Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build(deps): bump org.postgresql:postgresql from 42.6.0 to 42.7.2 #227

Closed

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Mar 14, 2024

Bumps org.postgresql:postgresql from 42.6.0 to 42.7.2.

Release notes

Sourced from org.postgresql:postgresql's releases.

v42.7.2

Security

CVE-2024-1597 and Security Advisory addressed. The vulnerability occurs only in non-default preferQueryMode=simple mode and only if a negative place holder -? is used. See the security advisory for details

What's Changed

Full Changelog: pgjdbc/pgjdbc@REL42.7.1...REL42.7.2

v42.7.1

Fixed regressions since 42.7.0

  • Revert "Use canonical DateStyle name (#2925)" @​vlsi (#3035)
  • Revert "feat: support SET statements combining with other queries with semicolon in PreparedStatement" @​vlsi (#3010)
  • chore: use java.release=8 when building pgjdbc from the generated source distribution @​vlsi (#3038), the driver uses Java 8 methods only

Changes

  • Apply connectTimeout before SSLSocket.startHandshake to avoid infinite wait in case the connection is broken @​davecramer (#3040)
  • perf: improve performance of PreparedStatement.setBlob, BlobInputStream, and BlobOutputStream with dynamic buffer sizing @​vlsi (#3044)
  • fix: avoid timezone conversions when sending LocalDateTime to the database @​vlsi (#2852)
  • fix: support waffle-jna 2.x and 3.x by using reflective approach for ManagedSecBufferDesc @​chrullrich (#2720)

🧰 Maintenance

⬆️ Dependencies

... (truncated)

Changelog

Sourced from org.postgresql:postgresql's changelog.

[42.7.2] (2024-02-21 08:23:00 -0500)

Security

  • security: SQL Injection via line comment generation, it is possible in SimpleQuery mode to generate a line comment by having a placeholder for a numeric with a - such as -?. There must be second placeholder for a string immediately after. Setting the parameter to a -ve value creates a line comment. This has been fixed in this version fixes CVE-2024-1597. Reported by Paul Gerste. See the security advisory for more details. This has been fixed in versions 42.7.2, 42.6.1 42.5.5, 42.4.4, 42.3.9, 42.2.28.jre7. See the security advisory for work arounds.

Changed

Added

[42.7.1] (2023-12-06 08:34:00 -0500)

Changed

  • perf: improve performance of PreparedStatement.setBlob, BlobInputStream, and BlobOutputStream with dynamic buffer sizing [PR #3044](pgjdbc/pgjdbc#3044)

Fixed

[42.7.0] (2023-11-20 09:33:00 -0500)

Changed

Fixed

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [org.postgresql:postgresql](https://github.com/pgjdbc/pgjdbc) from 42.6.0 to 42.7.2.
- [Release notes](https://github.com/pgjdbc/pgjdbc/releases)
- [Changelog](https://github.com/pgjdbc/pgjdbc/blob/master/CHANGELOG.md)
- [Commits](pgjdbc/pgjdbc@REL42.6.0...REL42.7.2)

---
updated-dependencies:
- dependency-name: org.postgresql:postgresql
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Copy link
Author

dependabot bot commented on behalf of github Mar 14, 2024

The following labels could not be found: dependencies, java.

@codecov-commenter
Copy link

Codecov Report

All modified and coverable lines are covered by tests ✅

❗ No coverage uploaded for pull request base (main@caaf554). Click here to learn what that means.

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #227   +/-   ##
=======================================
  Coverage        ?   72.11%           
=======================================
  Files           ?      839           
  Lines           ?    16872           
  Branches        ?      954           
=======================================
  Hits            ?    12168           
  Misses          ?     4306           
  Partials        ?      398           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link

github-actions bot commented Mar 14, 2024

Test Results

   500 files  ±0     500 suites  ±0   18m 36s ⏱️ - 2m 12s
12 829 tests ±0  12 797 ✅ ±0  32 💤 ±0  0 ❌ ±0 
12 869 runs  ±0  12 837 ✅ ±0  32 💤 ±0  0 ❌ ±0 

Results for commit d22713f. ± Comparison against base commit caaf554.

This pull request removes 137 and adds 137 tests. Note that renamed tests count towards both.
org.eclipse.edc.connector.callback.staticendpoint.CallbackStaticEndpointExtensionTest ‑ [2] {edc.callback.cb.transactional=false, edc.callback.cb.uri=url}
org.eclipse.edc.connector.callback.staticendpoint.CallbackStaticEndpointExtensionTest ‑ [3] {edc.callback.cb.uri=url, edc.callback.cb.auth-key=test, edc.callback.cb.events=test, edc.callback.cb.transactional=false}
org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest ‑ [10] ACCEPTING, TERMINATED, java.util.concurrent.CompletableFuture@54275b5d[Completed normally], org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest$DispatchFailureArguments$$Lambda$618/0x0000000801385330@5d01b0d8
org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest ‑ [11] VERIFYING, TERMINATED, java.util.concurrent.CompletableFuture@6851b296[Completed normally], org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest$DispatchFailureArguments$$Lambda$619/0x0000000801385590@9e50283
org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest ‑ [12] TERMINATING, TERMINATED, java.util.concurrent.CompletableFuture@194224ca[Completed normally], org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest$DispatchFailureArguments$$Lambda$620/0x00000008013857f0@254e9709
org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest ‑ [1] REQUESTING, REQUESTING, java.util.concurrent.CompletableFuture@7bc2bb58[Completed exceptionally: org.eclipse.edc.spi.EdcException: error], org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest$DispatchFailureArguments$$Lambda$609/0x0000000801383990@7e2c6fd6
org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest ‑ [2] ACCEPTING, ACCEPTING, java.util.concurrent.CompletableFuture@6728370a[Completed exceptionally: org.eclipse.edc.spi.EdcException: error], org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest$DispatchFailureArguments$$Lambda$610/0x0000000801383bf0@2b5f8e61
org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest ‑ [3] VERIFYING, VERIFYING, java.util.concurrent.CompletableFuture@498a4d62[Completed exceptionally: org.eclipse.edc.spi.EdcException: error], org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest$DispatchFailureArguments$$Lambda$611/0x0000000801383e50@6fbe4800
org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest ‑ [4] TERMINATING, TERMINATING, java.util.concurrent.CompletableFuture@70139a81[Completed exceptionally: org.eclipse.edc.spi.EdcException: error], org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest$DispatchFailureArguments$$Lambda$612/0x00000008013840b0@60f9dc7e
org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest ‑ [5] REQUESTING, TERMINATING, java.util.concurrent.CompletableFuture@632d4cf2[Completed exceptionally: org.eclipse.edc.spi.EdcException: error], org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest$DispatchFailureArguments$$Lambda$613/0x0000000801384310@f10d055
…
org.eclipse.edc.connector.callback.staticendpoint.CallbackStaticEndpointExtensionTest ‑ [2] {edc.callback.cb.uri=url, edc.callback.cb.transactional=false}
org.eclipse.edc.connector.callback.staticendpoint.CallbackStaticEndpointExtensionTest ‑ [3] {edc.callback.cb.transactional=false, edc.callback.cb.events=test, edc.callback.cb.auth-key=test, edc.callback.cb.uri=url}
org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest ‑ [10] ACCEPTING, TERMINATED, java.util.concurrent.CompletableFuture@3ff8a3ad[Completed normally], org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest$DispatchFailureArguments$$Lambda$618/0x0000756ad4385978@550fa96f
org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest ‑ [11] VERIFYING, TERMINATED, java.util.concurrent.CompletableFuture@77ba583[Completed normally], org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest$DispatchFailureArguments$$Lambda$619/0x0000756ad4385bd8@5613247e
org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest ‑ [12] TERMINATING, TERMINATED, java.util.concurrent.CompletableFuture@2d07aacc[Completed normally], org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest$DispatchFailureArguments$$Lambda$620/0x0000756ad4385e38@ff5d4f1
org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest ‑ [1] REQUESTING, REQUESTING, java.util.concurrent.CompletableFuture@2404abe2[Completed exceptionally: org.eclipse.edc.spi.EdcException: error], org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest$DispatchFailureArguments$$Lambda$609/0x0000756ad4383fd8@16cf7fd0
org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest ‑ [2] ACCEPTING, ACCEPTING, java.util.concurrent.CompletableFuture@38ef1a0a[Completed exceptionally: org.eclipse.edc.spi.EdcException: error], org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest$DispatchFailureArguments$$Lambda$610/0x0000756ad4384238@56f9de3b
org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest ‑ [3] VERIFYING, VERIFYING, java.util.concurrent.CompletableFuture@1ed9d173[Completed exceptionally: org.eclipse.edc.spi.EdcException: error], org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest$DispatchFailureArguments$$Lambda$611/0x0000756ad4384498@6e981e78
org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest ‑ [4] TERMINATING, TERMINATING, java.util.concurrent.CompletableFuture@4fa5cc73[Completed exceptionally: org.eclipse.edc.spi.EdcException: error], org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest$DispatchFailureArguments$$Lambda$612/0x0000756ad43846f8@224e6e88
org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest ‑ [5] REQUESTING, TERMINATING, java.util.concurrent.CompletableFuture@70c56434[Completed exceptionally: org.eclipse.edc.spi.EdcException: error], org.eclipse.edc.connector.contract.negotiation.ConsumerContractNegotiationManagerImplTest$DispatchFailureArguments$$Lambda$613/0x0000756ad4384958@2c3f43d1
…

♻️ This comment has been updated with latest results.

Copy link
Author

dependabot bot commented on behalf of github Mar 15, 2024

Superseded by #229.

@dependabot dependabot bot closed this Mar 15, 2024
@dependabot dependabot bot deleted the dependabot/gradle/org.postgresql-postgresql-42.7.2 branch March 15, 2024 03:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant