ReplicaDB v0.18.3

This release adds first-class Microsoft Entra authentication configuration for SQL Server connections and improves DB2 parallel-read coverage and release tooling.

Highlights

• Add Azure SQL authentication support for both SQL Server sources and sinks:
• ActiveDirectoryInteractive for local browser and MFA sign-in.
• ActiveDirectoryDefault for Azure CLI, environment, workload, and default credential chains.
• ActiveDirectoryManagedIdentity and the ActiveDirectoryMSI alias.
• ActiveDirectoryServicePrincipal for unattended secret-based execution.
• ActiveDirectoryServicePrincipalCertificate for certificate-based execution.
• ActiveDirectoryIntegrated for external Kerberos or native authentication setups.
• Add explicit source and sink authentication settings through CLI options, options files, and the configuration wizard.
• Include the Azure Identity and MSAL runtime dependencies required by the Microsoft SQL Server JDBC driver.
• Add credential redaction for connection properties, JDBC URLs, logs, debug output, Sentry contexts, tags, breadcrumbs, and exception payloads.
• Add a local, network-free Azure authentication simulation that verifies the JDBC properties sent for all supported modes.

What's Changed

Azure SQL and Microsoft Entra authentication

• Add source.auth.* and sink.auth.* configuration properties, plus matching --source-auth-* and --sink-auth-* CLI options.
• Map the first-class configuration to the Microsoft JDBC Driver for SQL Server without implementing a second OAuth or token provider in ReplicaDB.
• Preserve existing username/password connections and the generic source.connect.parameter.* and sink.connect.parameter.* pass-through.
• Validate authentication modes before Sentry initialization and before replication tasks start.
• Prevent concurrent browser flows by requiring jobs=1 for Interactive authentication, including raw JDBC URL configuration.
• Close source and sink task managers independently when authentication or connection setup fails.
• Make local launchers browser-capable by default while keeping container runtimes explicitly headless.
• Document local, unattended, and Azure-hosted configuration, permissions, networking, and headless-runtime limitations.

DB2 and integration coverage

• Improve DB2 parallel projection handling and add regression coverage for duplicate labels and partition-alias collisions.
• Fix DB2-to-PostgreSQL test setup so projection-only tests provide the required sink connection configuration.
• Keep the full Testcontainers integration matrix and package checks green in CI.

Tooling and documentation

• Update the configuration wizard to generate the same Azure authentication contract as the CLI and options file.
• Update documentation and release guidance for Java 17, Azure SQL authentication, and runtime dependency packaging.
• Update Markdown tool dependencies.
• Publish one standard distribution containing all supported runtime drivers, including Oracle support.

Upgrade Notes

• Existing SQL username/password jobs remain compatible.
• ActiveDirectoryPassword is deprecated and is not recommended for MFA. Prefer Interactive for user-present sign-in, Default or Managed Identity for Azure-hosted workloads, and service principal or certificate authentication for unattended execution.
• Interactive authentication requires a local desktop browser and jobs=1. Docker and Podman images are headless; use a non-interactive authentication mode there.
• Azure SQL still requires the appropriate contained database user or group permissions and firewall or private-network access.
• Keep secrets in environment-managed configuration. Do not place passwords, client secrets, access tokens, or certificate contents in JDBC URLs, command history, or committed files.

Validation

• Local Azure/configuration/security validation: 28 tests passed.
• GitHub Actions Only CI/CT: all integration matrix jobs and package validation passed.
• CodeQL: passed.
• Release packaging: passed for the standard archive.
• Docker and Podman runtime image checks: Java 17 images built successfully.
• Live Azure authentication was not required by the normal CI; the repository includes a deterministic simulation for the ReplicaDB-to-JDBC authentication boundary.

Downloads

• ReplicaDB-0.18.3.tar.gz (github.com)
• ReplicaDB-0.18.3.zip

Full changes: compare v0.18.2...v0.18.3