This is an automated email from the ASF dual-hosted git repository. MartijnVisser pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/flink-connector-jdbc.git
commit a7f4d2707089a01f93b5ca016c577a3bdc0d1c6c Author: Martijn Visser <[email protected]> AuthorDate: Mon Sep 21 13:53:58 2026 +0200 [FLINK-40729][jdbc] Bump mssql-jdbc from 10.2.1.jre8 to 13.6.0.jre8 10.2.1.jre8 falls in the affected range of CVE-2025-59250, and so does the 11.2.0.jre8 that Dependabot proposed in apache/flink-connector-jdbc#208: that branch is only fixed from 11.2.4 onwards. 13.6.0.jre8 is the current release and carries no known advisory. The jre8 classifier is kept. The connector still compiles to Java 8 bytecode, and 13.6.0.jre8 is a Java 8 build that still ships SQLServerXADataSource, which the tests use. Generated-by: Claude Code (Claude Opus 5) --- flink-connector-jdbc-sqlserver/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/flink-connector-jdbc-sqlserver/pom.xml b/flink-connector-jdbc-sqlserver/pom.xml index f08beb33..815dac5d 100644 --- a/flink-connector-jdbc-sqlserver/pom.xml +++ b/flink-connector-jdbc-sqlserver/pom.xml @@ -33,7 +33,7 @@ under the License. <packaging>jar</packaging> <properties> - <sqlserver.version>10.2.1.jre8</sqlserver.version> + <sqlserver.version>13.6.0.jre8</sqlserver.version> <flink.forkCountITCase>1</flink.forkCountITCase> </properties>
