build(deps): bump the maven-minor-and-patch group across 1 directory with 6 updates #26

2026-10-17T18:53:14Z

dependabot[bot] commented

2026-10-17 18:53:14 +00:00

(Migrated from github.com)

Bumps the maven-minor-and-patch group with 6 updates in the / directory:

Package	From	To
com.kingsrook:qbit-build-parent	`2.1.0`	`2.1.2`
com.h2database:h2	`2.2.224`	`2.5.252`
org.postgresql:postgresql	`42.7.9`	`42.7.14`
org.testcontainers:testcontainers-postgresql	`2.0.3`	`2.0.5`
org.apache.maven.plugins:maven-checkstyle-plugin	`3.3.1`	`3.6.0`
org.apache.maven:apache-maven	`3.9.11`	`3.10.0`

Updates com.kingsrook:qbit-build-parent from 2.1.0 to 2.1.2

Release notes

Sourced from com.kingsrook:qbit-build-parent's releases.

Build Parent and Guardrails 2.1.2

com.kingsrook:qbit-build-parent:2.1.2 and com.kingsrook:qbit-guardrails:2.1.2 are published to Maven Central from the signed tag v2.1.2 on main 1630c83.

G1 default allow-lists now include qbit-assistant's provider SPI package (com.kingsrook.qbits.assistant.spi), so qbits can depend on the provider API without per-repo allow-list entries (#13).

This is a patch release with no other changes since 2.1.1.

Build Parent and Guardrails 2.1.1

com.kingsrook:qbit-build-parent:2.1.1 and com.kingsrook:qbit-guardrails:2.1.1 are published to Maven Central from the signed tag v2.1.1 on main 699c457.

G1 default allow-lists now include qbit-email and its public api package, so qbits can depend on qbit-email without per-repo allow-list entries (#12).

Patch release; no other changes from 2.1.0.

Changelog

Sourced from com.kingsrook:qbit-build-parent's changelog.

Changelog

All notable changes to QBit Build Parent POM will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

[Unreleased]

Changed

G1 default API packages include qbit-assistant's published provider SPI, com.kingsrook.qbits.assistant.spi; artifact com.kingsrook.qbits:qbit-assistant-provider-api is already covered by com.kingsrook.qbits:*-api. Assistant implementation packages remain forbidden.

G1 default allow-lists include qbit-email's published API: artifact com.kingsrook.qbits:qbit-email and package com.kingsrook.qbits.email.api (as for qbit-object-storage), so consumers need no per-repo allow-list.

Commits

1630c83 Merge pull request #13 from QRun-IO/feature/assistant-spi-allowlist
00c6f1b feat(guardrails): allow qbit-assistant's provider SPI by default
b42f4f3 Bump version to 2.1.1 [skip ci]
699c457 Merge pull request #12 from QRun-IO/feature/email-api-allowlist
574a169 ci: re-run after a ChromeDriver install flake
0f54482 feat(guardrails): allow qbit-email's published API by default
736b796 Merge pull request #11 from QRun-IO/feature/ga-only-tag-filter-main
a4035aa ci: fix regex escaping in the GA tag filter
52706aa ci: publish_release only on GA tags (port of #7 to main)
See full diff in compare view

Updates com.h2database:h2 from 2.2.224 to 2.5.252

Release notes

Sourced from com.h2database:h2's releases.

Version 2.5.252

version-2.5.250

... (truncated)

Commits

f986838 in preparation for a release
06c34a7 Merge pull request #4418 from andreitokar/issues-4380-4376
1aef3e0 #4376: Reading INFORMATION_SCHEMA.COLUMNS fails with a NPE while any material...
4bb8aee #4380: creating a MATERIALIZED VIEW makes a persistent database permanently u...
95b6af0 Merge pull request #4417 from andreitokar/issue-4395
6ec30b6 #4395 disallow constraints between temporary and permanent tables
0f0f856 Merge pull request #4416 from andreitokar/issue-4405
f718b76 #4405 SecureFileStore.readFully() may skip decryption
e231ff7 #4405 SecureFileStore.readFully() may skip
4da0d1d Merge pull request #4415 from jjh75607/fix/log-sql-aarch64
Additional commits viewable in compare view

Updates org.postgresql:postgresql from 42.7.9 to 42.7.14

Release notes

Sourced from org.postgresql:postgresql's releases.

v42.7.14

Security

This release fixes two security vulnerabilities.

requireAuth is silently not enforced when the value excludes every authentication method (GHSA-rhp9-mr79-r74h, CVE-2026-107314)

Severity: Moderate (CVSS 5.9) | Affected versions: 42.7.11 – 42.7.13

If the requireAuth connection property excluded all six authentication methods the driver knows (for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none) or contained no method at all (for example requireAuth=,), the driver applied no restriction and accepted whatever method the server asked for, including cleartext password. An attacker positioned between the application and the server could use this to request cleartext password authentication and receive the database password.

Unset values, positive lists (such as requireAuth=scram-sha-256) and partial exclusions (such as requireAuth=!password,!md5) were not affected, and neither were deployments that do not set requireAuth.

Behavior after upgrading:

A value that excludes every method now refuses the connection with SQLState 08004 and the message Authentication method is not allowed by requireAuth (or the channel binding error when channelBinding=require is also set).

A value that names no method is rejected as an invalid requireAuth value.

Because affected deployments had this value by mistake, and connections worked normally on affected versions, connections with such a value will fail after upgrading. Replace it with a positive list of the methods your server uses, for example requireAuth=scram-sha-256.

Independently of this fix, use sslmode=verify-full with a trusted CA so that an attacker cannot present a substitute server.

Thanks to @manus-pi for finding and reporting this issue.

Driver stores bytes of earlier statements when it pads a value shorter than its declared length (GHSA-f64h-wr5q-3qf3, CVE-2026-107315)

Severity: Moderate (CVSS 5.3) | Affected versions: 42.7.4 – 42.7.13

When an application sent a value shorter than the length it declared, the driver padded the missing bytes with data from earlier messages on the same connection instead of zeros, and the server stored them. The stored value could contain SQL text and parameter values of earlier, unrelated statements (up to 8192 bytes, or 16320 with GSS encryption). On pooled connections, those statements could come from other requests. 42.7.3 and earlier padded with zeros.

This is reachable through the following public API when the declared length is larger than the data:

PreparedStatement.setObject(int, ByteStreamWriter)

CopyIn.writeToCopy(ByteStreamWriter) and CopyIn.writeToCopy(byte[], int, int)

PGCopyOutputStream.write(byte[], int, int) (writes over 64 KiB)

LargeObject.write(byte[], int, int)

java.sql.Blob.setBytes(long, byte[], int, int)

Padding is now always zeros. Applications whose declared length always matches the data were not affected. Values stored by an affected version through such a call may already contain leaked data, so you may want to review affected columns. There is no connection property to disable the old behavior; the workaround on older versions is to make the declared length match the data.

Thanks to @vlsi for finding and reporting this issue.

Full Changelog: https://github.com/pgjdbc/pgjdbc/compare/REL42.7.13...REL42.7.14

v42.7.12: security

Silent channel-binding authentication downgrade (CVE-2026-54291)

channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS (with channel binding) to plain SCRAM-SHA-256 (without it), losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection triggers the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash. Examples are Ed25519, Ed448, and post-quantum algorithms.

Two issues combine in releases 42.7.4 through 42.7.11:

The bundled com.ongres.scram:scram-client (3.1 or 3.2) returns an empty byte array instead of failing when it cannot derive the binding hash for such a certificate. This is the library issue tracked as GHSA-p9jg-fcr6-3mhf.

... (truncated)

Changelog

Sourced from org.postgresql:postgresql's changelog.

Changelog

Notable changes since version 42.0.0, read the complete History of Changes.

The format is based on Keep a Changelog.

[Unreleased]

Fixed

fix: PGStream.skip no longer loops forever when the connection ends while the driver is discarding bytes, and no longer mistakes a stream that skips nothing for one that has ended. InputStream.skip may return zero with more data still coming, which a stream supplied through the socketFactory property is free to do; the driver now reads a byte in that case and treats only -1 as the end [PR #4358](pgjdbc/pgjdbc#4358)

fix: LargeObjectManager operations now work inside an active XA transaction. Since 42.7.13 an XA branch keeps the caller's autoCommit=true, and the guard rejected large objects as if the connection were idle. It now checks the server transaction state (getTransactionState()) instead of autoCommit, so a genuine auto-commit connection with no open transaction is still refused [Issue #4309](pgjdbc/pgjdbc#4309) [PR #4310](pgjdbc/pgjdbc#4310)

fix: batch update counts are no longer secured as committed inside an XA transaction. BatchResultHandler treated per-statement progress as durable whenever autoCommit=true, but an XA branch keeps autoCommit=true while the transaction is open, so a batch that flushed mid-way and then failed could report rolled-back statements as succeeded. Progress is now secured only when no server transaction is open [Issue #4309](pgjdbc/pgjdbc#4309) [PR #4311](pgjdbc/pgjdbc#4311)

Changed

fix: backend message lengths are checked before anything is sized from them. Each length is checked against the message layout and a limit for its type, the lengths inside DataRow and FunctionCallResponse are checked against the message, and the NegotiateProtocolVersion option count is bounded. A hostile or out of sync backend could previously force an allocation of up to two gigabytes with a five byte header [Issue #4015](pgjdbc/pgjdbc#4015)

fix: the read buffer is limited to 32 MiB and grows once per request rather than once per socket read. It previously doubled on every read while a large request was outstanding, so a peer that declared a large length and sent it slowly grew the buffer until the doubling past 1 GiB overflowed to a negative size [Issue #4015](pgjdbc/pgjdbc#4015)

fix: a zero-length CopyData body is accepted. It is valid on the wire and was previously rejected by an assertion, so it failed only on JVMs started with -ea [Issue #4015](pgjdbc/pgjdbc#4015)

fix: GSS packet lengths are bounded. The encrypted transport is limited to a 16380 byte payload and the handshake to a 65532 byte token, matching PQ_GSS_MAX_PACKET_SIZE and PQ_GSS_AUTH_BUFFER_SIZE [Issue #4015](pgjdbc/pgjdbc#4015)

fix: a connection whose stream has been refused is no longer reusable. Any refused length or count marks the stream broken, so Connection.isClosed() reports it closed and a pool that tests on borrow discards it. The socket is dropped with SO_LINGER 0 [Issue #4015](pgjdbc/pgjdbc#4015)

fix: a protocol violation before authentication is reported as PSQLException with SQLState 08P01 rather than as a plain I/O error, and is no longer retried under sslMode=allow or sslMode=prefer [Issue #4015](pgjdbc/pgjdbc#4015)

fix: the counts inside RowDescription, ParameterDescription, CopyInResponse and CopyOutResponse are checked against the declared message length. A RowDescription claiming more fields than its length can hold previously read its field descriptions out of the messages that followed it [Issue #4015](pgjdbc/pgjdbc#4015)

fix: the driver checks that each backend message was consumed exactly before reading the next message type, so a reader that stops short of its declared length is refused rather than misreading what follows [Issue #4015](pgjdbc/pgjdbc#4015)

fix: the authentication loop, the GSS encryption handshake and the GSS authentication handshake each stop after 64 round trips. A zero-length GSS token is a valid continuation, so a server could previously keep a client exchanging tokens forever before any credentials were exchanged [Issue #4015](pgjdbc/pgjdbc#4015)

fix: ErrorResponse before authentication is limited to 30000 bytes rather than 32 MiB, matching libpq's limit for messages outside VALID_LONG_MESSAGE_TYPE, and a C string inside a declared message is no longer scanned past the end of that message. Both were allocations an unauthenticated peer could cause [Issue #4015](pgjdbc/pgjdbc#4015)

fix: an ErrorResponse or NoticeResponse longer than 32 MiB is truncated to that size rather than refused. The body past the limit is drained and the shortened message is delivered, so the connection stays usable [Issue #4015](pgjdbc/pgjdbc#4015)

fix: the read buffer returns to its initial size once the message that grew it is drained, so a connection no longer retains 32 MiB after one large error [Issue #4015](pgjdbc/pgjdbc#4015)

fix: exceeding maxResultBuffer closes the connection. The row is not read past the limit, so the connection cannot continue, and it is now dropped where the limit is exceeded rather than refused as a protocol violation at the next message. The error reported is the limit alone, with SQLState 08S01 as before [Issue #4015](pgjdbc/pgjdbc#4015)

Security

fix: a requireAuth value that excludes every authentication method, such as !password,!md5,!gss,!sspi,!scram-sha-256,!none, now refuses every method. A connection with such a value now fails with SQLState 08004. Before, the driver treated the value as if requireAuth were not set, and used any method the server asked for, even a cleartext password. This affects 42.7.11 through 42.7.13 GHSA-rhp9-mr79-r74h

fix: a requireAuth value without a method in it, such as , or ,,, now fails with SQLState 22023. Before, the driver treated it as if requireAuth were not set. Commas at the very end of a value are still ignored, as in password,. This affects 42.7.11 through 42.7.13 GHSA-rhp9-mr79-r74h

[42.7.13] (2026-07-06)

Added

feat: invalidate the prepared-statement cache when the server reports a search_path change via GUC_REPORT (PostgreSQL 18+), so cached plans are no longer used against the wrong schema [PR #4259](pgjdbc/pgjdbc#4259)

feat: reWriteBatchedInserts now merges up to 32768 rows into one multi-values INSERT (bounded by the 65535 bind-parameter limit on the extended protocol) instead of capping at 128, which speeds up batches of few-column rows. The new reWriteBatchedInsertsSize connection property lowers that cap when set; the default of 0 uses that maximum. [PR #4207](pgjdbc/pgjdbc#4207)

feat: invalidate the prepared-statement cache after CREATE/DROP/ALTER so callers no longer trip on "cached plan must not change result type" without opting into autosave=ALWAYS. Controlled by the new flushCacheOnDdl connection property (default true); set to false for the prior behaviour. [PR #4067](pgjdbc/pgjdbc#4067)

feat: add connectExecutor connection property to customize the Executor used to run the worker task that performs the connection attempt when loginTimeout is in effect. The value is the fully qualified name of a class implementing java.util.concurrent.Executor. With a null value, the default, the driver retains the prior behavior of running the connection attempt on a daemon thread named "PostgreSQL JDBC driver connection thread". The executor must run the task on a thread other than the caller's. Running the attempt on a named thread lets applications that monitor driver-created threads identify it. [PR #4165](pgjdbc/pgjdbc#4165)

feat: add classLoaderStrategy connection property to control which classloaders the driver searches when loading a class named by a connection property, for example socketFactory. The default driver-first now falls back to the thread context classloader when the driver's classloader cannot resolve the class, which fixes class loading in non-flat class paths such as Quarkus and OSGi. Set driver to keep the previous driver-classloader-only behaviour, or context-first to prefer the thread context classloader [Issue #2112](pgjdbc/pgjdbc#2112) [PR #4167](pgjdbc/pgjdbc#4167)

feat: add OID constants for geometric arrays, RECORD, and refcursor [PR #4220](pgjdbc/pgjdbc#4220)

feat: LargeObject BlobInputStream now skips by seeking instead of reading, and the driver exposes the server version so it can select the 64-bit large-object API where available [PR #4204](pgjdbc/pgjdbc#4204)

Changed

refactor: the worker that runs the connection attempt under loginTimeout is now a FutureTask (ConnectTask) instead of the hand-rolled ConnectThread. When the caller hits the timeout, the task is now cancelled with cancel(true), which interrupts the worker thread rather than letting it run to completion. This makes the connection attempt interruptible, so loginTimeout can stop a slow connection attempt instead of leaking a thread. As before, a connection that the worker still manages to establish after the caller gives up is closed by the worker so that it does not leak. There are no public API changes and this should only lead to faster background resource cleanup for connections that time out. [PR #4120](pgjdbc/pgjdbc#4120)

chore: PGXAConnection.ConnectionHandler now rejects setAutoCommit(false) and setSavepoint(...) during an active XA branch, in addition to the long-rejected setAutoCommit(true) / commit() / rollback(). The setSavepoint rejection was already meant to be in place but the guard misspelled the method name as setSavePoint, so savepoints silently went through. Both changes bring the proxy in line with JTA 1.2 §3.4. [PR #4114](pgjdbc/pgjdbc#4114)

chore: commitPrepared / rollback-of-prepared now return XAER_RMFAIL instead of XAER_RMERR when the underlying connection is left in a non-idle TransactionState. Transaction managers (Geronimo, Narayana, Atomikos) treat XAER_RMFAIL as retryable on a fresh XAResource; the prepared transaction is no longer abandoned. [PR #4114](pgjdbc/pgjdbc#4114)

refactor: derive getPrimaryKeys from pg_constraint.conkey [PR #4202](pgjdbc/pgjdbc#4202)

Fixed

fix: the published GitHub release now ships the released postgresql-<version>.jar and its detached PGP signature, taken from the same signed build that is uploaded to Maven Central, instead of a leftover SNAPSHOT jar [Issue #3812](pgjdbc/pgjdbc#3812) [PR #3814](pgjdbc/pgjdbc#3814)

fix: simplify the Statement#cancel state machine by dropping the redundant CANCELLED state. killTimerTask now waits for the state to return to IDLE directly, which removes a spin-forever case when more than one thread observes the cancel completing [PR #1827](pgjdbc/pgjdbc#1827).

... (truncated)

Commits

ebdd9d0 chore: bump version to 42.7.14
0e764c8 test: Add additional PgBufferedOutputStream.writeZeros(...) tests
c8998c8 fix: writeZeros() could send stale buffer contents instead of zeros
a65ef98 fix: refuse every method when requireAuth excludes them all
3297557 docs: add 42.7.13 release changelog (#4270)
d93d370 style: apply Autostyle to docs/ and .github/
2e05ff9 build: check docs/ and .github/ formatting with Autostyle
b4a6087 Adjust EditorConfig für Makefiles
725cebb fix(jdbc): reject empty timestamp/timestamptz text with a clear error
23a1b0d fix(scram): fail closed on channel-binding downgrade (no scram bump)
Additional commits viewable in compare view

Updates org.testcontainers:testcontainers-postgresql from 2.0.3 to 2.0.5

Release notes

Sourced from org.testcontainers:testcontainers-postgresql's releases.

2.0.5

What's Changed

🚀 Features & Enhancements

Support apache/artemis in ArtemisContainer (#11590) @eddumelendez

Add getHttpPort and getGrpcPort methods in WeaviateContainer (#11712) @eddumelendez

Add support for !override docker compose tag (#11490) @meck-gd

🐛 Bug Fixes

Fix jarFileTest cache relocatability (#11574) @ribafish

📖 Documentation

Update LocalStack docs (#11581) @eddumelendez

🧹 Housekeeping

Fix typo in GenericContainer namespace validation error message (#11717) @haider2122

Replace deprecated/removed method calls javadoc examples (#11570) @ratonalgaze

Use weaviate client v6 (#11711) @eddumelendez

Polish CI workflows (#11686) @eddumelendez

Update testcontainers version to 2.0.4 (#11357) @github-actions[bot]

Update docs version to 2.0.4 (#11573) @github-actions[bot]

📦 Dependency updates

Combined dependencies PR (#11710) @eddumelendez

Combined dependencies PR (#11708) @eddumelendez

Combined dependencies PR (#11707) @eddumelendez

Combined dependencies PR (#11706) @eddumelendez

Combined dependencies PR (#11705) @eddumelendez

Combined dependencies PR (#11704) @eddumelendez

Combined dependencies PR (#11701) @eddumelendez

Combined dependencies PR (#11700) @eddumelendez

Combined dependencies PR (#11699) @eddumelendez

Combined dependencies PR (#11685) @eddumelendez

Combined dependencies PR (#11684) @eddumelendez

Combined dependencies PR (#11681) @eddumelendez

Combined dependencies PR (#11672) @eddumelendez

Combined dependencies PR (#11671) @eddumelendez

Combined dependencies PR (#11670) @eddumelendez

Combined dependencies PR (#11632) @eddumelendez

2.0.4

... (truncated)

Commits

5c44820 Fix typo (#11717)
84b1c3a Add getHttpPort and getGrpcPort methods in WeaviateContainer (#11712)
a412b8e Use weaviate client v6 (#11711)
058fa82 Combined dependencies PR (#11710)
773f344 Merge remote-tracking branch 'origin/dependabot/gradle/modules/hivemq/ch.qos....
ebe6043 Merge remote-tracking branch 'origin/dependabot/gradle/modules/activemq/org.a...
5248d1d Merge remote-tracking branch 'origin/dependabot/gradle/modules/scylladb/softw...
ab781f6 Combined dependencies PR (#11708)
2d6c1be Merge remote-tracking branch 'origin/dependabot/gradle/core/org.jetbrains-ann...
e76c291 Merge remote-tracking branch 'origin/dependabot/gradle/core/org.junit.platfor...
Additional commits viewable in compare view

Updates org.apache.maven.plugins:maven-checkstyle-plugin from 3.3.1 to 3.6.0

Commits

dd1abd9 [maven-release-plugin] prepare release maven-checkstyle-plugin-3.6.0
9ccb06e fix
6ac89b8 [MCHECKSTYLE-452] Upgrade to Doxia 2.0.0 GA Stack
ff1a1b7 Bump org.apache.commons:commons-lang3 from 3.16.0 to 3.17.0
13e16c5 Remove unecessary test dependency on plexus-container-default
a7c962a [maven-release-plugin] prepare for next development iteration
868abc9 [maven-release-plugin] prepare release maven-checkstyle-plugin-3.5.0
9043f8a [MCHECKSTYLE-446] Dynamically calculate xrefLocation/xrefTestLocation
0e7bd00 [MCHECKSTYLE-445] Upgrade to Doxia 2.0.0 Milestone Stack
b92666d Bump org.apache.maven.plugins:maven-plugins from 42 to 43
Additional commits viewable in compare view

Updates org.apache.maven:apache-maven from 3.9.11 to 3.10.0

Bumps the maven-minor-and-patch group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [com.kingsrook:qbit-build-parent](https://github.com/Kingsrook/qbit-bom) | `2.1.0` | `2.1.2` | | [com.h2database:h2](https://github.com/h2database/h2database) | `2.2.224` | `2.5.252` | | [org.postgresql:postgresql](https://github.com/pgjdbc/pgjdbc) | `42.7.9` | `42.7.14` | | [org.testcontainers:testcontainers-postgresql](https://github.com/testcontainers/testcontainers-java) | `2.0.3` | `2.0.5` | | [org.apache.maven.plugins:maven-checkstyle-plugin](https://github.com/apache/maven-checkstyle-plugin) | `3.3.1` | `3.6.0` | | org.apache.maven:apache-maven | `3.9.11` | `3.10.0` | Updates `com.kingsrook:qbit-build-parent` from 2.1.0 to 2.1.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kingsrook/qbit-bom/releases">com.kingsrook:qbit-build-parent's releases</a>.</em></p> <blockquote> <h2>Build Parent and Guardrails 2.1.2</h2> <p><code>com.kingsrook:qbit-build-parent:2.1.2</code> and <code>com.kingsrook:qbit-guardrails:2.1.2</code> are published to Maven Central from the signed tag <code>v2.1.2</code> on main <code>1630c83</code>.</p> <ul> <li><strong>G1 default allow-lists</strong> now include qbit-assistant's provider SPI package (<code>com.kingsrook.qbits.assistant.spi</code>), so qbits can depend on the provider API without per-repo allow-list entries (<a href="https://redirect.github.com/QRun-IO/qbit-bom/pull/13">#13</a>).</li> </ul> <p>This is a patch release with no other changes since 2.1.1.</p> <h2>Build Parent and Guardrails 2.1.1</h2> <p><code>com.kingsrook:qbit-build-parent:2.1.1</code> and <code>com.kingsrook:qbit-guardrails:2.1.1</code> are published to Maven Central from the signed tag <code>v2.1.1</code> on main <code>699c457</code>.</p> <ul> <li><strong>G1 default allow-lists</strong> now include qbit-email and its public api package, so qbits can depend on <code>qbit-email</code> without per-repo allow-list entries (<a href="https://redirect.github.com/QRun-IO/qbit-bom/pull/12">#12</a>).</li> </ul> <p>Patch release; no other changes from 2.1.0.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/QRun-IO/qbit-bom/blob/main/CHANGELOG.md">com.kingsrook:qbit-build-parent's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to QBit Build Parent POM will be documented in this file.</p> <p>The format is based on <a href="https://keepachangelog.com/en/1.1.0/">Keep a Changelog</a> and this project adheres to <a href="https://semver.org/spec/v2.0.0.html">Semantic Versioning</a>.</p> <h2>[Unreleased]</h2> <h3>Changed</h3> <ul> <li>G1 default API packages include qbit-assistant's published provider SPI, <code>com.kingsrook.qbits.assistant.spi</code>; artifact <code>com.kingsrook.qbits:qbit-assistant-provider-api</code> is already covered by <code>com.kingsrook.qbits:*-api</code>. Assistant implementation packages remain forbidden.</li> <li>G1 default allow-lists include qbit-email's published API: artifact <code>com.kingsrook.qbits:qbit-email</code> and package <code>com.kingsrook.qbits.email.api</code> (as for qbit-object-storage), so consumers need no per-repo allow-list.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/QRun-IO/qbit-bom/commit/1630c830fe943a0857e0c149c8e640622a1960e8"><code>1630c83</code></a> Merge pull request <a href="https://redirect.github.com/Kingsrook/qbit-bom/issues/13">#13</a> from QRun-IO/feature/assistant-spi-allowlist</li> <li><a href="https://github.com/QRun-IO/qbit-bom/commit/00c6f1bb5557184f803f16a65e06b67970204158"><code>00c6f1b</code></a> feat(guardrails): allow qbit-assistant's provider SPI by default</li> <li><a href="https://github.com/QRun-IO/qbit-bom/commit/b42f4f30a2003c57341ff44313061c494f0ee936"><code>b42f4f3</code></a> Bump version to 2.1.1 [skip ci]</li> <li><a href="https://github.com/QRun-IO/qbit-bom/commit/699c457f374e85120e7a5c3e665afcb4e6bcca24"><code>699c457</code></a> Merge pull request <a href="https://redirect.github.com/Kingsrook/qbit-bom/issues/12">#12</a> from QRun-IO/feature/email-api-allowlist</li> <li><a href="https://github.com/QRun-IO/qbit-bom/commit/574a1696b6e5c3eb3cf8af7490df96c39f7bba72"><code>574a169</code></a> ci: re-run after a ChromeDriver install flake</li> <li><a href="https://github.com/QRun-IO/qbit-bom/commit/0f5448256c77647fa6c18ae1fbca108142f97e36"><code>0f54482</code></a> feat(guardrails): allow qbit-email's published API by default</li> <li><a href="https://github.com/QRun-IO/qbit-bom/commit/736b796d48f7cea65bfde28fce19f4ed3a307936"><code>736b796</code></a> Merge pull request <a href="https://redirect.github.com/Kingsrook/qbit-bom/issues/11">#11</a> from QRun-IO/feature/ga-only-tag-filter-main</li> <li><a href="https://github.com/QRun-IO/qbit-bom/commit/a4035aa8d714f659ec49b1664a639927bae4f217"><code>a4035aa</code></a> ci: fix regex escaping in the GA tag filter</li> <li><a href="https://github.com/QRun-IO/qbit-bom/commit/52706aa987f881ebc39a25a941ff0b6b300760bb"><code>52706aa</code></a> ci: publish_release only on GA tags (port of <a href="https://redirect.github.com/Kingsrook/qbit-bom/issues/7">#7</a> to main)</li> <li>See full diff in <a href="https://github.com/Kingsrook/qbit-bom/compare/v2.1.0...v2.1.2">compare view</a></li> </ul> </details> <br /> Updates `com.h2database:h2` from 2.2.224 to 2.5.252 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/h2database/h2database/releases">com.h2database:h2's releases</a>.</em></p> <blockquote> <h2>Version 2.5.252</h2>  <h2>version-2.5.250</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/h2database/h2database/commit/f986838bbbf4941d2edcd5298b18c9936d1b7359"><code>f986838</code></a> in preparation for a release</li> <li><a href="https://github.com/h2database/h2database/commit/06c34a7fa288208ecabb5d670555fd807270bb2a"><code>06c34a7</code></a> Merge pull request <a href="https://redirect.github.com/h2database/h2database/issues/4418">#4418</a> from andreitokar/issues-4380-4376</li> <li><a href="https://github.com/h2database/h2database/commit/1aef3e0692b7379402b2a1a14e5223a8911e31ec"><code>1aef3e0</code></a> <a href="https://redirect.github.com/h2database/h2database/issues/4376">#4376</a>: Reading INFORMATION_SCHEMA.COLUMNS fails with a NPE while any material...</li> <li><a href="https://github.com/h2database/h2database/commit/4bb8aee6bf4305a83e79b6a93e9e3781f904fed9"><code>4bb8aee</code></a> <a href="https://redirect.github.com/h2database/h2database/issues/4380">#4380</a>: creating a MATERIALIZED VIEW makes a persistent database permanently u...</li> <li><a href="https://github.com/h2database/h2database/commit/95b6af03b8768d770e5dac1ae829b7c15301b38e"><code>95b6af0</code></a> Merge pull request <a href="https://redirect.github.com/h2database/h2database/issues/4417">#4417</a> from andreitokar/issue-4395</li> <li><a href="https://github.com/h2database/h2database/commit/6ec30b66b68a298d6cfc424aa77fec90ebf05199"><code>6ec30b6</code></a> <a href="https://redirect.github.com/h2database/h2database/issues/4395">#4395</a> disallow constraints between temporary and permanent tables</li> <li><a href="https://github.com/h2database/h2database/commit/0f0f85605084bd4eaad8f6a467ff802161048b60"><code>0f0f856</code></a> Merge pull request <a href="https://redirect.github.com/h2database/h2database/issues/4416">#4416</a> from andreitokar/issue-4405</li> <li><a href="https://github.com/h2database/h2database/commit/f718b764c6d53e160f94d05003eae81d554ec253"><code>f718b76</code></a> <a href="https://redirect.github.com/h2database/h2database/issues/4405">#4405</a> SecureFileStore.readFully() may skip decryption</li> <li><a href="https://github.com/h2database/h2database/commit/e231ff7def4c280ffb845cb0b6e92fb9686867d1"><code>e231ff7</code></a> <a href="https://redirect.github.com/h2database/h2database/issues/4405">#4405</a> SecureFileStore.readFully() may skip</li> <li><a href="https://github.com/h2database/h2database/commit/4da0d1d02b4e860d6c2e68ff2de0c11c0a19011c"><code>4da0d1d</code></a> Merge pull request <a href="https://redirect.github.com/h2database/h2database/issues/4415">#4415</a> from jjh75607/fix/log-sql-aarch64</li> <li>Additional commits viewable in <a href="https://github.com/h2database/h2database/compare/version-2.2.224...version-2.5.252">compare view</a></li> </ul> </details> <br /> Updates `org.postgresql:postgresql` from 42.7.9 to 42.7.14 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pgjdbc/pgjdbc/releases">org.postgresql:postgresql's releases</a>.</em></p> <blockquote> <h2>v42.7.14</h2> <h2>Security</h2> <p>This release fixes two security vulnerabilities.</p> <h3><code>requireAuth</code> is silently not enforced when the value excludes every authentication method (<a href="https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h">GHSA-rhp9-mr79-r74h</a>, CVE-2026-107314)</h3> <p><strong>Severity:</strong> Moderate (CVSS 5.9) | <strong>Affected versions:</strong> 42.7.11 – 42.7.13</p> <p>If the <code>requireAuth</code> connection property excluded all six authentication methods the driver knows (for example <code>requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none</code>) or contained no method at all (for example <code>requireAuth=,</code>), the driver applied no restriction and accepted whatever method the server asked for, including cleartext <code>password</code>. An attacker positioned between the application and the server could use this to request cleartext password authentication and receive the database password.</p> <p>Unset values, positive lists (such as <code>requireAuth=scram-sha-256</code>) and partial exclusions (such as <code>requireAuth=!password,!md5</code>) were not affected, and neither were deployments that do not set <code>requireAuth</code>.</p> <p>Behavior after upgrading:</p> <ul> <li>A value that excludes every method now refuses the connection with SQLState <code>08004</code> and the message <code>Authentication method is not allowed by requireAuth</code> (or the channel binding error when <code>channelBinding=require</code> is also set).</li> <li>A value that names no method is rejected as an invalid <code>requireAuth</code> value.</li> </ul> <p>Because affected deployments had this value by mistake, and connections worked normally on affected versions, <strong>connections with such a value will fail after upgrading</strong>. Replace it with a positive list of the methods your server uses, for example <code>requireAuth=scram-sha-256</code>.</p> <p>Independently of this fix, use <code>sslmode=verify-full</code> with a trusted CA so that an attacker cannot present a substitute server.</p> <p>Thanks to <a href="https://github.com/manus-pi"><code>@manus-pi</code></a> for finding and reporting this issue.</p> <h3>Driver stores bytes of earlier statements when it pads a value shorter than its declared length (<a href="https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-f64h-wr5q-3qf3">GHSA-f64h-wr5q-3qf3</a>, CVE-2026-107315)</h3> <p><strong>Severity:</strong> Moderate (CVSS 5.3) | <strong>Affected versions:</strong> 42.7.4 – 42.7.13</p> <p>When an application sent a value shorter than the length it declared, the driver padded the missing bytes with data from earlier messages on the same connection instead of zeros, and the server stored them. The stored value could contain SQL text and parameter values of earlier, unrelated statements (up to 8192 bytes, or 16320 with GSS encryption). On pooled connections, those statements could come from other requests. 42.7.3 and earlier padded with zeros.</p> <p>This is reachable through the following public API when the declared length is larger than the data:</p> <ul> <li><code>PreparedStatement.setObject(int, ByteStreamWriter)</code></li> <li><code>CopyIn.writeToCopy(ByteStreamWriter)</code> and <code>CopyIn.writeToCopy(byte[], int, int)</code></li> <li><code>PGCopyOutputStream.write(byte[], int, int)</code> (writes over 64 KiB)</li> <li><code>LargeObject.write(byte[], int, int)</code></li> <li><code>java.sql.Blob.setBytes(long, byte[], int, int)</code></li> </ul> <p>Padding is now always zeros. Applications whose declared length always matches the data were not affected. Values stored by an affected version through such a call may already contain leaked data, so you may want to review affected columns. There is no connection property to disable the old behavior; the workaround on older versions is to make the declared length match the data.</p> <p>Thanks to <a href="https://github.com/vlsi"><code>@vlsi</code></a> for finding and reporting this issue.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/pgjdbc/pgjdbc/compare/REL42.7.13...REL42.7.14">https://github.com/pgjdbc/pgjdbc/compare/REL42.7.13...REL42.7.14</a></p> <h2>v42.7.12: security</h2> <h3>Silent channel-binding authentication downgrade (CVE-2026-54291)</h3> <p><code>channelBinding=require</code> connections can be silently downgraded from SCRAM-SHA-256-PLUS (with channel binding) to plain SCRAM-SHA-256 (without it), losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection triggers the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash. Examples are Ed25519, Ed448, and post-quantum algorithms.</p> <p>Two issues combine in releases 42.7.4 through 42.7.11:</p> <p>The bundled <code>com.ongres.scram:scram-client</code> (3.1 or 3.2) returns an empty byte array instead of failing when it cannot derive the binding hash for such a certificate. This is the library issue tracked as <a href="https://github.com/ongres/scram/security/advisories/GHSA-p9jg-fcr6-3mhf">GHSA-p9jg-fcr6-3mhf</a>.</p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pgjdbc/pgjdbc/blob/master/CHANGELOG.md">org.postgresql:postgresql's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>Notable changes since version 42.0.0, read the complete <a href="https://jdbc.postgresql.org/documentation/changelog.html">History of Changes</a>.</p> <p>The format is based on <a href="http://keepachangelog.com/en/1.0.0/">Keep a Changelog</a>.</p> <h2>[Unreleased]</h2> <h3>Fixed</h3> <ul> <li>fix: <code>PGStream.skip</code> no longer loops forever when the connection ends while the driver is discarding bytes, and no longer mistakes a stream that skips nothing for one that has ended. <code>InputStream.skip</code> may return zero with more data still coming, which a stream supplied through the <code>socketFactory</code> property is free to do; the driver now reads a byte in that case and treats only <code>-1</code> as the end [PR <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4358">#4358</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/pull/4358">pgjdbc/pgjdbc#4358</a>)</li> <li>fix: <code>LargeObjectManager</code> operations now work inside an active XA transaction. Since 42.7.13 an XA branch keeps the caller's <code>autoCommit=true</code>, and the guard rejected large objects as if the connection were idle. It now checks the server transaction state (<code>getTransactionState()</code>) instead of <code>autoCommit</code>, so a genuine auto-commit connection with no open transaction is still refused [Issue <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4309">#4309</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4309">pgjdbc/pgjdbc#4309</a>) [PR <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4310">#4310</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/pull/4310">pgjdbc/pgjdbc#4310</a>)</li> <li>fix: batch update counts are no longer secured as committed inside an XA transaction. <code>BatchResultHandler</code> treated per-statement progress as durable whenever <code>autoCommit=true</code>, but an XA branch keeps <code>autoCommit=true</code> while the transaction is open, so a batch that flushed mid-way and then failed could report rolled-back statements as succeeded. Progress is now secured only when no server transaction is open [Issue <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4309">#4309</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4309">pgjdbc/pgjdbc#4309</a>) [PR <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4311">#4311</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/pull/4311">pgjdbc/pgjdbc#4311</a>)</li> </ul> <h3>Changed</h3> <ul> <li>fix: backend message lengths are checked before anything is sized from them. Each length is checked against the message layout and a limit for its type, the lengths inside <code>DataRow</code> and <code>FunctionCallResponse</code> are checked against the message, and the <code>NegotiateProtocolVersion</code> option count is bounded. A hostile or out of sync backend could previously force an allocation of up to two gigabytes with a five byte header [Issue <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">#4015</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">pgjdbc/pgjdbc#4015</a>)</li> <li>fix: the read buffer is limited to 32 MiB and grows once per request rather than once per socket read. It previously doubled on every read while a large request was outstanding, so a peer that declared a large length and sent it slowly grew the buffer until the doubling past 1 GiB overflowed to a negative size [Issue <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">#4015</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">pgjdbc/pgjdbc#4015</a>)</li> <li>fix: a zero-length <code>CopyData</code> body is accepted. It is valid on the wire and was previously rejected by an assertion, so it failed only on JVMs started with <code>-ea</code> [Issue <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">#4015</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">pgjdbc/pgjdbc#4015</a>)</li> <li>fix: GSS packet lengths are bounded. The encrypted transport is limited to a 16380 byte payload and the handshake to a 65532 byte token, matching <code>PQ_GSS_MAX_PACKET_SIZE</code> and <code>PQ_GSS_AUTH_BUFFER_SIZE</code> [Issue <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">#4015</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">pgjdbc/pgjdbc#4015</a>)</li> <li>fix: a connection whose stream has been refused is no longer reusable. Any refused length or count marks the stream broken, so <code>Connection.isClosed()</code> reports it closed and a pool that tests on borrow discards it. The socket is dropped with <code>SO_LINGER 0</code> [Issue <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">#4015</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">pgjdbc/pgjdbc#4015</a>)</li> <li>fix: a protocol violation before authentication is reported as <code>PSQLException</code> with SQLState <code>08P01</code> rather than as a plain I/O error, and is no longer retried under <code>sslMode=allow</code> or <code>sslMode=prefer</code> [Issue <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">#4015</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">pgjdbc/pgjdbc#4015</a>)</li> <li>fix: the counts inside <code>RowDescription</code>, <code>ParameterDescription</code>, <code>CopyInResponse</code> and <code>CopyOutResponse</code> are checked against the declared message length. A <code>RowDescription</code> claiming more fields than its length can hold previously read its field descriptions out of the messages that followed it [Issue <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">#4015</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">pgjdbc/pgjdbc#4015</a>)</li> <li>fix: the driver checks that each backend message was consumed exactly before reading the next message type, so a reader that stops short of its declared length is refused rather than misreading what follows [Issue <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">#4015</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">pgjdbc/pgjdbc#4015</a>)</li> <li>fix: the authentication loop, the GSS encryption handshake and the GSS authentication handshake each stop after 64 round trips. A zero-length GSS token is a valid continuation, so a server could previously keep a client exchanging tokens forever before any credentials were exchanged [Issue <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">#4015</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">pgjdbc/pgjdbc#4015</a>)</li> <li>fix: <code>ErrorResponse</code> before authentication is limited to 30000 bytes rather than 32 MiB, matching libpq's limit for messages outside <code>VALID_LONG_MESSAGE_TYPE</code>, and a C string inside a declared message is no longer scanned past the end of that message. Both were allocations an unauthenticated peer could cause [Issue <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">#4015</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">pgjdbc/pgjdbc#4015</a>)</li> <li>fix: an <code>ErrorResponse</code> or <code>NoticeResponse</code> longer than 32 MiB is truncated to that size rather than refused. The body past the limit is drained and the shortened message is delivered, so the connection stays usable [Issue <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">#4015</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">pgjdbc/pgjdbc#4015</a>)</li> <li>fix: the read buffer returns to its initial size once the message that grew it is drained, so a connection no longer retains 32 MiB after one large error [Issue <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">#4015</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">pgjdbc/pgjdbc#4015</a>)</li> <li>fix: exceeding <code>maxResultBuffer</code> closes the connection. The row is not read past the limit, so the connection cannot continue, and it is now dropped where the limit is exceeded rather than refused as a protocol violation at the next message. The error reported is the limit alone, with SQLState <code>08S01</code> as before [Issue <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">#4015</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4015">pgjdbc/pgjdbc#4015</a>)</li> </ul> <h3>Security</h3> <ul> <li>fix: a <code>requireAuth</code> value that excludes every authentication method, such as <code>!password,!md5,!gss,!sspi,!scram-sha-256,!none</code>, now refuses every method. A connection with such a value now fails with SQLState <code>08004</code>. Before, the driver treated the value as if <code>requireAuth</code> were not set, and used any method the server asked for, even a cleartext password. This affects 42.7.11 through 42.7.13 <a href="https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h">GHSA-rhp9-mr79-r74h</a></li> <li>fix: a <code>requireAuth</code> value without a method in it, such as <code>,</code> or <code>,,</code>, now fails with SQLState <code>22023</code>. Before, the driver treated it as if <code>requireAuth</code> were not set. Commas at the very end of a value are still ignored, as in <code>password,</code>. This affects 42.7.11 through 42.7.13 <a href="https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h">GHSA-rhp9-mr79-r74h</a></li> </ul> <h2>[42.7.13] (2026-07-06)</h2> <h3>Added</h3> <ul> <li>feat: invalidate the prepared-statement cache when the server reports a <code>search_path</code> change via GUC_REPORT (PostgreSQL 18+), so cached plans are no longer used against the wrong schema [PR <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4259">#4259</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/pull/4259">pgjdbc/pgjdbc#4259</a>)</li> <li>feat: <code>reWriteBatchedInserts</code> now merges up to 32768 rows into one multi-values <code>INSERT</code> (bounded by the 65535 bind-parameter limit on the extended protocol) instead of capping at 128, which speeds up batches of few-column rows. The new <code>reWriteBatchedInsertsSize</code> connection property lowers that cap when set; the default of <code>0</code> uses that maximum. [PR <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4207">#4207</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/pull/4207">pgjdbc/pgjdbc#4207</a>)</li> <li>feat: invalidate the prepared-statement cache after CREATE/DROP/ALTER so callers no longer trip on "cached plan must not change result type" without opting into <code>autosave=ALWAYS</code>. Controlled by the new <code>flushCacheOnDdl</code> connection property (default <code>true</code>); set to <code>false</code> for the prior behaviour. [PR <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4067">#4067</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/pull/4067">pgjdbc/pgjdbc#4067</a>)</li> <li>feat: add <code>connectExecutor</code> connection property to customize the <code>Executor</code> used to run the worker task that performs the connection attempt when <code>loginTimeout</code> is in effect. The value is the fully qualified name of a class implementing <code>java.util.concurrent.Executor</code>. With a null value, the default, the driver retains the prior behavior of running the connection attempt on a daemon thread named <code>"PostgreSQL JDBC driver connection thread"</code>. The executor must run the task on a thread other than the caller's. Running the attempt on a named thread lets applications that monitor driver-created threads identify it. [PR <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4165">#4165</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/pull/4165">pgjdbc/pgjdbc#4165</a>)</li> <li>feat: add <code>classLoaderStrategy</code> connection property to control which classloaders the driver searches when loading a class named by a connection property, for example <code>socketFactory</code>. The default <code>driver-first</code> now falls back to the thread context classloader when the driver's classloader cannot resolve the class, which fixes class loading in non-flat class paths such as Quarkus and OSGi. Set <code>driver</code> to keep the previous driver-classloader-only behaviour, or <code>context-first</code> to prefer the thread context classloader [Issue <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/2112">#2112</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/2112">pgjdbc/pgjdbc#2112</a>) [PR <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4167">#4167</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/pull/4167">pgjdbc/pgjdbc#4167</a>)</li> <li>feat: add OID constants for geometric arrays, <code>RECORD</code>, and <code>refcursor</code> [PR <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4220">#4220</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/pull/4220">pgjdbc/pgjdbc#4220</a>)</li> <li>feat: <code>LargeObject</code> <code>BlobInputStream</code> now skips by seeking instead of reading, and the driver exposes the server version so it can select the 64-bit large-object API where available [PR <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4204">#4204</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/pull/4204">pgjdbc/pgjdbc#4204</a>)</li> </ul> <h3>Changed</h3> <ul> <li>refactor: the worker that runs the connection attempt under <code>loginTimeout</code> is now a <code>FutureTask</code> (<code>ConnectTask</code>) instead of the hand-rolled <code>ConnectThread</code>. When the caller hits the timeout, the task is now cancelled with <code>cancel(true)</code>, which interrupts the worker thread rather than letting it run to completion. This makes the connection attempt interruptible, so <code>loginTimeout</code> can stop a slow connection attempt instead of leaking a thread. As before, a connection that the worker still manages to establish after the caller gives up is closed by the worker so that it does not leak. There are no public API changes and this should only lead to faster background resource cleanup for connections that time out. [PR <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4120">#4120</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/pull/4120">pgjdbc/pgjdbc#4120</a>)</li> <li>chore: <code>PGXAConnection.ConnectionHandler</code> now rejects <code>setAutoCommit(false)</code> and <code>setSavepoint(...)</code> during an active XA branch, in addition to the long-rejected <code>setAutoCommit(true)</code> / <code>commit()</code> / <code>rollback()</code>. The <code>setSavepoint</code> rejection was already meant to be in place but the guard misspelled the method name as <code>setSavePoint</code>, so savepoints silently went through. Both changes bring the proxy in line with JTA 1.2 §3.4. [PR <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4114">#4114</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/pull/4114">pgjdbc/pgjdbc#4114</a>)</li> <li>chore: <code>commitPrepared</code> / <code>rollback</code>-of-prepared now return <code>XAER_RMFAIL</code> instead of <code>XAER_RMERR</code> when the underlying connection is left in a non-idle <code>TransactionState</code>. Transaction managers (Geronimo, Narayana, Atomikos) treat <code>XAER_RMFAIL</code> as retryable on a fresh <code>XAResource</code>; the prepared transaction is no longer abandoned. [PR <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4114">#4114</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/pull/4114">pgjdbc/pgjdbc#4114</a>)</li> <li>refactor: derive <code>getPrimaryKeys</code> from <code>pg_constraint.conkey</code> [PR <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4202">#4202</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/pull/4202">pgjdbc/pgjdbc#4202</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>fix: the published GitHub release now ships the released <code>postgresql-<version>.jar</code> and its detached PGP signature, taken from the same signed build that is uploaded to Maven Central, instead of a leftover SNAPSHOT jar [Issue <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3812">#3812</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3812">pgjdbc/pgjdbc#3812</a>) [PR <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3814">#3814</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3814">pgjdbc/pgjdbc#3814</a>)</li> <li>fix: simplify the <code>Statement#cancel</code> state machine by dropping the redundant <code>CANCELLED</code> state. <code>killTimerTask</code> now waits for the state to return to <code>IDLE</code> directly, which removes a spin-forever case when more than one thread observes the cancel completing [PR <a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/1827">#1827</a>](<a href="https://redirect.github.com/pgjdbc/pgjdbc/pull/1827">pgjdbc/pgjdbc#1827</a>).</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pgjdbc/pgjdbc/commit/ebdd9d0a4017e74182eabb0cc304105a0120b647"><code>ebdd9d0</code></a> chore: bump version to 42.7.14</li> <li><a href="https://github.com/pgjdbc/pgjdbc/commit/0e764c8526b39c337d59a6ae5422fa3b0103ddcb"><code>0e764c8</code></a> test: Add additional PgBufferedOutputStream.writeZeros(...) tests</li> <li><a href="https://github.com/pgjdbc/pgjdbc/commit/c8998c8e9632a7cdecb128dd7cd122d330b3598a"><code>c8998c8</code></a> fix: writeZeros() could send stale buffer contents instead of zeros</li> <li><a href="https://github.com/pgjdbc/pgjdbc/commit/a65ef98fe37bf0ecbd1a6331205cdb924985ed75"><code>a65ef98</code></a> fix: refuse every method when requireAuth excludes them all</li> <li><a href="https://github.com/pgjdbc/pgjdbc/commit/3297557c6a8059d0d6e3522c79f0bd9a6f82ee07"><code>3297557</code></a> docs: add 42.7.13 release changelog (<a href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4270">#4270</a>)</li> <li><a href="https://github.com/pgjdbc/pgjdbc/commit/d93d370984fbbccd099fc6466e4075ba46d8ec59"><code>d93d370</code></a> style: apply Autostyle to docs/ and .github/</li> <li><a href="https://github.com/pgjdbc/pgjdbc/commit/2e05ff9e3ea9e8249f25dcb7017984285f1f76b1"><code>2e05ff9</code></a> build: check docs/ and .github/ formatting with Autostyle</li> <li><a href="https://github.com/pgjdbc/pgjdbc/commit/b4a6087d2f07b578923a5272fa0155602ade9d40"><code>b4a6087</code></a> Adjust EditorConfig für Makefiles</li> <li><a href="https://github.com/pgjdbc/pgjdbc/commit/725cebbb4e13be777483bd916b19dfcd428b5f26"><code>725cebb</code></a> fix(jdbc): reject empty timestamp/timestamptz text with a clear error</li> <li><a href="https://github.com/pgjdbc/pgjdbc/commit/23a1b0dac5a8fc633cc163e883eb21f0219ea521"><code>23a1b0d</code></a> fix(scram): fail closed on channel-binding downgrade (no scram bump)</li> <li>Additional commits viewable in <a href="https://github.com/pgjdbc/pgjdbc/compare/REL42.7.9...REL42.7.14">compare view</a></li> </ul> </details> <br /> Updates `org.testcontainers:testcontainers-postgresql` from 2.0.3 to 2.0.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/testcontainers/testcontainers-java/releases">org.testcontainers:testcontainers-postgresql's releases</a>.</em></p> <blockquote> <h2>2.0.5</h2> <h1>What's Changed</h1> <h2>🚀 Features & Enhancements</h2> <ul> <li>Support <code>apache/artemis</code> in ArtemisContainer (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11590">#11590</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> <li>Add getHttpPort and getGrpcPort methods in WeaviateContainer (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11712">#11712</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> <li>Add support for !override docker compose tag (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11490">#11490</a>) <a href="https://github.com/meck-gd"><code>@meck-gd</code></a></li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li>Fix jarFileTest cache relocatability (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11574">#11574</a>) <a href="https://github.com/ribafish"><code>@ribafish</code></a></li> </ul> <h2>📖 Documentation</h2> <ul> <li>Update LocalStack docs (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11581">#11581</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> </ul> <h2>🧹 Housekeeping</h2> <ul> <li>Fix typo in GenericContainer namespace validation error message (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11717">#11717</a>) <a href="https://github.com/haider2122"><code>@haider2122</code></a></li> <li>Replace deprecated/removed method calls javadoc examples (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11570">#11570</a>) <a href="https://github.com/ratonalgaze"><code>@ratonalgaze</code></a></li> <li>Use weaviate client v6 (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11711">#11711</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> <li>Polish CI workflows (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11686">#11686</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> <li>Update testcontainers version to 2.0.4 (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11357">#11357</a>) @<a href="https://github.com/apps/github-actions">github-actions[bot]</a></li> <li>Update docs version to 2.0.4 (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11573">#11573</a>) @<a href="https://github.com/apps/github-actions">github-actions[bot]</a></li> </ul> <h2>📦 Dependency updates</h2>  <ul> <li>Combined dependencies PR (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11710">#11710</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> <li>Combined dependencies PR (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11708">#11708</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> <li>Combined dependencies PR (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11707">#11707</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> <li>Combined dependencies PR (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11706">#11706</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> <li>Combined dependencies PR (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11705">#11705</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> <li>Combined dependencies PR (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11704">#11704</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> <li>Combined dependencies PR (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11701">#11701</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> <li>Combined dependencies PR (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11700">#11700</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> <li>Combined dependencies PR (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11699">#11699</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> <li>Combined dependencies PR (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11685">#11685</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> <li>Combined dependencies PR (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11684">#11684</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> <li>Combined dependencies PR (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11681">#11681</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> <li>Combined dependencies PR (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11672">#11672</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> <li>Combined dependencies PR (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11671">#11671</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> <li>Combined dependencies PR (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11670">#11670</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> <li>Combined dependencies PR (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11632">#11632</a>) <a href="https://github.com/eddumelendez"><code>@eddumelendez</code></a></li> </ul>  <h2>2.0.4</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/testcontainers/testcontainers-java/commit/5c448202ac69d073f746433d3e79f6a2bf0ec585"><code>5c44820</code></a> Fix typo (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11717">#11717</a>)</li> <li><a href="https://github.com/testcontainers/testcontainers-java/commit/84b1c3a5951f18421ed35e82c44a1d17c5690cad"><code>84b1c3a</code></a> Add getHttpPort and getGrpcPort methods in WeaviateContainer (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11712">#11712</a>)</li> <li><a href="https://github.com/testcontainers/testcontainers-java/commit/a412b8ea77bae4ef51ca3e6bed7cffd0566b362e"><code>a412b8e</code></a> Use weaviate client v6 (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11711">#11711</a>)</li> <li><a href="https://github.com/testcontainers/testcontainers-java/commit/058fa82a96853bd653aa3bcaa95b6d94a148ea69"><code>058fa82</code></a> Combined dependencies PR (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11710">#11710</a>)</li> <li><a href="https://github.com/testcontainers/testcontainers-java/commit/773f344be6446a45da27e21d1d1a1c493b1a4062"><code>773f344</code></a> Merge remote-tracking branch 'origin/dependabot/gradle/modules/hivemq/ch.qos....</li> <li><a href="https://github.com/testcontainers/testcontainers-java/commit/ebe60437d087b16e5fac33ae554ecce13303b8bd"><code>ebe6043</code></a> Merge remote-tracking branch 'origin/dependabot/gradle/modules/activemq/org.a...</li> <li><a href="https://github.com/testcontainers/testcontainers-java/commit/5248d1dec9810e31b2cb0dc93ac04dd2820141ff"><code>5248d1d</code></a> Merge remote-tracking branch 'origin/dependabot/gradle/modules/scylladb/softw...</li> <li><a href="https://github.com/testcontainers/testcontainers-java/commit/ab781f6f71a619d4a55206e6c9380108a2508d13"><code>ab781f6</code></a> Combined dependencies PR (<a href="https://redirect.github.com/testcontainers/testcontainers-java/issues/11708">#11708</a>)</li> <li><a href="https://github.com/testcontainers/testcontainers-java/commit/2d6c1be44a8618016f3510b6a30286c54a55ac7d"><code>2d6c1be</code></a> Merge remote-tracking branch 'origin/dependabot/gradle/core/org.jetbrains-ann...</li> <li><a href="https://github.com/testcontainers/testcontainers-java/commit/e76c291ab852e6b9c6f8d7ddf3ec46bdcd52b2a3"><code>e76c291</code></a> Merge remote-tracking branch 'origin/dependabot/gradle/core/org.junit.platfor...</li> <li>Additional commits viewable in <a href="https://github.com/testcontainers/testcontainers-java/compare/2.0.3...2.0.5">compare view</a></li> </ul> </details> <br /> Updates `org.apache.maven.plugins:maven-checkstyle-plugin` from 3.3.1 to 3.6.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/maven-checkstyle-plugin/commit/dd1abd9ee7cb1046ece3ae013fa6e68a345c7a32"><code>dd1abd9</code></a> [maven-release-plugin] prepare release maven-checkstyle-plugin-3.6.0</li> <li><a href="https://github.com/apache/maven-checkstyle-plugin/commit/9ccb06ed3ef759a109d48456ccdad3f583f3ba57"><code>9ccb06e</code></a> fix</li> <li><a href="https://github.com/apache/maven-checkstyle-plugin/commit/6ac89b88deec9893875a40ec62718bc02d1a27cc"><code>6ac89b8</code></a> [MCHECKSTYLE-452] Upgrade to Doxia 2.0.0 GA Stack</li> <li><a href="https://github.com/apache/maven-checkstyle-plugin/commit/ff1a1b76e24a66107413eafda9eb17a3782957cd"><code>ff1a1b7</code></a> Bump org.apache.commons:commons-lang3 from 3.16.0 to 3.17.0</li> <li><a href="https://github.com/apache/maven-checkstyle-plugin/commit/13e16c5bbf322f24257b27f5ec4be01d2e39d485"><code>13e16c5</code></a> Remove unecessary test dependency on plexus-container-default</li> <li><a href="https://github.com/apache/maven-checkstyle-plugin/commit/a7c962ae77e10c210b51e56e949f9df7223d1e71"><code>a7c962a</code></a> [maven-release-plugin] prepare for next development iteration</li> <li><a href="https://github.com/apache/maven-checkstyle-plugin/commit/868abc95ea488a56f92a4610bdfd5d25c471e0de"><code>868abc9</code></a> [maven-release-plugin] prepare release maven-checkstyle-plugin-3.5.0</li> <li><a href="https://github.com/apache/maven-checkstyle-plugin/commit/9043f8a96ee5f3ab9971ecae399fce4da6a8ce2e"><code>9043f8a</code></a> [MCHECKSTYLE-446] Dynamically calculate xrefLocation/xrefTestLocation</li> <li><a href="https://github.com/apache/maven-checkstyle-plugin/commit/0e7bd00e106ea76d9ffaadf1256a95d463bf60e3"><code>0e7bd00</code></a> [MCHECKSTYLE-445] Upgrade to Doxia 2.0.0 Milestone Stack</li> <li><a href="https://github.com/apache/maven-checkstyle-plugin/commit/b92666d0b0dc3dfc4975be701e2f104ed6e96fb0"><code>b92666d</code></a> Bump org.apache.maven.plugins:maven-plugins from 42 to 43</li> <li>Additional commits viewable in <a href="https://github.com/apache/maven-checkstyle-plugin/compare/maven-checkstyle-plugin-3.3.1...maven-checkstyle-plugin-3.6.0">compare view</a></li> </ul> </details> <br /> Updates `org.apache.maven:apache-maven` from 3.9.11 to 3.10.0

KofTwentyTwo (Migrated from github.com) reviewed

2026-10-17 18:53:14 +00:00

This pull request has changes conflicting with the target branch.

pom.xml

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin dependabot/maven/develop/maven-minor-and-patch-fdf31ab6d8:dependabot/maven/develop/maven-minor-and-patch-fdf31ab6d8

git checkout dependabot/maven/develop/maven-minor-and-patch-fdf31ab6d8

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-webhooks#26

build(deps): bump the maven-minor-and-patch group across 1 directory with 6 updates #26

Build Parent and Guardrails 2.1.2

Build Parent and Guardrails 2.1.1

Changelog

[Unreleased]

Changed

Version 2.5.252

version-2.5.250

v42.7.14

Security

requireAuth is silently not enforced when the value excludes every authentication method (GHSA-rhp9-mr79-r74h, CVE-2026-107314)

Driver stores bytes of earlier statements when it pads a value shorter than its declared length (GHSA-f64h-wr5q-3qf3, CVE-2026-107315)

v42.7.12: security

Silent channel-binding authentication downgrade (CVE-2026-54291)

Changelog

[Unreleased]

Fixed

Changed

Security

[42.7.13] (2026-07-06)

Added

Changed

Fixed

2.0.5

What's Changed

🚀 Features & Enhancements

🐛 Bug Fixes

📖 Documentation

🧹 Housekeeping

📦 Dependency updates

2.0.4

Checkout

`requireAuth` is silently not enforced when the value excludes every authentication method (GHSA-rhp9-mr79-r74h, CVE-2026-107314)