Home » Oreps » Frost Server » All Pull Requests » #2435
fraunhoferiosb/frost-server
A Complete Server implementation of the OGC SensorThings API
Watch
1
Commit Activity
Pull Requests
Directory Browser
Velocity History
Releases

Bump the dependencies group across 1 directory with 30 updates #2435

Compare code on GitHub
Open
dependabot[bot] opened 2:10am on September 20, 2026 wants to merge 1 commit into fraunhoferiosb/frost-server v2.x from
dependabot/maven/v2.x/dependencies-4c3f82cff2
dependabot[bot]
fraunhoferiosb/frost-server
dependabot/maven/v2.x/dependencies-4c3f82cff2
Diff Delta:
0
Classified as:  General

dependabot-bot's Description of Work

Bumps the dependencies group with 30 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| ch.qos.logback:logback-classic | 1.5.37 | 1.6.3 |
| com.github.dasniko:testcontainers-keycloak | 4.2.1 | 4.3.1 |
| com.google.guava:guava | 33.6.0-jre | 33.7.1-jre |
| io.prometheus:prometheus-metrics-bom | 1.8.0 | 1.9.0 |
| org.eclipse.jetty.ee10:jetty-ee10-servlet | 12.1.10 | 12.1.13 |
| org.jooq:jooq | 3.21.6 | 3.21.8 |
| org.jooq:jooq-codegen | 3.21.6 | 3.21.8 |
| org.jooq:jooq-meta | 3.21.6 | 3.21.8 |
| org.jooq:jooq-codegen | 3.21.6 | 3.21.8 |
| org.jooq:jooq-meta | 3.21.6 | 3.21.8 |
| org.junit:junit-bom | 6.1.1 | 6.1.3 |
| org.junit.platform:junit-platform-suite | 6.1.1 | 6.1.3 |
| org.mariadb.jdbc:mariadb-java-client | 3.5.9 | 3.5.10 |
| org.postgresql:postgresql | 42.7.12 | 42.7.13 |
| org.slf4j:jul-to-slf4j | 2.0.18 | 2.0.19 |
| org.slf4j:slf4j-api | 2.0.18 | 2.0.19 |
| org.slf4j:slf4j-api | 2.0.18 | 2.0.19 |
| tools.jackson:jackson-bom | 3.2.0 | 3.2.2 |
| io.github.git-commit-id:git-commit-id-maven-plugin | 10.0.0 | 10.0.1 |
| org.apache.maven.plugins:maven-compiler-plugin | 3.15.0 | 3.16.0 |
| org.apache.maven.plugins:maven-jar-plugin | 3.5.0 | 3.5.1 |
| org.codehaus.mojo:build-helper-maven-plugin | 3.6.1 | 3.6.2 |
| org.codehaus.mojo:exec-maven-plugin | 3.6.3 | 3.6.4 |
| org.sonarsource.scanner.maven:sonar-maven-plugin | 5.7.0.6970 | 5.8.0.7211 |
| com.diffplug.spotless:spotless-maven-plugin | 3.8.0 | 3.10.2 |
| org.apache.maven.plugins:maven-surefire-plugin | 3.5.6 | 3.6.0 |
| com.hivemq:hivemq-mqtt-client | 1.3.16 | 1.4.0 |
| com.hivemq:hivemq-mqtt-client-epoll | 1.3.16 | 1.4.0 |
| org.bouncycastle:bcpkix-jdk18on | 1.85 | 1.86 |
| org.bouncycastle:bcprov-jdk18on | 1.85 | 1.86 |
| org.bouncycastle:bcutil-jdk18on | 1.85 | 1.86 |
| org.bouncycastle:bcprov-jdk18on | 1.85 | 1.86 |
| org.bouncycastle:bcutil-jdk18on | 1.85 | 1.86 |
| com.hivemq:hivemq-mqtt-client-websocket | 1.3.16 | 1.4.0 |
| org.apache.maven:apache-maven | 3.9.15 | 3.9.16 |

Updates ch.qos.logback:logback-classic from 1.5.37 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.



Logback 1.6.3


2026-08-14 Release of logback version 1.6.3




  • In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, </code>) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).




  • Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.




  • The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.




  • ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.




  • Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation
    warning above uses the batched gate.




  • The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.




  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.




--
Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch


Logback 1.6.2


https://github.com/user-attachments/assets/9ceaf157-b758-4188-815d-edfe4e1b4edd


2026-08-10 Release of logback version 1.6.2




  • Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.




  • Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:


    <property name="logback.skipCallerContradictionAnalysis" value="true"/>



  • SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.




  • Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.




  • Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.




  • Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.




  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.




Logback 1.6.1


2026-07-28 Release of logback version 1.6.1


• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)


<!-- raw HTML omitted -->

... (truncated)

Commits



  • e8e824d prepare release 1.6.3


  • 761821b MDCBasedDiscriminator has a gated warning mechanism


  • 53ed122 update copyright year


  • c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate


  • b5aa931 added BatchedSimpleInvocationGate


  • 1f22af7 add javadocs to SimpleInvocationGate


  • 638ffa7 prevent forward and backward slashes to escape to other directories


  • 7d6b9a4 add missing ch.qos.logback.core.property package


  • fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender


  • c73b43f deprecate the withJansi path

  • Additional commits viewable in compare view


Updates com.github.dasniko:testcontainers-keycloak from 4.2.1 to 4.3.1

Release notes

Sourced from com.github.dasniko:testcontainers-keycloak's releases.



v4.3.1


What's Changed



Full Changelog: https://github.com/dasniko/testcontainers-keycloak/compare/v4.3.0...v4.3.1


v4.3.0


New Features



What's Changed


(dependencies only)



Full Changelog: https://github.com/dasniko/testcontainers-keycloak/compare/v4.2.1...v4.3.0


Commits



  • 97d3605 more endpoint methods (#318)


  • ee2a53f chore(deps-dev): bump ch.qos.logback:logback-classic (#316)


  • 4424fff chore(deps-dev): bump io.rest-assured:rest-assured from 6.0.0 to 6.0.1 (#315)


  • d9ef870 chore(deps-dev): bump junit-jupiter.version from 6.1.1 to 6.1.2 (#314)


  • 5d40175 chore: bump keycloak-admin-client version to 26.0.11 (#317)


  • 24f9262 Update Keycloak version to 26.7 in README and versions documentation


  • a3ddbcd ci: derive kc.version from pom.xml keycloak.version


  • 7cfdb29 prepare for 4.3 release by updating keycloak dependencies and version


  • 4b89fee chore: externalize dependency versions in pom.xml


  • 8d03c7b chore: bump testcontainers.version to 2.0.5

  • Additional commits viewable in compare view


Updates com.google.guava:guava from 33.6.0-jre to 33.7.1-jre

Release notes

Sourced from com.google.guava:guava's releases.



33.7.1


Maven


<dependency>

  <groupId>com.google.guava</groupId>

  <artifactId>guava</artifactId>

  <version>33.7.1-jre</version>

  <!-- or, for Android: -->

  <version>33.7.1-android</version>

</dependency>

Jar files



Guava requires one runtime dependency, which you can download here:



Javadoc



JDiff



Changelog


Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.


33.7.0


Newly introduced problem for Java 9 and Java 10 only


Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.


Maven


<dependency>

  <groupId>com.google.guava</groupId>

  <artifactId>guava</artifactId>

  <version>33.7.0-jre</version>

  <!-- or, for Android: -->

</tr></table>


... (truncated)

Commits


Updates io.prometheus:prometheus-metrics-bom from 1.8.0 to 1.9.0

Release notes

Sourced from io.prometheus:prometheus-metrics-bom's releases.



v1.9.0



1.9.0 (2026-09-16)


Features



  • support metric name filtering in OpenTelemetry exporter (#2344) (9b0ede8)


Bug Fixes



  • avoid protobuf debug reflection in native images (#2251) (7f899e7)

  • bound HTTPServer request resources (#2333) (33ec556)

  • bound observation buffering during collection (#2336) (43788f5)

  • bound scrape query parameters (#2334) (27e1912)


  • ci: skip benchmark report for skipped runs (#2422) (40eddb0)

  • clarify benchmark regression report verdicts (#2394) (e5fa067)


  • deps: update dependency com.google.guava:guava to v33.7.0-jre (#2387) (bf0db49)


  • deps: update dependency io.dropwizard.metrics:metrics-core to v4.2.40 (#2432) (dd88326)


  • deps: update dependency io.dropwizard.metrics5:metrics-core to v5.0.8 (#2433) (42f3c8a)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.29.0-alpha (#2235) (cf9f702)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.30.0-alpha (#2328) (1ca2716)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.30.0-alpha (#2330) (07623c1)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.31.0-alpha (#2401) (6c26619)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.31.0-alpha (#2402) (ac0d68a)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.31.1-alpha (#2409) (5eea652)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.31.1-alpha (#2410) (0bcef89)


  • deps: update dependency org.apache.tomcat.embed:tomcat-embed-core to v11.0.23 (#2241) (a017f80)


  • deps: update dependency org.apache.tomcat.embed:tomcat-embed-core to v11.0.24 (#2294) (63967bd)


  • deps: update dependency org.apache.tomcat.embed:tomcat-embed-core to v11.0.25 (#2389) (92f8344)


  • deps: update dependency org.apache.tomcat.embed:tomcat-embed-core to v11.0.26 (#2477) (05146c0)


  • deps: update dependency org.springframework.boot:spring-boot-starter-parent to v4.1.1 (#2399) (a0b0880)


  • deps: update jetty monorepo to v12.1.11 (#2279) (4dc54da)


  • deps: update jetty monorepo to v12.1.12 (#2371) (08967e0)


  • deps: update jetty monorepo to v12.1.13 (#2459) (b217f05)


  • deps: update junit-framework monorepo to v6.1.2 (#2300) (5966d1d)


  • deps: update junit-framework monorepo to v6.1.3 (#2374) (d1ade52)


  • deps: update otel.instrumentation.version (#2236) (158230d)


  • deps: update protobuf (#2400) (e2db1ed)


  • deps: update protobuf (#2438) (8ad6fa8)


  • deps: update protobuf to v4.35.1 (#2221) (cf17073)

  • disable micrometer compat build cache (#2457) (6a40eda)

  • drop +Inf bound from OpenTelemetry classic histogram boundaries (#2458) (a3bce9a)


  • exposition: export internal package for OSGi resolution (#2415) (28b503d)


  • httpserver: make scrape error responses secure and configurable (f6d9df5)

  • include counter names in negative value errors (#2315) (ea8f935)

  • include license files in release source jars (#2250) (08cf925), closes #2216

  • keep late observations out of subsequent collection buffers (#2471) (d78b149)

  • keep PR title check required after rebases (#2414) (e3d4c3b)

  • prevent buffer stripe index overflow (#2331) (b6cd000)


<!-- raw HTML omitted -->

... (truncated)

Changelog

Sourced from io.prometheus:prometheus-metrics-bom's changelog.




1.9.0 (2026-09-16)


Features



  • support metric name filtering in OpenTelemetry exporter (#2344) (9b0ede8)


Bug Fixes



  • avoid protobuf debug reflection in native images (#2251) (7f899e7)

  • bound HTTPServer request resources (#2333) (33ec556)

  • bound observation buffering during collection (#2336) (43788f5)

  • bound scrape query parameters (#2334) (27e1912)


  • ci: skip benchmark report for skipped runs (#2422) (40eddb0)

  • clarify benchmark regression report verdicts (#2394) (e5fa067)


  • deps: update dependency com.google.guava:guava to v33.7.0-jre (#2387) (bf0db49)


  • deps: update dependency io.dropwizard.metrics:metrics-core to v4.2.40 (#2432) (dd88326)


  • deps: update dependency io.dropwizard.metrics5:metrics-core to v5.0.8 (#2433) (42f3c8a)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.29.0-alpha (#2235) (cf9f702)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.30.0-alpha (#2328) (1ca2716)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.30.0-alpha (#2330) (07623c1)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.31.0-alpha (#2401) (6c26619)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.31.0-alpha (#2402) (ac0d68a)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.31.1-alpha (#2409) (5eea652)


  • deps: update dependency io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha to v2.31.1-alpha (#2410) (0bcef89)


  • deps: update dependency org.apache.tomcat.embed:tomcat-embed-core to v11.0.23 (#2241) (a017f80)


  • deps: update dependency org.apache.tomcat.embed:tomcat-embed-core to v11.0.24 (#2294) (63967bd)


  • deps: update dependency org.apache.tomcat.embed:tomcat-embed-core to v11.0.25 (#2389) (92f8344)


  • deps: update dependency org.apache.tomcat.embed:tomcat-embed-core to v11.0.26 (#2477) (05146c0)


  • deps: update dependency org.springframework.boot:spring-boot-starter-parent to v4.1.1 (#2399) (a0b0880)


  • deps: update jetty monorepo to v12.1.11 (#2279) (4dc54da)


  • deps: update jetty monorepo to v12.1.12 (#2371) (08967e0)


  • deps: update jetty monorepo to v12.1.13 (#2459) (b217f05)


  • deps: update junit-framework monorepo to v6.1.2 (#2300) (5966d1d)


  • deps: update junit-framework monorepo to v6.1.3 (#2374) (d1ade52)


  • deps: update otel.instrumentation.version (#2236) (158230d)


  • deps: update protobuf (#2400) (e2db1ed)


  • deps: update protobuf (#2438) (8ad6fa8)


  • deps: update protobuf to v4.35.1 (#2221) (cf17073)

  • disable micrometer compat build cache (#2457) (6a40eda)

  • drop +Inf bound from OpenTelemetry classic histogram boundaries (#2458) (a3bce9a)


  • exposition: export internal package for OSGi resolution (#2415) (28b503d)


  • httpserver: make scrape error responses secure and configurable (f6d9df5)

  • include counter names in negative value errors (#2315) (ea8f935)

  • include license files in release source jars (#2250) (08cf925), closes #2216

  • keep late observations out of subsequent collection buffers (#2471) (d78b149)

  • keep PR title check required after rebases (#2414) (e3d4c3b)

  • prevent buffer stripe index overflow (#2331) (b6cd000)

  • redact invalid configuration values (#2335) (7e7e533)


<!-- raw HTML omitted -->

... (truncated)

Commits



  • 71e821c chore(main): release 1.9.0 (#2237)


  • d78b149 fix: keep late observations out of subsequent collection buffers (#2471)


  • 085263b perf: avoid allocating a mapping lambda on every labelValues() call (#2442)


  • 9ec38b7 chore(deps): update otel/opentelemetry-collector-contrib docker tag to v0.161...


  • 05146c0 fix(deps): update dependency org.apache.tomcat.embed:tomcat-embed-core to v11...


  • 59ca1f0 test: focus PR benchmarks on client_java and measure label lookups (#2468)


  • 398d087 fix: show uncertainty in benchmark comparisons (#2476)


  • 8722230 perf: skip snapshot rebuild in mergeDuplicates when names are unique (#2441)


  • ea8f935 fix: include counter names in negative value errors (#2315)


  • fba2007 test: verify buffer recovery after snapshot failures (#2446)

  • Additional commits viewable in compare view


Updates org.eclipse.jetty.ee10:jetty-ee10-servlet from 12.1.10 to 12.1.13

Updates org.jooq:jooq from 3.21.6 to 3.21.8

Updates org.jooq:jooq-codegen from 3.21.6 to 3.21.8

Updates org.jooq:jooq-meta from 3.21.6 to 3.21.8

Updates org.jooq:jooq-codegen from 3.21.6 to 3.21.8

Updates org.jooq:jooq-meta from 3.21.6 to 3.21.8

Updates org.junit:junit-bom from 6.1.1 to 6.1.3

Release notes

Sourced from org.junit:junit-bom's releases.



JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3


See Release Notes.


Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.2...r6.1.3


JUnit 6.1.2 = Platform 6.1.2 + Jupiter 6.1.2 + Vintage 6.1.2


See Release Notes.


Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.1...r6.1.2


Commits



  • f59f60d Release 6.1.3


  • cd8ec92 Finalize 6.1.3 release notes


  • c8729f2 Restore compatibility with GraalVM 25 (#5901)


  • ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)


  • fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)


  • 62afc02 Delay GraalVM plugin updates for 3 days


  • 0cc2902 Skip graalVmTest task if GraalVM env vars are not set


  • f6bbfc5 Move GraalVM tests to separate test task (#5903)


  • e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)


  • 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)

  • Additional commits viewable in compare view


Updates org.junit.platform:junit-platform-suite from 6.1.1 to 6.1.3

Release notes

Sourced from org.junit.platform:junit-platform-suite's releases.



JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3


See Release Notes.


Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.2...r6.1.3


JUnit 6.1.2 = Platform 6.1.2 + Jupiter 6.1.2 + Vintage 6.1.2


See Release Notes.


Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.1...r6.1.2


Commits



  • f59f60d Release 6.1.3


  • cd8ec92 Finalize 6.1.3 release notes


  • c8729f2 Restore compatibility with GraalVM 25 (#5901)


  • ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)


  • fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)


  • 62afc02 Delay GraalVM plugin updates for 3 days


  • 0cc2902 Skip graalVmTest task if GraalVM env vars are not set


  • f6bbfc5 Move GraalVM tests to separate test task (#5903)


  • e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)


  • 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)

  • Additional commits viewable in compare view


Updates org.mariadb.jdbc:mariadb-java-client from 3.5.9 to 3.5.10

Release notes

Sourced from org.mariadb.jdbc:mariadb-java-client's releases.



MariaDB Connector/Java 3.5.10



3.5.10 (Jul 2026)


Full Changelog


Key Enhancements



  • CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)

  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)

  • CONJ-1330 - add infer test to CI


Issues Resolved



  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server

  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is
    attacker-controlled (report by Qing Xu)

  • CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute

  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)

  • CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)

  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to
    jmestwa-coder)

  • CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating
    up front (thanks to jmestwa-coder)

  • CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to
    jmestwa-coder)

  • CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own
    password is supplied (report by fg0x0)

  • CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to
    jmestwa-coder)

  • CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)

  • CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing
    dot (report by Shaswata, thanks to Pepo48 for PR)

  • CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds
    Integer.MAX_VALUE, and returns bulk generated keys out of batch order


Changelog

Sourced from org.mariadb.jdbc:mariadb-java-client's changelog.




3.5.10 (Jul 2026)


Full Changelog


Key Enhancements



  • CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)

  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)

  • CONJ-1330 - add infer test to CI


Issues Resolved



  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server

  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is
    attacker-controlled (report by Qing Xu)

  • CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute

  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)

  • CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)

  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to
    jmestwa-coder)

  • CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating
    up front (thanks to jmestwa-coder)

  • CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to
    jmestwa-coder)

  • CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own
    password is supplied (report by fg0x0)

  • CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to
    jmestwa-coder)

  • CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)

  • CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing
    dot (report by Shaswata, thanks to Pepo48 for PR)

  • CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds
    Integer.MAX_VALUE, and returns bulk generated keys out of batch order



3.4.4 (Jul 2026)


Full Changelog


Notable Changes


  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)


Bugs Fixed


  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server

  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is
    attacker-controlled (report by Qing Xu)

  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)

  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to
    jmestwa-coder)


<!-- raw HTML omitted -->

... (truncated)

Commits



  • 6164678 [misc] update changelog


  • 6f58858 [CONJ-1335] getGeneratedKe...

Description has been truncated

5 total changed files
(1 file ignored)
Loading changes...
Loading changes...
Loading changes...
Loading changes...
You are now leaving the Pull Request Diff Zone
PR review complete, one step closer to shipping 🚀
GitClear uses cookies to ensure you get the best experience on our website. Learn more about our cookie policy