From abb1111135507ef0267f8324a3f4ee58bf0bcbe8 Mon Sep 17 00:00:00 2001
From: Stefan Bischof <stbischof@bipolis.org>
Date: Tue, 10 Nov 2026 20:11:41 +0100
Subject: [PATCH 1/2] build: AssertJ together with the Byte Buddy it is built
 against

Dependabot raised AssertJ to 3.27.7 in the root pom and in jdbc/impl.
AssertJ 3.27 imports net.bytebuddy from 1.18 on, but the parent pom
manages Byte Buddy 1.17.5, so the OSGi test runs of jdbc/impl and
guard/jsqltranspiler could not resolve AssertJ and failed on main.

The root pom and jdbc/pom.xml, whose parent is the daanse parent pom,
now set the two side by side: AssertJ 3.27.7 and Byte Buddy 1.18.3,
the version AssertJ is built against. jdbc/impl takes AssertJ from
there instead of naming its own version.

Signed-off-by: Stefan Bischof <stbischof@bipolis.org>
---
 jdbc/impl/pom.xml | 1 -
 jdbc/pom.xml      | 3 +++
 pom.xml           | 2 ++
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/jdbc/impl/pom.xml b/jdbc/impl/pom.xml
index 0244094..0bcd44c 100644
--- a/jdbc/impl/pom.xml
+++ b/jdbc/impl/pom.xml
@@ -92,7 +92,6 @@
     <dependency>
       <groupId>org.assertj</groupId>
       <artifactId>assertj-core</artifactId>
-      <version>3.27.7</version>
       <scope>test</scope>
     </dependency>
   </dependencies>
diff --git a/jdbc/pom.xml b/jdbc/pom.xml
index 0b633fe..8ccc55c 100644
--- a/jdbc/pom.xml
+++ b/jdbc/pom.xml
@@ -28,6 +28,9 @@
   <properties>
     <revision>0.0.1-SNAPSHOT</revision>
     <slf4j.version>2.0.9</slf4j.version>
+    <!-- AssertJ is built against this Byte Buddy and imports it from 1.18 on: change the two together. -->
+    <assertj.version>3.27.7</assertj.version>
+    <bytebuddy.version>1.18.3</bytebuddy.version>
   </properties>
 
   <dependencyManagement>
diff --git a/pom.xml b/pom.xml
index 744a98e..727f471 100644
--- a/pom.xml
+++ b/pom.xml
@@ -32,7 +32,9 @@
     <scm.repo.detail>org.eclipse.daanse.sql</scm.repo.detail>
     <slf4j.version>2.0.9</slf4j.version>
     <mockito.version>4.9.0</mockito.version>
+    <!-- AssertJ is built against this Byte Buddy and imports it from 1.18 on: change the two together. -->
     <assertj.version>3.27.7</assertj.version>
+    <bytebuddy.version>1.18.3</bytebuddy.version>
 
     <java.version>17</java.version>
     <java.release>17</java.release>

From e2104012e54892a7706e447808964e42f84012d6 Mon Sep 17 00:00:00 2001
From: Stefan Bischof <stbischof@bipolis.org>
Date: Tue, 10 Nov 2026 20:11:41 +0100
Subject: [PATCH 2/2] jdbc/metadata, dialect(mariadb): MariaDB Connector/J
 3.5.11

Connector/J before 3.4.5 has several advisories, among them a rogue
server driving large heap allocations from lengths it declares in OK
packets; jdbc/metadata used 3.4.3. Both test dependencies on the
driver now take 3.5.11, the latest 3.x.

Signed-off-by: Stefan Bischof <stbischof@bipolis.org>
---
 dialect/db/mariadb/pom.xml | 2 +-
 jdbc/metadata/pom.xml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dialect/db/mariadb/pom.xml b/dialect/db/mariadb/pom.xml
index 0774d23..2c70856 100644
--- a/dialect/db/mariadb/pom.xml
+++ b/dialect/db/mariadb/pom.xml
@@ -62,7 +62,7 @@
     <dependency>
       <groupId>org.mariadb.jdbc</groupId>
       <artifactId>mariadb-java-client</artifactId>
-      <version>3.4.5</version>
+      <version>3.5.11</version>
       <scope>test</scope>
     </dependency>
     <!-- Round-trip test (Testcontainer-backed). JUnit + assertj come from
diff --git a/jdbc/metadata/pom.xml b/jdbc/metadata/pom.xml
index 980c369..1eaa277 100644
--- a/jdbc/metadata/pom.xml
+++ b/jdbc/metadata/pom.xml
@@ -54,7 +54,7 @@
     <dependency>
       <groupId>org.mariadb.jdbc</groupId>
       <artifactId>mariadb-java-client</artifactId>
-      <version>3.4.3</version>
+      <version>3.5.11</version>
       <scope>test</scope>
     </dependency>
     <dependency>