Update dependency org.postgresql:postgresql to v42.7.3 #9
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
42.2.6->42.7.3Release Notes
pgjdbc/pgjdbc (org.postgresql:postgresql)
v42.7.3Changed
Fixed
else iftoswitchNoSuchMethodError on ByteBuffer#positionwhen running on Java 8v42.7.2Security
SimpleQuerymode to generate a line comment by having a placeholder for a numeric with a-such as
-?. There must be second placeholder for a string immediately after. Setting the parameter to a -ve value creates a line comment.This has been fixed in this version fixes CVE-2024-1597. Reported by Paul Gerste. See the security advisory for more details. This has been fixed in versions 42.7.2, 42.6.1 42.5.5, 42.4.4, 42.3.9, 42.2.28.jre7. See the security advisory for work arounds.
Changed
Added
v42.7.1Changed
Fixed
Fixes Issue #3008
Fixes Issue #3007
,Issue #2850
Closes [Issue #1391(https://github.com/pgjdbc/pgjdbc/issues/1391)
v42.7.0Changed
java.desktopmodule. PR #2967Fixed
v42.6.0Changed
fix: use PhantomReferences instead of
Obejct.finalize()to track Connection leaks PR #2847The change replaces all uses of Object.finalize with PhantomReferences.
The leaked resources (Connections) are tracked in a helper thread that is active as long as
there are connections in use. By default, the thread keeps running for 30 seconds after all
the connections are released. The timeout is set with pgjdbc.config.cleanup.thread.ttl system property.
refactor:(loom) replace the usages of synchronized with ReentrantLock PR #2635
Fixes Issue #1951
v42.5.4Fixed
fix: fix testGetSQLTypeQueryCache by searching for xid type. We used to search for box type but it is now cached. xid is not cached, this nuance is required for the test.
fix OidValueCorrectnessTest BOX_ARRAY OID, by adding BOX_ARRAY to the oidTypeName map [PR #2810](https://github.com/pgjdbc/pgjdbc/pull/28100).
fixes Issue #2804.
fix: Make sure that github CI runs tests on all(https://togithub.com/pgjdbc/pgjdbc/pull/2809)dbc/pgjdbc/pull/2809\)).
v42.5.3Fixed
fix: Add box to TypeInfoCache, fixes Issue #2746 PR #2747
fix: regression in PgResultSet LONG_MIN copy and paste error fixes Issue #2748 PR#2749
v42.5.2Changed
regression: This release has 2 known regressions which make it unusable see the notes above. We advise people to use 42.5.3 instead.
docs: specify that timeouts are in seconds and there is a maximum. Housekeeping on some tests fixes #Issue 2671 PR #2686
docs: clarify binaryTransfer and add it to README PR# 2698
docs: Document the need to encode reserved characters in the connection URL PR #2700
feat: Define binary transfer for custom types dynamically/automatically fixes Issue #2554 PR #2556
Added
fix: added gssResponseTimeout as part of PR #2687 to make sure we don't wait forever on a GSS RESPONSE
Fixed
fix: Ensure case of XML tags in Maven snippet is correct PR #2682
fix: Make sure socket is closed if an exception is thrown in createSocket fixes Issue #2684 PR #2685
fix: Apply patch from Issue #2683 to fix hanging ssl connections PR #2687
fix - binary conversion of (very) long numeric values (longer than 4 * 2^15 digits) PR #2697 fixes Issue #2695
minor: enhance readability connection of startup params PR #2705
v42.5.1Security
This has been fixed in this version fixes CVE-2022-41946 see the security advisory for more details. Reported by Jonathan Leitschuh This has been fixed in versions 42.5.1, 42.4.3 42.3.8, 42.2.27.jre7. Note there is no fix for 42.2.26.jre6. See the security advisory for work arounds.
Fixed
v42.5.0Changed
float now aliases to float8 PR #2598 fixes Issue #2597
v42.4.2Changed
Added
Fixed
v42.4.1Security
SQL. This allowed a malicious table with column names that include statement terminator to be parsed and
executed as multiple separate commands.
Changed
Added
v42.4.0Changed
startup parameters in a transaction (default=false like 42.2.x) fixes Issue #2425
pgbouncer cannot deal with transactions in statement pooling mode PR #2425
Fixed
PR #2525, Issue #1311
Regression since 42.2.13. PR #2531, issue #2527
v42.3.6Changed
Added
Fixed
v42.3.5Changed
Added
Fixed
This is a regression from 42.2.x versions where tcpNoDelay defaulted to true
v42.3.4Changed
and default timezones PR 2464 fixes Issue #2221
Added
Fixed
v42.3.3Changed
They can no longer be used to configure the driver logging. Instead use java.util.logging
configuration mechanisms such as
logging.properties.Added
Fixed
v42.3.2Security
sslhostnameverifier, socketFactory, sslfactory, sslpasswordcallback connection properties.
However, the driver did not verify if the class implements the expected interface before instantiating the class. This
would allow a malicious class to be instantiated that could execute arbitrary code from the JVM. Fixed in commit
Changed
is prefer or require PR #2396 remove the need to have a ticket in the cache before asking the server if gss encryptions are supported
or JDBC 4.2.
CallableStatement#getBoolean(int) on BIT(>1).
Changes internal constructors for PgConnection and related classes to only accept the connection properties object and
remove the user and password arguments. Any locations that required those fields can retrieve them from the properties map.
Added
Adds authenticationPluginClassName connection property that allows end users to specify a class
that will provide the connection passwords at runtime. Users implementing that interface must
ensure that each invocation of the method provides a new char[] array as the contents
will be filled with zeroes by the driver after use.Call sites within the driver have been updated to use the char[] directly wherever possible.
This includes direct usage in the GSS authentication code paths that internally were already converting the String password into a char[] for internal usage.
This allows configuring a connection with a password that must be generated on the fly or periodically changes. PR #2369 original issue Issue #2102
Fixed
fixes Issue #921 synchronize modification of shared calendar
resultSet.getTimestamp() only ms precision is retained, the microsecond fractional digits are lost." This change will retain the microsecond
precision when .getTimestamp() is called on TIME(6). PR #2181 Closes Issue #1537
Add to TestUtil and also to DatabaseMetaData setup and teardown fixes Issue #2060
OutOfMemoryException=>OutOfMemoryErrorsafety TimestampUtil is not thread safe. It raises exceptions when multiple threads use ResultSets of one connection. PR #2291
fixes Issue #921
If PgStatement and PgResultSet use their own TimestampUtil no synchronize is needed.
v42.3.1Changed
multi-dimensional array the one exception is byte[], which is not supported.
improve the parsing of bytea hex encoded string by making a lookup table for each of the valid ascii code points to the 4 bit numeric value
Added
Fixed
binary numeric values which represented integers multiples of 10,000 from 10,000-9,990,000 were not decoded correctly
GreagoriantoGregorian.v42.3.0Changed
Added
Resource can be provided using 1) property "-Dorg.postgresql.pgservicefile=file1" 2) environment variable PGSERVICEFILE=file2 3) default location "$HOME/.pg_service.conf" 4) environment variable PGSYSCONFDIR=dir1 looks for file "dir1/pg_service.conf".
Fixed
Add a property
QUOTE_RETURNING_IDENTIFIERSwhich determines if we put double quotesaround identifiers that are provided in the returning array.
v42.2.24Fixed
Avoid leaking server error details through BatchUpdateException when logServerErrorDetail PR #2254
QueryExecutorImpl.receiveFastpathResult did not properly handle ParameterStatus messages.
This in turn caused failures for some LargeObjectManager operations. Closes Issue #2237
Fixed by adding the missing code path, based on the existing handling in processResults. PR #2253
It is possible to break method PgDatabaseMetaData.getIndexInfo() by adding certain custom operators. This PR fixes it.
use older syntax for COMMENT ON FUNCTION with explicit no-arg parameter parentheses as it is required on server versions before v10.
Handle cleanup of connection creation in StatementTest, handle cleanup of privileged connection in DatabaseMetaDataTest
fixes issues introduced in PR #2199 closes Issue #2196
v42.2.23Changed
Fixed
This does not have the issue of name shadowing / qual-names, and has the added benefit of fixing #1948.
v42.2.22Fixed
due to the blocking nature of the driver and issues with seeing if there is a byte available on a blocking stream when it is encrypted
this introduces unacceptable delays in returning from peek(). At this time there is no simple solution to this.
v42.2.21Changed
Fixed
fixes Issue 2173
v42.2.20Fixed
The usage of
setQueryTimeout();with the same value as thesetNetworkTimeout();is blocking the current transaction timeout.The timeouts are blocking each other with this approach.
v42.2.19Notable Changes
Changed
There is a small behaviour change here as a result. If closeOnCompletion is called on an existing statement and the statement
is executed a second time it will fail.
Added
Fixed
v42.2.18Fixed
fixed in #1920
v42.2.17Changed
Added
Fixed
v42.2.16Known issues
Fixed
Since 42.2.0 single dimensional arrays were stored 0 based. They are now sent 1 based which is the SQL standard, and the default
for Postgres when sent as strings such as '{1,2,3}'. Fixes issue 1860 in PR 1863.
v42.2.15Known issues
Changed
postgresql-$version-jdbc-src.tar.gz, and add top-level archive folder ba017507are possible. Now the driver will attempt to connect to the server with a GSSAPI encrypted connection. If that fails then
attempt an SSL connection, finally falling back to a plain text connection. All of this is controlled using both the gssEncMode
and sslMode parameters which, in concert with pg_hba.conf, determine if a particular mode is allowed and or required. PR 1821 ad921b9e
Added
Fixed
v42.2.14Changed
v42.2.13Notable Changes
Reported by David Dworken, this is an XXE and more information can be found here.
Sehrope Sarkuni reworked the XML parsing to provide a solution in commit 14b62aca4.
Changed
Added
Fixed
procedures fixed in PR 1774
v42.2.12Notable changes
We have released 42.2.12 to correct regressions in this version: Specifically
We recommend that version 42.2.11 not be used.
Changed
This change introduced a breaking change which will be moved to 42.3.0
v42.2.11Notable changes
As mentioned above this version is broken and should not be used.
Changed
DatabaseMetaData#getProceduresreturns only procedures (not functions) for PostgreSQL 11+ PR 1723commitorxa.preparecommand PR 1729Added
raiseExceptionOnSilentRollbackconnection option to configure if silent rollback should raise an exception PR 1729ByteStreamWriterin CopyManager PR 1702Fixed
.as decimal separator in PGInterval PR 1705Changed
Added
dockerfolder)v42.2.10Changed
Added
Fixed
v42.2.9Changed
Added
Fixed
v42.2.8Changed
Added
Fixed
v42.2.7Changed
Added
Fixed
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.