Bump org.mariadb.jdbc:mariadb-java-client from 2.7.1 to 2.7.14

[dependabot]

Bumps org.mariadb.jdbc:mariadb-java-client from 2.7.1 to 2.7.14.

Release notes

Sourced from org.mariadb.jdbc:mariadb-java-client's releases.

MariaDB Connector/Java 2.7.14

2.7.14 (Jun 2026)

Full Changelog

• CONJ-1315 cap BigDecimal/BigInteger string parsing length to prevent CPU exhaustion if Mitm (report by tonghuaroot)
• CONJ-1316 pin Locale.ROOT on locale-sensitive call sites (fixes locale-dependent parsing/formatting, e.g. under tr_TR) (thanks to jmestwa-coder)
• CONJ-1317 ensure non-UTF8 charset cannot be used for protocol exchanges (report by fg0x0)
• match local infile filename case-sensitively (thanks to jmestwa-coder)
• create gssapi jaas config temp file with owner-only permissions (thanks to jmestwa-coder)
• encode caching_sha2 clear password as UTF-8 (thanks to jmestwa-coder)
• call inflater.end() in finally in CompressInputStream (thanks to jmestwa-coder)

MariaDB Connector/Java 2.7.13

2.7.13 (Dec 2025)

Full Changelog

• CONJ-661 Fixed intermittent NullPointerException when calling prepareStatement
• CONJ-1167 Fixed possible ArrayIndexOutOfBoundsException when using CallableStatement
• CONJ-1185 Fixed Android compatibility issue: Pattern CANON_EQ flag not supported
• CONJ-1293 Fixed NullPointerException in MariaDbDataSource when setLoginTimeout(0) has been called
• CONJ-1174 Fixed ResultSetMetaData precision for signed BIGINT (was reported as 20)

MariaDB Connector/Java 2.7.12

2.7.12 (Feb 2024)

Full Changelog

• CONJ-1145 Wrong sequence number of sub header with compressing procotol active
• CONJ-1151 Wrong debug trace when using compression protocol
• CONJ-1152 Improve message when reaching socket timeout during connection initial commands
• CONJ-1153 session tracking only read first SYSTEM_VARIABLES session tracking change

MariaDB Connector/Java 2.7.11

2.7.11 (Nov 2023)

Full Changelog

• CONJ-1075 LOAD DATA INFILE is broken on windows
• CONJ-1108 Database metadata listing TEMPORARY tables/sequences
• CONJ-1118 Aurora Single Write Cluster Endpoint can't make Read DB Connection for readonly transaction

MariaDB Connector/Java 2.7.10

2.7.10 (Aug 2023)

Full Changelog

• CONJ-1091 Ensure setting connectTimeout as timeout for socket timeout until connection is done. This permit to set a connectTimeout, while socketTimeout can still be set to 0

MariaDB Connector/Java 2.7.9

2.7.9 (Mar 2023)

Full Changelog

• CONJ-1062 correcting TlsSocketPlugin to use Driver classloader

... (truncated)

Changelog

Sourced from org.mariadb.jdbc:mariadb-java-client's changelog.

2.7.15 (Jul 2026)

Full Changelog

Bugs Fixed

• CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
• CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
• CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
• CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
• CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)

3.5.9 (Jun 2026)

Full Changelog

Key Enhancements

• CONJ-1223 - cache TLS trust/key managers across connections to reduce SSL connection cost
• CONJ-1314 - add SPI for interactive dialog (PAM) authentication callback
• CONJ-1311 - add dedicated option useIpForKillQuery for query cancellation
• CONJ-1310 - Add full native image support and CI coverage

Issues Resolved

• CONJ-1320 - PAM (dialog) authentication must require a secure connection (report by fg0x0)
• CONJ-1319 - Use constant-time comparison when validating the server certificate fingerprint (report by jmestwa-coder)
• CONJ-1318 - enforce allowLocalInfile=false on the server's local-infile request, so a malicious server cannot read a client file despite the option being disabled
• CONJ-1322 - match local infile filename case-sensitively (thanks to jmestwa-coder)
• CONJ-1323 - LOAD LOCAL INFILE validation rejects statements preceded by line comments (thanks to sebdomdev)
• CONJ-1315 - cap BigDecimal/BigInteger string parsing length to prevent CPU exhaustion if MitM (report by tonghuaroot)
• CONJ-1317 - ensure non-UTF8 charset cannot be used for protocol exchanges (report by fg0x0)
• CONJ-1304 - CallableStatement parameter metadata read from mysql.proc, with MySQL info_schema fallback
• CONJ-1299 - keep VALUES literals after the last placeholder when rewriting batches
• CONJ-1313 - race condition in HaMode#getAvailableHostInOrder can cause NPE
• CONJ-1311 - Connection.cancelCurrentQuery fails with SslMode.VERIFY_FULL when client socket IP is set
• CONJ-1264 - handle LocalDateTime as a zoneless wall-clock value
• CONJ-1316 - pin Locale.ROOT on locale-sensitive call sites and date/time/Duration text formatting (fixes locale-dependent parsing/formatting, e.g. under tr_TR) (thanks to jmestwa-coder)
• CONJ-1324 - fix SQL parser to correctly handle '--' in expressions and reset lastChar after block comments
• CONJ-1323 - LOAD LOCAL INFILE validation rejects statements preceded by line comments (thanks to sebdomdev)
• CONJ-1318 - allowLocalInfile=false does not block LOAD DATA LOCAL INFILE against a malicious server (thanks to tharavel)

3.4.3 (Jun 2026)

Full Changelog

Bugs Fixed

... (truncated)

Commits

• defeee0 [misc] update maxscale-tag environment variable to MAXSCALE_VERSION
• a4489c6 fix: correct setup-java action to v5
• 5eb54a2 bump 2.7.14
• 1a98191 match local infile filename case-sensitively
• c95e74b [misc] maxscale CI test correction
• ebc728e [misc] test: detect MaxScale via isMaxscale(), drop dead skysql checks
• 639ef19 [misc] add MaxScale CI testing
• 35385d6 [misc] detect MaxScale version from session state tracking
• 7aca9f3 [misc] pin Locale.ROOT on locale-sensitive call sites
• c2a0e0d [misc] cap BigDecimal/BigInteger string parsing length to prevent CPU exhaustion
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.