fix(deps): update dependency com.microsoft.sqlserver:mssql-jdbc to v10 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
com.microsoft.sqlserver:mssql-jdbc	8.4.1.jre8 → 10.2.4.jre11

---

JDBC Driver for SQL Server has improper input validation issue

CVE-2025-59250 / GHSA-m494-w24q-6f7w

More information

Details

Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-59250
• https://github.com/microsoft/mssql-jdbc/pull/2798
• https://github.com/microsoft/mssql-jdbc/pull/2800
• https://github.com/microsoft/mssql-jdbc/pull/2801
• https://github.com/microsoft/mssql-jdbc/pull/2802
• https://github.com/microsoft/mssql-jdbc/pull/2803
• https://github.com/microsoft/mssql-jdbc/pull/2807
• https://github.com/microsoft/mssql-jdbc/commit/9732e1bbc6ec44166fda2cddab31ce1c86c873dd#diff-45367b99a1951943bfecfc7765e80df687967aa56286a5b2e039f77cd9a0e118
• https://github.com/microsoft/mssql-jdbc
• https://github.com/microsoft/mssql-jdbc/blob/main/CHANGELOG.md
• https://learn.microsoft.com/en-us/sql/connect/jdbc/microsoft-jdbc-driver-for-sql-server-support-matrix
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59250

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Test Results

654 tests  ±0   654 ✅ ±0   3m 16s ⏱️ +40s
108 suites ±0     0 💤 ±0 
108 files   ±0     0 ❌ ±0 

Results for commit 226871a. ± Comparison against base commit e72e766.

[jbeckers]

I'm unsure why Renovate suggests such an old version.

We have been using mssql-jdbc-13.2.1.jre11 in prod for over a year (and are planning to upgrade to the latest version 13.4.0 as we speak).

JDK support for all versions is similar, newer is better: https://learn.microsoft.com/en-us/sql/connect/jdbc/microsoft-jdbc-driver-for-sql-server-support-matrix?view=sql-server-ver17#java-and-jdbc-specification-support

SQL server support is the same for all versions: https://learn.microsoft.com/en-us/sql/connect/jdbc/microsoft-jdbc-driver-for-sql-server-support-matrix?view=sql-server-ver17#sql-version-compatibility

[mgaffigan]

I'm unsure why Renovate suggests such an old version.

Agreed, but progress is progress.

[tonygermano]

I'm unsure why Renovate suggests such an old version.

@jbeckers My guess is because this is a security update, and that is the lowest version that is not affected by the named CVE. I'm sure we would entertain a PR that upgrades the library to something more current, especially if it's already well tested in your environment.