[dependabot]

Bumps org.mariadb.jdbc:mariadb-java-client from 3.5.10 to 4.0.0.

Release notes

Sourced from org.mariadb.jdbc:mariadb-java-client's releases.

MariaDB Connector/Java 4.0.0

4.0.0 (Oct 2026)

Full Changelog

4.0.0 includes every fix of 3.5.11, listed below.

Major Changes

• CONJ-1361 - Java 17 is the minimum runtime, Java 8 and 11 are no longer supported (the 3.5 branch remains available for Java 8)
• CONJ-1321 - TLS enabled by default: sslMode now defaults to verify-full
• CONJ-1384 - AWS IAM authentication moves to the separate artifact mariadb-java-client-aws, the connector no longer depends on the AWS SDK; the plugin gains STS assume role support (CONJ-877, report by Adrian Samatan) and ships the RDS root certificates so that the default sslMode validates an RDS endpoint without configuration
• CONJ-1306 - PreparedStatement.executeQuery() rejects statements that return no result set, as the JDBC specification requires; the permitNoResults option restores the former behavior (report by Christopher Schultz)
• CONJ-651 - Stream LOB columns from the socket instead of loading them in memory (report by Ilya Zhavoronkov)

Key Enhancements

• CONJ-1386 - New sslMode=allow: verify-full when the server announces TLS, unencrypted otherwise, for a mix of servers with and without TLS behind one connection string
• CONJ-1347 - setSavepoint() throws in auto-commit mode instead of silently succeeding
• CONJ-1262 - cachedCodecs option now defaults to true
• CONJ-1370 - JNA dependency removed, Unix domain sockets use the JDK implementation
• CONJ-1371 - useReadAheadInput option and ReadAheadBufferedStream removed
• CONJ-1366 - First-class module-info.java (module org.mariadb.jdbc)
• CONJ-1367 - Virtual threads: no carrier pinning in driver locks, verified by a JFR-based test
• CONJ-1354 - GSSAPI authentication uses the native GSS-API where available
• CONJ-1308 - Support MariaDB 12.3 XML data type
• CONJ-1220 - Unix domain sockets on Windows, for SSH tunnels (report by DAIKOZ)
• CONJ-1378 - Try every IP address a hostname resolves to when opening the socket
• CONJ-1369 - Performance work on the Java 17 code base: packet reader and writer buffers, readNBytes, ranged Arrays.equals, no String.format on data paths
• CONJ-1365 - Performance: VarHandle little-endian access in packet buffers
• CONJ-1373 - Performance: JDK UTF-8 encoder for long strings in Writer.writeString / writeStringEscaped
• CONJ-1375 - Performance: cache codec resolution for getObject(index, Class) and setObject
• CONJ-1377 - Performance: faster client-side query parsing in ClientParser and NativeSql
• CONJ-1368 - Build and test tooling: tests run against the built jar, GraalVM metadata refreshed, CI matrix on Java 17, 21 and 25

Issues Resolved

• CONJ-1383 - Connection init rebuilds session_track_system_variables from @@​global, discarding the session-level last_gtid set by MaxScale (report by Sawan Patel)
• CONJ-1379 - Set an explicit session tracking list and guard character_set_results like character_set_client (report by fg0x0)
• CONJ-1381 - Bound server-declared lengths by the packet before allocating and reading from them (report by fg0x0)
• CONJ-1374 - Redirect URL password partially logged when containing '@'
• CONJ-1372 - caching_sha2_password full authentication fails over a Unix socket when SSL is disabled (report by 工藤航)

... (truncated)

Changelog

Sourced from org.mariadb.jdbc:mariadb-java-client's changelog.

4.0.0 (Oct 2026)

Full Changelog

4.0.0 includes every fix of 3.5.11, listed below.

Major Changes

• CONJ-1361 - Java 17 is the minimum runtime, Java 8 and 11 are no longer supported (the 3.5 branch remains available for Java 8)
• CONJ-1321 - TLS enabled by default: sslMode now defaults to verify-full
• CONJ-1384 - AWS IAM authentication moves to the separate artifact mariadb-java-client-aws, the connector no longer depends on the AWS SDK; the plugin gains STS assume role support (CONJ-877, report by Adrian Samatan) and ships the RDS root certificates so that the default sslMode validates an RDS endpoint without configuration
• CONJ-1306 - PreparedStatement.executeQuery() rejects statements that return no result set, as the JDBC specification requires; the permitNoResults option restores the former behavior (report by Christopher Schultz)
• CONJ-651 - Stream LOB columns from the socket instead of loading them in memory (report by Ilya Zhavoronkov)

Key Enhancements

• CONJ-1386 - New sslMode=allow: verify-full when the server announces TLS, unencrypted otherwise, for a mix of servers with and without TLS behind one connection string
• CONJ-1347 - setSavepoint() throws in auto-commit mode instead of silently succeeding
• CONJ-1262 - cachedCodecs option now defaults to true
• CONJ-1370 - JNA dependency removed, Unix domain sockets use the JDK implementation
• CONJ-1371 - useReadAheadInput option and ReadAheadBufferedStream removed
• CONJ-1366 - First-class module-info.java (module org.mariadb.jdbc)
• CONJ-1367 - Virtual threads: no carrier pinning in driver locks, verified by a JFR-based test
• CONJ-1354 - GSSAPI authentication uses the native GSS-API where available
• CONJ-1308 - Support MariaDB 12.3 XML data type
• CONJ-1220 - Unix domain sockets on Windows, for SSH tunnels (report by DAIKOZ)
• CONJ-1378 - Try every IP address a hostname resolves to when opening the socket
• CONJ-1369 - Performance work on the Java 17 code base: packet reader and writer buffers, readNBytes, ranged Arrays.equals, no String.format on data paths
• CONJ-1365 - Performance: VarHandle little-endian access in packet buffers
• CONJ-1373 - Performance: JDK UTF-8 encoder for long strings in Writer.writeString / writeStringEscaped
• CONJ-1375 - Performance: cache codec resolution for getObject(index, Class) and setObject
• CONJ-1377 - Performance: faster client-side query parsing in ClientParser and NativeSql
• CONJ-1368 - Build and test tooling: tests run against the built jar, GraalVM metadata refreshed, CI matrix on Java 17, 21 and 25

Issues Resolved

• CONJ-1383 - Connection init rebuilds session_track_system_variables from @@​global, discarding the session-level last_gtid set by MaxScale (report by Sawan Patel)
• CONJ-1379 - Set an explicit session tracking list and guard character_set_results like character_set_client (report by fg0x0)
• CONJ-1381 - Bound server-declared lengths by the packet before allocating and reading from them (report by fg0x0)
• CONJ-1374 - Redirect URL password partially logged when containing '@'
• CONJ-1372 - caching_sha2_password full authentication fails over a Unix socket when SSL is disabled (report by 工藤航)
• CONJ-1360 - Incorrect dependency check in AwsIamCredentialPlugin (report by Dheeraj Nalluri)

... (truncated)

Commits

• 52164c4 Merge branch 'develop'
• 84b586b [CONJ-1387] LOAD DATA LOCAL INFILE file check must not match text inside iden...
• c08af21 [CONJ-1384] Publish the AWS-IAM plugin to Maven Central like the connector
• 429f3c8 Merge branch 'develop'
• 87ac514 bump 4.0.0 version
• 85d4407 [misc] test stability improvement
• 39c575c [misc] correcting javadoc
• 9fe800b [misc] Infer analyses the sources as Java 17
• aaf71e4 [misc] test stability improvement
• 874537d [misc] java warning correction
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)