Skip to content

Bump the safe-patch-updates group across 1 directory with 3 updates#526

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/maven/develop/safe-patch-updates-3e1af85c75
Open

Bump the safe-patch-updates group across 1 directory with 3 updates#526
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/maven/develop/safe-patch-updates-3e1af85c75

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 30, 2026

Copy link
Copy Markdown

Bumps the safe-patch-updates group with 3 updates in the / directory: org.postgresql:postgresql, jakarta.annotation:jakarta.annotation-api and org.glassfish.hk2:osgi-resource-locator.

Updates org.postgresql:postgresql from 42.7.11 to 42.7.12

Release notes

Sourced from org.postgresql:postgresql's releases.

Security

Silent channel-binding authentication downgrade (CVE-2026-54291)

channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS (with channel binding) to plain SCRAM-SHA-256 (without it), losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection triggers the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash. Examples are Ed25519, Ed448, and post-quantum algorithms.

Two issues combine in releases 42.7.4 through 42.7.11:

The bundled com.ongres.scram:scram-client (3.1 or 3.2) returns an empty byte array instead of failing when it cannot derive the binding hash for such a certificate. This is the library issue tracked as GHSA-p9jg-fcr6-3mhf.

pgJDBC does not enforce channelBinding=require where it matters. ScramAuthenticator checks only that the server advertised a -PLUS mechanism; it neither rejects the empty binding nor checks that the negotiated mechanism uses channel binding. The connection therefore downgrades silently.

Only connections that set channelBinding=require are affected. Under the default prefer policy, and under allow or disable, falling back to plain SCRAM is the documented behaviour.

Releases before 42.7.4 are unaffected, because they do not support channel binding.

Changelog

Sourced from org.postgresql:postgresql's changelog.

[42.7.12] (2026-xx-xx)

Security

Added

  • feat: reWriteBatchedInserts now merges up to 32768 rows into one multi-values INSERT (bounded by the 65535 bind-parameter limit on the extended protocol) instead of capping at 128, which speeds up batches of few-column rows. The new reWriteBatchedInsertsSize connection property lowers that cap when set; the default of 0 uses that maximum.
  • feat: invalidate the prepared-statement cache after CREATE/DROP/ALTER so callers no longer trip on "cached plan must not change result type" without opting into autosave=ALWAYS. Controlled by the new flushCacheOnDdl connection property (default true); set to false for the prior behaviour.
  • feat: add connectExecutor connection property to customize the Executor used to run the worker task that performs the connection attempt when loginTimeout is in effect. The value is the fully qualified name of a class implementing java.util.concurrent.Executor. With a null value, the default, the driver retains the prior behavior of running the connection attempt on a daemon thread named "PostgreSQL JDBC driver connection thread". The executor must run the task on a thread other than the caller's. Running the attempt on a named thread lets applications that monitor driver-created threads identify it.
  • feat: add connectThreadFactory connection property to customize the ThreadFactory used to spawn the worker thread that runs the connection attempt when loginTimeout is in effect. The value is the fully qualified name of a class implementing java.util.concurrent.ThreadFactory. With a null value, the default, the driver retains the prior behavior of using a daemon thread named "PostgreSQL JDBC driver connection thread". Useful for testing timeout behaviour or for applications that want detailed control of all driver-created threads.
  • feat: add classLoaderStrategy connection property to control which classloaders the driver searches when loading a class named by a connection property, for example socketFactory. The default driver-first now falls back to the thread context classloader when the driver's classloader cannot resolve the class, which fixes class loading in non-flat class paths such as Quarkus and OSGi. Set driver to keep the previous driver-classloader-only behaviour, or context-first to prefer the thread context classloader [Issue #2112](pgjdbc/pgjdbc#2112)

Changed

  • refactor: the worker that runs the connection attempt under loginTimeout is now a FutureTask (ConnectTask) instead of the hand-rolled ConnectThread. When the caller hits the timeout, the task is now cancelled with cancel(true), which interrupts the worker thread rather than letting it run to completion. This makes the connection attempt interruptible, so loginTimeout can stop a slow connection attempt instead of leaking a thread. As before, a connection that the worker still manages to establish after the caller gives up is closed by the worker so that it does not leak. There are no public API changes and this should only lead to faster background resource cleanup for connections that time out.
  • chore: PGXAConnection.ConnectionHandler now rejects setAutoCommit(false) and setSavepoint(...) during an active XA branch, in addition to the long-rejected setAutoCommit(true) / commit() / rollback(). The setSavepoint rejection was already meant to be in place but the guard misspelled the method name as setSavePoint, so savepoints silently went through. Both changes bring the proxy in line with JTA 1.2 §3.4.
  • chore: commitPrepared / rollback-of-prepared now return XAER_RMFAIL instead of XAER_RMERR when the underlying connection is left in a non-idle TransactionState. Transaction managers (Geronimo, Narayana, Atomikos) treat XAER_RMFAIL as retryable on a fresh XAResource; the prepared transaction is no longer abandoned.

Fixed

  • fix: the published GitHub release now ships the released postgresql-<version>.jar and its detached PGP signature, taken from the same signed build that is uploaded to Maven Central, instead of a leftover SNAPSHOT jar [Issue #3812](pgjdbc/pgjdbc#3812) [PR #3814](pgjdbc/pgjdbc#3814)
  • fix: simplify the Statement#cancel state machine by dropping the redundant CANCELLED state. killTimerTask now waits for the state to return to IDLE directly, which removes a spin-forever case when more than one thread observes the cancel completing [PR #1827](pgjdbc/pgjdbc#1827).
  • perf: defer simple-query flushes until the driver reads the response, allowing BEGIN and the following query to share a network flush [Issue #3894](pgjdbc/pgjdbc#3894)
  • fix: reWriteBatchedInserts no longer throws IllegalArgumentException when batching a parameterless INSERT (for example INSERT INTO t VALUES (1, 2)) of 256 rows or more.
  • fix: a comment before CALL in a CallableStatement no longer hides the native call, so OUT parameter registration works for /* comment */ call proc(?, ?) and similar. Parser.modifyJdbcCall now skips leading whitespace and SQL comments (both -- and /* */) before the call, tolerates a trailing comment after a { ... } escape, and no longer adds a spurious comma when moving an OUT parameter into a call whose arguments are only a comment [Issue #2538](pgjdbc/pgjdbc#2538)
  • fix: PreparedStatement.toString() no longer throws for a bytea value supplied as text via PGobject. Hex-format values (\x...) are validated and rendered as a bytea literal, and escape-format values are quoted and cast like any other literal [Issue #3757](pgjdbc/pgjdbc#3757)
  • fix: the driver no longer nulls the contextClassLoader of shared ForkJoinPool.commonPool() worker threads, which previously left unrelated tasks on those threads running with a null classloader [Issue #4155](pgjdbc/pgjdbc#4155)
  • fix: getCharacterStream wraps String in StringReader [PR #4063](pgjdbc/pgjdbc#4063)
  • fix: PGXAConnection no longer saves and restores the underlying connection's JDBC autoCommit flag. All XA-protocol SQL (BEGIN, PREPARE TRANSACTION, COMMIT, ROLLBACK, COMMIT PREPARED, ROLLBACK PREPARED, the recover() SELECT) is sent through QUERY_SUPPRESS_BEGIN, so the caller's autoCommit value is invariant across every XAResource call. Fixes the "2nd phase commit must be issued using an idle connection" failure during recovery on managed datasources that pool connections with autoCommit=false (TomEE, WildFly, WebSphere Liberty).
  • fix: PGXAConnection.prepare() now mutates XA state only after PREPARE TRANSACTION succeeds. A failed PREPARE previously left the driver thinking the branch was already prepared, so the follow-up rollback(xid) tried ROLLBACK PREPARED against a non-existent gid and returned XAER_RMERR. Transaction managers (Narayana) escalated this to HeuristicMixedException. With the fix, rollback(xid) takes the active-branch path and issues a plain ROLLBACK, which the server accepts cleanly. Fixes [Issue #3153](pgjdbc/pgjdbc#3153), [Issue #3123](pgjdbc/pgjdbc#3123).
  • fix: an updatable result set over an unqualified table name is now classified using only the table visible through search_path. When two schemas held a table with the same name and the same primary or unique index name but a different set of key columns, the driver took the union of both schemas' columns, so the result set could be wrongly rejected as not updatable [PR #4214](pgjdbc/pgjdbc#4214). Supersedes [PR #3400](pgjdbc/pgjdbc#3400).
Commits

Updates jakarta.annotation:jakarta.annotation-api from 2.1.0 to 2.1.1

Commits

Updates org.glassfish.hk2:osgi-resource-locator from 1.0.3 to 1.0.4

Release notes

Sourced from org.glassfish.hk2:osgi-resource-locator's releases.

1.0.4

What's Changed

This is a port of 3.0.0 changes to 1.0.x branch. Both 3.0.0 and 1.0.4 contain exactly the same changes.

Improvements

Fixes

Maintenance

Dependency upgrades

... (truncated)

Commits
  • 046f6db Prepare release 1.0.4
  • f5ec9f3 Merge pull request #86 from caytec/refactor/java-security-ultimate-scan
  • 43e36eb Fixed potential NPE in ServiceLoader class
  • 9a4cd98 Bump org.apache.felix:maven-bundle-plugin from 5.1.9 to 6.0.0
  • 97826e0 Bump org.junit:junit-bom from 5.11.3 to 5.11.4
  • 8d164db Bump org.apache.maven.plugins:maven-javadoc-plugin from 3.11.1 to 3.11.2
  • 8b7a6b8 Bump org.apache.maven.plugins:maven-javadoc-plugin from 3.10.1 to 3.11.1
  • ebf475c Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.1 to 3.5.2
  • 1eb095e Bump org.junit:junit-bom from 5.11.2 to 5.11.3
  • 2c7e5a3 Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.0 to 3.5.1
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the safe-patch-updates group across 1 directory with 3 updates
f5fee4c 
Bumps the safe-patch-updates group with 3 updates in the / directory: [org.postgresql:postgresql](https://github.com/pgjdbc/pgjdbc), [jakarta.annotation:jakarta.annotation-api](https://github.com/eclipse-ee4j/common-annotations-api) and [org.glassfish.hk2:osgi-resource-locator](https://github.com/eclipse-ee4j/glassfish-hk2-extra).


Updates `org.postgresql:postgresql` from 42.7.11 to 42.7.12
- [Release notes](https://github.com/pgjdbc/pgjdbc/releases)
- [Changelog](https://github.com/pgjdbc/pgjdbc/blob/master/CHANGELOG.md)
- [Commits](pgjdbc/pgjdbc@REL42.7.11...REL42.7.12)

Updates `jakarta.annotation:jakarta.annotation-api` from 2.1.0 to 2.1.1
- [Commits](jakartaee/common-annotations-api@2.1.0...2.1.1)

Updates `org.glassfish.hk2:osgi-resource-locator` from 1.0.3 to 1.0.4
- [Release notes](https://github.com/eclipse-ee4j/glassfish-hk2-extra/releases)
- [Commits](eclipse-ee4j/glassfish-hk2-extra@1.0.3-RELEASE...1.0.4)

---
updated-dependencies:
- dependency-name: org.postgresql:postgresql
  dependency-version: 42.7.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: safe-patch-updates
- dependency-name: jakarta.annotation:jakarta.annotation-api
  dependency-version: 2.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: safe-patch-updates
- dependency-name: org.glassfish.hk2:osgi-resource-locator
  dependency-version: 1.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: safe-patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Jun 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants