[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.mariadb.jdbc:mariadb-java-client (source)	3.5.9 → 4.0.0

---

Release Notes

mariadb-corporation/mariadb-connector-j (org.mariadb.jdbc:mariadb-java-client)

v4.0.0

Compare Source

Full Changelog

4.0.0 includes every fix of 3.5.11, listed below.

Major Changes

• CONJ-1361 - Java 17 is the minimum runtime, Java 8 and 11 are no longer supported (the 3.5 branch remains available for Java 8)
• CONJ-1321 - TLS enabled by default: sslMode now defaults to verify-full
• CONJ-1384 - AWS IAM authentication moves to the separate artifact mariadb-java-client-aws, the connector no longer
  depends on the AWS SDK; the plugin gains STS assume role support (CONJ-877, report by Adrian Samatan) and ships
  the RDS root certificates so that the default sslMode validates an RDS endpoint without configuration
• CONJ-1306 - PreparedStatement.executeQuery() rejects statements that return no result set, as the JDBC
  specification requires; the permitNoResults option restores the former behavior (report by Christopher Schultz)
• CONJ-651 - Stream LOB columns from the socket instead of loading them in memory (report by Ilya Zhavoronkov)

Key Enhancements

• CONJ-1386 - New sslMode=allow: verify-full when the server announces TLS, unencrypted otherwise, for a mix of
  servers with and without TLS behind one connection string
• CONJ-1347 - setSavepoint() throws in auto-commit mode instead of silently succeeding
• CONJ-1262 - cachedCodecs option now defaults to true
• CONJ-1370 - JNA dependency removed, Unix domain sockets use the JDK implementation
• CONJ-1371 - useReadAheadInput option and ReadAheadBufferedStream removed
• CONJ-1366 - First-class module-info.java (module org.mariadb.jdbc)
• CONJ-1367 - Virtual threads: no carrier pinning in driver locks, verified by a JFR-based test
• CONJ-1354 - GSSAPI authentication uses the native GSS-API where available
• CONJ-1308 - Support MariaDB 12.3 XML data type
• CONJ-1220 - Unix domain sockets on Windows, for SSH tunnels (report by DAIKOZ)
• CONJ-1378 - Try every IP address a hostname resolves to when opening the socket
• CONJ-1369 - Performance work on the Java 17 code base: packet reader and writer buffers, readNBytes, ranged
  Arrays.equals, no String.format on data paths
• CONJ-1365 - Performance: VarHandle little-endian access in packet buffers
• CONJ-1373 - Performance: JDK UTF-8 encoder for long strings in Writer.writeString / writeStringEscaped
• CONJ-1375 - Performance: cache codec resolution for getObject(index, Class) and setObject
• CONJ-1377 - Performance: faster client-side query parsing in ClientParser and NativeSql
• CONJ-1368 - Build and test tooling: tests run against the built jar, GraalVM metadata refreshed, CI matrix on
  Java 17, 21 and 25

Issues Resolved

• CONJ-1383 - Connection init rebuilds session_track_system_variables from @​@​global, discarding the session-level
  last_gtid set by MaxScale (report by Sawan Patel)
• CONJ-1379 - Set an explicit session tracking list and guard character_set_results like character_set_client
  (report by fg0x0)
• CONJ-1381 - Bound server-declared lengths by the packet before allocating and reading from them (report by fg0x0)
• CONJ-1374 - Redirect URL password partially logged when containing '@​'
• CONJ-1372 - caching_sha2_password full authentication fails over a Unix socket when SSL is disabled (report by
  工藤航)
• CONJ-1360 - Incorrect dependency check in AwsIamCredentialPlugin (report by Dheeraj Nalluri)
• CONJ-1344 - DatabaseMetaData imported/exported keys ignore lower_case_table_names when using SHOW CREATE TABLE
  (report by plantegg ren)

v3.5.11

Compare Source

Full Changelog

Key Enhancements

• CONJ-1353 - Generate a CycloneDX 1.6 SBOM meeting the CISA 2026 minimum elements
• CONJ-1356 - parsec authentication without BouncyCastle on Java 8/11 and without provider-dependent key derivation
• CONJ-1355 - Add NonRegisteringDriver so that DataSources and pools never register the driver in DriverManager, which pinned the class loader (report by mario-schwede-hivemq)
• CONJ-1348 - Reassembling packets larger than 16 MB copied the accumulated content once per fragment

Issues Resolved

• CONJ-1383 - Connection init rebuilds session_track_system_variables from @​@​global, discarding the session-level
  last_gtid set by MaxScale (report by Sawan Patel)
• CONJ-1379 - Set an explicit session tracking list and guard character_set_results like character_set_client
  (report by fg0x0)
• CONJ-1381 - Bound server-declared lengths by the packet before allocating and reading from them (report by fg0x0)
• CONJ-1357 - XA recover() must not trust server-supplied gtrid_length/bqual_length (report by fg0x0)
• CONJ-1374 - Redirect URL password partially logged when containing '@​' (report by @​manus-pi)
• CONJ-1372 - caching_sha2_password full authentication fails over a Unix socket when SSL is disabled (report by 工藤航)
• CONJ-1360 - Incorrect dependency check in AwsIamCredentialPlugin (report by Dheeraj Nalluri)
• CONJ-1358 - Client-side query timeout thread cannot be stopped and outlives an idle driver
• CONJ-1352 - Batched statements fail when a trigger produces a result set (report by Christopher Schultz)
• CONJ-1351 - Reading an invalid DATE value might throw unchecked exceptions instead of SQLException
• CONJ-1346 - Log-and-throw antipattern: server errors and hostname verification failures logged at DEBUG instead of
  WARN/INFO (report by Alexander Schwartz)
• CONJ-1345 - DatabaseMetaData#getURL() exposes database password since Connector/J 3.5.10 (report by Klaas)
• CONJ-1344 - DatabaseMetaData imported/exported keys ignore lower_case_table_names when using SHOW CREATE TABLE
  (report by plantegg ren)
• CONJ-1343 - DatabaseMetaData.getSQLKeywords() includes eight pairs of concatenated words (report by Adam Rauch)
• CONJ-1349 - DatabaseMetaData.getBestRowIdentifier() returns primary key columns in an undefined order

v3.5.10

Compare Source

Full Changelog

Key Enhancements

• CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
• CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
• CONJ-1330 - add infer test to CI

Issues Resolved

• CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
• CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is
  attacker-controlled (report by Qing Xu)
• CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
• CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
• CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
• CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to
  jmestwa-coder)
• CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating
  up front (thanks to jmestwa-coder)
• CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to
  jmestwa-coder)
• CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own
  password is supplied (report by fg0x0)
• CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to
  jmestwa-coder)
• CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
• CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing
  dot (report by Shaswata, thanks to Pepo48 for PR)
• CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds
  Integer.MAX_VALUE, and returns bulk generated keys out of batch order

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.