From dc82ad6d6cb0d8e8e350fa330045162b835c12d0 Mon Sep 17 00:00:00 2001
From: maxpetrusenkoagent <max.petrusenko.agent@gmail.com>
Date: Mon, 15 Jun 2026 05:04:40 -0400
Subject: [PATCH] Pin Debian MariaDB client library

---
 docker/Dockerfile.debian | 19 +++++++++++++++++++
 docker/Dockerfile.j2     | 21 ++++++++++++++++++++-
 2 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/docker/Dockerfile.debian b/docker/Dockerfile.debian
index 85afb0f5..c7faa073 100644
--- a/docker/Dockerfile.debian
+++ b/docker/Dockerfile.debian
@@ -51,6 +51,16 @@ ENV DEBIAN_FRONTEND=noninteractive \
     TERM=xterm-256color \
     CARGO_HOME="/root/.cargo" \
     USER="root"
+
+# Force the install of an older MariaDB client library to prevent Diesel from
+# misreading result sets with affected MariaDB Connector/C releases.
+# See https://github.com/dani-garcia/vaultwarden/issues/6416
+# See https://github.com/dani-garcia/vaultwarden/issues/7268
+RUN echo "deb http://snapshot.debian.org/archive/debian/20250707T084701Z/ trixie main" > /etc/apt/sources.list.d/mariadb-snapshot.list && \
+    echo "Acquire::Check-Valid-Until false;" > /etc/apt/apt.conf.d/allow-snapshot && \
+    echo 'Package: libmariadb* mariadb*' > /etc/apt/preferences.d/mariadb-snapshot && \
+    echo 'Pin: origin "snapshot.debian.org"' >> /etc/apt/preferences.d/mariadb-snapshot && \
+    echo 'Pin-Priority: 1001' >> /etc/apt/preferences.d/mariadb-snapshot
 # Install clang && xx-c-essentials to get `xx-cargo` working
 # Install pkg-config to allow amd64 builds to find all libraries
 # Install git so build.rs can determine the correct version
@@ -148,6 +158,15 @@ ENV ROCKET_PROFILE="release" \
 
 # Create data folder and Install needed libraries
 RUN mkdir /data && \
+    # Force the install of an older MariaDB client library to prevent Diesel from
+    # misreading result sets with affected MariaDB Connector/C releases.
+    # See https://github.com/dani-garcia/vaultwarden/issues/6416
+    # See https://github.com/dani-garcia/vaultwarden/issues/7268
+    echo "deb http://snapshot.debian.org/archive/debian/20250707T084701Z/ trixie main" > /etc/apt/sources.list.d/mariadb-snapshot.list && \
+    echo "Acquire::Check-Valid-Until false;" > /etc/apt/apt.conf.d/allow-snapshot && \
+    echo 'Package: libmariadb* mariadb*' > /etc/apt/preferences.d/mariadb-snapshot && \
+    echo 'Pin: origin "snapshot.debian.org"' >> /etc/apt/preferences.d/mariadb-snapshot && \
+    echo 'Pin-Priority: 1001' >> /etc/apt/preferences.d/mariadb-snapshot && \
     apt-get update && apt-get install -y \
         --no-install-recommends \
         ca-certificates \
diff --git a/docker/Dockerfile.j2 b/docker/Dockerfile.j2
index f7a056ff..26938109 100644
--- a/docker/Dockerfile.j2
+++ b/docker/Dockerfile.j2
@@ -72,8 +72,18 @@ ENV DEBIAN_FRONTEND=noninteractive \
     # Debian Trixie uses libpq v17
     PQ_LIB_DIR="/usr/local/musl/pq17/lib"
 {%- endif %}
-
 {% if base == "debian" %}
+
+# Force the install of an older MariaDB client library to prevent Diesel from
+# misreading result sets with affected MariaDB Connector/C releases.
+# See https://github.com/dani-garcia/vaultwarden/issues/6416
+# See https://github.com/dani-garcia/vaultwarden/issues/7268
+RUN echo "deb http://snapshot.debian.org/archive/debian/20250707T084701Z/ trixie main" > /etc/apt/sources.list.d/mariadb-snapshot.list && \
+    echo "Acquire::Check-Valid-Until false;" > /etc/apt/apt.conf.d/allow-snapshot && \
+    echo 'Package: libmariadb* mariadb*' > /etc/apt/preferences.d/mariadb-snapshot && \
+    echo 'Pin: origin "snapshot.debian.org"' >> /etc/apt/preferences.d/mariadb-snapshot && \
+    echo 'Pin-Priority: 1001' >> /etc/apt/preferences.d/mariadb-snapshot
+
 # Install clang && xx-c-essentials to get `xx-cargo` working
 # Install pkg-config to allow amd64 builds to find all libraries
 # Install git so build.rs can determine the correct version
@@ -193,6 +203,15 @@ ENV ROCKET_PROFILE="release" \
 # Create data folder and Install needed libraries
 RUN mkdir /data && \
 {% if base == "debian" %}
+    # Force the install of an older MariaDB client library to prevent Diesel from
+    # misreading result sets with affected MariaDB Connector/C releases.
+    # See https://github.com/dani-garcia/vaultwarden/issues/6416
+    # See https://github.com/dani-garcia/vaultwarden/issues/7268
+    echo "deb http://snapshot.debian.org/archive/debian/20250707T084701Z/ trixie main" > /etc/apt/sources.list.d/mariadb-snapshot.list && \
+    echo "Acquire::Check-Valid-Until false;" > /etc/apt/apt.conf.d/allow-snapshot && \
+    echo 'Package: libmariadb* mariadb*' > /etc/apt/preferences.d/mariadb-snapshot && \
+    echo 'Pin: origin "snapshot.debian.org"' >> /etc/apt/preferences.d/mariadb-snapshot && \
+    echo 'Pin-Priority: 1001' >> /etc/apt/preferences.d/mariadb-snapshot && \
     apt-get update && apt-get install -y \
         --no-install-recommends \
         ca-certificates \