Skip to content

Bump the backend-prod group across 2 directories with 7 updates - #873

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/backend-prod-b5977ecab4
Open

Bump the backend-prod group across 2 directories with 7 updates#873
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/backend-prod-b5977ecab4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 30, 2026

Copy link
Copy Markdown
Contributor

Bumps the backend-prod group with 7 updates in the / directory:

Package From To
software.amazon.awssdk:s3 2.46.20 2.49.6
com.fasterxml.jackson.datatype:jackson-datatype-jdk8 2.22.0 2.22.1
org.mariadb.jdbc:mariadb-java-client 3.5.9 3.5.10
commons-codec:commons-codec 1.22.0 1.22.1
com.fasterxml.jackson.datatype:jackson-datatype-hibernate6 2.22.0 2.22.1
org.bouncycastle:bcprov-jdk18on 1.84 1.85
org.bouncycastle:bcpkix-jdk18on 1.84 1.85

Bumps the backend-prod group with 7 updates in the /server directory:

Package From To
software.amazon.awssdk:s3 2.46.20 2.49.6
com.fasterxml.jackson.datatype:jackson-datatype-jdk8 2.22.0 2.22.1
org.mariadb.jdbc:mariadb-java-client 3.5.9 3.5.10
commons-codec:commons-codec 1.22.0 1.22.1
com.fasterxml.jackson.datatype:jackson-datatype-hibernate6 2.22.0 2.22.1
org.bouncycastle:bcprov-jdk18on 1.84 1.85
org.bouncycastle:bcpkix-jdk18on 1.84 1.85

Updates software.amazon.awssdk:s3 from 2.46.20 to 2.49.6

Updates com.fasterxml.jackson.datatype:jackson-datatype-jdk8 from 2.22.0 to 2.22.1

Updates org.mariadb.jdbc:mariadb-java-client from 3.5.9 to 3.5.10

Release notes

Sourced from org.mariadb.jdbc:mariadb-java-client's releases.

MariaDB Connector/Java 3.5.10

3.5.10 (Jul 2026)

Full Changelog

Key Enhancements

  • CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
  • CONJ-1330 - add infer test to CI

Issues Resolved

  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
  • CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
  • CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)
  • CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating up front (thanks to jmestwa-coder)
  • CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)
  • CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)
  • CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder)
  • CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
  • CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing dot (report by Shaswata, thanks to Pepo48 for PR)
  • CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds Integer.MAX_VALUE, and returns bulk generated keys out of batch order
Changelog

Sourced from org.mariadb.jdbc:mariadb-java-client's changelog.

3.5.10 (Jul 2026)

Full Changelog

Key Enhancements

  • CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
  • CONJ-1330 - add infer test to CI

Issues Resolved

  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
  • CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
  • CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)
  • CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating up front (thanks to jmestwa-coder)
  • CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)
  • CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)
  • CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder)
  • CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
  • CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing dot (report by Shaswata, thanks to Pepo48 for PR)
  • CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds Integer.MAX_VALUE, and returns bulk generated keys out of batch order

3.4.4 (Jul 2026)

Full Changelog

Notable Changes
  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
Bugs Fixed
  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)

... (truncated)

Commits
  • 6164678 [misc] update changelog
  • 6f58858 [CONJ-1335] getGeneratedKeys() throws SQLDataException "integer overflow" aft...
  • 9f06db7 [misc] CI stability improvement
  • 99aa9e2 [CONJ-1336] correction follow up
  • 28a1550 [CONJ-1336] strip trailing dot from hostname before SNI and hostname verifica...
  • b2b3f1b [misc] limit authentication switch requests to 10 per connection
  • 26ca60a [misc] bound the whole connection phase by connectTimeout
  • 15e08ff [CONJ-1337] Limit parsec authentication PBKDF2 iteration factor to the connec...
  • d3c4a72 bump 3.5.10 version
  • d85e05f [CONJ-1342] socketFactory option allows loading arbitrary bytecode via jar: U...
  • Additional commits viewable in compare view

Updates commons-codec:commons-codec from 1.22.0 to 1.22.1

Changelog

Sourced from commons-codec:commons-codec's changelog.

Apache Commons Codec 1.22.1 Release Notes

The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.22.1.

The Apache Commons Codec component contains encoders and decoders for formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

This is a feature and maintenance release. Java 8 or later is required.

Fixed Bugs

  • CODEC-344: Base64.Builder.setEncodeTable(byte...) accepts invalid custom alphabets. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-340: Base58.Builder.setEncodeTable(byte...) is ignored when encoding and decoding. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-342: Base32.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-343: Base32.Builder.setHexDecodeTable(boolean) sets the encode table to a decode lookup table. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-341: Base16.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-339: URLCodec.encodeUrl(BitSet, byte[]) allows custom safe sets to emit URL encoding control characters. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-338: PercentCodec loses literal '+' when plusForSpace is enabled. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-337: Digest ALL reuses System.in, so only the first algorithm sees the real input (#431). Thanks to Ruiqi Dong, Gary Gregory.
  •         Fix Base64.toIntegerBytes(BigInteger) for zero edge case ([#441](https://github.com/apache/commons-codec/issues/441)). Thanks to Gary Gregory.

  •         Add messages when throwing NullPointerException. Thanks to Gary Gregory.

  •         Add messages when throwing NullPointerException. Thanks to Gary Gregory.

  •         StringEncoderComparator.StringEncoderComparator(StringEncoder) now fails fast on null input. Thanks to Gary Gregory.

Changes

  •         Bump org.apache.commons:commons-parent from 98 to 103. Thanks to Gary Gregory.

  •         Bump commons-io:commons-io from 2.21.0 to 2.22.0. Thanks to Gary Gregory.

For complete information on Apache Commons Codec, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Commons Codec website:

https://commons.apache.org/proper/commons-codec/

Download page: https://commons.apache.org/proper/commons-codec/download_codec.cgi

Commits
  • dc8f6c8 Prepare for the release candidate 1.22.1 RC1
  • 8203c1c Prepare for the next release candidate
  • 5647fe2 StringEncoderComparator.StringEncoderComparator(StringEncoder) now fails
  • 00c27a9 Reduce vertical whitespace
  • 568f2d7 Remove unused method
  • 316fb15 Remove unused method
  • bf6b543 Bump actions/checkout from 7.0.0 to 7.0.1
  • e14cdfe Extract redundant code.
  • 3351e63 Add messages when throwing NullPointerException.
  • f22dab7 Update SCM tag
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson.datatype:jackson-datatype-hibernate6 from 2.22.0 to 2.22.1

Commits
  • 0aaa618 [maven-release-plugin] prepare release jackson-datatype-hibernate-parent-2.22.1
  • 225f09a Prep for 2.22.1 release
  • febc318 Merge branch '2.21' into 2.22
  • bac4477 Post-release dep version bump
  • 1487f1b [maven-release-plugin] prepare for next development iteration
  • 73013e9 [maven-release-plugin] prepare release jackson-datatype-hibernate-parent-2.21.5
  • 98c2b92 Merge branch '2.21' into 2.22
  • f7b148e Post-release dep version bump
  • cc337b2 Prep for 2.21.5 release
  • 1eab1f6 Post-release dep version bump
  • Additional commits viewable in compare view

Updates org.bouncycastle:bcprov-jdk18on from 1.84 to 1.85

Changelog

Sourced from org.bouncycastle:bcprov-jdk18on's changelog.

... (truncated)

Commits

Updates org.bouncycastle:bcpkix-jdk18on from 1.84 to 1.85

Changelog

Sourced from org.bouncycastle:bcpkix-jdk18on's changelog.

... (truncated)

Commits

Updates software.amazon.awssdk:s3 from 2.46.20 to 2.49.6

Updates com.fasterxml.jackson.datatype:jackson-datatype-jdk8 from 2.22.0 to 2.22.1

Updates org.mariadb.jdbc:mariadb-java-client from 3.5.9 to 3.5.10

Release notes

Sourced from org.mariadb.jdbc:mariadb-java-client's releases.

MariaDB Connector/Java 3.5.10

3.5.10 (Jul 2026)

Full Changelog

Key Enhancements

  • CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
  • CONJ-1330 - add infer test to CI

Issues Resolved

  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
  • CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
  • CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)
  • CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating up front (thanks to jmestwa-coder)
  • CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)
  • CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)
  • CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder)
  • CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
  • CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing dot (report by Shaswata, thanks to Pepo48 for PR)
  • CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds Integer.MAX_VALUE, and returns bulk generated keys out of batch order
Changelog

Sourced from org.mariadb.jdbc:mariadb-java-client's changelog.

3.5.10 (Jul 2026)

Full Changelog

Key Enhancements

  • CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
  • CONJ-1330 - add infer test to CI

Issues Resolved

  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
  • CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
  • CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)
  • CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating up front (thanks to jmestwa-coder)
  • CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)
  • CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)
  • CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder)
  • CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
  • CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing dot (report by Shaswata, thanks to Pepo48 for PR)
  • CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds Integer.MAX_VALUE, and returns bulk generated keys out of batch order

3.4.4 (Jul 2026)

Full Changelog

Notable Changes
  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
Bugs Fixed
  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)

... (truncated)

Commits
  • 6164678 [misc] update changelog
  • 6f58858 [CONJ-1335] getGeneratedKeys() throws SQLDataException "integer overflow" aft...
  • 9f06db7 [misc] CI stability improvement
  • 99aa9e2 [CONJ-1336] correction follow up
  • 28a1550 [CONJ-1336] strip trailing dot from hostname before SNI and hostname verifica...
  • b2b3f1b [misc] limit authentication switch requests to 10 per connection
  • 26ca60a [misc] bound the whole connection phase by connectTimeout
  • 15e08ff [CONJ-1337] Limit parsec authentication PBKDF2 iteration factor to the connec...
  • d3c4a72 bump 3.5.10 version
  • d85e05f [CONJ-1342] socketFactory option allows loading arbitrary bytecode via jar: U...
  • Additional commits viewable in compare view

Updates commons-codec:commons-codec from 1.22.0 to 1.22.1

Changelog

Sourced from commons-codec:commons-codec's changelog.

Apache Commons Codec 1.22.1 Release Notes

The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.22.1.

The Apache Commons Codec component contains encoders and decoders for formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

This is a feature and maintenance release. Java 8 or later is required.

Fixed Bugs

  • CODEC-344: Base64.Builder.setEncodeTable(byte...) accepts invalid custom alphabets. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-340: Base58.Builder.setEncodeTable(byte...) is ignored when encoding and decoding. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-342: Base32.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-343: Base32.Builder.setHexDecodeTable(boolean) sets the encode table to a decode lookup table. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-341: Base16.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-339: URLCodec.encodeUrl(BitSet, byte[]) allows custom safe sets to emit URL encoding control characters. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-338: PercentCodec loses literal '+' when plusForSpace is enabled. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-337: Digest ALL reuses System.in, so only the first algorithm sees the real input (#431). Thanks to Ruiqi Dong, Gary Gregory.
  •         Fix Base64.toIntegerBytes(BigInteger) for zero edge case ([#441](https://github.com/apache/commons-codec/issues/441)). Thanks to Gary Gregory.

  •         Add messages when throwing NullPointerException. Thanks to Gary Gregory.

  •         Add messages when throwing NullPointerException. Thanks to Gary Gregory.

  •         StringEncoderComparator.StringEncoderComparator(StringEncoder) now fails fast on null input. Thanks to Gary Gregory.

Changes

  •         Bump org.apache.commons:commons-parent from 98 to 103. Thanks to Gary Gregory.

  •         Bump commons-io:commons-io from 2.21.0 to 2.22.0. Thanks to Gary Gregory.

For complete information on Apache Commons Codec, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Commons Codec website:

https://commons.apache.org/proper/commons-codec/

Download page: https://commons.apache.org/proper/commons-codec/download_codec.cgi

Commits
  • dc8f6c8 Prepare for the release candidate 1.22.1 RC1
  • 8203c1c Prepare for the next release candidate
  • 5647fe2 StringEncoderComparator.StringEncoderComparator(StringEncoder) now fails
  • 00c27a9 Reduce vertical whitespace
  • 568f2d7 Remove unused method
  • 316fb15 Remove unused method
  • bf6b543 Bump actions/checkout from 7.0.0 to 7.0.1
  • e14cdfe Extract redundant code.
  • 3351e63 Add messages when throwing NullPointerException.
  • f22dab7 Update SCM tag
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson.datatype:jackson-datatype-hibernate6 from 2.22.0 to 2.22.1

Commits
  • 0aaa618 [maven-release-plugin] prepare release jackson-datatype-hibernate-parent-2.22.1
  • 225f09a Prep for 2.22.1 release
  • febc318 Merge branch '2.21' into 2.22
  • bac4477 Post-release dep version bump
  • 1487f1b [maven-release-plugin] prepare for next development iteration
  • 73013e9 [maven-release-plugin] prepare release jackson-datatype-hibernate-parent-2.21.5
  • 98c2b92 Merge branch '2.21' into 2.22
  • f7b148e Post-release dep version bump
  • cc337b2 Prep for 2.21.5 release
  • 1eab1f6 Post-release dep version bump
  • Additional commits viewable in compare view

Updates org.bouncycastle:bcprov-jdk18on from 1.84 to 1.85

Changelog

Sourced from org.bouncycastle:bcprov-jdk18on's changelog.

... (truncated)

Commits

Updates org.bouncycastle:bcpkix-jdk18on from 1.84 to 1.85

Changelog

Sourced from org.bouncycastle:bcpkix-jdk18on's changelog.

... (truncated)

Commits

Updates software.amazon.awssdk:s3 from 2.46.20 to 2.49.6

Updates com.fasterxml.jackson.datatype:jackson-datatype-jdk8 from 2.22.0 to 2.22.1

Updates org.mariadb.jdbc:mariadb-java-client from 3.5.9 to 3.5.10

Release notes

Sourced from org.mariadb.jdbc:mariadb-java-client's releases.

MariaDB Connector/Java 3.5.10

3.5.10 (Jul 2026)

Full Changelog

Key Enhancements

  • CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
  • CONJ-1330 - add infer test to CI

Issues Resolved

  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
  • CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
  • CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)
  • CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating up front (thanks to jmestwa-coder)
  • CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)
  • CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)
  • CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder)
  • CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
  • CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing dot (report by Shaswata, thanks to Pepo48 for PR)
  • CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds Integer.MAX_VALUE, and returns bulk generated keys out of batch order
Changelog

Sourced from org.mariadb.jdbc:mariadb-java-client's changelog.

3.5.10 (Jul 2026)

Full Changelog

Key Enhancements

  • CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
  • CONJ-1330 - add infer test to CI

Issues Resolved

  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
  • CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
  • CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)
  • CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating up front (thanks to jmestwa-coder)
  • CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)
  • CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)
  • CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder)
  • CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
  • CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing dot (report by Shaswata, thanks to Pepo48 for PR)
  • CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds Integer.MAX_VALUE, and returns bulk generated keys out of batch order

3.4.4 (Jul 2026)

Full Changelog

Notable Changes
  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
Bugs Fixed
  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)

... (truncated)

Commits
  • 6164678 [misc] update changelog
  • 6f58858 [CONJ-1335] getGeneratedKeys() throws SQLDataException "integer overflow" aft...
  • 9f06db7 [misc] CI stability improvement
  • 99aa9e2 [CONJ-1336] correction follow up
  • 28a1550 [CONJ-1336] strip trailing dot from hostname before SNI and hostname verifica...
  • b2b3f1b [misc] limit authentication switch requests to 10 per connection
  • 26ca60a [misc] bound the whole connection phase by connectTimeout
  • 15e08ff [CONJ-1337] Limit parsec authentication PBKDF2 iteration factor to the connec...
  • d3c4a72 bump 3.5.10 version
  • d85e05f [CONJ-1342] socketFactory option allows loading arbitrary bytecode via jar: U...
  • Additional commits viewable in compare view

Updates commons-codec:commons-codec from 1.22.0 to 1.22.1

Changelog

Sourced from commons-codec:commons-codec's changelog.

Apache Commons Codec 1.22.1 Release Notes

The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.22.1.

The Apache Commons Codec component contains encoders and decoders for formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

This is a feature and maintenance release. Java 8 or later is required.

Fixed Bugs

  • CODEC-344: Base64.Builder.setEncodeTable(byte...) accepts invalid custom alphabets. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-340: Base58.Builder.setEncodeTable(byte...) is ignored when encoding and decoding. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-342: Base32.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-343: Base32.Builder.setHexDecodeTable(boolean) sets the encode table to a decode lookup table. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-341: Base16.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-339: URLCodec.encodeUrl(BitSet, byte[]) allows custom safe sets to emit URL encoding control characters. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-338: PercentCodec loses literal '+' when plusForSpace is enabled. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-337: Digest ALL reuses System.in, so only the first algorithm sees the real input (#431). Thanks to Ruiqi Dong, Gary Gregory.
  •         Fix Base64.toIntegerBytes(BigInteger) for zero edge case ([#441](https://github.com/apache/commons-codec/issues/441)). Thanks to Gary Gregory.

  •         Add messages when throwing NullPointerException. Thanks to Gary Gregory.

  •         Add messages when throwing NullPointerException. Thanks to Gary Gregory.

  •         StringEncoderComparator.StringEncoderComparator(StringEncoder) now fails fast on null input. Thanks to Gary Gregory.

Changes

  •         Bump org.apache.commons:commons-parent from 98 to 103. Thanks to Gary Gregory.

  •         Bump commons-io:commons-io from 2.21.0 to 2.22.0. Thanks to Gary Gregory.

For complete information on Apache Commons Codec, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Commons Codec website:

https://commons.apache.org/proper/commons-codec/

Download page: https://commons.apache.org/proper/commons-codec/download_codec.cgi

Commits
  • dc8f6c8 Prepare for the release candidate 1.22.1 RC1
  • 8203c1c Prepare for the next release candidate
  • 5647fe2 StringEncoderComparator.StringEncoderComparator(StringEncoder) now fails
  • 00c27a9 Reduce vertical whitespace
  • 568f2d7 Remove unused method
  • 316fb15 Remove unused method
  • bf6b543 Bump actions/checkout from 7.0.0 to 7.0.1
  • e14cdfe Extract redundant code.
  • 3351e63 Add messages when throwing NullPointerException.
  • f22dab7 Update SCM tag
  • Additional commits viewable in compare view

Updates com.fasterxml.jackson.datatype:jackson-datatype-hibernate6 from 2.22.0 to 2.22.1

Commits
  • 0aaa618 [maven-release-plugin] prepare release jackson-datatype-hibernate-parent-2.22.1
  • 225f09a Prep for 2.22.1 release
  • febc318 Merge branch '2.21' into 2.22
  • bac4477 Post-release dep version bump
  • 1487f1b [maven-release-plugin] prepare for next development iteration
  • 73013e9 [maven-release-plugin] prepare release jackson-datatype-hibernate-parent-2.21.5
  • 98c2b92 Merge branch '2.21' into 2.22
  • f7b148e Post-release dep version bump
  • cc337b2 Prep for 2.21.5 release
  • 1eab1f6 Post-release dep version bump
  • Additional commits viewable in compare view

Updates org.bouncycastle:bcprov-jdk18on from 1.84 to 1.85

Changelog

Sourced from org.bouncycastle:bcprov-jdk18on's changelog.

... (truncated)

Commits

Updates org.bouncycastle:bcpkix-jdk18on from 1.84 to 1.85

Changelog

Sourced from org.bouncycastle:bcpkix-jdk18on's changelog.

... (truncated)

Commits

Updates software.amazon.awssdk:s3 from 2.46.20 to 2.49.6

Updates com.fasterxml.jackson.datatype:jackson-datatype-jdk8 from 2.22.0 to 2.22.1

Updates org.mariadb.jdbc:mariadb-java-client from 3.5.9 to 3.5.10

Release notes

Sourced from org.mariadb.jdbc:mariadb-java-client's releases.

MariaDB Connector/Java 3.5.10

3.5.10 (Jul 2026)

Full Changelog

Key Enhancements

  • CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
  • CONJ-1330 - add infer test to CI

Issues Resolved

  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
  • CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
  • CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)
  • CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating up front (thanks to jmestwa-coder)
  • CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)
  • CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)
  • CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder)
  • CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
  • CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing dot (report by Shaswata, thanks to Pepo48 for PR)
  • CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds Integer.MAX_VALUE, and returns bulk generated keys out of batch order
Changelog

Sourced from org.mariadb.jdbc:mariadb-java-client's changelog.

3.5.10 (Jul 2026)

Full Changelog

Key Enhancements

  • CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
  • CONJ-1330 - add infer test to CI

Issues Resolved

  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
  • CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
  • CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)
  • CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating up front (thanks to jmestwa-coder)
  • CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)
  • CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)
  • CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder)
  • CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
  • CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing dot (report by Shaswata, thanks to Pepo48 for PR)
  • CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds Integer.MAX_VALUE, and returns bulk generated keys out of batch order

3.4.4 (Jul 2026)

Full Changelog

Notable Changes
  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
Bugs Fixed
  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)

... (truncated)

Commits
  • 6164678 [misc] update changelog
  • 6f58858 [CONJ-1335] getGeneratedKeys() throws SQLDataException "integer overflow" aft...
  • 9f06db7 [misc] CI stability improvement
  • 99aa9e2 [CONJ-1336] correction follow up
  • 28a1550 [CONJ-1336] strip trailing dot from hostname before SNI and hostname verifica...
  • b2b3f1b [misc] limit authentication switch requests to 10 per connection
  • 26ca60a [misc] bound the whole connection phase by connectTimeout
  • 15e08ff [CONJ-1337] Limit parsec authentication PBKDF2 iteration factor to the connec...
  • d3c4a72 bump 3.5.10 version
  • d85e05f [CONJ-1342] socketFactory option allows loading arbitrary bytecode via jar: U...
  • Additional commits viewable in compare view

Updates commons-codec:commons-codec from 1.22.0 to 1.22.1

Changelog

Sourced from commons-codec:commons-codec's changelog.

Apache Commons Codec 1.22.1 Release Notes

The Apache Commons Codec team is pleased to announce the release of Apache Commons Codec 1.22.1.

The Apache Commons Codec component contains encoders and decoders for formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

This is a feature and maintenance release. Java 8 or later is required.

Fixed Bugs

  • CODEC-344: Base64.Builder.setEncodeTable(byte...) accepts invalid custom alphabets. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-340: Base58.Builder.setEncodeTable(byte...) is ignored when encoding and decoding. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-342: Base32.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-343: Base32.Builder.setHexDecodeTable(boolean) sets the encode table to a decode lookup table. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-341: Base16.Builder.setEncodeTable(byte...) can create a codec that cannot decode its own output. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-339: URLCodec.encodeUrl(BitSet, byte[]) allows custom safe sets to emit URL encoding control characters. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-338: PercentCodec loses literal '+' when plusForSpace is enabled. Thanks to Ruiqi Dong, Gary Gregory.
  • CODEC-337: Digest ALL reuses System.in, so only the first algorithm sees the real input (#431). Thanks to Ruiqi Dong, Gary Gregory.
  •         Fix Base64.toIntegerBytes(BigInteger) for zero edge case ([#441](https://github.com/apache/commons-codec/issues/441)). Thanks to Gary Gregory.

  •         Add messages when throwing NullPointerException. Thanks to Gary Gregory.

  •         Add messages when throwing NullPointerException. Thanks to Gary Gregory.

  •         StringEncoderComparator.StringEncoderComparator(StringEncoder) now fails fast on null input. Thanks to Gary Gregory.

Changes

  •         Bump org.apache.commons:commons-parent from 98 to 103. Thanks to Gary Gregory.

  •         Bump commons-io:commons-io from 2.21.0 to 2.22.0. Thanks to Gary Gregory.

For complete information on Apache Commons Codec, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Commons Codec website:

https://commons.apache.org/proper/commons-codec/

Download page: Description has been truncated

@dependabot
Bump the backend-prod group across 2 directories with 7 updates
e8fc028 
Bumps the backend-prod group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| software.amazon.awssdk:s3 | `2.46.20` | `2.49.6` |
| com.fasterxml.jackson.datatype:jackson-datatype-jdk8 | `2.22.0` | `2.22.1` |
| [org.mariadb.jdbc:mariadb-java-client](https://github.com/mariadb-corporation/mariadb-connector-j) | `3.5.9` | `3.5.10` |
| [commons-codec:commons-codec](https://github.com/apache/commons-codec) | `1.22.0` | `1.22.1` |
| [com.fasterxml.jackson.datatype:jackson-datatype-hibernate6](https://github.com/FasterXML/jackson-datatype-hibernate) | `2.22.0` | `2.22.1` |
| [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java) | `1.84` | `1.85` |
| [org.bouncycastle:bcpkix-jdk18on](https://github.com/bcgit/bc-java) | `1.84` | `1.85` |

Bumps the backend-prod group with 7 updates in the /server directory:

| Package | From | To |
| --- | --- | --- |
| software.amazon.awssdk:s3 | `2.46.20` | `2.49.6` |
| com.fasterxml.jackson.datatype:jackson-datatype-jdk8 | `2.22.0` | `2.22.1` |
| [org.mariadb.jdbc:mariadb-java-client](https://github.com/mariadb-corporation/mariadb-connector-j) | `3.5.9` | `3.5.10` |
| [commons-codec:commons-codec](https://github.com/apache/commons-codec) | `1.22.0` | `1.22.1` |
| [com.fasterxml.jackson.datatype:jackson-datatype-hibernate6](https://github.com/FasterXML/jackson-datatype-hibernate) | `2.22.0` | `2.22.1` |
| [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java) | `1.84` | `1.85` |
| [org.bouncycastle:bcpkix-jdk18on](https://github.com/bcgit/bc-java) | `1.84` | `1.85` |



Updates `software.amazon.awssdk:s3` from 2.46.20 to 2.49.6

Updates `com.fasterxml.jackson.datatype:jackson-datatype-jdk8` from 2.22.0 to 2.22.1

Updates `org.mariadb.jdbc:mariadb-java-client` from 3.5.9 to 3.5.10
- [Release notes](https://github.com/mariadb-corporation/mariadb-connector-j/releases)
- [Changelog](https://github.com/mariadb-corporation/mariadb-connector-j/blob/main/CHANGELOG.md)
- [Commits](mariadb-corporation/mariadb-connector-j@3.5.9...3.5.10)

Updates `commons-codec:commons-codec` from 1.22.0 to 1.22.1
- [Changelog](https://github.com/apache/commons-codec/blob/master/RELEASE-NOTES.txt)
- [Commits](apache/commons-codec@rel/commons-codec-1.22.0...rel/commons-codec-1.22.1)

Updates `com.fasterxml.jackson.datatype:jackson-datatype-hibernate6` from 2.22.0 to 2.22.1
- [Commits](FasterXML/jackson-datatype-hibernate@jackson-datatype-hibernate-parent-2.22.0...jackson-datatype-hibernate-parent-2.22.1)

Updates `org.bouncycastle:bcprov-jdk18on` from 1.84 to 1.85
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcpkix-jdk18on` from 1.84 to 1.85
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `software.amazon.awssdk:s3` from 2.46.20 to 2.49.6

Updates `com.fasterxml.jackson.datatype:jackson-datatype-jdk8` from 2.22.0 to 2.22.1

Updates `org.mariadb.jdbc:mariadb-java-client` from 3.5.9 to 3.5.10
- [Release notes](https://github.com/mariadb-corporation/mariadb-connector-j/releases)
- [Changelog](https://github.com/mariadb-corporation/mariadb-connector-j/blob/main/CHANGELOG.md)
- [Commits](mariadb-corporation/mariadb-connector-j@3.5.9...3.5.10)

Updates `commons-codec:commons-codec` from 1.22.0 to 1.22.1
- [Changelog](https://github.com/apache/commons-codec/blob/master/RELEASE-NOTES.txt)
- [Commits](apache/commons-codec@rel/commons-codec-1.22.0...rel/commons-codec-1.22.1)

Updates `com.fasterxml.jackson.datatype:jackson-datatype-hibernate6` from 2.22.0 to 2.22.1
- [Commits](FasterXML/jackson-datatype-hibernate@jackson-datatype-hibernate-parent-2.22.0...jackson-datatype-hibernate-parent-2.22.1)

Updates `org.bouncycastle:bcprov-jdk18on` from 1.84 to 1.85
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcpkix-jdk18on` from 1.84 to 1.85
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `software.amazon.awssdk:s3` from 2.46.20 to 2.49.6

Updates `com.fasterxml.jackson.datatype:jackson-datatype-jdk8` from 2.22.0 to 2.22.1

Updates `org.mariadb.jdbc:mariadb-java-client` from 3.5.9 to 3.5.10
- [Release notes](https://github.com/mariadb-corporation/mariadb-connector-j/releases)
- [Changelog](https://github.com/mariadb-corporation/mariadb-connector-j/blob/main/CHANGELOG.md)
- [Commits](mariadb-corporation/mariadb-connector-j@3.5.9...3.5.10)

Updates `commons-codec:commons-codec` from 1.22.0 to 1.22.1
- [Changelog](https://github.com/apache/commons-codec/blob/master/RELEASE-NOTES.txt)
- [Commits](apache/commons-codec@rel/commons-codec-1.22.0...rel/commons-codec-1.22.1)

Updates `com.fasterxml.jackson.datatype:jackson-datatype-hibernate6` from 2.22.0 to 2.22.1
- [Commits](FasterXML/jackson-datatype-hibernate@jackson-datatype-hibernate-parent-2.22.0...jackson-datatype-hibernate-parent-2.22.1)

Updates `org.bouncycastle:bcprov-jdk18on` from 1.84 to 1.85
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcpkix-jdk18on` from 1.84 to 1.85
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `software.amazon.awssdk:s3` from 2.46.20 to 2.49.6

Updates `com.fasterxml.jackson.datatype:jackson-datatype-jdk8` from 2.22.0 to 2.22.1

Updates `org.mariadb.jdbc:mariadb-java-client` from 3.5.9 to 3.5.10
- [Release notes](https://github.com/mariadb-corporation/mariadb-connector-j/releases)
- [Changelog](https://github.com/mariadb-corporation/mariadb-connector-j/blob/main/CHANGELOG.md)
- [Commits](mariadb-corporation/mariadb-connector-j@3.5.9...3.5.10)

Updates `commons-codec:commons-codec` from 1.22.0 to 1.22.1
- [Changelog](https://github.com/apache/commons-codec/blob/master/RELEASE-NOTES.txt)
- [Commits](apache/commons-codec@rel/commons-codec-1.22.0...rel/commons-codec-1.22.1)

Updates `com.fasterxml.jackson.datatype:jackson-datatype-hibernate6` from 2.22.0 to 2.22.1
- [Commits](FasterXML/jackson-datatype-hibernate@jackson-datatype-hibernate-parent-2.22.0...jackson-datatype-hibernate-parent-2.22.1)

Updates `org.bouncycastle:bcprov-jdk18on` from 1.84 to 1.85
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

Updates `org.bouncycastle:bcpkix-jdk18on` from 1.84 to 1.85
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

---
updated-dependencies:
- dependency-name: software.amazon.awssdk:s3
  dependency-version: 2.49.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-prod
- dependency-name: com.fasterxml.jackson.datatype:jackson-datatype-jdk8
  dependency-version: 2.22.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.mariadb.jdbc:mariadb-java-client
  dependency-version: 3.5.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: commons-codec:commons-codec
  dependency-version: 1.22.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: com.fasterxml.jackson.datatype:jackson-datatype-hibernate6
  dependency-version: 2.22.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.bouncycastle:bcprov-jdk18on
  dependency-version: '1.85'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-prod
- dependency-name: org.bouncycastle:bcpkix-jdk18on
  dependency-version: '1.85'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-prod
- dependency-name: software.amazon.awssdk:s3
  dependency-version: 2.49.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-prod
- dependency-name: com.fasterxml.jackson.datatype:jackson-datatype-jdk8
  dependency-version: 2.22.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.mariadb.jdbc:mariadb-java-client
  dependency-version: 3.5.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: commons-codec:commons-codec
  dependency-version: 1.22.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: com.fasterxml.jackson.datatype:jackson-datatype-hibernate6
  dependency-version: 2.22.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.bouncycastle:bcprov-jdk18on
  dependency-version: '1.85'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-prod
- dependency-name: org.bouncycastle:bcpkix-jdk18on
  dependency-version: '1.85'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-prod
- dependency-name: software.amazon.awssdk:s3
  dependency-version: 2.49.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-prod
- dependency-name: com.fasterxml.jackson.datatype:jackson-datatype-jdk8
  dependency-version: 2.22.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.mariadb.jdbc:mariadb-java-client
  dependency-version: 3.5.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: commons-codec:commons-codec
  dependency-version: 1.22.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: com.fasterxml.jackson.datatype:jackson-datatype-hibernate6
  dependency-version: 2.22.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.bouncycastle:bcprov-jdk18on
  dependency-version: '1.85'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-prod
- dependency-name: org.bouncycastle:bcpkix-jdk18on
  dependency-version: '1.85'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-prod
- dependency-name: software.amazon.awssdk:s3
  dependency-version: 2.49.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-prod
- dependency-name: com.fasterxml.jackson.datatype:jackson-datatype-jdk8
  dependency-version: 2.22.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.mariadb.jdbc:mariadb-java-client
  dependency-version: 3.5.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: commons-codec:commons-codec
  dependency-version: 1.22.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: com.fasterxml.jackson.datatype:jackson-datatype-hibernate6
  dependency-version: 2.22.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-prod
- dependency-name: org.bouncycastle:bcprov-jdk18on
  dependency-version: '1.85'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-prod
- dependency-name: org.bouncycastle:bcpkix-jdk18on
  dependency-version: '1.85'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-prod
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Jul 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants