Bump com.microsoft.sqlserver:mssql-jdbc from 13.4.0.jre11 to 13.6.0.jre11

[dependabot]

Bumps com.microsoft.sqlserver:mssql-jdbc from 13.4.0.jre11 to 13.6.0.jre11.

Release notes

Sourced from com.microsoft.sqlserver:mssql-jdbc's releases.

[13.6.0] Stable Release

Added

• Add FLOAT16 Vector Version Negotiation to the TVP Write Path #2997

  • What was added: Negotiated vector-version validation before writing VECTOR column metadata for table-valued parameters.
  • Who benefits: Applications sending vector columns through table-valued parameters.
  • Impact: Rejects all vectors on version 0 and FLOAT16 vectors on version 1 before data is written to the wire, with a clear driver error.

• Port Legacy FX Non-AE Test Scenarios to JUnit #3008

  • What was added: Forty-eight legacyFx-tagged JUnit tests covering previously unported non-Always-Encrypted functional scenarios.
  • Who benefits: Contributors and CI validation pipelines.
  • Impact: Improves regression coverage while advancing retirement of the legacy FX test suite.

• Add Cross-Driver Connection String Aliases for Unification #3011

  • What was added: Case-insensitive aliases for uid, trusted_connection, app, connectTimeout, columnEncryption, and quotedId, mapped to their canonical JDBC properties.
  • Who benefits: Applications sharing connection-string configuration across Microsoft data drivers.
  • Impact: Improves portability while preserving all existing JDBC property names and aliases.

• Add getCurrentApplicationName to PerformanceLogCallback #3018

  • What was added: A default getCurrentApplicationName() method that exposes the publishing connection's applicationName to performance callbacks.
  • Who benefits: Applications using connection pools and performance-event correlation.
  • Impact: Allows events to be associated with a pool or application without breaking existing callback implementations.

Changed

• Optimize MONEY, DECIMAL, and String Processing in the ResultSet Read Path #2991

  • What was changed: Removed intermediate allocations from MONEY/SMALLMONEY decoding, common BigDecimal encoding, short synchronous string reads, and NBCROW initialization.
  • Who benefits: Applications reading high-volume or wide result sets.
  • Impact: Reduces garbage-collection pressure and improves throughput while preserving decoded values and existing fallback behavior.

• Validate Reflective Class Names for Connection Properties #3004

  • What was changed: Added Java binary class-name validation before reflectively loading classes specified by properties such as socketFactoryClass and accessTokenCallbackClass.
  • Who benefits: Applications configuring custom callback, socket-factory, or related reflective classes.
  • Impact: Malformed class names now fail early with a dedicated driver error instead of producing confusing reflective-loading failures.

• Update Vector Tests for Server-Side FLOAT16/FLOAT32 Conversion #3005

  • What was changed: Updated and expanded vector tests for implicit and explicit conversion between FLOAT16 and FLOAT32 vector subtypes.
  • Who benefits: Contributors validating vector interoperability against servers supporting vector version 2.
  • Impact: Covers assignments, casts, conversions, bulk copy, routines, precision loss, nulls, and dimension mismatch behavior.

• Adjust License File to Enable GitHub Detection #3010

  • What was changed: Normalized the MIT license text formatting.
  • Who benefits: Repository users and automated tooling.
  • Impact: Enables GitHub to detect and display the repository license; there is no runtime impact.

• Suppress CodeQL False Positive for Protocol-Mandated MD5 #3014

  • What was changed: Documented and suppressed the CodeQL SM05136 finding for MD5 used by NTLM channel binding as required by MS-NLMP.
  • Who benefits: Contributors and security-scanning pipelines.
  • Impact: Reduces false-positive security findings without changing authentication behavior.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)