Skip to content

chore: upgrade postgresql to 42.7.10 due to CVE#4420

Merged
bobbai00 merged 2 commits intoapache:mainfrom
pjfanning:postgresql-upgrade
May 5, 2026
Merged

chore: upgrade postgresql to 42.7.10 due to CVE#4420
bobbai00 merged 2 commits intoapache:mainfrom
pjfanning:postgresql-upgrade

Conversation

@pjfanning
Copy link
Copy Markdown
Member

What changes were proposed in this PR?

CVE-2025-49146 affects 42.7.4 which is used in various places

Any related issues, documentation, discussions?

How was this PR tested?

Was this PR authored or co-authored using generative AI tooling?

@pjfanning pjfanning changed the title upgrade postgresql to 42.7.10 due to CVE chore: upgrade postgresql to 42.7.10 due to CVE Apr 20, 2026
@github-actions github-actions Bot added engine dependencies Pull requests that update a dependency file common labels Apr 20, 2026
@pjfanning pjfanning marked this pull request as draft April 20, 2026 19:51
@Yicong-Huang
Copy link
Copy Markdown
Contributor

@aglinxinyuan @bobbai00 do we need this in for 1.1?

@aglinxinyuan
Copy link
Copy Markdown
Contributor

aglinxinyuan commented May 3, 2026

@aglinxinyuan @bobbai00 do we need this in for 1.1?

It's not required, but we can still proceed with the upgrade. We can merge it after merging those test PRs, such that the testing will be easier.

@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented May 3, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 42.23%. Comparing base (b9c899f) to head (a4a1987).

Additional details and impacted files
@@            Coverage Diff            @@
##               main    #4420   +/-   ##
=========================================
  Coverage     42.22%   42.23%           
  Complexity     2180     2180           
=========================================
  Files           980      980           
  Lines         36287    36287           
  Branches       3783     3783           
=========================================
+ Hits          15321    15324    +3     
+ Misses        20037    20036    -1     
+ Partials        929      927    -2     
Flag Coverage Δ
access-control-service 39.53% <ø> (ø)
amber 43.14% <ø> (+0.01%) ⬆️
computing-unit-managing-service 0.00% <ø> (ø)
config-service 0.00% <ø> (ø)
file-service 33.24% <ø> (ø)
workflow-compiling-service 47.72% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@pjfanning
Copy link
Copy Markdown
Member Author

pjfanning commented May 5, 2026

Closing. There is an issue that needs investigation and I think I'll need to leave it to the Texera team to do this.

https://github.com/apache/texera/actions/runs/25405045722/job/74514056705

@pjfanning pjfanning force-pushed the postgresql-upgrade branch from d632519 to a4a1987 Compare May 5, 2026 22:29
@github-actions github-actions Bot added the platform Non-amber Scala service paths label May 5, 2026
@pjfanning pjfanning marked this pull request as ready for review May 5, 2026 22:35
@pjfanning
Copy link
Copy Markdown
Member Author

ok - this set of changes seems to be getting further in the build

Copy link
Copy Markdown
Contributor

@bobbai00 bobbai00 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Thank you very much for this effort @pjfanning

@bobbai00 bobbai00 merged commit 6b79896 into apache:main May 5, 2026
19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

common dependencies Pull requests that update a dependency file engine platform Non-amber Scala service paths

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants