dependabot[bot] opened a new pull request, #7105:
URL: https://github.com/apache/hop/pull/7105
Bumps [org.postgresql:postgresql](https://github.com/pgjdbc/pgjdbc) from
42.7.10 to 42.7.11.
Release notes
Sourced from https://github.com/pgjdbc/pgjdbc/releases";>org.postgresql:postgresql's
releases.
v42.7.11
Security
fix: Limit SCRAM PBKDF2 iterations accepted from the server.
pgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256
authentication, where a malicious or compromised PostgreSQL server could
specify an extremely large PBKDF2 iteration count, causing the client to
consume unbounded CPU and potentially exhaust connection pools. The fix
introduces a new scramMaxIterations connection property (defaulting to 100,000)
to cap iteration counts before computation begins.
See the https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq";>Security
Advisory for more detail.
The following https://nvd.nist.gov/vuln/detail/CVE-2026-42198";>CVE-2026-42198 has
been issued.
Changes
fix: Add sources and javadocs to shaded published lib generation https://github.com/sehrope";>@sehrope (https://redirect.github.com/pgjdbc/pgjdbc/issues/4043";>#4043)
update Changelog and website for release of 42.7.11 https://github.com/davecramer";>@davecramer (https://redirect.github.com/pgjdbc/pgjdbc/issues/4042";>#4042)
Fix scram fix location in changelog and update published artifact
developer list https://github.com/sehrope";>@sehrope
(https://redirect.github.com/pgjdbc/pgjdbc/issues/4041";>#4041)
Restrict test with scram_iterations to v16+ and release notes https://github.com/sehrope";>@sehrope (https://redirect.github.com/pgjdbc/pgjdbc/issues/4040";>#4040)
chore(deps): update ubuntu:24.04 docker digest to 84e77de https://github.com/renovate-bot";>@renovate-bot (https://redirect.github.com/pgjdbc/pgjdbc/issues/4017";>#4017)
test: add tests for QueryExecutor#getTransactionState https://github.com/vlsi";>@vlsi (https://redirect.github.com/pgjdbc/pgjdbc/issues/4006";>#4006)
chore(deps): update actions/create-github-app-token action to v2.2.2 https://github.com/renovate-bot";>@renovate-bot (https://redirect.github.com/pgjdbc/pgjdbc/issues/3983";>#3983)
fix: fix flaky CopyBothResponseTest by using WAL flush LSN https://github.com/vlsi";>@vlsi (https://redirect.github.com/pgjdbc/pgjdbc/issues/3979";>#3979)
fix: fix flaky replication restart tests by waiting for
confirmed_flush_lsn https://github.com/vlsi";>@vlsi
(https://redirect.github.com/pgjdbc/pgjdbc/issues/3975";>#3975)
test: fix flaky LogicalReplicationStatusTest by polling
pg_stat_replication https://github.com/vlsi";>@vlsi
(https://redirect.github.com/pgjdbc/pgjdbc/issues/3974";>#3974)
chore: replace Appveyor with ikalnytskyi/action-setup-postgres https://github.com/vlsi";>@vlsi (https://redirect.github.com/pgjdbc/pgjdbc/issues/3966";>#3966)
test: move test table creation from https://github.com/BeforeEach";>@BeforeEach to https://github.com/BeforeAll";>@BeforeAll https://github.com/vlsi";>@vlsi (https://redirect.github.com/pgjdbc/pgjdbc/issues/3967";>#3967)
Return jsonb as PGObject fixes Issue https://redirect.github.com/pgjdbc/pgjdbc/issues/3926";>#3926 https://github.com/davecramer";>@davecramer (https://redirect.github.com/pgjdbc/pgjdbc/issues/3956";>#3956)
Update docker scripts https://github.com/davecramer";>@davecramer (https://redirect.github.com/pgjdbc/pgjdbc/issues/3958";>#3958)
implement require_auth, this is pretty much how libpq does this. https://github.com/davecramer";>@davecramer (https://redirect.github.com/pgjdbc/pgjdbc/issues/3895";>#3895)
docs: add SCRAM authentication test setup section to TESTING.md https://github.com/emmaeng700";>@emmaeng700 (https://redirect.github.com/pgjdbc/pgjdbc/issues/3945";>#3945)
Add RequireServerVersion annotation for tests https://github.com/sehrope";>@sehrope (https://redirect.github.com/pgjdbc/pgjdbc/issues/3939";>#3939)
🐛 Bug Fixes
fix: ensure extended protocol messages end with Sync message https://github.com/vlsi";>@vlsi (https://redirect.github.com/pgjdbc/pgjdbc/issues/3728";>#3728)
fix: enable cursor-based fetching in extended protocol when transaction
started via SQL command https://github.com/vlsi";>@vlsi (https://redirect.github.com/pgjdbc/pgjdbc/issues/3996";>#3996)
fix: retry with SSL on IOException when sslMode=ALLOW https://github.com/vlsi";>@vlsi (https://redirect.github.com/pgjdbc/pgjdbc/issues/3973";>#3973)
fix: allow fallback to non-SSL connection when sslMode=prefer and
sslResponseTimeout kicks in https://github.com/vlsi";>@vlsi (https://redirect.github.com/pgjdbc/pgjdbc/issues/3968";>#3968)
fix: catch SecurityException from setContextClassLoader on ForkJoinPool
workers https://github.com/vlsi";>@vlsi (https://redirect.github.com/pgjdbc/pgjdbc/issues/3962";>#3962)
fix: use compareTo for LogSequenceNumber
