Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package mariadb-java-client for
openSUSE:Factory checked in at 2026-11-03 17:55:08
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/mariadb-java-client (Old)
and /work/SRC/openSUSE:Factory/.mariadb-java-client.new.1257 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "mariadb-java-client"
Tue Nov 3 17:55:08 2026 rev:7 rq:1394544 version:3.5.11
Changes:
--------
--- /work/SRC/openSUSE:Factory/mariadb-java-client/mariadb-java-client.changes
2025-03-28 09:37:19.420860433 +0100
+++
/work/SRC/openSUSE:Factory/.mariadb-java-client.new.1257/mariadb-java-client.changes
2026-11-03 17:57:44.873796007 +0100
@@ -1,0 +2,257 @@
+Mon Nov 2 16:33:22 UTC 2026 - Fridrich Strba <[email protected]>
+
+- Upgrade to version 3.5.11
+ * Key Enhancements
+ + CONJ-1386: New sslMode=allow: verify-full when the server
+ announces TLS, unencrypted otherwise
+ + CONJ-1353: Generate a CycloneDX 1.6 SBOM meeting CISA 2026
+ minimum elements
+ + CONJ-1356: Parsec authentication without BouncyCastle on Java
+ 8/11 and without provider-dependent key derivation
+ + CONJ-1355: Add NonRegisteringDriver so DataSources and pools
+ never register the driver in DriverManager
+ + CONJ-1348: Reassembling packets larger than 16 MB copied the
+ accumulated content once per fragment
+ * Issues Resolved
+ + CONJ-1387: LOAD DATA LOCAL INFILE file check must not match
+ text inside identifiers or literals (CVE-2026-119210,
+ bsc#1289117)
+ + CONJ-1383: Connection init rebuilds
+ session_track_system_variables from @@global, discarding
+ session-level last_gtid set by MaxScale
+ + CONJ-1379: Set explicit session tracking list and guard
+ character_set_results like character_set_client
+ (CVE-2026-119281, bsc#1289110)
+ + CONJ-1381: Bound server-declared lengths by packet before
+ reading from them (CVE-2026-119277, bsc#1289115)
+ + CONJ-1382: Bound server-declared lengths by packet before
+ allocating (CVE-2026-119276, bsc#1289116)
+ + CONJ-1380: Rogue server can crash client during
+ caching_sha2_password authentication (CVE-2026-119278,
+ bsc#1289114)
+ + CONJ-1357: XA recover() must not trust server-supplied
+ gtrid_length/bqual_length (CVE-2026-119280, bsc#1289030)
+ + CONJ-1374: Redirect URL password partially logged when
+ containing '@'
+ + CONJ-1372: caching_sha2_password full authentication fails
+ over Unix socket when SSL is disabled
+ + CONJ-1360: Incorrect dependency check in
+ AwsIamCredentialPlugin
+ + CONJ-1358: Client-side query timeout thread cannot be stopped
+ and outlives an idle driver
+ + CONJ-1352: Batched statements fail when trigger produces a
+ result set
+ + CONJ-1351: Reading invalid DATE value might throw unchecked
+ exceptions instead of SQLException
+ + CONJ-1346: Log-and-throw antipattern: server errors and
+ hostname verification failures logged at DEBUG instead of
+ WARN/INFO
+ + CONJ-1345: DatabaseMetaData#getURL() exposes database password
+ since Connector/J 3.5.10
+ + CONJ-1344: DatabaseMetaData imported/exported keys ignore
+ lower_case_table_names when using SHOW CREATE TABLE
+ + CONJ-1343: DatabaseMetaData.getSQLKeywords() includes eight
+ pairs of concatenated words
+ + CONJ-1349: DatabaseMetaData.getBestRowIdentifier() returns
+ primary key columns in an undefined order
+- Changes of 3.5.10:
+ * Key Enhancements
+ + CONJ-1333: Add maxAllowedPacket connection option
+ + CONJ-1339: Add maxAllowedColumns option to bound
+ server-announced column count
+ + CONJ-1330: Add infer test to CI
+ * Issues Resolved
+ + CONJ-1332: Reject multipart (>16 MB) packets before
+ authentication to prevent pre-auth OOM from rogue server
+ + CONJ-1342: socketFactory option allows loading arbitrary
+ bytecode via jar: URL, enabling RCE when JDBC URL is
+ attacker-controlled
+ + CONJ-1307: Connection.setReadOnly(true) still allows DML
+ statements to execute
+ + CONJ-1326: Unsafe escaping in
+ enquoteLiteral()/enquoteNCharLiteral()
+ + CONJ-1327: Align SSL hostname verification with TLS libraries
+ + CONJ-1329: LOAD DATA LOCAL INFILE validation fails open when
+ bound parameter cannot be rendered
+ + CONJ-1331: trustStore-configured TLS connections defer
+ certificate chain/identity validation instead of validating up
+ front
+ + CONJ-1340: SQL injection via unescaped identifiers in
+ updatable ResultSet generated statements
+ + CONJ-1341: MariaDbPoolDataSource.getConnection(user, password)
+ ignores user argument when pool password is supplied
+ + CONJ-1328: restrictedAuth allowlist is matched with substring
+ contains() instead of equality
+ + CONJ-1338: Validate length-encoded integers fit non-negative
+ int before use as length (CVE-2026-119279, bsc#1289111)
+ + CONJ-1336: Regression CONJ-1282: TLS connection fails when
+ JDBC hostname is absolute FQDN ending with trailing dot
+ + CONJ-1335: getGeneratedKeys() throws integer overflow after
+ batch insert when auto-increment value exceeds
+ Integer.MAX_VALUE and returns bulk generated keys out of batch
+ order
+- Changes of 3.5.9:
+ * Key Enhancements
+ + CONJ-1223: Cache TLS trust/key managers across connections to
+ reduce SSL connection cost
+ + CONJ-1314: Add SPI for interactive dialog (PAM) authentication
+ callback
+ + CONJ-1311: Add dedicated option useIpForKillQuery for query
+ cancellation
+ + CONJ-1310: Add full native image support and CI coverage
+ * Issues Resolved
+ + CONJ-1320: PAM (dialog) authentication must require secure
+ connection
+ + CONJ-1319: Use constant-time comparison when validating server
+ certificate fingerprint
+ + CONJ-1318: Enforce allowLocalInfile=false on server
+ local-infile request to prevent rogue server reading client
+ files
+ + CONJ-1322: Match local infile filename case-sensitively
+ + CONJ-1323: LOAD LOCAL INFILE validation rejects statements
+ preceded by line comments
+ + CONJ-1315: Cap BigDecimal/BigInteger string parsing length to
+ prevent CPU exhaustion if MitM
+ + CONJ-1317: Ensure non-UTF8 charset cannot be used for protocol
+ exchanges
+ + CONJ-1304: CallableStatement parameter metadata read from
+ mysql.proc, with MySQL info_schema fallback
+ + CONJ-1299: Keep VALUES literals after last placeholder when
+ rewriting batches
+ + CONJ-1313: Race condition in HaMode#getAvailableHostInOrder
+ can cause NPE
+ + CONJ-1311: Connection.cancelCurrentQuery fails with
+ SslMode.VERIFY_FULL when client socket IP is set
+ + CONJ-1264: Handle LocalDateTime as zoneless wall-clock value
+ + CONJ-1316: Pin Locale.ROOT on locale-sensitive call sites and
+ date/time/Duration text formatting
+ + CONJ-1324: Fix SQL parser to correctly handle '--' in
+ expressions and reset lastChar after block comments
+- Changes of 3.5.8:
+ * Issues Resolved
+ + CONJ-1305: XAResource.isSameRM() incorrectly returns true when
+ rewriteBatchedStatements differs between connections
+ + CONJ-1303: Statement.cancel() fails to kill running query
+ during result streaming
+ * Other
+ + CONJ-1298: Performance improvement: avoid decoding extended
+ format
+- Changes of 3.5.7:
+ * Key Enhancements
+ + CONJ-1282: Added TLS SNI (Server Name Indication) support
+ + CONJ-1271: Added MariaDbDataTruncation exception that includes
+ MariaDB error code and error message
+ * Issues Resolved
+ + CONJ-1291: Fixed ConnectionPoolDataSource incompatibility and
+ connection leaks due to internal ConnectionEventListener in
+ Connector/J 3.5.x
+ + CONJ-1286: Fixed MariaDbPoolPinnedConnection thread-safety
+ issue
+ + CONJ-1283: Fixed rewriteBatchedStatements bug when having
+ parenthesis after VALUES parts
+ + CONJ-1287: Fixed authentication plugin multi-exchange prefix
+ (0x01) handling introduced in MDEV-37554
+ + CONJ-1290: Fixed NullPointerException in
+ MultiPrimaryReplicaClient
+ + CONJ-1295: Fixed MariaDbClob compilation with JDK 26+
+- Changes of 3.5.6:
+ * Key Enhancements
+ + CONJ-1238: rewriteBatchStatements implementation
+ + CONJ-1274: Server prepared statement client failover to client
+ prepared statement
+ * Issues Resolved
+ + CONJ-1278: Prepared statement caching enablement correction,
+ same as 2.x
+ + CONJ-1279: Metadata table name addition for 12.1 after
+ MDEV-28933
+ + CONJ-1280: Permit having multiple commands with initSql option
+ + CONJ-1276: Connection#isValid(int timeout) does not obey
+ passed timeout if network is down
+- Changes of 3.5.5:
+ * Issues Resolved
+ + CONJ-1265: Ensure rollback and release savepoint operation are
+ sent to server, even when no transaction is in progress
+ + CONJ-1270: forceConnectionTimeZoneToSession does not always
+ set timezone to server
+- Changes of 3.5.4:
+ * Key Enhancements
+ + CONJ-1261: Added caching option for loadCodecs results to
+ improve performance
+ * Issues Resolved
+ + CONJ-1234: Fixed incorrect type definitions in
+ DatabaseMetaData.getTypeInfo()
+ + CONJ-1247: Resolved potential race condition causing
+ NullPointerException
+ + CONJ-1250: Avoid redundant queries for
+ CallableStatement.getParameterMetaData()
+ + CONJ-1251: Fixed SSL configuration issue where zero SSL
+ settings only functioned without explicit SSL configuration
+ + CONJ-1252: Resolved GSSAPI authentication error when server
+ exchanges begin with 0x01 byte
+ + CONJ-1254: Corrected DatabaseMetadata.getTypeInfo() returning
+ incorrect values for AUTO_INCREMENT, FIXED_PREC_SCALE, and
+ CASE_SENSITIVE fields
+ + CONJ-1255: Fixed getString method on BIT(1) fields to honor
+ transformedBitIsBoolean configuration
+ + CONJ-1259: Enhanced metadata compatibility with MariaDB
+ version 12.0
+ + CONJ-1260: Improved performance of
+ DatabaseMetaData.getExportedKeys
+ + CONJ-1256: Fixed issue to ensure correct catalog name is
+ returned
+- Changes of 3.5.3:
+ * Bugs Fixed
+ + CONJ-1226: Fixed issue where dates containing zero day or
+ month resulted in DateTimeException
+ + CONJ-1232: Resolved timestamp string representation
+ incompatibility between versions 2.7 and 3.x (see
+ oldModeNoPrecisionTimestamp)
+ + CONJ-1226: Fixed incorrect values returned by
+ ResultSet.getColumnType() for unsigned values
+ + CONJ-1241: Corrected regression in 3.x affecting column
+ metadata for unsigned types
+ + CONJ-1243: Fixed CallableStatement.getParameterMetadata()
+ returning wrong java.sql.Type for boolean values
+ + CONJ-1236: Prevented NullPointerException after reconnection
+ failure in high availability configurations
+ + CONJ-1237: Fixed issue with incorrect statements.isClosed
+ value after closing connection
+ + CONJ-1239: Disabled BULK operations when no parameters are
+ present
+ + CONJ-1240: Fixed connectivity issues with databases that only
+ accept TLSv1.3
+ + CONJ-1235: Modified redirection option to enable by default
+ only when SSL is enabled
+- Changes of 3.5.2:
+ * Bugs Fixed
+ + CONJ-1216: Resolved performance issue when batch processing on
+ MySQL and pre-10.2 MariaDB servers
+ + CONJ-1218: Incorrect behavior where XA connections are closed
+ when regular connections are terminated
+ + CONJ-1217: trustCertificateKeyStorePassword alias parameter is
+ not taken into account
+ + CONJ-1221: DatabaseMetadata.getTypeInfo() is missing data
+ types UUID and VECTOR
+ + CONJ-1225: Exception thrown prematurely without checking all
+ available connections
+ + CONJ-1228: result-set.getObject() on BLOB type returns Blob in
+ place of byte[]
+ + CONJ-660: New disconnectOnExpiredPasswords connection option
+ + CONJ-1229: Permit executeQuery commands to not return a result
+ set
+- Changes of 3.5.1:
+ * Notable changes
+ + CONJ-1193: Implement parsec authentication
+ + CONJ-1207: New HaMode: sequential write, loadbalance read
+ + CONJ-1208: Permit bulk for INSERT ON DUPLICATE KEY UPDATE
+ commands for 11.5.1+ servers
+ * Bugs Fixed
+ + CONJ-1053: Mark waffle-jna dependency optional in module
+ descriptor
+ + CONJ-1196: setObject on java.util.Date was considered a
+ java.sql.Date and truncated hour/minutes/seconds/ms
+ + CONJ-1211: JDBC 4.3 enquoteIdentifier missing validation
+ + CONJ-1213: SQL command ending with semicolon and trailing
+ space does not use bulk
+
+-------------------------------------------------------------------
Old:
----
3.5.0.tar.gz
New:
----
3.5.11.tar.gz
_scmsync.obsinfo
build.specials.obscpio
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ mariadb-java-client.spec ++++++
--- /var/tmp/diff_new_pack.GjvxYu/_old 2026-11-03 17:57:45.907839305 +0100
+++ /var/tmp/diff_new_pack.GjvxYu/_new 2026-11-03 17:57:45.912839515 +0100
@@ -1,7 +1,7 @@
#
# spec file for package mariadb-java-client
#
-# Copyright (c) 2025 SUSE LLC
+# Copyright (c) 2026 SUSE LLC and contributors
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -17,7 +17,7 @@
Name: mariadb-java-client
-Version: 3.5.0
+Version: 3.5.11
Release: 0
Summary: Connects applications developed in Java to MariaDB and MySQL
databases
License: BSD-3-Clause AND LGPL-2.1-or-later
@@ -27,11 +27,10 @@
BuildRequires: fdupes
BuildRequires: java-devel >= 9
BuildRequires: maven-local
+BuildRequires: mvn(biz.aQute.bnd:bnd-maven-plugin)
BuildRequires: mvn(com.google.code.maven-replacer-plugin:replacer)
BuildRequires: mvn(net.java.dev.jna:jna)
BuildRequires: mvn(net.java.dev.jna:jna-platform)
-BuildRequires: mvn(org.apache.felix:maven-bundle-plugin)
-BuildRequires: mvn(org.codehaus.mojo:build-helper-maven-plugin)
BuildRequires: mvn(org.osgi:osgi.cmpn)
BuildRequires: mvn(org.osgi:osgi.core)
BuildRequires: mvn(org.slf4j:slf4j-api)
@@ -60,20 +59,9 @@
%pom_remove_dep org.junit:junit-bom
%pom_remove_dep org.junit.jupiter:junit-jupiter-engine
-# used in buildtime for generating OSGI metadata
-%pom_remove_plugin biz.aQute.bnd:bnd-maven-plugin
-
%pom_add_dep net.java.dev.jna:jna
%pom_add_dep net.java.dev.jna:jna-platform
-# make the slf4j dependency version-independent
-%pom_remove_dep org.slf4j:slf4j-api
-%pom_add_dep org.slf4j:slf4j-api
-
-# use the latest OSGi implementation
-%pom_change_dep -r :org.osgi.core org.osgi:osgi.core
-%pom_change_dep -r :org.osgi.compendium org.osgi:osgi.cmpn
-
rm -r src/main/java/org/mariadb/jdbc/plugin/credential/aws
# removing dependencies and 'provides', which mariadb-java-client cannot
process from module-info.java
@@ -90,7 +78,9 @@
%pom_remove_plugin org.jacoco:jacoco-maven-plugin
%pom_remove_plugin org.apache.maven.plugins:maven-source-plugin
-%pom_remove_plugin org.sonatype.plugins:nexus-staging-maven-plugin
+%pom_remove_plugin org.sonatype.central:central-publishing-maven-plugin
+%pom_remove_plugin org.cyclonedx:cyclonedx-maven-plugin
+%pom_remove_plugin org.codehaus.gmavenplus:gmavenplus-plugin
%pom_remove_plugin -r :maven-gpg-plugin
%pom_remove_plugin -r :maven-javadoc-plugin
++++++ 3.5.0.tar.gz -> 3.5.11.tar.gz ++++++
++++ 45283 lines of diff (skipped)
++++++ _scmsync.obsinfo ++++++
mtime: 1793638652
commit: dad10ba1bdb2ab1ea8fd4f35e619fa19431c673d65325d66dffbc2c74865c2ac
url: https://src.opensuse.org/java-packages/mariadb-java-client
revision: dad10ba1bdb2ab1ea8fd4f35e619fa19431c673d65325d66dffbc2c74865c2ac
projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-11-02 17:57:32.000000000 +0100
@@ -0,0 +1 @@
+.osc
