chore(deps): Update database drivers

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.postgresql:postgresql (source)	42.7.10 → 42.7.11
org.mariadb.jdbc:mariadb-java-client (source)	3.5.8 → 3.5.9
org.xerial:sqlite-jdbc	3.53.0.0 → 3.53.2.0

---

Release Notes

pgjdbc/pgjdbc (org.postgresql:postgresql)

v42.7.11

Security

• fix: Limit SCRAM PBKDF2 iterations accepted from the server.
  pgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256 authentication, where a malicious or compromised PostgreSQL server could specify an extremely large PBKDF2 iteration count, causing the client to consume unbounded CPU and potentially exhaust connection pools. The fix introduces a new scramMaxIterations connection property (defaulting to 100,000) to cap iteration counts before computation begins.
  See the Security Advisory for more detail.
  The following CVE-2026-42198 has been issued.

Added

• feat: implement require_auth connection property, aligning with libpq behavior PR #​3895

Changed

• chore: replace Appveyor CI with ikalnytskyi/action-setup-postgres PR #​3966
• chore: upgrade Gradle to v9 PR #​3978

Fixed

• fix: ensure extended protocol messages end with Sync message PR #​3728
• fix: enable cursor-based fetching in extended protocol when transaction started via SQL command PR #​3996
• fix: retry with SSL on IOException when sslMode=ALLOW PR #​3973
• fix: make sure the driver honours connectTimeout when retrying the connection PR #​3968
• fix: allow fallback to non-SSL connection when sslMode=prefer and sslResponseTimeout kicks in PR #​3968
• fix: catch SecurityException from setContextClassLoader on ForkJoinPool workers PR #​3962
• fix: use compareTo for LogSequenceNumber comparison to handle unsigned values correctly PR #​3961
• fix: release COPY lock on IOException to prevent connection hang PR #​3957
• fix: return jsonb as PGObject instead of String PR #​3956
• fix: align SSL key file permission check with libpq PR #​3952
• fix: guard connection closed flag with a reentrant lock to protect against concurrent close PR #​3905

mariadb-corporation/mariadb-connector-j (org.mariadb.jdbc:mariadb-java-client)

v3.5.9

Full Changelog

Key Enhancements

• CONJ-1223 - cache TLS trust/key managers across connections to reduce SSL connection cost
• CONJ-1314 - add SPI for interactive dialog (PAM) authentication callback
• CONJ-1311 - add dedicated option useIpForKillQuery for query cancellation
• CONJ-1310 - Add full native image support and CI coverage

Issues Resolved

• CONJ-1320 - PAM (dialog) authentication must require a secure connection (report by fg0x0)
• CONJ-1319 - Use constant-time comparison when validating the server certificate fingerprint (report by jmestwa-coder)
• CONJ-1318 - enforce allowLocalInfile=false on the server's local-infile request, so a malicious server cannot read a client file despite the option being disabled
• CONJ-1322 - match local infile filename case-sensitively (thanks to jmestwa-coder)
• CONJ-1323 - LOAD LOCAL INFILE validation rejects statements preceded by line comments (thanks to sebdomdev)
• CONJ-1315 - cap BigDecimal/BigInteger string parsing length to prevent CPU exhaustion if MitM (report by tonghuaroot)
• CONJ-1317 - ensure non-UTF8 charset cannot be used for protocol exchanges (report by fg0x0)
• CONJ-1304 - CallableStatement parameter metadata read from mysql.proc, with MySQL info_schema fallback
• CONJ-1299 - keep VALUES literals after the last placeholder when rewriting batches
• CONJ-1313 - race condition in HaMode#getAvailableHostInOrder can cause NPE
• CONJ-1311 - Connection.cancelCurrentQuery fails with SslMode.VERIFY_FULL when client socket IP is set
• CONJ-1264 - handle LocalDateTime as a zoneless wall-clock value
• CONJ-1316 - pin Locale.ROOT on locale-sensitive call sites and date/time/Duration text formatting (fixes
  locale-dependent parsing/formatting, e.g. under tr_TR) (thanks to jmestwa-coder)
• CONJ-1324 - fix SQL parser to correctly handle '--' in expressions and reset lastChar after block comments
• CONJ-1323 - LOAD LOCAL INFILE validation rejects statements preceded by line comments (thanks to sebdomdev)

xerial/sqlite-jdbc (org.xerial:sqlite-jdbc)

v3.53.2.0

Compare Source

Changelog

🚀 Features

sqlite

• upgrade to sqlite 3.53.2 (3e1dabf)

🛠 Build

deps

• bump org.graalvm.buildtools:native-maven-plugin (d24c1cc)
• bump org.graalvm.buildtools:native-maven-plugin (751989a)
• bump org.graalvm.sdk:nativeimage from 25.0.2 to 25.0.3 (cc3e1a5)
• bump shanegenschaw/pull-request-comment-trigger (cc93aa7)

deps-dev

• bump surefire.version from 3.5.5 to 3.5.6 (3c29706)
• bump org.apache.maven.plugins:maven-enforcer-plugin (8a20a64)

unscoped

• fail workflow if child workflow also fails (49ea263)
• remove PR comment trigger (03bfd9a)

Contributors

We'd like to thank the following people for their contributions:
Gauthier, Gauthier Roebroeck

v3.53.1.0

Compare Source

Changelog

🚀 Features

sqlite

• upgrade to sqlite 3.53.1 (8263322)

🔄️ Changes

• rewrite amalgamation_version.sh for POSIX shell (52522d0)
• fix android usage (7ef8e0f)

🛠 Build

deps

• bump gummy-bears-api-24 to 0.14.0 (a28d6ce)
• bump gummy-bears-api-24 to 0.13.0 (248e1e9)

deps-dev

• bump org.jreleaser:jreleaser-maven-plugin (396fdf3)
• bump com.tngtech.archunit:archunit-junit5 (458abe1)

unscoped

• conditionally bootstrap SLF4J API JAR (bc7d223)
• make JAVA_CLASSPATH configurable (5aa7426)

Contributors

We'd like to thank the following people for their contributions:
Gauthier, Gauthier Roebroeck, Michael Osipov

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • On day 1 of the month (* * 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.