dependabot[bot] opened a new pull request, #14565: URL: https://github.com/apache/cloudstack/pull/14565
Bumps [org.mariadb.jdbc:mariadb-java-client](https://github.com/mariadb-corporation/mariadb-connector-j) from 3.1.4 to 3.3.7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mariadb-corporation/mariadb-connector-j/releases";>org.mariadb.jdbc:mariadb-java-client's releases</a>.</em></p> <blockquote> <h2>MariaDB Connector/Java 3.3.7</h2> <h2><a href="https://github.com/mariadb-corporation/mariadb-connector-j/tree/3.3.7";>3.3.7</a> (Oct 2026)</h2> <p><a href="https://github.com/mariadb-corporation/mariadb-connector-j/compare/3.3.6...3.3.7";>Full Changelog</a></p> <h5>Bugs Fixed</h5> <ul> <li>CONJ-1383 Connection init rebuilds session_track_system_variables from @<a href="https://github.com/global";><code>@global</code></a>, discarding the session-level last_gtid set by MaxScale (report by Sawan Patel)</li> <li>CONJ-1379 Set an explicit session tracking list and guard character_set_results like character_set_client (report by fg0x0)</li> <li>CONJ-1382 Bound server-declared lengths by the packet before allocating (report by fg0x0)</li> <li>CONJ-1381 Bound server-declared lengths by the packet before reading from them (report by fg0x0)</li> <li>CONJ-1380 Rogue server can crash the client during caching_sha2_password authentication (report by shadow043)</li> <li>CONJ-1338 Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)</li> <li>CONJ-1357 XA recover() must not trust server-supplied gtrid_length/bqual_length (report by fg0x0)</li> <li>CONJ-1349 DatabaseMetaData.getBestRowIdentifier() returns primary key columns in an undefined order</li> </ul> <h2>MariaDB Connector/Java 3.3.6</h2> <h2><a href="https://github.com/mariadb-corporation/mariadb-connector-j/tree/3.3.6";>3.3.6</a> (Jul 2026)</h2> <p><a href="https://github.com/mariadb-corporation/mariadb-connector-j/compare/3.3.5...3.3.6";>Full Changelog</a></p> <h5>Notable Changes</h5> <ul> <li>CONJ-1339 Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)</li> </ul> <h5>Bugs Fixed</h5> <ul> <li>CONJ-1332 Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server</li> <li>CONJ-1342 socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)</li> <li>CONJ-1326 Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)</li> <li>CONJ-1329 LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)</li> <li>CONJ-1340 SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)</li> <li>CONJ-1341 MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)</li> <li>CONJ-1328 restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder)</li> </ul> <h2>MariaDB Connector/Java 3.3.5</h2> <h2><a href="https://github.com/mariadb-corporation/mariadb-connector-j/tree/3.3.5";>3.3.5</a> (Jun 2026)</h2> <p><a href="https://github.com/mariadb-corporation/mariadb-connector-j/compare/3.3.4...3.3.5";>Full Changelog</a></p> <h5>Bugs Fixed</h5> <ul> <li>CONJ-1315 cap BigDecimal/BigInteger string parsing length to prevent CPU exhaustion if Mitm (report by tonghuaroot)</li> <li>CONJ-1316 pin Locale.ROOT on locale-sensitive call sites and date/time/Duration text formatting (fixes locale-dependent parsing/formatting, e.g. under tr_TR) (thanks to jmestwa-coder)</li> <li>CONJ-1259 DatabaseMetaData read-only detection: handle MariaDB 12.0 <code>@@read_only</code> returning <code>ON</code>/<code>OFF</code></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/mariadb-corporation/mariadb-connector-j/blob/main/CHANGELOG.md";>org.mariadb.jdbc:mariadb-java-client's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/mariadb-corporation/mariadb-connector-j/tree/3.3.7";>3.3.7</a> (Oct 2026)</h2> <p><a href="https://github.com/mariadb-corporation/mariadb-connector-j/compare/3.3.6...3.3.7";>Full Changelog</a></p> <h5>Bugs Fixed</h5> <ul> <li>CONJ-1383 Connection init rebuilds session_track_system_variables from @<a href="https://github.com/global";><code>@global</code></a>, discarding the session-level last_gtid set by MaxScale (report by Sawan Patel)</li> <li>CONJ-1379 Set an explicit session tracking list and guard character_set_results like character_set_client (report by fg0x0)</li> <li>CONJ-1382 Bound server-declared lengths by the packet before allocating (report by fg0x0)</li> <li>CONJ-1381 Bound server-declared lengths by the packet before reading from them (report by fg0x0)</li> <li>CONJ-1380 Rogue server can crash the client during caching_sha2_password authentication (report by shadow043)</li> <li>CONJ-1338 Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)</li> <li>CONJ-1357 XA recover() must not trust server-supplied gtrid_length/bqual_length (report by fg0x0)</li> <li>CONJ-1349 DatabaseMetaData.getBestRowIdentifier() returns primary key columns in an undefined order</li> </ul> <h2><a href="https://github.com/mariadb-corporation/mariadb-connector-j/tree/3.5.10";>3.5.10</a> (Jul 2026)</h2> <p><a href="https://github.com/mariadb-corporation/mariadb-connector-j/compare/3.5.9...3.5.10";>Full Changelog</a></p> <h4>Key Enhancements</h4> <ul> <li>CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)</li> <li>CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)</li> <li>CONJ-1330 - add infer test to CI</li> </ul> <h4>Issues Resolved</h4> <ul> <li>CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server</li> <li>CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)</li> <li>CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute</li> <li>CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)</li> <li>CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)</li> <li>CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)</li> <li>CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating up front (thanks to jmestwa-coder)</li> <li>CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)</li> <li>CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)</li> <li>CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder)</li> <li>CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)</li> <li>CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing dot (report by Shaswata, thanks to Pepo48 for PR)</li> <li>CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds Integer.MAX_VALUE, and returns bulk generated keys out of batch order</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mariadb-corporation/mariadb-connector-j/commit/4d2f8002399949ed7f138e9c0b75b69229538120";><code>4d2f800</code></a> [CONJ-1387] LOAD DATA LOCAL INFILE file check must not match text inside iden...</li> <li><a href="https://github.com/mariadb-corporation/mariadb-connector-j/commit/12507c963c6a9dee12dea7165b46f6f5195dda6e";><code>12507c9</code></a> bump 3.3.7 version</li> <li><a href="https://github.com/mariadb-corporation/mariadb-connector-j/commit/beb445fcf9294113878fc05ac77f0efdf0596ac6";><code>beb445f</code></a> [CONJ-1382] Bound server-declared lengths by the packet before allocating</li> <li><a href="https://github.com/mariadb-corporation/mariadb-connector-j/commit/bab1ae07a9032635aaeb33f7e8e80958b01427d5";><code>bab1ae0</code></a> [CONJ-1383] Keep last_gtid tracked when the session already tracks it</li> <li><a href="https://github.com/mariadb-corporation/mariadb-connector-j/commit/49c92adfcf816853e324031ba9762a69444cfd12";><code>49c92ad</code></a> [CONJ-1381] Bound server-declared lengths by the packet before reading from them</li> <li><a href="https://github.com/mariadb-corporation/mariadb-connector-j/commit/86a90b0dc9746aa3bd4aa1df264be22a2d1b7d98";><code>86a90b0</code></a> [CONJ-1380] Rogue server can crash the client during caching_sha2_password au...</li> <li><a href="https://github.com/mariadb-corporation/mariadb-connector-j/commit/dbbadc3e215c47bdb913ddf50739ada09a7f23ea";><code>dbbadc3</code></a> [CONJ-1338] Validate 8-byte length-encoded integers fit a non-negative int in...</li> <li><a href="https://github.com/mariadb-corporation/mariadb-connector-j/commit/2212a4f6a09a15e06b2af4d5333a12316e39f9d2";><code>2212a4f</code></a> [misc] rely on protocol capability only</li> <li><a href="https://github.com/mariadb-corporation/mariadb-connector-j/commit/fdabe74a7df6dce1d6c099f4d0ca1e2acc25919a";><code>fdabe74</code></a> [CONJ-1379] Set an explicit session tracking list and guard character_set_res...</li> <li><a href="https://github.com/mariadb-corporation/mariadb-connector-j/commit/e9d767103bfd178ed57caa4cb97bbfbf7e54da6b";><code>e9d7671</code></a> [CONJ-1357] avoid XA recover() trusting server-supplied gtrid_length/bqual_le...</li> <li>Additional commits viewable in <a href="https://github.com/mariadb-corporation/mariadb-connector-j/compare/3.1.4...3.3.7";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/cloudstack/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
