[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.mariadb.jdbc:mariadb-java-client (source)	3.5.9 → 3.5.11

---

Release Notes

mariadb-corporation/mariadb-connector-j (org.mariadb.jdbc:mariadb-java-client)

v3.5.11

Compare Source

Full Changelog

Key Enhancements

• CONJ-1353 - Generate a CycloneDX 1.6 SBOM meeting the CISA 2026 minimum elements
• CONJ-1356 - parsec authentication without BouncyCastle on Java 8/11 and without provider-dependent key derivation
• CONJ-1355 - Add NonRegisteringDriver so that DataSources and pools never register the driver in DriverManager, which pinned the class loader (report by mario-schwede-hivemq)
• CONJ-1348 - Reassembling packets larger than 16 MB copied the accumulated content once per fragment

Issues Resolved

• CONJ-1383 - Connection init rebuilds session_track_system_variables from @​@​global, discarding the session-level
  last_gtid set by MaxScale (report by Sawan Patel)
• CONJ-1379 - Set an explicit session tracking list and guard character_set_results like character_set_client
  (report by fg0x0)
• CONJ-1381 - Bound server-declared lengths by the packet before allocating and reading from them (report by fg0x0)
• CONJ-1357 - XA recover() must not trust server-supplied gtrid_length/bqual_length (report by fg0x0)
• CONJ-1374 - Redirect URL password partially logged when containing '@​' (report by @​manus-pi)
• CONJ-1372 - caching_sha2_password full authentication fails over a Unix socket when SSL is disabled (report by 工藤航)
• CONJ-1360 - Incorrect dependency check in AwsIamCredentialPlugin (report by Dheeraj Nalluri)
• CONJ-1358 - Client-side query timeout thread cannot be stopped and outlives an idle driver
• CONJ-1352 - Batched statements fail when a trigger produces a result set (report by Christopher Schultz)
• CONJ-1351 - Reading an invalid DATE value might throw unchecked exceptions instead of SQLException
• CONJ-1346 - Log-and-throw antipattern: server errors and hostname verification failures logged at DEBUG instead of
  WARN/INFO (report by Alexander Schwartz)
• CONJ-1345 - DatabaseMetaData#getURL() exposes database password since Connector/J 3.5.10 (report by Klaas)
• CONJ-1344 - DatabaseMetaData imported/exported keys ignore lower_case_table_names when using SHOW CREATE TABLE
  (report by plantegg ren)
• CONJ-1343 - DatabaseMetaData.getSQLKeywords() includes eight pairs of concatenated words (report by Adam Rauch)
• CONJ-1349 - DatabaseMetaData.getBestRowIdentifier() returns primary key columns in an undefined order

v3.5.10

Compare Source

Full Changelog

Key Enhancements

• CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
• CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
• CONJ-1330 - add infer test to CI

Issues Resolved

• CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
• CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is
  attacker-controlled (report by Qing Xu)
• CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
• CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
• CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
• CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to
  jmestwa-coder)
• CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating
  up front (thanks to jmestwa-coder)
• CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to
  jmestwa-coder)
• CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own
  password is supplied (report by fg0x0)
• CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to
  jmestwa-coder)
• CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
• CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing
  dot (report by Shaswata, thanks to Pepo48 for PR)
• CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds
  Integer.MAX_VALUE, and returns bulk generated keys out of batch order

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.