Update dependency org.mariadb.jdbc:mariadb-java-client to v3.5.10

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.mariadb.jdbc:mariadb-java-client (source)	3.3.2 → 3.5.10

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

mariadb-corporation/mariadb-connector-j (org.mariadb.jdbc:mariadb-java-client)

v3.5.10

Compare Source

Full Changelog

Key Enhancements

• CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
• CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
• CONJ-1330 - add infer test to CI

Issues Resolved

• CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
• CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is
  attacker-controlled (report by Qing Xu)
• CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
• CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
• CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
• CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to
  jmestwa-coder)
• CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating
  up front (thanks to jmestwa-coder)
• CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to
  jmestwa-coder)
• CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own
  password is supplied (report by fg0x0)
• CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to
  jmestwa-coder)
• CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
• CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing
  dot (report by Shaswata, thanks to Pepo48 for PR)
• CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds
  Integer.MAX_VALUE, and returns bulk generated keys out of batch order

v3.5.9

Compare Source

Full Changelog

Key Enhancements

• CONJ-1223 - cache TLS trust/key managers across connections to reduce SSL connection cost
• CONJ-1314 - add SPI for interactive dialog (PAM) authentication callback
• CONJ-1311 - add dedicated option useIpForKillQuery for query cancellation
• CONJ-1310 - Add full native image support and CI coverage

Issues Resolved

• CONJ-1320 - PAM (dialog) authentication must require a secure connection (report by fg0x0)
• CONJ-1319 - Use constant-time comparison when validating the server certificate fingerprint (report by jmestwa-coder)
• CONJ-1318 - enforce allowLocalInfile=false on the server's local-infile request, so a malicious server cannot read a client file despite the option being disabled
• CONJ-1322 - match local infile filename case-sensitively (thanks to jmestwa-coder)
• CONJ-1323 - LOAD LOCAL INFILE validation rejects statements preceded by line comments (thanks to sebdomdev)
• CONJ-1315 - cap BigDecimal/BigInteger string parsing length to prevent CPU exhaustion if MitM (report by tonghuaroot)
• CONJ-1317 - ensure non-UTF8 charset cannot be used for protocol exchanges (report by fg0x0)
• CONJ-1304 - CallableStatement parameter metadata read from mysql.proc, with MySQL info_schema fallback
• CONJ-1299 - keep VALUES literals after the last placeholder when rewriting batches
• CONJ-1313 - race condition in HaMode#getAvailableHostInOrder can cause NPE
• CONJ-1311 - Connection.cancelCurrentQuery fails with SslMode.VERIFY_FULL when client socket IP is set
• CONJ-1264 - handle LocalDateTime as a zoneless wall-clock value
• CONJ-1316 - pin Locale.ROOT on locale-sensitive call sites and date/time/Duration text formatting (fixes
  locale-dependent parsing/formatting, e.g. under tr_TR) (thanks to jmestwa-coder)
• CONJ-1324 - fix SQL parser to correctly handle '--' in expressions and reset lastChar after block comments
• CONJ-1323 - LOAD LOCAL INFILE validation rejects statements preceded by line comments (thanks to sebdomdev)
• CONJ-1318 - allowLocalInfile=false does not block LOAD DATA LOCAL INFILE against a malicious server (thanks to tharavel)

v3.5.8

Compare Source

Full Changelog

Issues Resolved

• CONJ-1305 - XAResource.isSameRM() incorrectly returns true when rewriteBatchedStatements differs between connections
• CONJ-1303 - Statement.cancel() fails to kill running query during result streaming

Other

• CONJ-1298 - Performance improvement: avoid decoding extended format

v3.5.7

Compare Source

Full Changelog

Key Enhancements

• CONJ-1282 - Added TLS SNI (Server Name Indication) support
• CONJ-1271 - Added MariaDbDataTruncation exception that includes MariaDB error code and error message

Issues Resolved

• CONJ-1291 - Fixed ConnectionPoolDataSource incompatibility and connection leaks due to internal ConnectionEventListener in MariaDB Connector/J 3.5.x
• CONJ-1286 - Fixed MariaDbPoolPinnedConnection thread-safety issue
• CONJ-1283 - Fixed rewriteBatchedStatements introduced in 3.5.6 bug when having parentesis after VALUES parts
• CONJ-1287 - Fixed authentication plugin multi-exchange prefix (0x01) handling introduced in MDEV-37554
• CONJ-1290 - Fixed NullPointerException in MultiPrimaryReplicaClient
• CONJ-1295 - Fixed MariaDbClob compilation with JDK 26+

v3.5.6

Compare Source

Full Changelog

Key Enhancements

• CONJ-1238 - rewriteBatchStatements implementation
• CONJ-1274 - server prepared statement client failover to client prepared statement

Issues Resolved

• CONJ-1278 - prepared statement caching enablement correction, same than 2.x
• CONJ-1279 - metadata table name addition for 12.1 after MDEV-28933
• CONJ-1280 - permit having multiple command with initSql option
• CONJ-1276 - Connection#isValid(int timeout) does not obey the passed in timeout if the network is down.

v3.5.5

Compare Source

Full Changelog

Issues Resolved

• CONJ-1265 - ensure rollback and release savepoint operation to be sent to server, even when there is no transaction in progress
• CONJ-1270 - forceConnectionTimeZoneToSession doesn't always set the timezone to server

v3.5.4

Compare Source

Full Changelog

Key Enhancements

• CONJ-1261 - Added caching option for loadCodecs results to improve performance

Issues Resolved

• CONJ-1234 - Fixed incorrect type definitions in DatabaseMetaData.getTypeInfo()
• CONJ-1247 - Resolved potential race condition that could cause NullPointerException
• CONJ-1250 - avoids redundant queries for CallableStatement.getParameterMetaData()
• CONJ-1251 - Fixed SSL configuration issue where zero SSL settings only functioned without explicit SSL configuration
• CONJ-1252 - Resolved GSSAPI authentication error when server exchanges begin with 0x01 byte
• CONJ-1254 - Corrected DatabaseMetadata.getTypeInfo() returning incorrect values for AUTO_INCREMENT, FIXED_PREC_SCALE, and CASE_SENSITIVE fields
• CONJ-1255 - Fixed getString method on BIT(1) fields to properly honor transformedBitIsBoolean configuration
• CONJ-1259 - Enhanced metadata compatibility with MariaDB version 12.0
• CONJ-1260 - Improved performance of DatabaseMetaData.getExportedKeys method
• CONJ-1256 - Fixed issue to ensure correct catalog name is returned

v3.5.3

Compare Source

Full Changelog

Bugs Fixed

• CONJ-1226 Fixed issue where dates containing zero day or month resulted in a DateTimeException
• CONJ-1232 Resolved timestamp string representation incompatibility between versions 2.7 and 3.x
  • see new option oldModeNoPrecisionTimestamp
• CONJ-1226 Fixed incorrect values returned by ResultSet.getColumnType() for unsigned values
• CONJ-1241 Corrected regression in 3.x affecting column metadata for unsigned types
• CONJ-1243 Fixed CallableStatement.getParameterMetadata() returning wrong java.sql.Type for boolean values
• CONJ-1236 Prevented NPE (Null Pointer Exception) after reconnection failure in high availability configurations
• CONJ-1237 Fixed issue with incorrect statements.isClosed value after closing connection
• CONJ-1239 Disabled BULK operations when no parameters are present
• CONJ-1240 Fixed connectivity issues with databases that only accept TLSv1.3
• CONJ-1235 Modified redirection option to enable by default only when SSL is enabled

v3.5.2

Compare Source

Full Changelog

Bugs Fixed

• CONJ-1216 Resolved a performance issue that occurred when batch processing on MySQL and older MariaDB (pre-10.2) servers
• CONJ-1218 Incorrect behavior where XA connections are closed when regular connections are terminated - this is against specifications
• CONJ-1217 The trustCertificateKeyStorePassword alias parameter isn’t taken into account
• CONJ-1221 DatabaseMetadata.getTypeInfo() is missing the data types UUID and VECTOR
• CONJ-1225 System throws an exception prematurely without checking all available connections
• CONJ-1228 result-set.getObject() on BLOB type returns Blob in place of byte[]
• CONJ-660 new disconnectOnExpiredPasswords connection option that controls client behavior when connecting with an expired password.
  When set to true (default), the client disconnects if it detects an expired password.
  When false, the client maintains the connection and allows setting a new password.
• CONJ-1229 Permit executeQuery commands to not return a result-set

v3.5.1

Compare Source

Full Changelog

Key Enhancements

• CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
• CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
• CONJ-1330 - add infer test to CI

Issues Resolved

• CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
• CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is
  attacker-controlled (report by Qing Xu)
• CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
• CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
• CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
• CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to
  jmestwa-coder)
• CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating
  up front (thanks to jmestwa-coder)
• CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to
  jmestwa-coder)
• CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own
  password is supplied (report by fg0x0)
• CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to
  jmestwa-coder)
• CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
• CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing
  dot (report by Shaswata, thanks to Pepo48 for PR)
• CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds
  Integer.MAX_VALUE, and returns bulk generated keys out of batch order

v3.5.0

Compare Source

Full Changelog

Notable changes

* CONJ-1193 Parsec authentication implementation

• CONJ-1183 permit setting specific truststore

Bugs Fixed

• CONJ-1202 Session variable setting must be executed last
• CONJ-1201 incorrect default behavior for forceConnectionTimeZoneToSession
• CONJ-1200 Batch import fails with exception "Unknown command"
• CONJ-1199 option connectionCollation addition in order to force collation
• CONJ-1187 Use different exception type for connection timeouts

v3.4.4

Compare Source

Full Changelog

Notable Changes

• CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)

Bugs Fixed

• CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
• CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is
  attacker-controlled (report by Qing Xu)
• CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
• CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to
  jmestwa-coder)
• CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to
  jmestwa-coder)
• CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own
  password is supplied (report by fg0x0)
• CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to
  jmestwa-coder)

v3.4.3

Compare Source

Full Changelog

Bugs Fixed

• CONJ-1315 - cap BigDecimal/BigInteger string parsing length to prevent CPU exhaustion if Mitm (report by tonghuaroot)
• CONJ-1316 - pin Locale.ROOT on locale-sensitive call sites and date/time/Duration text formatting (fixes
  locale-dependent parsing/formatting, e.g. under tr_TR) (thanks to jmestwa-coder)
• CONJ-1259 - DatabaseMetaData read-only detection: handle MariaDB 12.0 @@read_only returning ON/OFF
  instead of 1/0
• CONJ-1317 - ensure non-UTF8 charset cannot be used for protocol exchanges (report by fg0x0)
• CONJ-1320 - PAM (dialog) authentication now requires a secure connection (TLS or unix socket), like mysql_clear_password (report by fg0x0)
• CONJ-1319 - use constant-time comparison when validating the server certificate fingerprint (thanks to jmestwa-coder)
• CONJ-1322 - match local infile filename case-sensitively (thanks to jmestwa-coder)
• CONJ-1323 - LOAD LOCAL INFILE validation rejects statements preceded by line comments (thanks to sebdomdev)
• CONJ-1318 - allowLocalInfile=false does not block LOAD DATA LOCAL INFILE against a malicious server (thanks to tharavel)

v3.4.2: MariaDB Connector/Java 3.4.2

Compare Source

3.4.2 (Mar 2025)

Full Changelog

Bugs Fixed

bug fix report from 3.3.4

• CONJ-1237 wrong statements.isClosed value after closing connection
• CONJ-1236 ensure not having NPE after reconnection fail for high availability configurations
• CONJ-1239 disable BULK use when there isn't any parameter

v3.4.1

Compare Source

Full Changelog

Bugs Fixed

• CONJ-1181 Ensure Prepare cache use schema
• CONJ-1178 DatabaseMetaData.getImportedKeys return different PK_NAME value than getExportedKeys.
• CONJ-1180 Correct DatabaseMeta.getExportedKeys() performances
• CONJ-1185 Android app compatibility, regex CANON_EQ flag not supported
• CONJ-1188 database meta getSQLKeywords listing all reserved key word, not restricted keywords only
• CONJ-1189 implementation of pinGlobalTxToPhysicalConnection for XA Connection
• CONJ-1190 Adding MySQL option 'databaseTerm' as alias for useCatalogTerm for compatibility
• CONJ-1191 slow metadata getImportedKeys when not having database set
• CONJ-685 permit setting sslMode per host
• CONJ-686 Allow mixing TCP and socket hosts in failover configuration
• CONJ-1068 ResultSetMetaData.getColumnTypeName() returns VARCHAR instead of TINYTEXT
• CONJ-1182 missing XA_RBTIMEOUT,XA_RBTIMEOUT and XA_RBDEADLOCK error mapping

v3.4.0

Compare Source

Full Changelog

Notable Changes

• CONJ-981 Add support for connection redirection
• CONJ-1087 handle mariadb-11.1+ transaction_isolation
• CONJ-1100 Be able to filter system tables and views
• CONJ-1105 TLS certificate validation without needs to provide certificate client side
• CONJ-1171 timezone support missing feature
• CONJ-1173 Bulk implementation returning individual results for MariaDB 11.5
• CONJ-1154 avoid unnecessary set transaction isolation queries

Bugs Fixed

• CONJ-1103 Connector/J Version 3 Does Not Respect "nullCatalogMeansCurrent" Property
• CONJ-1161 Database connection failing on android
• CONJ-1107 MariaDB Connector 3 no longer supports query timeout with MySQL
• CONJ-1125 Inconsistency in Handling PreparedStatement.executeQuery() between MariaDB and MySQL Connectors
• CONJ-1156 getTables should be ordered as expected
• CONJ-1163 jdbcCompliantTruncation Does Not Appear To Be Working
• CONJ-1164 Variable initialization ahead of LOAD DATA INFILE not possible by validateLocalFileName pattern
• CONJ-1168 useBulkStmts compatibility value with pre 3.2 version
• CONJ-1169 improve Client prepared statement setMaxRows implementation
• CONJ-1170 OFFSET missing from getSQLKeywords
• CONJ-1158 DatabaseMetaData#getFunctions's result not property ordered
• CONJ-1159 DatabaseMetaData#getClientInfoProperties not ordered correctly
• CONJ-1166 Implement connection properties fallbackToSystemKeyStore and fallbackToSystemTrustStore
• CONJ-1174 ConnectorJ gives precision of 20 for signed bigint

v3.3.6

Compare Source

Full Changelog

Notable Changes

• CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)

Bugs Fixed

• CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
• CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is
  attacker-controlled (report by Qing Xu)
• CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
• CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to
  jmestwa-coder)
• CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to
  jmestwa-coder)
• CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own
  password is supplied (report by fg0x0)
• CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to
  jmestwa-coder)

v3.3.5

Compare Source

Full Changelog

Bugs Fixed

• CONJ-1315 - cap BigDecimal/BigInteger string parsing length to prevent CPU exhaustion if Mitm (report by tonghuaroot)
• CONJ-1316 - pin Locale.ROOT on locale-sensitive call sites and date/time/Duration text formatting (fixes
  locale-dependent parsing/formatting, e.g. under tr_TR) (thanks to jmestwa-coder)
• CONJ-1259 - DatabaseMetaData read-only detection: handle MariaDB 12.0 @@read_only returning ON/OFF
  instead of 1/0
• CONJ-1317 - ensure non-UTF8 charset cannot be used for protocol exchanges (report by fg0x0)
• CONJ-1322 - match local infile filename case-sensitively (thanks to jmestwa-coder)
• CONJ-1323 - LOAD LOCAL INFILE validation rejects statements preceded by line comments (thanks to sebdomdev)
• CONJ-1318 - allowLocalInfile=false does not block LOAD DATA LOCAL INFILE against a malicious server (thanks to tharavel)

v3.3.4: MariaDB Connector/Java 3.3.4

Compare Source

3.3.4 (Mar 2025)

Full Changelog

Bugs Fixed

• CONJ-1237 wrong statements.isClosed value after closing connection
• CONJ-1236 ensure not having NPE after reconnection fail for high availability configurations
• CONJ-1239 disable BULK use when there isn't any parameter

v3.3.3

Compare Source

Full Changelog

Bugs Fixed

• CONJ-1050 regression in 3.x.y: nonparameterized batch "INSERT INTO products( name ) VALUES ( 'aaaa' )" fails
• CONJ-1150 Error using PrepareStatement.setURL with null url
• CONJ-1152 Improve message when reaching socket timeout during connection initial commands

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.