Bump com.mchange:c3p0 from 0.12.0 to 0.14.0 in the maven group across 1 directory

[dependabot]

Bumps the maven group with 1 update in the / directory: com.mchange:c3p0.

Updates com.mchange:c3p0 from 0.12.0 to 0.14.0

Changelog

Sourced from com.mchange:c3p0's changelog.

    -- Reorganize the build, which previously was basically a direct port of an ancient ant
 build, into a build that is reliable, much simpler, and respects the mill-build philosophy.
 (With a lot of help from claude.ai, this one.)
    -- The Statement cache was clearing parameters and batches, but otherwise not resetting
       Statement state that may have been modified by prior users' activity. We now carefully
       either reset mutated Statement state, or refuse to re-cache on operations that change
       state in ways we can't reverse. Many thanks to Fredrik Jeppsson for calling attention
       to this issue!

c3p0-0.14.1 -- Modify c3p0 to use new BeanInfoGen functionality, restoring compatability with Java [7,11). -- Modify BeanInfoGen to (optionally but by default) cache descriptors rather than regenerating for each call to an introspection method. -- Modify BeanInfoGen to log items skipped from descriptors due to API incompatibility. -- Modify BeanInfoGen to generate BeanInfo classes in which properties/events/methods that existed in the JVM under which they were generated and built, but do not exist under the runtime JVM are tolerate, simply omitted at runtime from BeanInfo descriptors. This fixes compatability with Java environments before Java 11, under whose API c3p0 and mchange-commons-java are currently built. (Thanks to Vlad Skarzhevskyy, @​skarzhevskyy on GitHub, for calling attention to this issue.) c3p0-0.14.0 -- Update to mill 1.1.6 and fix broken support for reproducible builds via the SOURCE_DATE_EPOCH environment variable. -- Generate explicit BeanInfo classes for c3p0-defined concrete DataSource and ConnectionPoolDataSource implementations, which exclude "connection" and/or "pooledConnection" from introspected bean properties, in order to preclude attacks such as those described here: https://mogwailabs.de/en/blog/2023/04/look-mama-no-templatesimpl/ -- Enforce a deterministic ordering on methods produced by the code generator DelegatorGenerator, in order to keep builds including such generated classes reproducible. (mchange-commons-java and c3p0 subclass) -- Define BeanInfoGen, a code-generation utility that defines explicit BeanInfo classes for what otherwise would have been introspected via JavaBean naming conventions, but that permits properties to be excluded from such introspection. (mchange-commons-java) -- JavaBeanObjectFactory now enforces a whitelist of classes it is willing to construct from References that call upon it. That whitelist is defined by new config parameter com.mchange.v2.naming.referenceableJavaBeanClassWhitelist (mchange-commons-java) -- Define false-biased config security key com.mchange.v2.naming.allowIndirectSerializationViaReference, disabling by default indirect serialization/deserialization of Referenceable but otherwise not serializable objects by serializing their references. This is a clever mechanism, but rarely used, and a place where attackers might smuggle a malicious reference. (mchange-commons-java) c3p0-0.13.0 -- Ensure sessions are marked as endRequest() is called prior to check-in, to eliminate race between DBMS cleanup and checkout by a new client. Thanks Krrish (ota0912 on github). -- Take generic JavaBeanObjectFactory out of the whitelist of object factories, com.mchange.v2.naming.objectFactoryWhitelist, mchange-commons-java ReferenceableUtils is willing to dereference. Only C3P0JavaBeanObjectFactory should be used. -- Modify C3P0JavaBeanObjectFactory to use C3P0JavaBeanReferencePropertyOverrider. -- Modify the JavaBeanReferenceMaker employed by c3p0 beans to use C3P0JavaBeanReferencePropertyOverrider -- Define C3P0JavaBeanReferencePropertyOverrider, supporting the serialization and deserialization of user-defined config key value pairs (the 'extensions' property) -- Add support for extensions, in the form of JavaBeanReferencePropertyOverrider, that allow javax.naming.Referenceable JavaBeans that include non-String, non-coerceable-to-string,

... (truncated)

Commits

• 931fd53 Update test console scala version, versions for mchange-commons-java 0.6.0 fi...
• 76cff33 Extremely minor tweaks to tests.
• d35e3b1 Wrote release notes for 0.14.0.
• 50c128a Update CHANGELOG for 0.14.0, README.md fixes.
• d7ae528 Update README.md to track changes to the test.runClasspath task, when explain...
• 2607761 Update README.md for 0.14.0, add to brief note re security fixes, describe re...
• 0dfeb19 Make the output jar from our overridden sourceJar task 'out.jar' to match the...
• 943f8ce Add a mill-update script and update the mill wrapper script.
• 2bc04d7 Upgrade build to mill 1.1.6 and modify to support reproducible builds (of mai...
• ef8a6e9 Keep code-generation order deterministic by imposing a stable order on method...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.