chore(deps): bump org.mariadb:r2dbc-mariadb from 1.1.4 to 1.4.1 in /app/server

[dependabot]

Bumps org.mariadb:r2dbc-mariadb from 1.1.4 to 1.4.1.

Release notes

Sourced from org.mariadb:r2dbc-mariadb's releases.

MariaDB Connector/R2DBC 1.4.1

1.4.1 (Jun 2026)

Full Changelog

Notable Changes:

• R2DBC-116 Add GraalVM native-image configuration and CI coverage
• Update dependencies (Project Reactor 2025.0.6, Netty 4.2.15.Final)

Bugs Fixed:

• R2DBC-115 Clear-text authentication plugins (PAM, mysql_clear_password) must require a secure connection (report by fg0x0)
• R2DBC-117 Cap BigDecimal/BigInteger string parsing length to prevent CPU exhaustion if MitM (report by tonghuaroot)
• R2DBC-119 Fail closed when a classpath: SSL certificate is missing
• R2DBC-120 Stored-procedure CALL detection wrongly matched any query containing "call" (thanks to yunhobb)
• R2DBC-121 caching_sha2_password/sha256_password login fails with passwords of 20 characters or more (report by 4UjwXc)
• R2DBC-124 Ensure a non-UTF8 charset cannot be used for protocol exchanges (report by fg0x0)
• R2DBC-122 Fix SQL parser to correctly handle '--' in expressions
• R2DBC-123 Pin Locale.ROOT on locale-sensitive wire-format codec sites (thanks to jmestwa-coder)

MariaDB Connector/R2DBC 1.4.0

1.4.0 (Feb 2026)

Notable Changes:

• R2DBC-109 Add fallbackToSystemTrustStore and fallbackToSystemKeyStore options
• R2DBC-110 Support java.time.Instant parameters
• R2DBC-114 Implement Wrapped interface to expose EventLoop scheduler for r2dbc-pool optimization

Bugs Fixed:

• R2DBC-108 Handle authentication plugin multi-exchange prefix (0x01) introduced in MDEV-37554
• R2DBC-111 Potential hang when upstream subscription is cancelled before demand
• R2DBC-112 Failed authentication when using caching_sha2_password with passwords longer than 18 characters
• R2DBC-113 Add support for RSA public key content in cachingRsaPublicKey and rsaPublicKey options

MariaDB Connector/R2DBC 1.3.1

1.3.1 (Jun 2026)

Maintenance release for the 1.3 line, back-porting the corrections, CI and security fixes made after 1.3.0. java.time.Instant parameter support is intentionally not included.

Notable Changes:

• R2DBC-108 Handle authentication plugin multi-exchange prefix (0x01) introduced in MDEV-37554
• R2DBC-109 Add fallbackToSystemTrustStore and fallbackToSystemKeyStore options
• R2DBC-113 Support inline RSA public key for sha256_password and caching_sha2_password
• R2DBC-114 Implement Wrapped interface to expose the EventLoop scheduler for r2dbc-pool
• R2DBC-116 Add GraalVM native-image configuration and CI testing

Bugs Fixed:

• R2DBC-111 Potential hang when upstream subscription is cancelled before demand
• R2DBC-112 Failed authentication using caching_sha2_password with passwords longer than 18 characters

... (truncated)

Changelog

Sourced from org.mariadb:r2dbc-mariadb's changelog.

1.4.1 (Jun 2026)

Full Changelog

Notable Changes:

• R2DBC-116 Add GraalVM native-image configuration and CI coverage
• Update dependencies (Project Reactor 2025.0.6, Netty 4.2.15.Final)

Bugs Fixed:

• R2DBC-115 Clear-text authentication plugins (PAM, mysql_clear_password) must require a secure connection (report by fg0x0)
• R2DBC-117 Cap BigDecimal/BigInteger string parsing length to prevent CPU exhaustion if MitM (report by tonghuaroot)
• R2DBC-119 Fail closed when a classpath: SSL certificate is missing
• R2DBC-120 Stored-procedure CALL detection wrongly matched any query containing "call" (thanks to yunhobb)
• R2DBC-121 caching_sha2_password/sha256_password login fails with passwords of 20 characters or more (report by 4UjwXc)
• R2DBC-124 Ensure a non-UTF8 charset cannot be used for protocol exchanges (report by fg0x0)
• R2DBC-122 Fix SQL parser to correctly handle '--' in expressions
• R2DBC-123 Pin Locale.ROOT on locale-sensitive wire-format codec sites (thanks to jmestwa-coder)

1.4.0 (Feb 2026)

Notable Changes:

• R2DBC-109 Add fallbackToSystemTrustStore and fallbackToSystemKeyStore options
• R2DBC-110 Support java.time.Instant parameters
• R2DBC-114 Implement Wrapped interface to expose EventLoop scheduler for r2dbc-pool optimization

Bugs Fixed:

• R2DBC-108 Handle authentication plugin multi-exchange prefix (0x01) introduced in MDEV-37554
• R2DBC-111 Potential hang when upstream subscription is cancelled before demand
• R2DBC-112 Failed authentication when using caching_sha2_password with passwords longer than 18 characters
• R2DBC-113 Add support for RSA public key content in cachingRsaPublicKey and rsaPublicKey options

1.3.0 (Oct 2024)

Notable Changes:

• R2DBC-106 Implement parsec authentication. see https://mariadb.com/kb/en/authentication-plugin-parsec/

1.2.2 (Sep 2024)

Notable Changes:

• R2DBC-105 Permit avoiding session setting with new option skipPostCommands

Bugs Fixed:

• R2DBC-104 Redirection might result in connection error

1.2.1 (19 Jun 2024)

... (truncated)

Commits

• a82d265 bump 1.4.1
• 44602cb [misc] fix flaky PrepareResultSetTest.cacheReuse under load
• 68d9f81 [misc] test correction about pamOtherPwd sanitization
• 4656951 [misc] bump dependencies
• cd9b6f9 [misc] code style correction
• 76181aa [R2DBC-121] caching_sha2_password/sha256_password login fails with passwords ...
• ccf4326 [R2DBC-120] Stored-procedure CALL detection wrongly matched any query contain...
• 84dc70c Merge PR #92 (yunhobb): fix incorrect stored procedure CALL detection in crea...
• 11d92c0 [misc] mask pamOtherPwd in MariadbConnectionConfiguration.toString()
• 1ec789e [misc] reject malformed auth-switch seed and column-definition packets cleanly
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Warning

Tests have not run on the HEAD b4a95a0 yet

---

Mon, 03 Aug 2026 23:34:01 UTC