[dependabot]

Bumps mariadb from 3.0.0 to 3.5.5.

Release notes

Sourced from mariadb's releases.

MariaDB Connector/Node.js 3.5.5

3.5.5 (Oct 2026)

Full Changelog

Notable changes

• CONJS-373: Each release ships a signed CycloneDX 1.6 software bill of materials, listing the package's dependencies for supply-chain audits
• CONJS-377: Faster queries: client-side parsing of the query and decoding of DATE, DATETIME and ASCII values in text protocol results take less time
• CONJS-382: Faster text protocol queries with large string parameters: a string with nothing to escape is encoded natively, 3x faster at 128 characters and 10x and more from 512
• CONJS-383: Faster execute() on large result sets: binary protocol rows no longer allocate a buffer per row, 40% faster on a 1000-row result set

Issues Fixed

• A pool that fails to create a connection now reports it through the logger when the application registers no error listener; the failure used to be silently dropped by a default listener (#180)
• CONJS-371: changeUser() failed with ER_SELF_SIGNED_SHA256 for a caching_sha2_password user after a self-signed TLS handshake, although the connection was already authenticated (report by fg0x0)
• CONJS-378: Pool.escape() returned a backslash-escaped value under NO_BACKSLASH_ESCAPES when every connection of the pool was in use, leaving the value injectable (report by buxuwa)
• CONJS-379: SQL injection through a Buffer parameter under the big5 client charset: the five lead bytes 0xFA-0xFE, single bytes for the server, were not escaped (report by fg0x0)
• CONJS-380: SQL injection through a string parameter or escape() under the big5, gbk, sjis and cp932 client charsets, ordinary characters encoding to sequences the server reads as single bytes (report by fg0x0)
• CONJS-381: A connection configured with a charset the server does not support, such as gb18030 on MariaDB, silently stayed on utf8mb4 while parameters were escaped for the requested charset; the connection is now refused by the server (report by fg0x0)
• CONJS-388: The meta property of a result could not be deleted, which made every Sequelize raw query fail with "Cannot delete property 'meta'" (#234)
• CONJS-389: connection.destroy() did not kill the running query on a TLS connection with certificate validation: the kill connection, opened on the server IP, failed hostname verification; the query promise also never settled when that connection could not be opened (#304)
• SqlError lost its constructor shape through a namespace import, so err instanceof SqlError was false (#356 thanks to GiHoon1123)
• CONJS-386: A query issued while the connection was still sending a previous command, such as a large insert or a streamed parameter, could be silently dropped and its promise never settled, including when the connection failed (#358 thanks to GiHoon1123)
• Type definitions: StreamCallback was declared as a value it never exports
• CONJS-385: Type definitions: TypeScript users can now pass bitOneIsBoolean, jsonStrings, fullResult, restrictedAuth, permitConnectionWhenExpired, permitRedirect, charsetNumber, enableKeepAlive and keepAliveInitialDelay, a function or logParam for logger, without a cast; the unused logPackets option and the internal ConnectionInfo.collation are no longer declared; the pool's error event and SqlError.cause are declared

MariaDB Connector/Node.js 3.5.4

3.5.4 (Jul 2026)

Full Changelog

Notable changes

• CONJS-355: Avoid flat-cloning the connection options for every command, relying on a prototype-chain merge instead (#353 thanks to erulabs)
• CONJS-357: Add JavaScript SAST (CodeQL + eslint-plugin-security) to CI
• CONJS-365: Enable standard TLS certificate identity validation under Deno
• CONJS-366: New option maxAllowedColumns (default 65535) bounding the column count announced by the server, a rogue server being otherwise able to have the client allocate metadata for a result-set that will never complete (report by fg0x0)

Issues Fixed

• CONJS-329: An exception thrown by a callback was reported to that same callback as a database error, instead of propagating like it does from any other node-style callback (report by Assen Totin)
• CONJS-356: Corrected ed25519 authentication with zero-configuration SSL
• CONJS-358: Refuse multi-part packet (> 16MB) reassembly before authentication completes, a rogue server being otherwise able to exhaust client memory before any credential is even validated
• CONJS-359: Corrected the default maxAllowedPacket value when the option is not set
• CONJS-360: batch() ignored the insertIdAsNumber / supportBigNumbers / bigNumberStrings options for insertId
• CONJS-361: The connection stopped sending commands after a command ending on the last packet of a network chunk: a prepared statement was never executed, without error nor timeout (report by Assen Totin)
• CONJS-362: Limit the parsec authentication PBKDF2 iteration factor and move the key derivation off the event loop, a rogue server being otherwise able to freeze the whole process for minutes (report by fg0x0)
• CONJS-363: typeCast accessors returned corrupted values with prepared statements
• CONJS-364: Types / TypeNumbers enums threw at runtime (#347, contribution by BrianDouglasIE)
• CONJS-367: Uninitialized process memory leaked to server via malformed GeoJSON Polygon parameter (report by fg0x0)
• CONJS-368: Fixed SQL injection in text protocol when session uses NO_BACKSLASH_ESCAPES (report by fg0x0)
• CONJS-369: Fixed SQL injection through object keys in SET expansion when using permitSetMultiParamEntries (report by fg0x0)

MariaDB Connector/Node.js 3.5.3

... (truncated)

Changelog

Sourced from mariadb's changelog.

3.5.5 (Oct 2026)

Full Changelog

Notable changes

• CONJS-373: Each release ships a signed CycloneDX 1.6 software bill of materials, listing the package's dependencies for supply-chain audits
• CONJS-377: Faster queries: client-side parsing of the query and decoding of DATE, DATETIME and ASCII values in text protocol results take less time
• CONJS-382: Faster text protocol queries with large string parameters: a string with nothing to escape is encoded natively, 3x faster at 128 characters and 10x and more from 512
• CONJS-383: Faster execute() on large result sets: binary protocol rows no longer allocate a buffer per row, 40% faster on a 1000-row result set

Issues Fixed

• A pool that fails to create a connection now reports it through the logger when the application registers no error listener; the failure used to be silently dropped by a default listener (#180)
• CONJS-371: changeUser() failed with ER_SELF_SIGNED_SHA256 for a caching_sha2_password user after a self-signed TLS handshake, although the connection was already authenticated (report by fg0x0)
• CONJS-378: Pool.escape() returned a backslash-escaped value under NO_BACKSLASH_ESCAPES when every connection of the pool was in use, leaving the value injectable (report by buxuwa and Kaya Emre Arikan)
• CONJS-379: SQL injection through a Buffer parameter under the big5 client charset: the five lead bytes 0xFA-0xFE, single bytes for the server, were not escaped (report by fg0x0)
• CONJS-380: SQL injection through a string parameter or escape() under the big5, gbk, sjis and cp932 client charsets, ordinary characters encoding to sequences the server reads as single bytes (report by fg0x0)
• CONJS-381: A connection configured with a charset the server does not support, such as gb18030 on MariaDB, silently stayed on utf8mb4 while parameters were escaped for the requested charset; the connection is now refused by the server (report by fg0x0)
• CONJS-388: The meta property of a result could not be deleted, which made every Sequelize raw query fail with "Cannot delete property 'meta'" (#234)
• CONJS-389: connection.destroy() did not kill the running query on a TLS connection with certificate validation: the kill connection, opened on the server IP, failed hostname verification; the query promise also never settled when that connection could not be opened (#304)
• SqlError lost its constructor shape through a namespace import, so err instanceof SqlError was false (#356 thanks to GiHoon1123)
• CONJS-386: A query issued while the connection was still sending a previous command, such as a large insert or a streamed parameter, could be silently dropped and its promise never settled, including when the connection failed (#358 thanks to GiHoon1123)
• Type definitions: StreamCallback was declared as a value it never exports
• CONJS-385: Type definitions: TypeScript users can now pass bitOneIsBoolean, jsonStrings, fullResult, restrictedAuth, permitConnectionWhenExpired, permitRedirect, charsetNumber, enableKeepAlive and keepAliveInitialDelay, a function or logParam for logger, without a cast; the unused logPackets option and the internal ConnectionInfo.collation are no longer declared; the pool's error event and SqlError.cause are declared

3.4.8 (Oct 2026)

Full Changelog

Issues Fixed

• CONJS-378: Pool.escape() escaped with backslashes under NO_BACKSLASH_ESCAPES when every connection of the pool was in use (report by buxuwa)
• CONJS-379: Fixed SQL injection in Buffer parameter escaping under big5 client charset: lead bytes 0xFA-0xFE are single bytes for the server (report by fg0x0)
• CONJS-380: Fixed SQL injection in string parameter and escape() escaping under big5, gbk, sjis and cp932 client charsets, the escape being applied before encoding (report by fg0x0)
• CONJS-381: A configured collation is always set with SET NAMES, so that a charset the server does not support (gb18030 on MariaDB) is refused instead of silently ignored (report by fg0x0)

3.3.5 (Oct 2026)

Full Changelog

Issues Fixed

• CONJS-378: Pool.escape() escaped with backslashes under NO_BACKSLASH_ESCAPES when every connection of the pool was in use (report by buxuwa)
• CONJS-379: Fixed SQL injection in Buffer parameter escaping under big5 client charset: lead bytes 0xFA-0xFE are single bytes for the server (report by fg0x0)
• CONJS-380: Fixed SQL injection in string parameter and escape() escaping under big5, gbk, sjis and cp932 client charsets, the escape being applied before encoding (report by fg0x0)
• CONJS-381: A configured collation is always set with SET NAMES, so that a charset the server does not support (gb18030 on MariaDB) is refused instead of silently ignored (report by fg0x0)

3.2.6 (Oct 2026)

Full Changelog

Issues Fixed

• CONJS-378: Pool.escape() escaped with backslashes under NO_BACKSLASH_ESCAPES when every connection of the pool was in use (report by buxuwa)
• CONJS-379: Fixed SQL injection in Buffer parameter escaping under big5 client charset: lead bytes 0xFA-0xFE are single bytes for the server (report by fg0x0)
• CONJS-380: Fixed SQL injection in string parameter and escape() escaping under big5, gbk, sjis and cp932 client charsets, the escape being applied before encoding (report by fg0x0)

... (truncated)

Commits

• a9bf77d [misc] release workflow started by hand only
• bf7807a [CONJS-389] test: destroyed query is rejected when no kill connection can be ...
• cd9add9 [CONJS-385] restore pool 'enqueue' event
• 3e307f8 [misc] updating changelog
• 6348198 [CONJS-389] destroy() kill connection fails hostname verification with TLS
• 221532e [CONJS-388] Result meta property can be deleted #234
• 3078fc2 [misc] Pool connection failures are silently dropped when the application has...
• 9daaa72 Merge branch 'develop'
• b5af03b Merge pull request #360 from mariadb-corporation/dependabot/npm_and_yarn/sour...
• f8e5b97 Merge pull request #359 from mariadb-corporation/dependabot/npm_and_yarn/brac...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mariadb since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 45.97%. Comparing base (743fe7f) to head (52cb69e).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2311      +/-   ##
==========================================
- Coverage   46.00%   45.97%   -0.04%     
==========================================
  Files        1070     1070              
  Lines       17610    17610              
  Branches     3261     3261              
==========================================
- Hits         8102     8096       -6     
- Misses       9508     9514       +6     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.