Bump mariadb from 3.0.0 to 3.2.5

[dependabot]

Bumps mariadb from 3.0.0 to 3.2.5.

Release notes

Sourced from mariadb's releases.

MariaDB Connector/Node.js 3.2.5

3.2.5 (Jul 2026)

Full Changelog

Notable changes

• CONJS-357: Add JavaScript SAST (CodeQL + eslint-plugin-security) to CI

Issues Fixed

• CONJS-358: Refuse multi-part packet (> 16MB) reassembly before authentication completes, a rogue server being otherwise able to exhaust client memory before any credential is even validated
• CONJS-363: typeCast accessors returned corrupted values with prepared statements
• CONJS-367: Uninitialized process memory leaked to server via malformed GeoJSON Polygon parameter (report by fg0x0)
• CONJS-368: Fixed SQL injection in text protocol when session uses NO_BACKSLASH_ESCAPES (report by fg0x0)
• CONJS-369: Fixed SQL injection through object keys in SET expansion when using permitSetMultiParamEntries (report by fg0x0)
• Escape the server-supplied filename before building the LOCAL INFILE validation regular expression

MariaDB Connector/Node.js 3.2.4

3.2.4 (Jun 2026)

Full Changelog

Issues Fixed

• CONJS-350: Fixed possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charset (report by fg0x0)
• CONJS-353: PAM (dialog) authentication now requires a secure connection (TLS or a local unix socket), since it transmits the password in clear text (report by fg0x0)
• CONJS-354: Reject a server-initiated LOAD DATA LOCAL INFILE request when permitLocalInfile is disabled (report by tharavel)
• Refuse sending the password in clear (mysql_clear_password) over an unencrypted connection

MariaDB Connector/Node.js 3.2.3

3.2.3 (Dec 2023)

Full Changelog

• CONJS-207 Add support for connection redirection
• CONJS-271 wrong binary decoding of 00:00:00 TIME values
• CONJS-272 Error doesn't always have parameters according to option
• CONJS-273 Bulk insert error when last bunch of parameters is reaching max_allowed_packet
• CONJS-274 permit disabling BULK insert for one batch
• CONJS-207 Add support for connection redirection

MariaDB Connector/Node.js 3.2.2

3.2.2 (Oct 2023)

Full Changelog

Issues Fixed

• CONJS-270 Always send connection attributes, even when connectAttributes is not set
• CONJS-269 avoid useless "set names utf8mb4" on connection creation if not needed
• CONJS-268 importFile method doesn't always throw error when imported commands fails #253
• CONJS-267 Ensure that option collation with id > 255 are respected

MariaDB Connector/Node.js 3.2.1

3.2.1 (Sep 2023)

Full Changelog

... (truncated)

Changelog

Sourced from mariadb's changelog.

3.2.5 (Jul 2026)

Full Changelog

Notable changes

• CONJS-357: Add JavaScript SAST (CodeQL + eslint-plugin-security) to CI

Issues Fixed

• CONJS-358: Refuse multi-part packet (> 16MB) reassembly before authentication completes, a rogue server being otherwise able to exhaust client memory before any credential is even validated
• CONJS-363: typeCast accessors returned corrupted values with prepared statements
• CONJS-367: Uninitialized process memory leaked to server via malformed GeoJSON Polygon parameter (report by fg0x0)
• CONJS-368: Fixed SQL injection in text protocol when session uses NO_BACKSLASH_ESCAPES (report by fg0x0)
• CONJS-369: Fixed SQL injection through object keys in SET expansion when using permitSetMultiParamEntries (report by fg0x0)
• Escape the server-supplied filename before building the LOCAL INFILE validation regular expression

3.5.3 (Jun1 2026)

Full Changelog

Notable changes

• Minimum supported Node.js version is now 20 (was 18; Node 18 went EOL in April 2025)
• CONJS-346: Add RowsWithMeta<T> and WithMeta<T> helper types for typing query() / execute() result shapes — RowsWithMeta<T> for the default rows-array-with-meta shape, WithMeta<T> for the metaAsArray: true tuple form (types-only, no runtime change)

Issues Fixed

• CONJS-354: Reject a server-initiated LOAD DATA LOCAL INFILE request when permitLocalInfile is disabled (report by tharavel)
• CONJS-353: PAM (dialog) authentication now requires a secure connection (TLS or a local unix socket), since it transmits the password in clear text (report by fg0x0)
• CONJS-351: Use constant-time comparison when validating the server certificate fingerprint token, preventing a timing side-channel that could leak the token to a man-in-the-middle
• CONJS-350: Fixed possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charset (report by fg0x0)
• CONJS-344: Restore dual ESM/CJS support after the 3.5 ESM migration (#346):
  • TypeScript types now compile under moduleResolution: "Node16" / "NodeNext" / "Bundler" — fixes TS2846 / TS2834 reported in 3.5.1 and 3.5.2
  • Ship paired .d.cts declarations for the require condition
  • Ship a real CJS bundle in dist/ so require('mariadb') works on Node 20+ without --experimental-require-module or ExperimentalWarning
  • Restore the default ESM export, so import mariadb from 'mariadb' works again (matches 3.4.x behavior)

3.4.6 (Jun 2026)

Full Changelog

Issues Fixed

• CONJS-331: Corrected parsec authentication plugin handling
• CONJS-350: Fixed possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charset (report by fg0x0)
• CONJS-349: Fixed cleartext password disclosure to a man-in-the-middle when relying on certificate fingerprint validation (self-signed trust mode)
• CONJS-351: Use constant-time comparison when validating the server certificate fingerprint token, preventing a timing side-channel that could leak the token to a man-in-the-middle
• CONJS-353: PAM (dialog) authentication now requires a secure connection (TLS or a local unix socket), since it transmits the password in clear text (report by fg0x0)
• CONJS-354: Reject a server-initiated LOAD DATA LOCAL INFILE request when permitLocalInfile is disabled (report by tharavel)
• Refuse sending the password in clear (mysql_clear_password) over an unencrypted connection

3.3.3 (Jun 2026)

Full Changelog

... (truncated)

Commits

• d7c1aed bump 3.2.5 version
• 8eb4509 [CONJS-369] Object keys interpolated as identifiers without escapeId in SET e...
• 6995c8c [CONJS-368] SQL injection in text protocol when session uses NO_BACKSLASH_ESC...
• a4aa048 [CONJS-367] Uninitialized process memory leaked to server via malformed GeoJS...
• 50875bb [CONJS-363] typeCast accessors return corrupted values with prepared statements
• c622eb6 [misc] test correction for maxscale
• 0048069 [misc] correct maxscale CI tag
• 928b5b2 [CONJS-358] Refuse multi-part packet reassembly before authentication
• e32eb77 [misc] test correction
• 1b0a01e [misc] correct CodeQL false positive
• Additional commits viewable in compare view