fix(deps): update dependency com.microsoft.sqlserver:mssql-jdbc to v12.8.2.jre11 [security]

[alaudaa-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
com.microsoft.sqlserver:mssql-jdbc	12.8.1.jre11 -> 12.8.2.jre11

---

JDBC Driver for SQL Server has improper input validation issue

CVE-2025-59250 / GHSA-m494-w24q-6f7w

More information

Details

Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-59250
• https://github.com/microsoft/mssql-jdbc/pull/2798
• https://github.com/microsoft/mssql-jdbc/pull/2800
• https://github.com/microsoft/mssql-jdbc/pull/2801
• https://github.com/microsoft/mssql-jdbc/pull/2802
• https://github.com/microsoft/mssql-jdbc/pull/2803
• https://github.com/microsoft/mssql-jdbc/pull/2807
• https://github.com/microsoft/mssql-jdbc/commit/9732e1bbc6ec44166fda2cddab31ce1c86c873dd#diff-45367b99a1951943bfecfc7765e80df687967aa56286a5b2e039f77cd9a0e118
• https://github.com/microsoft/mssql-jdbc
• https://github.com/microsoft/mssql-jdbc/blob/main/CHANGELOG.md
• https://learn.microsoft.com/en-us/sql/connect/jdbc/microsoft-jdbc-driver-for-sql-server-support-matrix
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59250

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[alaudabot]

🚨 Stale Pull Request Warning

This pull request has been inactive for 54 days.

Automated Actions Schedule:

• ⚠️ Warning: After 30 days (now)
• 🔒 Auto-close: After 60 days
• 🗑️ Branch deletion: After 90 days (if not protected)

To keep this PR active:

• Add new commits
• Reply to this comment
• Request reviews

Protected branches (won't be deleted): main,release-*,alauda-*

This is an automated message. Reply to this comment to reset the inactivity timer.

[alaudabot]

🚨 Stale Pull Request Warning

This pull request has been inactive for 35 days.

Automated Actions Schedule:

• ⚠️ Warning: After 30 days (now)
• 🔒 Auto-close: After 60 days
• 🗑️ Branch deletion: After 90 days (if not protected)

To keep this PR active:

• Add new commits
• Reply to this comment
• Request reviews

Protected branches (won't be deleted): main,release-*,alauda-*

This is an automated message. Reply to this comment to reset the inactivity timer.

[alaudabot]

🚨 Stale Pull Request Warning

This pull request has been inactive for 35 days.

Automated Actions Schedule:

• ⚠️ Warning: After 30 days (now)
• 🔒 Auto-close: After 60 days
• 🗑️ Branch deletion: After 90 days (if not protected)

To keep this PR active:

• Add new commits
• Reply to this comment
• Request reviews

Protected branches (won't be deleted): main,release-*,alauda-*

This is an automated message. Reply to this comment to reset the inactivity timer.

[danielfbm]

PR Assist Bot — Owner Approval Needed

This PR targets release branch alauda-2025.1.0. Per policy, release-branch merges require explicit owner approval before the bot proceeds.

PR: AlaudaDevops/docker-sonarqube#30
Branch: alauda-2025.1.0
Type: Security / Dependency update (Renovate)

Please reply with /approve-merge or provide explicit approval for the bot to merge this PR on the next sweep.

[alaudabot]

[pr-assist-bot] Release Branch Security PR — Owner Approval Needed

This PR targets release branch alauda-2025.1.0. Per policy, release-branch dependency merges require explicit owner approval before the bot proceeds.

PR: #30 — fix(deps): update dependency com.microsoft.sqlserver:mssql-jdbc to v12.8.2.jre11 [security]
Branch: alauda-2025.1.0
Type: Security / Dependency update (Renovate)

Please reply with /approve-merge or provide explicit approval for the bot to merge this PR on the next sweep.

[alaudabot]

/retest

[alaudabot]

/retest

[alaudabot]

/retest

[alaudabot]

PR Assist Bot Analysis

Failure Type: Infrastructure / Repository Access
Failed Checks: sonarqube-build, sonarqube-plugin
Root Cause: The git-clone task is failing at the start of both pipelines (Tasks Completed: 1 Failed, Skipped: 10), preventing all downstream steps from running. This is a persistent clone failure on the alauda-2025.1.0 branch — possibly a credential, access, or branch configuration issue.
Retest attempts: 3 — stopping (same git-clone failure pattern, no progress)
Recommendation: Manual investigation needed — verify repository access for the CI runner to the alauda-2025.1.0 branch. The mssql-jdbc v12.8.2 update itself may be fine; the CI infrastructure needs attention.

[alaudabot]

PR Assist Bot Analysis

Failure Type: Infrastructure / Repository Access
Failed Checks: sonarqube-build, sonarqube-plugin
Root Cause: The git-clone task is failing at the start of both pipelines, preventing all downstream steps from running. This is a persistent clone failure on the alauda-2025.1.0 branch — consistent with the same pattern seen in docker-sonarqube#33 and #35 on this branch.
Retest attempts: 3 — stopping (same git-clone failure pattern, no progress)
Recommendation: Manual investigation needed — verify repository access for the CI runner to the alauda-2025.1.0 branch. The mssql-jdbc v12.8.2 update itself may be fine; the CI infrastructure needs attention.

[danielfbm]

PR Assist Bot Analysis

Failure Type: Infrastructure/Transient (git-clone network timeout)
Failed Checks: Pipelines as Code CI / sonarqube-build, Pipelines as Code CI / sonarqube-plugin
Retest attempts: 3 — stopping (same failure pattern, no progress)

Root Cause: Both checks fail at the git-clone step with a 10-minute timeout — same GitHub network connectivity issue affecting the build cluster (~2026-04-21T04:51 UTC window). The security dependency update in this PR is unrelated.

Recommendation: Manual investigation needed — 3 retest attempts exhausted. See docker-sonarqube#35 for the same diagnosis.

[alaudabot]

🚨 Stale Pull Request Warning

This pull request has been inactive for 32 days.

Automated Actions Schedule:

• ⚠️ Warning: After 30 days (now)
• 🔒 Auto-close: After 60 days
• 🗑️ Branch deletion: After 90 days (if not protected)

To keep this PR active:

• Add new commits
• Reply to this comment
• Request reviews

Protected branches (won't be deleted): main,release-*,alauda-*

This is an automated message. Reply to this comment to reset the inactivity timer.

[alaudabot]

🚨 Stale Pull Request Warning

This pull request has been inactive for 35 days.

Automated Actions Schedule:

• ⚠️ Warning: After 30 days (now)
• 🔒 Auto-close: After 60 days
• 🗑️ Branch deletion: After 90 days (if not protected)

To keep this PR active:

• Add new commits
• Reply to this comment
• Request reviews

Protected branches (won't be deleted): main,release-*,alauda-*

This is an automated message. Reply to this comment to reset the inactivity timer.