build(deps): bump the jdbc-drivers group with 3 updates

[dependabot]

Bumps the jdbc-drivers group with 3 updates: org.apache.derby:derby, com.oracle.database.jdbc:ojdbc8 and com.microsoft.sqlserver:mssql-jdbc.

Updates org.apache.derby:derby from 10.14.2.0 to 10.17.1.0

Updates com.oracle.database.jdbc:ojdbc8 from 19.3.0.0 to 23.26.3.0.0

Updates com.microsoft.sqlserver:mssql-jdbc from 7.2.1.jre8 to 13.6.0.jre8

Release notes

Sourced from com.microsoft.sqlserver:mssql-jdbc's releases.

[13.6.0] Stable Release

Added

• Add FLOAT16 Vector Version Negotiation to the TVP Write Path #2997

  • What was added: Negotiated vector-version validation before writing VECTOR column metadata for table-valued parameters.
  • Who benefits: Applications sending vector columns through table-valued parameters.
  • Impact: Rejects all vectors on version 0 and FLOAT16 vectors on version 1 before data is written to the wire, with a clear driver error.

• Port Legacy FX Non-AE Test Scenarios to JUnit #3008

  • What was added: Forty-eight legacyFx-tagged JUnit tests covering previously unported non-Always-Encrypted functional scenarios.
  • Who benefits: Contributors and CI validation pipelines.
  • Impact: Improves regression coverage while advancing retirement of the legacy FX test suite.

• Add Cross-Driver Connection String Aliases for Unification #3011

  • What was added: Case-insensitive aliases for uid, trusted_connection, app, connectTimeout, columnEncryption, and quotedId, mapped to their canonical JDBC properties.
  • Who benefits: Applications sharing connection-string configuration across Microsoft data drivers.
  • Impact: Improves portability while preserving all existing JDBC property names and aliases.

• Add getCurrentApplicationName to PerformanceLogCallback #3018

  • What was added: A default getCurrentApplicationName() method that exposes the publishing connection's applicationName to performance callbacks.
  • Who benefits: Applications using connection pools and performance-event correlation.
  • Impact: Allows events to be associated with a pool or application without breaking existing callback implementations.

Changed

• Optimize MONEY, DECIMAL, and String Processing in the ResultSet Read Path #2991

  • What was changed: Removed intermediate allocations from MONEY/SMALLMONEY decoding, common BigDecimal encoding, short synchronous string reads, and NBCROW initialization.
  • Who benefits: Applications reading high-volume or wide result sets.
  • Impact: Reduces garbage-collection pressure and improves throughput while preserving decoded values and existing fallback behavior.

• Validate Reflective Class Names for Connection Properties #3004

  • What was changed: Added Java binary class-name validation before reflectively loading classes specified by properties such as socketFactoryClass and accessTokenCallbackClass.
  • Who benefits: Applications configuring custom callback, socket-factory, or related reflective classes.
  • Impact: Malformed class names now fail early with a dedicated driver error instead of producing confusing reflective-loading failures.

• Update Vector Tests for Server-Side FLOAT16/FLOAT32 Conversion #3005

  • What was changed: Updated and expanded vector tests for implicit and explicit conversion between FLOAT16 and FLOAT32 vector subtypes.
  • Who benefits: Contributors validating vector interoperability against servers supporting vector version 2.
  • Impact: Covers assignments, casts, conversions, bulk copy, routines, precision loss, nulls, and dimension mismatch behavior.

• Adjust License File to Enable GitHub Detection #3010

  • What was changed: Normalized the MIT license text formatting.
  • Who benefits: Repository users and automated tooling.
  • Impact: Enables GitHub to detect and display the repository license; there is no runtime impact.

• Suppress CodeQL False Positive for Protocol-Mandated MD5 #3014

  • What was changed: Documented and suppressed the CodeQL SM05136 finding for MD5 used by NTLM channel binding as required by MS-NLMP.
  • Who benefits: Contributors and security-scanning pipelines.
  • Impact: Reduces false-positive security findings without changing authentication behavior.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: dbunit/dbunit-extension/.coderabbit.yml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 06d0af64-74a0-45e3-945a-a6d818ed8bf4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}