Update dependency org.postgresql:postgresql to v42.7.13 by renovate[bot] · Pull Request #120 · slick/slick-testkit-example

renovate · 2025-01-14T22:01:44Z

This PR contains the following updates:

Package	Type	Update	Change
org.postgresql:postgresql (source)	Test	patch	`42.7.4` → `42.7.13`

Release Notes

pgjdbc/pgjdbc (org.postgresql:postgresql)

`v42.7.13`

Added

feat: invalidate the prepared-statement cache when the server reports a search_path change via GUC_REPORT (PostgreSQL 18+), so cached plans are no longer used against the wrong schema PR #4259
feat: reWriteBatchedInserts now merges up to 32768 rows into one multi-values INSERT (bounded by the 65535 bind-parameter limit on the extended protocol) instead of capping at 128, which speeds up batches of few-column rows. The new reWriteBatchedInsertsSize connection property lowers that cap when set; the default of 0 uses that maximum. PR #4207
feat: invalidate the prepared-statement cache after CREATE/DROP/ALTER so callers no longer trip on "cached plan must not change result type" without opting into autosave=ALWAYS. Controlled by the new flushCacheOnDdl connection property (default true); set to false for the prior behaviour. PR #4067
feat: add connectExecutor connection property to customize the Executor used to run the worker task that performs the connection attempt when loginTimeout is in effect. The value is the fully qualified name of a class implementing java.util.concurrent.Executor. With a null value, the default, the driver retains the prior behavior of running the connection attempt on a daemon thread named "PostgreSQL JDBC driver connection thread". The executor must run the task on a thread other than the caller's. Running the attempt on a named thread lets applications that monitor driver-created threads identify it. PR #4165
feat: add classLoaderStrategy connection property to control which classloaders the driver searches when loading a class named by a connection property, for example socketFactory. The default driver-first now falls back to the thread context classloader when the driver's classloader cannot resolve the class, which fixes class loading in non-flat class paths such as Quarkus and OSGi. Set driver to keep the previous driver-classloader-only behaviour, or context-first to prefer the thread context classloader Issue #2112 PR #4167
feat: add OID constants for geometric arrays, RECORD, and refcursor PR #4220
feat: LargeObject BlobInputStream now skips by seeking instead of reading, and the driver exposes the server version so it can select the 64-bit large-object API where available PR #4204

Changed

refactor: the worker that runs the connection attempt under loginTimeout is now a FutureTask (ConnectTask) instead of the hand-rolled ConnectThread. When the caller hits the timeout, the task is now cancelled with cancel(true), which interrupts the worker thread rather than letting it run to completion. This makes the connection attempt interruptible, so loginTimeout can stop a slow connection attempt instead of leaking a thread. As before, a connection that the worker still manages to establish after the caller gives up is closed by the worker so that it does not leak. There are no public API changes and this should only lead to faster background resource cleanup for connections that time out. PR #4120
chore: PGXAConnection.ConnectionHandler now rejects setAutoCommit(false) and setSavepoint(...) during an active XA branch, in addition to the long-rejected setAutoCommit(true) / commit() / rollback(). The setSavepoint rejection was already meant to be in place but the guard misspelled the method name as setSavePoint, so savepoints silently went through. Both changes bring the proxy in line with JTA 1.2 §3.4. PR #4114
chore: commitPrepared / rollback-of-prepared now return XAER_RMFAIL instead of XAER_RMERR when the underlying connection is left in a non-idle TransactionState. Transaction managers (Geronimo, Narayana, Atomikos) treat XAER_RMFAIL as retryable on a fresh XAResource; the prepared transaction is no longer abandoned. PR #4114
refactor: derive getPrimaryKeys from pg_constraint.conkey PR #4202

Fixed

fix: the published GitHub release now ships the released postgresql-<version>.jar and its detached PGP signature, taken from the same signed build that is uploaded to Maven Central, instead of a leftover SNAPSHOT jar Issue #3812 PR #3814
fix: simplify the Statement#cancel state machine by dropping the redundant CANCELLED state. killTimerTask now waits for the state to return to IDLE directly, which removes a spin-forever case when more than one thread observes the cancel completing PR #1827.
perf: defer simple-query flushes until the driver reads the response, allowing BEGIN and the following query to share a network flush Issue #3894 PR #4196
fix: reWriteBatchedInserts no longer throws IllegalArgumentException when batching a parameterless INSERT (for example INSERT INTO t VALUES (1, 2)) of 256 rows or more PR #4207
fix: a comment before CALL in a CallableStatement no longer hides the native call, so OUT parameter registration works for /* comment */ call proc(?, ?) and similar. Parser.modifyJdbcCall now skips leading whitespace and SQL comments (both -- and /* */) before the call, tolerates a trailing comment after a { ... } escape, and no longer adds a spurious comma when moving an OUT parameter into a call whose arguments are only a comment Issue #2538 PR #4209
fix: PreparedStatement.toString() no longer throws for a bytea value supplied as text via PGobject. Hex-format values (\x...) are validated and rendered as a bytea literal, and escape-format values are quoted and cast like any other literal Issue #3757 PR #4201
fix: the driver no longer nulls the contextClassLoader of shared ForkJoinPool.commonPool() worker threads, which previously left unrelated tasks on those threads running with a null classloader Issue #4155 PR #4156
fix: PgResultSet#getCharacterStream wraps String in a StringReader PR #4063
fix: PGXAConnection no longer saves and restores the underlying connection's JDBC autoCommit flag. All XA-protocol SQL (BEGIN, PREPARE TRANSACTION, COMMIT, ROLLBACK, COMMIT PREPARED, ROLLBACK PREPARED, the recover() SELECT) is sent through QUERY_SUPPRESS_BEGIN, so the caller's autoCommit value is invariant across every XAResource call. Fixes the "2nd phase commit must be issued using an idle connection" failure during recovery on managed datasources that pool connections with autoCommit=false (TomEE, WildFly, WebSphere Liberty) PR #4114
fix: PGXAConnection.prepare() now mutates XA state only after PREPARE TRANSACTION succeeds. A failed PREPARE previously left the driver thinking the branch was already prepared, so the follow-up rollback(xid) tried ROLLBACK PREPARED against a non-existent gid and returned XAER_RMERR. Transaction managers (Narayana) escalated this to HeuristicMixedException. With the fix, rollback(xid) takes the active-branch path and issues a plain ROLLBACK, which the server accepts cleanly. Fixes Issue #3153, Issue #3123. PR #4114
fix: an updatable result set over an unqualified table name is now classified using only the table visible through search_path. When two schemas held a table with the same name and the same primary or unique index name but a different set of key columns, the driver took the union of both schemas' columns, so the result set could be wrongly rejected as not updatable PR #4214. Supersedes PR #3400.
fix: LargeObject.close() now flushes a buffered output stream before marking the object closed, so closing a large object without an explicit flush() no longer drops buffered writes. The flush runs while the object is still open (it calls back into LargeObject.write()), and lo_close always runs afterward; a failure from lo_close no longer masks an earlier flush error, and the transaction is not committed when the flush failed Issue #4247 PR #4248.
fix: reject empty timestamp, timestamptz, and date text with a clear SQLException (SQLState 22007) instead of an ArrayIndexOutOfBoundsException PR #4278
fix: return null CHAR_OCTET_LENGTH for non-character columns PR #4231
fix: honor scale in ResultSet.getBigDecimal(int, int) PR #4211
fix: support java.time values in an updatable ResultSet updateRow() / insertRow() PR #3848
fix: improve batching when the RETURNING clause contains varchar or numeric types PR #4014
fix: correct estimatedReceiveBufferBytes accounting after a forced Sync PR #4014
fix: avoid creating a transient ResultSet for describe-statement purposes, and restore the pre-describe path for generated-key batches PR #4014
fix: add an explicit failure message when a multi-statement command executes in a batch PR #4014
fix: detect search_path changes case-insensitively PR #4216
fix: auto-detect the SSL key format instead of relying on the .key extension PR #3946
fix: build PKIX trust anchors without a KeyStore so FIPS JVMs work PR #4193
fix: use gssResponseTimeout rather than sslResponseTimeout for GSS connections PR #4076
fix: skip the autosave savepoint for SET LOCAL / SET SESSION TRANSACTION PR #4203
fix: do not throw AssertionError from BatchResultHandler on a closed connection PR #4187
fix: reject SQL_TSI_FRAC_SECOND with an explicit, explained error PR #4229
fix: reject a null URL in Driver.acceptsURL with a clear NullPointerException PR #4205
fix: reject overlong inputs in NumberParser.getFastLong instead of silently wrapping PR #4163
fix: reject out-of-range and NaN values in PGInterval.setSeconds PR #4194
fix: close the socket when PgConnection setup fails after connect PR #4161
fix: keep the LazyCleanerImpl cleanup task alive across a transient empty queue PR #4038
fix: append the default non-proxy hosts when socksNonProxyHosts is set PR #4045
fix: clear the ResourceBundle cache on deregister so the driver can unload PR #4237
fix: delete the temp file when spooling a stream to disk fails with an IOException PR #4190
fix: avoid a direct java.lang.management dependency in the maxResultBuffer parser PR #4069

`v42.7.12`

Security

fix: Enforce SCRAM channel-binding policy and prevent silent downgrade.
Under channelBinding=require, the driver silently downgraded from SCRAM-SHA-256-PLUS (with channel binding) to plain SCRAM-SHA-256 (without it) when the server presented a certificate whose signature algorithm has no tls-server-end-point channel-binding hash (e.g. Ed25519, Ed448, or post-quantum algorithms). An attacker who can intercept the TLS connection could exploit this to strip channel-binding protection.
The fix enforces channel binding in the driver's own code: it now fails the connection when no binding data can be extracted, and verifies the negotiated mechanism uses channel binding (-PLUS) when require is set.
Only connections that set channelBinding=require are affected. The default prefer policy and releases before 42.7.4 (which introduced channel-binding support) are unaffected.
See the Security Advisory for more detail.
The following CVE-2026-54291 has been issued.

`v42.7.11`

Security

fix: Limit SCRAM PBKDF2 iterations accepted from the server.
pgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256 authentication, where a malicious or compromised PostgreSQL server could specify an extremely large PBKDF2 iteration count, causing the client to consume unbounded CPU and potentially exhaust connection pools. The fix introduces a new scramMaxIterations connection property (defaulting to 100,000) to cap iteration counts before computation begins.
See the Security Advisory for more detail.
The following CVE-2026-42198 has been issued.

Added

feat: implement require_auth connection property, aligning with libpq behavior PR #3895

Changed

chore: replace Appveyor CI with ikalnytskyi/action-setup-postgres PR #3966
chore: upgrade Gradle to v9 PR #3978

Fixed

fix: ensure extended protocol messages end with Sync message PR #3728
fix: enable cursor-based fetching in extended protocol when transaction started via SQL command PR #3996
fix: retry with SSL on IOException when sslMode=ALLOW PR #3973
fix: make sure the driver honours connectTimeout when retrying the connection PR #3968
fix: allow fallback to non-SSL connection when sslMode=prefer and sslResponseTimeout kicks in PR #3968
fix: catch SecurityException from setContextClassLoader on ForkJoinPool workers PR #3962
fix: use compareTo for LogSequenceNumber comparison to handle unsigned values correctly PR #3961
fix: release COPY lock on IOException to prevent connection hang PR #3957
fix: return jsonb as PGObject instead of String PR #3956
fix: align SSL key file permission check with libpq PR #3952
fix: guard connection closed flag with a reentrant lock to protect against concurrent close PR #3905

`v42.7.10`

Changed

chore: Migrate to Shadow 9 PR 3931
style: fix empty line before javadoc for checkstyle compliance PR #3925
style: fix lambda argument indentation for checkstyle compliance PR #3922
test: add autosave=always|never|conservative and cleanupSavepoints=true|false to the randomized CI jobs PR #3917

Fixed

fix: non-standard strings failing test for version 19 PR #3934
fix: small issues in ConnectionFactoryImpl PR #3929
fix: process pending responses before fastpath to avoid protocol errors PR # 3913
doc: use.md, fix typos PR #3911
doc: datasource.md, fix minor formatting issue PR #3912
doc: add the new PGP signing key to the official documentation PR #3912

Reverted

Revert "fix: make all Calendar instances proleptic Gregorian (#3837) (#3887)" PR #3932

`v42.7.9`

Added

feat: query timeout property PR #3705
feat: Add PEMKeyManager to handle PEM based certs and keys PR #3700

Changed

perf: optimize PGInterval.getValue() by replacing String.format with StringBuilder
doc: update property quoteReturningIdentifiers default value PR #3847
security: Use a static method forName to load all user supplied classes. Use the Class.forName 3 parameter method and do not initilize it unless it is a subclass of the expected class

Fixed

fix: incorrect pg_stat_replication.reply_time calculation PR #3906
fix: close temporary lob descriptors that are used internally in PreparedStatement#setBlob
fix: PGXAConnection.prepare(Xid) should return XA_RDONLY if the connection is read only PR #3897
fix: make all Calendar instances proleptic Gregorian PR #3837
fix: Simplify concurrency guards on QueryExecutorBase#transaction and QueryExecutorBase#standardConformingStrings PR #3897
fix: avoid memory leaks in Java <= 21 caused by Thread.inheritedAccessControlContext PR #3886
fix: Issue #3784 pgjdbc can't decode numeric arrays containing special numbers like NaN PR #3838
fix: use ssl_is_used() to check for ssl connection PR #3867
fix: the classloader is nullable PR #3907

`v42.7.8`

Added

feat: Add configurable boolean-to-numeric conversion for ResultSet getters PR #3796

Changed

perf: remove QUERY_ONESHOT flag when calling getMetaData PR #3783
perf: use BufferedInputStream with FileInputStream PR #3750
perf: enable server-prepared statements for DatabaseMetaData

Fixed

fix: avoid NullPointerException when cancelling a query if cancel key is not known yet
fix: Change "PST" timezone in TimestampTest to "Pacific Standard Time" PR #3774
fix: traverse the current dimension to get the correct pos in PgArray#calcRemainingDataLength PR #3746
fix: make sure getImportedExportedKeys returns columns in consistent order
fix: Add "SELF_REFERENCING_COL_NAME" field to getTables' ResultSetMetaData to fix NullPointerException PR #3660
fix: unable to open replication connection to servers < 12
fix: avoid closing statement caused by driver's internal ResultSet#close()
fix: return empty metadata for empty catalog names as it was before
fix: Incorrect class comparison in PGXmlFactoryFactory validation

`v42.7.7`

Security

security: Client Allows Fallback to Insecure Authentication Despite channelBinding=require configuration.
Fix channel binding required handling to reject non-SASL authentication
Previously, when channel binding was set to "require", the driver would silently ignore this
requirement for non-SASL authentication methods. This could lead to a false sense of security
when channel binding was explicitly requested but not actually enforced. The fix ensures that when
channel binding is set to "require", the driver will reject connections that use
non-SASL authentication methods or when SASL authentication has not completed properly.
See the Security Advisory for more detail. Reported by George MacKerron
The following CVE-2025-49146 has been issued

Added

test: Added ChannelBindingRequiredTest to verify proper behavior of channel binding settings

`v42.7.6`

Features

fix: Enhanced DatabaseMetadata.getIndexInfo() method, added index comment as REMARKS property PR #3513

Performance Improvements

performance: Improve ResultSetMetadata.fetchFieldMetaData by using IN row values instead of UNION ALL for improved query performance (later reverted) PR #3510
feat:Use a single simple query for all startup parameters, so groupStartupParameters is no longer needed PR #3613

`v42.7.5`

Added

ci: Test with Java 23 PR #3381

Fixed

regression: revert change in fc60537 PR #3476
fix: PgDatabaseMetaData implementation of catalog as param and return value PR #3390
fix: Support default GSS credentials in the Java Postgres client PR #3451
fix: return only the transactions accessible by the current_user in XAResource.recover PR #3450
feat: don't force send extra_float_digits for PostgreSQL >= 12 fix Issue #3432 PR #3446
fix: exclude "include columns" from the list of primary keys PR #3434
perf: Enhance the meta query performance by specifying the oid. PR #3427
feat: support getObject(int, byte[].class) for bytea PR #3274
docs: document infinity and some minor edits PR #3407
fix: Added way to check for major server version, fixed check for RULE PR #3402
docs: fixed remaining paragraphs PR #3398
docs: fixed paragraphs in javadoc comments PR #3397
fix: Reuse buffers and reduce allocations in GSSInputStream addresses Issue #3251 PR #3255
chore: Update Gradle to 8.10.2 PR #3388
fix: getSchemas() PR #3386
fix: Update rpm postgresql-jdbc.spec.tpl with scram-client PR #3324
fix: Clearing thisRow and rowBuffer on close() of ResultSet Issue #3383 PR #3384
fix: Package was renamed to maven-bundle-plugin PR #3382
fix: As of version 18 the RULE privilege has been removed PR #3378
fix: use buffered inputstream to create GSSInputStream PR #3373
test: get rid of 8.4, 9.0 pg versions and use >= jdk version 17 PR #3372
Changed docker-compose version and renamed script file in instructions to match the real file name PR #3363
test:Do not assume "test" database in DatabaseMetaDataTransactionIsolationTest PR #3364
try to categorize dependencies PR #3362

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

mergify · 2026-06-23T11:55:51Z