[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.postgresql:postgresql (source)	42.7.13 → 42.7.14
com.mysql:mysql-connector-j (source)	26.7.0 → 26.10.0
org.mariadb.jdbc:mariadb-java-client (source)	3.5.10 → 3.5.11
org.xerial:sqlite-jdbc	3.53.4.0 → 3.54.1.0

---

Release Notes

pgjdbc/pgjdbc (org.postgresql:postgresql)

v42.7.14

Security

• fix: a requireAuth value that excludes every authentication method, such as !password,!md5,!gss,!sspi,!scram-sha-256,!none, now refuses every method. A connection with such a value now fails with SQLState 08004. Before, the driver treated the value as if requireAuth were not set, and used any method the server asked for, even a cleartext password. This affects 42.7.11 through 42.7.13 GHSA-rhp9-mr79-r74h
• fix: a requireAuth value without a method in it, such as , or ,,, now fails with SQLState 22023. Before, the driver treated it as if requireAuth were not set. Commas at the very end of a value are still ignored, as in password,. This affects 42.7.11 through 42.7.13 GHSA-rhp9-mr79-r74h
• fix: a value shorter than its declared length, such as one from a ByteStreamWriter whose getLength() is larger than what writeTo() writes, is now padded with zeros. Before, the driver padded it with bytes of messages sent earlier on the same connection, so the stored value could contain SQL text and parameter values of earlier statements. This affects 42.7.4 through 42.7.13 GHSA-f64h-wr5q-3qf3

mysql/mysql-connector-j (com.mysql:mysql-connector-j)

v26.10.0

Compare Source

mariadb-corporation/mariadb-connector-j (org.mariadb.jdbc:mariadb-java-client)

v3.5.11

Compare Source

Full Changelog

Key Enhancements

• CONJ-1353 - Generate a CycloneDX 1.6 SBOM meeting the CISA 2026 minimum elements
• CONJ-1356 - parsec authentication without BouncyCastle on Java 8/11 and without provider-dependent key derivation
• CONJ-1355 - Add NonRegisteringDriver so that DataSources and pools never register the driver in DriverManager, which pinned the class loader (report by mario-schwede-hivemq)
• CONJ-1348 - Reassembling packets larger than 16 MB copied the accumulated content once per fragment

Issues Resolved

• CONJ-1383 - Connection init rebuilds session_track_system_variables from @​@​global, discarding the session-level
  last_gtid set by MaxScale (report by Sawan Patel)
• CONJ-1379 - Set an explicit session tracking list and guard character_set_results like character_set_client
  (report by fg0x0)
• CONJ-1381 - Bound server-declared lengths by the packet before allocating and reading from them (report by fg0x0)
• CONJ-1357 - XA recover() must not trust server-supplied gtrid_length/bqual_length (report by fg0x0)
• CONJ-1374 - Redirect URL password partially logged when containing '@​' (report by @​manus-pi)
• CONJ-1372 - caching_sha2_password full authentication fails over a Unix socket when SSL is disabled (report by 工藤航)
• CONJ-1360 - Incorrect dependency check in AwsIamCredentialPlugin (report by Dheeraj Nalluri)
• CONJ-1358 - Client-side query timeout thread cannot be stopped and outlives an idle driver
• CONJ-1352 - Batched statements fail when a trigger produces a result set (report by Christopher Schultz)
• CONJ-1351 - Reading an invalid DATE value might throw unchecked exceptions instead of SQLException
• CONJ-1346 - Log-and-throw antipattern: server errors and hostname verification failures logged at DEBUG instead of
  WARN/INFO (report by Alexander Schwartz)
• CONJ-1345 - DatabaseMetaData#getURL() exposes database password since Connector/J 3.5.10 (report by Klaas)
• CONJ-1344 - DatabaseMetaData imported/exported keys ignore lower_case_table_names when using SHOW CREATE TABLE
  (report by plantegg ren)
• CONJ-1343 - DatabaseMetaData.getSQLKeywords() includes eight pairs of concatenated words (report by Adam Rauch)
• CONJ-1349 - DatabaseMetaData.getBestRowIdentifier() returns primary key columns in an undefined order

xerial/sqlite-jdbc (org.xerial:sqlite-jdbc)

v3.54.1.0

Compare Source

Changelog

🚀 Features

sqlite

• upgrade to sqlite 3.54.1 (1dee4e5)
• support automatic_index and cache_spill pragmas (559581a)

🐛 Fixes

jdbc

• quote savepoint name before interpolating into sql (140c04d)

native

• keep the live handle when open is called on an open db (920136d)
• bound strfilter output to the searched string bytes (87444ae)
• release the correct critical array pointer in serialize (49e5c18)

unscoped

• create extracted library and db copy readable by owner only (a315b4b)
• preserve SQL null bindings for null streams (201218f)

🏎 Perf

jdbc

• avoid cubic regex backtracking when finding primary keys (03582c2)

🔄️ Changes

jdbc

• share sql quote escaping between metadata and savepoints (6e26d10)

🛠 Build

deps

• bump org.graalvm.sdk:nativeimage (d9ff142)
• bump org.graalvm.buildtools:native-maven-plugin (44d8081)
• bump org.graalvm.buildtools:native-maven-plugin (0748a6a)
• bump org.graalvm.sdk:nativeimage from 25.2.4 to 25.3.4.1 (04adaab)
• bump org.graalvm.buildtools:native-maven-plugin (13a3976)
• bump actions/setup-java from 5 to 6 (9af0d95)

deps-dev

• bump org.mockito:mockito-core from 5.23.0 to 5.24.0 (ec7ddcd)
• bump com.tngtech.archunit:archunit-junit5 (d5bfa71)
• bump surefire.version from 3.6.0 to 3.6.1 (df7dbf7)
• bump org.sonatype.central:central-publishing-maven-plugin (3ee4140)
• bump org.codehaus.mojo:animal-sniffer-maven-plugin (c5992df)
• bump org.codehaus.mojo:versions-maven-plugin (e54786b)
• bump surefire.version from 3.5.6 to 3.6.0 (0062a19)
• bump org.apache.maven.plugins:maven-compiler-plugin (29f9aff)
• bump org.jreleaser:jreleaser-maven-plugin (3ecd1ee)

unscoped

• fix maven publishing (77ea1b1)
• update setup-java inputs (6474e66)
• bump android signatures to 0.16.0 (eb45649)
• enable immutable github releases with jreleaser (e5cd48b)

📝 Documentation

• fill documentation gaps (3850773), closes #​777
• document default compiled SQLite extensions (4610eaf), closes #​1075

Contributors

We'd like to thank the following people for their contributions:
Abdullah, Gauthier, Gauthier Roebroeck, Javid Khan, Sahana Bogar, sahvx655-wq, 박재홍

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • On day 1 of the month (* * 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.