Connector/J 3.5.10 Changelog

Full changelog for MariaDB Connector/J 3.5.10, listing every commit in the release.

Download Release Notes Changelog Connector/J Overview

Release date: 29 Jul 2026

For the highlights of this release, see the release notes.

The revision number links will take you to the revision's page on GitHub. On GitHub you can view more details of the revision and view diffs of the code modified in that revision.

• Revision #6164678e8 - [misc] update changelog

• Revision #6f5885870 - [CONJ-1335] getGeneratedKeys() throws SQLDataException "integer overflow" after batch insert when AUTO_INCREMENT value exceeds Integer.MAX_VALUE

• Revision #9f06db76c - [misc] CI stability improvement

• Revision #99aa9e2e7 - [CONJ-1336] correction follow up

• Revision #28a155035 - [CONJ-1336] strip trailing dot from hostname before SNI and hostname verification

• Revision #b2b3f1beb - [misc] limit authentication switch requests to 10 per connection

• Revision #26ca60ab4 - [misc] bound the whole connection phase by connectTimeout

• Revision #15e08ff54 - [CONJ-1337] Limit parsec authentication PBKDF2 iteration factor to the connection time

• Revision #d3c4a726d - bump 3.5.10 version

• Revision #d85e05f4d - [CONJ-1342] socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled

• Revision #7ad82ae78 - [misc] test correction for hostname validation, ssl case

• Revision #05c5474d2 - [CONJ-1340] ensuring having database set when using updatable results

• Revision #603af1769 - [misc] remove duplicated javadoc block

• Revision #2614c2e4c - [misc] keep datasource state in a single Configuration.Builder

• Revision #cb176a0e2 - [misc] redact credentials at rendering time, not in the configuration url

• Revision #4db7e2e81 - [misc] silence maven-compiler-plugin warnings

• Revision #78d5c35d3 - [misc] test correction for hostname validation

• Revision #03b9df302 - mask sensitive nonMappedOptions when serializing connection url

• Revision #5ecc80d7e - [CONJ-1341] MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied

• Revision #e5b1a3d9f - [misc] code style correction

• Revision #08452f78f - [CONJ-1327] ignore cn only when a san entry of the host type is present

• Revision #879d81841 - cap length-encoded field length before narrowing to int in row decoders

• Revision #554a88a2a - [CONJ-1340] escape identifiers in updatable result set generated sql

• Revision #cd0b6fa16 - [CONJ-1307] connection.setReadOnly(true) still allows DML statements to execute

• Revision #d2831dc9a - [CONJ-1339] Add maxAllowedColumns option to bound server-announced column count

• Revision #30d4a8833 - [CONJ-1338] validate length-encoded integers fit a non-negative int before use as a length

• Revision #22ca56817 - [misc] benchmark correction for java 23+

• Revision #ad193dd81 - [misc] CI proxy failover stability improvement

• Revision #824b627bd - [CONJ-1333] maxAllowedPacket default value follow up

• Revision #24ef4350a - [CONJ-1333] Add maxAllowedPacket connection option (send/receive limit)

• Revision #77cb4585b - [misc] bump jacoco version

• Revision #214d370f3 - [misc] fix flaky UnixsocketTest FD-leak check on macOS

• Revision #e3f7e1fe5 - [CONJ-1332] Reject multipart (>16 MB) packets before authentication

• Revision #200c18e53 - [CONJ-1330] update infer to 1.3.0 version

• Revision #71f12b5ad - [misc] handle possible NPE properly

• Revision #765a6140a - [misc] disallow debugging logs at authentication level

• Revision #854de227a - [CONJ-1331] Merge PR #233: validate trustStore chain instead of deferring identity

• Revision #960423184 - [CONJ-1330] add Infer static-analysis config

• Revision #45815bc59 - [misc] fix NPE and resource leak

• Revision #eb24d5a5c - validate trustStore chain instead of deferring identity

• Revision #12cffa32a - [CONJ-1329] Merge pull request #232 from jmestwa-coder/local-infile-fail-closed

• Revision #d4d84c465 - Merge pull request #231 from jmestwa-coder/restricted-auth-exact-match

• Revision #167af2500 - Merge pull request #229 from jmestwa-coder/redirect-url-hide-password

• Revision #bbe622c3c - [misc] sql_mode-aware enquoteLiteral, utf8mb4-safe enquoteNCharLiteral

• Revision #aa8cb0a87 - [CONJ-1326] Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral()

• Revision #c03bee1d4 - Merge pull request #228 from jmestwa-coder/enquote-literal-escaping

• Revision #eb845474c - [misc] code style correction

• Revision #a2e666d58 - [misc] upgrade google-java-format to 1.35.0 for JDK 25 support

• Revision #82ad499c6 - Merge pull request #227 from jmestwa-coder/okpacket-session-track-skip

• Revision #56e6736b4 - Merge pull request #226 from jmestwa-coder/parsec-iteration-unsigned

• Revision #25c6dcaf9 - read parsec auth iteration count as unsigned byte

• Revision #c9377bc86 - [misc] correct test logic for new maxscale version

• Revision #987021c04 - [misc] missing changelog entry

• Revision #347117ccf - refuse local infile request when parameter value unavailable

• Revision #e29b29181 - match restrictedAuth plugin list exactly

• Revision #a410311a7 - mask password in redirect url before logging

• Revision #6a6375713 - double quote and backslash in enquoteLiteral and enquoteNCharLiteral

• Revision #a04d44def - skip unknown session-track entries from OkPacket session buffer

• Revision #3e9f24106 - [misc] update PooledConnectionTest to prevent idle connection recreation for improved test reliability

_{This page is: Copyright © 2026 MariaDB. All rights reserved.}