and it completes the move of the ODBC driver binaries into the standalone mssql-python-odbc package. pip install --upgrade mssql-python Highlights Apache Arrow bulk copy Loading data that already lives in Arrow no longer has to round-trip through Python tuples. The new Cursor.bulkcopy_arrow() reads each batch's typed Arrow buffers directly in the Rust TDS core and streams them into the bulk-load packets, releasing the GIL for the duration of the transfer. import pyarrow as pa from mssql_python import connect conn = connect("Server=<server>.database.windows.net;Database=<database>;Encrypt=yes") cursor = conn.cursor() table = pa.table({"id": [1, 2, 3], "name": ["a", "b", "c"]}) result = cursor.bulkcopy_arrow("dbo.MyTable", table) print(result["rows_copied"], result["rows_per_second"]) Source accepts any of the following: pyarrow.Table, pyarrow.RecordBatch, or pyarrow.RecordBatchReader Any object exposing the Arrow C Data Interface (__arrow_c_stream__ or __arrow_c_array__), which covers polars, pandas 2.2+, DuckDB, and ADBC results Any iterable of record batches A polars DataFrame, a pandas 2.2+ DataFrame, or a DuckDB relation can be passed straight to bulkcopy_arrow() with no explicit conversion step. Everything else carries over from the classic bulkcopy(): same schema handling, same column mappings, same options, same statistics dictionary in return. Bulkcopy() now raises TypeError when passed an Arrow object, with a message pointing at bulkcopy_arrow(), so there is no silent slow path. token_provider= for Microsoft Entra ID credentials connect() accepts a token_provider argument: any object with a .get_token(scope) method that returns an object with a .token attribute. Every azure-identity credential qualifies. from azure.identity import AzureCliCredential from mssql_python import connect conn = connect( "Server=<server>.database.windows.net;Database=<database>", token_provider=AzureCliCredential(), ) Use this when you need explicit control over token acquisition, such as excluding specific providers, using a credential that is not in the built-in map, or passing custom options to the credential constructor. For environment-portable code, Authentication=ActiveDirectoryDefault in the connection string remains the simpler choice. token_provider= is mutually exclusive with Authentication= and with a raw token in attrs_before[SQL_COPT_SS_ACCESS_TOKEN]. The token scope is fixed to the Azure commercial cloud. For sovereign clouds, acquire the token yourself and pass it through attrs_before. Identity-aware connection pooling The connection pool now keys on the security context of a connection, not just the connection string. Two consequences: Connections established under different identities (access tokens, integrated auth) can no longer be handed to the wrong caller. Token acquisition is deferred until a pool miss, so a pool hit no longer pays for a round trip to the identity provider on every connect(). Pooled connections whose token is close to expiry are refreshed automatically rather than being reused until the server rejects them. ODBC driver ships exclusively via mssql-python-odbc v1.12.0 introduced the standalone mssql-python-odbc package while keeping the bundled libs/ tree as a fallback. That fallback is now removed. mssql-python hard-depends on mssql-python-odbc==18.6.2.1, so pip install mssql-python continues to pull the driver transparently, with no extra step for users. Why it matters: Smaller mssql-python wheels. ODBC binary updates ship on their own cadence, independent of mssql-python releases. If your environment installs packages from a private index or an offline mirror, make sure mssql-python-odbc is mirrored alongside mssql-python before upgrading. Bug fixes executemany() could silently insert zero rows. Numeric array parameter binding (TINYINT, SMALLINT, INT, FLOAT) left indicator slots uninitialized when a NULL appeared partway through a batch, which could drop the batch without raising. SQL_WVARCHAR output converters no longer act as a catch-all. The fallback is now gated on columns whose mapped type is str or bytes, so a converter registered for wide strings stops intercepting numeric and date columns. Integer-keyed output converters now fire. add_output_converter(SQL_DECIMAL, ...) and other integer ODBC SQL type codes dispatch correctly, matching pyodbc behavior. RecordBatchReader.close() works for Arrow result sets. Cursor.arrow_reader() returns a wrapper whose close() cancels any in-flight fetch, releases the server-side cursor and its locks, drains diagnostics into cursor.messages, and leaves the parent cursor usable. Teardown also runs on normal exhaustion, on with-block exit, and on garbage collection. No more AttributeError from Cursor.__del__. Cursor.__init__ sets closed and hstmt before anything can raise, and __del__ uses sys.is_finalizing() as its interpreter-shutdown guard. Upgrading For most users, pip install --upgrade mssql-python is all that is needed. Two things to check: Offline or private-index installs need mssql-python-odbc==18.6.2.1 available alongside mssql-python. bulkcopy() now rejects Arrow-shaped input. Anything exposing __arrow_c_stream__ or __arrow_c_array__, which includes pandas 2.2+ and polars DataFrames as well as pyarrow containers, raises TypeError pointing at bulkcopy_arrow(). Those inputs never loaded correctly through bulkcopy(), so this replaces a confusing failure with a clear one. Any code that was catching the old error will see an actionable message. Feedback Full release notes are on the releases page. File issues and feature requests at github.com/microsoft/mssql-python/issues, or email us at mssql-python@microsoft.com.
