Skip to content

Update dependencies - #88

Merged
alexandru merged 1 commit into
mainfrom
renovate/all-dependencies
Aug 30, 2026
Merged

Update dependencies#88
alexandru merged 1 commit into
mainfrom
renovate/all-dependencies

Conversation

@funfix

@funfix funfix Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending
gradle (source) minor 9.6.19.7.1
org.scalameta:munit Test patch 1.3.41.3.5
org.xerial:sqlite-jdbc Test patch 3.53.2.03.53.2.1 3.53.4.0
sbt/sbt minor 1.12.151.13.0
org.junit:junit-bom (source) dependencies patch 6.1.26.1.3
com.oracle.database.jdbc:ojdbc11 (source) dependencies patch 23.26.2.0.023.26.3.0.0
com.mysql:mysql-connector-j (source) dependencies major 9.7.026.7.0
org.mariadb.jdbc:mariadb-java-client (source) dependencies patch 3.5.93.5.10
org.xerial:sqlite-jdbc dependencies patch 3.53.2.03.53.2.1 3.53.4.0
ch.qos.logback:logback-classic (source, changelog) dependencies minor 1.5.381.6.3
com.ncorti.ktfmt.gradle:com.ncorti.ktfmt.gradle.gradle.plugin dependencies minor 0.26.00.27.0

Release Notes

gradle/gradle (gradle)

v9.7.1: 9.7.1

Compare Source

The Gradle team is excited to announce Gradle 9.7.1.

This is a patch release for 9.7.0. We recommend using 9.7.1 instead of 9.7.0.

Here are the highlights of 9.7.0 release:

  • Isolated Projects graduates to incubating
  • Broader Configuration Cache compatibility
  • Resilient Sync helps you fix broken builds
  • More source locations in problem reports

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
Adam,
Aman Gautam,
Aman Kumar,
Anton Dubrouski,
Aurimas,
gbhavya07,
Josh Friend,
nicklauslittle-gov,
Pragati,
project516,
Qin Mi,
Ravi,
sk-reddy17,
Suvrat Acharya,
Yongshun Ye.

Upgrade instructions

Switch your build to use Gradle 9.7.1 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.7.1 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

v9.7.0: 9.7.0

Compare Source

The Gradle team is excited to announce Gradle 9.7.0.

Here are the highlights of this release:

  • Isolated Projects graduates to incubating
  • Broader Configuration Cache compatibility
  • More source locations in problem reports

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle:
Adam,
Aman Gautam,
Aman Kumar,
Anton Dubrouski,
Aurimas,
gbhavya07,
Josh Friend,
nicklauslittle-gov,
Pragati,
project516,
Qin Mi,
Ravi,
sk-reddy17,
Suvrat Acharya,
Yongshun Ye.

Upgrade instructions

Switch your build to use Gradle 9.7.0 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.7.0 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

scalameta/munit (org.scalameta:munit)

v1.3.5

Compare Source

sbt 2: switch from sbt 1

Bug fixes

Miscellaneous

Build and dependency updates

xerial/sqlite-jdbc (org.xerial:sqlite-jdbc)

v3.53.2.1

Compare Source

Changelog
🐛 Fixes

jdbc

  • map DATETIME column type to Types.TIMESTAMP (19ac6bb), closes #​1436
  • throw SQLException from createConnection on invalid URL (fe636b7)
  • escape resolved table name in getExportedKeys query (b8eca2a)
  • escape catalog and schema in foreign key metadata queries (ff4b847)
  • escape table type values in getTables metadata query (33eaa19)
  • escape table name in getColumns metadata query (a5149f8)

pool

  • reset connection before notifying listeners on close (57f6cfa), closes #​821

unscoped

  • fallback to isAlpineLinux when map_files contains no musl entries (7537528), closes #​1382
🔄️ Changes
🛠 Build

deps

  • bump org.graalvm.buildtools:native-maven-plugin (75f593a)
  • bump org.graalvm.sdk:nativeimage from 25.0.3 to 25.1.3 (ac69b1e)
  • bump org.graalvm.buildtools:native-maven-plugin (37988f4)
  • bump org.graalvm.buildtools:native-maven-plugin (aae577a)
  • bump actions/checkout from 6 to 7 (9761dfd)
  • bump org.graalvm.buildtools:native-maven-plugin (e21a3b4)

deps-dev

  • bump org.apache.maven.plugins:maven-help-plugin (dcf3ea2)
  • bump org.jreleaser:jreleaser-maven-plugin (02e2e53)
  • bump org.sonatype.central:central-publishing-maven-plugin (72b9a31)

unscoped

  • add missing configuration for msvc (25b5de5)
  • central publishing wait only until validated (7018821)
  • switch to a maintained fork of setup-msvc-dev (3ca5e70)
  • fix older graalvm on windows (bb1382c)
Contributors

We'd like to thank the following people for their contributions:
Gauthier, Gauthier Roebroeck, Javid Khan, Kamil Krzywanski, Kilo Code Bot, dxbjavid

sbt/sbt (sbt/sbt)

v1.13.0: 1.13.0

Compare Source

⚠️ Remote code execution vulnerability fix

sbt team received a security report GHSA-943m-f264-54p4 from @​stasimus that when the serverConnectionType is set to Tcp, an attacker is able to execute arbitrary code remotely via BSP, similar to a recent bug that was found in JSON-RPC. sbt 1.13.0 and 2.0.7 fix this bug.

Builds with the default serverConnectionType are not affected. In affected builds, we recommend removing the serverConnectionType setting, or upgrading to a patched version or later. In an affected build, the setting might look like this:

Global / serverConnectionType := ConnectionType.Tcp

The remediation was implemented by @​stasimus.

🚀 updates

🐛 bug fixes

behind the scenes

new contributors

Full Changelog: sbt/sbt@v1.12.15...v1.13.0

mysql/mysql-connector-j (com.mysql:mysql-connector-j)

v26.7.0

Compare Source

mariadb-corporation/mariadb-connector-j (org.mariadb.jdbc:mariadb-java-client)

v3.5.10

Compare Source

Full Changelog

Key Enhancements
  • CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
  • CONJ-1330 - add infer test to CI
Issues Resolved
  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is
    attacker-controlled (report by Qing Xu)
  • CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
  • CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to
    jmestwa-coder)
  • CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating
    up front (thanks to jmestwa-coder)
  • CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to
    jmestwa-coder)
  • CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own
    password is supplied (report by fg0x0)
  • CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to
    jmestwa-coder)
  • CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
  • CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing
    dot (report by Shaswata, thanks to Pepo48 for PR)
  • CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds
    Integer.MAX_VALUE, and returns bulk generated keys out of batch order

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@alexandru
alexandru enabled auto-merge (squash) August 30, 2026 08:23
@alexandru
alexandru merged commit 54fe41a into main Aug 30, 2026
5 checks passed
@alexandru
alexandru deleted the renovate/all-dependencies branch August 30, 2026 08:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant