deps: bump the gradle-minor-patch group with 2 updates

[dependabot]

Bumps the gradle-minor-patch group with 2 updates: org.mariadb.jdbc:mariadb-java-client and com.diffplug.spotless.

Updates org.mariadb.jdbc:mariadb-java-client from 3.5.9 to 3.5.10

Release notes

Sourced from org.mariadb.jdbc:mariadb-java-client's releases.

MariaDB Connector/Java 3.5.10

3.5.10 (Jul 2026)

Full Changelog

Key Enhancements

• CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
• CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
• CONJ-1330 - add infer test to CI

Issues Resolved

• CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
• CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
• CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
• CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
• CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
• CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)
• CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating up front (thanks to jmestwa-coder)
• CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)
• CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)
• CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder)
• CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
• CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing dot (report by Shaswata, thanks to Pepo48 for PR)
• CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds Integer.MAX_VALUE, and returns bulk generated keys out of batch order

Changelog

Sourced from org.mariadb.jdbc:mariadb-java-client's changelog.

3.5.10 (Jul 2026)

Full Changelog

Key Enhancements

• CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)
• CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)
• CONJ-1330 - add infer test to CI

Issues Resolved

• CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
• CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
• CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute
• CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
• CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)
• CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)
• CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating up front (thanks to jmestwa-coder)
• CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to jmestwa-coder)
• CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own password is supplied (report by fg0x0)
• CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to jmestwa-coder)
• CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)
• CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing dot (report by Shaswata, thanks to Pepo48 for PR)
• CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds Integer.MAX_VALUE, and returns bulk generated keys out of batch order

3.4.4 (Jul 2026)

Full Changelog

Notable Changes

• CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)

Bugs Fixed

• CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server
• CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is attacker-controlled (report by Qing Xu)
• CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)
• CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to jmestwa-coder)

... (truncated)

Commits

• 6164678 [misc] update changelog
• 6f58858 [CONJ-1335] getGeneratedKeys() throws SQLDataException "integer overflow" aft...
• 9f06db7 [misc] CI stability improvement
• 99aa9e2 [CONJ-1336] correction follow up
• 28a1550 [CONJ-1336] strip trailing dot from hostname before SNI and hostname verifica...
• b2b3f1b [misc] limit authentication switch requests to 10 per connection
• 26ca60a [misc] bound the whole connection phase by connectTimeout
• 15e08ff [CONJ-1337] Limit parsec authentication PBKDF2 iteration factor to the connec...
• d3c4a72 bump 3.5.10 version
• d85e05f [CONJ-1342] socketFactory option allows loading arbitrary bytecode via jar: U...
• Additional commits viewable in compare view

Updates com.diffplug.spotless from 8.8.0 to 8.9.0

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions