Home » Oreps » Frost Server » All Pull Requests » #2428
fraunhoferiosb/frost-server
A Complete Server implementation of the OGC SensorThings API
Watch
1
Commit Activity
Pull Requests
Directory Browser
Velocity History
Releases

Bump the dependencies group across 1 directory with 26 updates #2428

Compare code on GitHub
Open
dependabot[bot] opened 1:33pm on September 9, 2026 wants to merge 85 Δ into fraunhoferiosb/frost-server v2.x from
dependabot/maven/v2.x/dependencies-1bbdf3d5cb
dependabot[bot]
fraunhoferiosb/frost-server
dependabot/maven/v2.x/dependencies-1bbdf3d5cb
Diff Delta:
85
About 21 Diff Delta/hour
Classified as:  General

dependabot-bot's Description of Work

Bumps the dependencies group with 26 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| ch.qos.logback:logback-classic | 1.5.37 | 1.6.3 |
| com.github.dasniko:testcontainers-keycloak | 4.2.1 | 4.3.1 |
| com.google.guava:guava | 33.6.0-jre | 33.7.1-jre |
| org.eclipse.jetty.ee10:jetty-ee10-servlet | 12.1.10 | 12.1.13 |
| org.jooq:jooq | 3.21.6 | 3.21.8 |
| org.jooq:jooq-codegen | 3.21.6 | 3.21.8 |
| org.jooq:jooq-meta | 3.21.6 | 3.21.8 |
| org.junit:junit-bom | 6.1.1 | 6.1.3 |
| org.junit.platform:junit-platform-suite | 6.1.1 | 6.1.3 |
| org.mariadb.jdbc:mariadb-java-client | 3.5.9 | 3.5.10 |
| org.postgresql:postgresql | 42.7.12 | 42.7.13 |
| org.slf4j:jul-to-slf4j | 2.0.18 | 2.0.19 |
| org.slf4j:slf4j-api | 2.0.18 | 2.0.19 |
| tools.jackson:jackson-bom | 3.2.0 | 3.2.2 |
| io.github.git-commit-id:git-commit-id-maven-plugin | 10.0.0 | 10.0.1 |
| org.apache.maven.plugins:maven-compiler-plugin | 3.15.0 | 3.16.0 |
| org.apache.maven.plugins:maven-jar-plugin | 3.5.0 | 3.5.1 |
| com.diffplug.spotless:spotless-maven-plugin | 3.8.0 | 3.10.2 |
| org.apache.maven.plugins:maven-surefire-plugin | 3.5.6 | 3.6.0 |
| com.hivemq:hivemq-mqtt-client | 1.3.16 | 1.4.0 |
| com.hivemq:hivemq-mqtt-client-epoll | 1.3.16 | 1.4.0 |
| org.bouncycastle:bcpkix-jdk18on | 1.84 | 1.85 |
| org.bouncycastle:bcprov-jdk18on | 1.84 | 1.85 |
| org.bouncycastle:bcutil-jdk18on | 1.84 | 1.85 |
| com.hivemq:hivemq-mqtt-client-websocket | 1.3.16 | 1.4.0 |
| org.apache.maven:apache-maven | 3.9.15 | 3.9.16 |

Updates ch.qos.logback:logback-classic from 1.5.37 to 1.6.3

Release notes

Sourced from ch.qos.logback:logback-classic's releases.



Logback 1.6.3


2026-08-14 Release of logback version 1.6.3




  • In response CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, </code>) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).




  • Colour console support is split out into a dedicated JansiConsoleAppender. It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.




  • The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.




  • ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behavior is covered by tests for issues/1063.




  • Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation
    warning above uses the batched gate.




  • The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.




  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.




--
Sponsoring SLF4J/logback/reload4j at https://github.com/sponsors/qos-ch


Logback 1.6.2


https://github.com/user-attachments/assets/9ceaf157-b758-4188-815d-edfe4e1b4edd


2026-08-10 Release of logback version 1.6.2




  • Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.




  • Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:


    <property name="logback.skipCallerContradictionAnalysis" value="true"/>



  • SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.




  • Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.




  • Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.




  • Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.




  • A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.




Logback 1.6.1


2026-07-28 Release of logback version 1.6.1


• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. .gz, .zip, .xz). Previously it used a nanotime-based .tmp suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)


<!-- raw HTML omitted -->

... (truncated)

Commits



  • e8e824d prepare release 1.6.3


  • 761821b MDCBasedDiscriminator has a gated warning mechanism


  • 53ed122 update copyright year


  • c7e2db2 rename SimpleInvocationGate as FixedIntervalInvocationGate


  • b5aa931 added BatchedSimpleInvocationGate


  • 1f22af7 add javadocs to SimpleInvocationGate


  • 638ffa7 prevent forward and backward slashes to escape to other directories


  • 7d6b9a4 add missing ch.qos.logback.core.property package


  • fa25930 add an extension path in ConsoleAppender for JansiConsoleAppender


  • c73b43f deprecate the withJansi path

  • Additional commits viewable in compare view


Updates com.github.dasniko:testcontainers-keycloak from 4.2.1 to 4.3.1

Release notes

Sourced from com.github.dasniko:testcontainers-keycloak's releases.



v4.3.1


What's Changed



Full Changelog: https://github.com/dasniko/testcontainers-keycloak/compare/v4.3.0...v4.3.1


v4.3.0


New Features



What's Changed


(dependencies only)



Full Changelog: https://github.com/dasniko/testcontainers-keycloak/compare/v4.2.1...v4.3.0


Commits



  • 97d3605 more endpoint methods (#318)


  • ee2a53f chore(deps-dev): bump ch.qos.logback:logback-classic (#316)


  • 4424fff chore(deps-dev): bump io.rest-assured:rest-assured from 6.0.0 to 6.0.1 (#315)


  • d9ef870 chore(deps-dev): bump junit-jupiter.version from 6.1.1 to 6.1.2 (#314)


  • 5d40175 chore: bump keycloak-admin-client version to 26.0.11 (#317)


  • 24f9262 Update Keycloak version to 26.7 in README and versions documentation


  • a3ddbcd ci: derive kc.version from pom.xml keycloak.version


  • 7cfdb29 prepare for 4.3 release by updating keycloak dependencies and version


  • 4b89fee chore: externalize dependency versions in pom.xml


  • 8d03c7b chore: bump testcontainers.version to 2.0.5

  • Additional commits viewable in compare view


Updates com.google.guava:guava from 33.6.0-jre to 33.7.1-jre

Release notes

Sourced from com.google.guava:guava's releases.



33.7.1


Maven


<dependency>

  <groupId>com.google.guava</groupId>

  <artifactId>guava</artifactId>

  <version>33.7.1-jre</version>

  <!-- or, for Android: -->

  <version>33.7.1-android</version>

</dependency>

Jar files



Guava requires one runtime dependency, which you can download here:



Javadoc



JDiff



Changelog


Guava 33.7.1 removes the Multi-Release line from our jar manifest, fixing an issue under Java 9 and 10 that was introduced to guava-jre in version 33.7.0. Sorry for the trouble.


33.7.0


Newly introduced problem for Java 9 and Java 10 only


Guava 33.7.0 includes a Multi-Release line in its jar manifest, even though it is no longer a multi-release jar. This causes some problems with tools from Java 9 and Java 10. The issue is fixed in version 33.7.1. Sorry for the trouble.


Maven


<dependency>

  <groupId>com.google.guava</groupId>

  <artifactId>guava</artifactId>

  <version>33.7.0-jre</version>

  <!-- or, for Android: -->

</tr></table>


... (truncated)

Commits


Updates org.eclipse.jetty.ee10:jetty-ee10-servlet from 12.1.10 to 12.1.13

Updates org.jooq:jooq from 3.21.6 to 3.21.8

Updates org.jooq:jooq-codegen from 3.21.6 to 3.21.8

Updates org.jooq:jooq-meta from 3.21.6 to 3.21.8

Updates org.jooq:jooq-codegen from 3.21.6 to 3.21.8

Updates org.jooq:jooq-meta from 3.21.6 to 3.21.8

Updates org.junit:junit-bom from 6.1.1 to 6.1.3

Release notes

Sourced from org.junit:junit-bom's releases.



JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3


See Release Notes.


Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.2...r6.1.3


JUnit 6.1.2 = Platform 6.1.2 + Jupiter 6.1.2 + Vintage 6.1.2


See Release Notes.


Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.1...r6.1.2


Commits



  • f59f60d Release 6.1.3


  • cd8ec92 Finalize 6.1.3 release notes


  • c8729f2 Restore compatibility with GraalVM 25 (#5901)


  • ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)


  • fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)


  • 62afc02 Delay GraalVM plugin updates for 3 days


  • 0cc2902 Skip graalVmTest task if GraalVM env vars are not set


  • f6bbfc5 Move GraalVM tests to separate test task (#5903)


  • e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)


  • 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)

  • Additional commits viewable in compare view


Updates org.junit.platform:junit-platform-suite from 6.1.1 to 6.1.3

Release notes

Sourced from org.junit.platform:junit-platform-suite's releases.



JUnit 6.1.3 = Platform 6.1.3 + Jupiter 6.1.3 + Vintage 6.1.3


See Release Notes.


Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.2...r6.1.3


JUnit 6.1.2 = Platform 6.1.2 + Jupiter 6.1.2 + Vintage 6.1.2


See Release Notes.


Full Changelog: https://github.com/junit-team/junit-framework/compare/r6.1.1...r6.1.2


Commits



  • f59f60d Release 6.1.3


  • cd8ec92 Finalize 6.1.3 release notes


  • c8729f2 Restore compatibility with GraalVM 25 (#5901)


  • ddc9e74 Update graalvm/setup-graalvm action to v1.6.4 (#5959)


  • fe2c52a Update plugin org.graalvm.buildtools.native to v1.1.7 (#5923)


  • 62afc02 Delay GraalVM plugin updates for 3 days


  • 0cc2902 Skip graalVmTest task if GraalVM env vars are not set


  • f6bbfc5 Move GraalVM tests to separate test task (#5903)


  • e87e052 Update plugin org.graalvm.buildtools.native to v1.1.6 (#5899)


  • 1cd56df Update plugin org.graalvm.buildtools.native to v1.1.5 (#5880)

  • Additional commits viewable in compare view


Updates org.mariadb.jdbc:mariadb-java-client from 3.5.9 to 3.5.10

Release notes

Sourced from org.mariadb.jdbc:mariadb-java-client's releases.



MariaDB Connector/Java 3.5.10



3.5.10 (Jul 2026)


Full Changelog


Key Enhancements



  • CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)

  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)

  • CONJ-1330 - add infer test to CI


Issues Resolved



  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server

  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is
    attacker-controlled (report by Qing Xu)

  • CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute

  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)

  • CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)

  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to
    jmestwa-coder)

  • CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating
    up front (thanks to jmestwa-coder)

  • CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to
    jmestwa-coder)

  • CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own
    password is supplied (report by fg0x0)

  • CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to
    jmestwa-coder)

  • CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)

  • CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing
    dot (report by Shaswata, thanks to Pepo48 for PR)

  • CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds
    Integer.MAX_VALUE, and returns bulk generated keys out of batch order


Changelog

Sourced from org.mariadb.jdbc:mariadb-java-client's changelog.




3.5.10 (Jul 2026)


Full Changelog


Key Enhancements



  • CONJ-1333 - Add maxAllowedPacket connection option (send/receive limit)

  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)

  • CONJ-1330 - add infer test to CI


Issues Resolved



  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server

  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is
    attacker-controlled (report by Qing Xu)

  • CONJ-1307 - Connection.setReadOnly(true) still allows DML statements to execute

  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)

  • CONJ-1327 - Align SSL hostname verification with TLS libraries (thanks to jmestwa-coder)

  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to
    jmestwa-coder)

  • CONJ-1331 - trustStore-configured TLS connections defer certificate-chain/identity validation instead of validating
    up front (thanks to jmestwa-coder)

  • CONJ-1340 - SQL injection via unescaped identifiers in updatable ResultSet generated statements (thanks to
    jmestwa-coder)

  • CONJ-1341 - MariaDbPoolDataSource.getConnection(user, password) ignores the user argument when the pool's own
    password is supplied (report by fg0x0)

  • CONJ-1328 - restrictedAuth allowlist is matched with substring contains() instead of equality (thanks to
    jmestwa-coder)

  • CONJ-1338 - Validate length-encoded integers fit a non-negative int before use as a length (report by fg0x0)

  • CONJ-1336 - CONJ-1282 regression: TLS connection fails when JDBC hostname is an absolute FQDN ending with a trailing
    dot (report by Shaswata, thanks to Pepo48 for PR)

  • CONJ-1335 - getGeneratedKeys() throws "integer overflow" after a batch insert when the auto-increment value exceeds
    Integer.MAX_VALUE, and returns bulk generated keys out of batch order



3.4.4 (Jul 2026)


Full Changelog


Notable Changes


  • CONJ-1339 - Add maxAllowedColumns option to bound server-announced column count (report by fg0x0)


Bugs Fixed


  • CONJ-1332 - Reject multipart (>16 MB) packets before authentication to prevent pre-auth OOM from a rogue server

  • CONJ-1342 - socketFactory option allows loading arbitrary bytecode via jar: URL, enabling RCE when JDBC URL is
    attacker-controlled (report by Qing Xu)

  • CONJ-1326 - Unsafe escaping in enquoteLiteral()/enquoteNCharLiteral() (thanks to jmestwa-coder)

  • CONJ-1329 - LOAD DATA LOCAL INFILE validation fails open when a bound parameter can't be rendered (thanks to
    jmestwa-coder)


<!-- raw HTML omitted -->

... (truncated)

Commits



  • 6164678 [misc] update changelog


  • 6f58858 [CONJ-1335] getGeneratedKeys() throws SQLDataException "integer overflow" aft...


  • 9f06db7 [misc] CI stability improvement


  • 99aa9e2 [CONJ-1336] correction follow up


  • 28a1550 [CONJ-1336] strip trailing dot from hostname before SNI and hostname verifica...


  • b2b3f1b [misc] limit authentication switch requests to 10 per connection


  • 26ca60a [misc] bound the whole connection phase by connectTimeout


  • 15e08ff [CONJ-1337] Limit parsec authentication PBKDF2 iteration factor to the connec...


  • d3c4a72 bump 3.5.10 version


  • d85e05f [CONJ-1342] socketFactory option allows loading arbitrary bytecode via jar: U...

  • Additional commits viewable in compare view


Updates org.postgresql:postgresql from 42.7.12 to 42.7.13

Release notes

Sourced from org.postgresql:postgresql's releases.



v42.7.13


Changes



  • docs: add 42.7.13 release changelog @​davecramer (#4270)

  • Adjust EditorConfig für Makefile @​BaumiCoder (#4279)

  • fix(scram): fail closed on channel-binding downgrade (no scram bump) @​vlsi (#4272)

  • Bump pgjdbc version from 42.7.12 to 42.7.13 @​davecramer (#4269)

  • chore: remove test-anorm-sbt module and its disabled CI wiring @​vlsi (#4261)

  • refactor(test-gss): convert to Java/JUnit 5 submodule of the main build @​vlsi (#4166)

  • ci: derive PG test versions from a Renovate-managed maxPgVersion @​vlsi (#4218)

  • feat(insert): cap reWriteBatchedInserts by the protocol limit, not 128 @​vlsi (#4207)

  • refactor(metadata): derive getPrimaryKeys from pg_constraint.conkey @​vlsi (#4202)

  • fix(protocol): defer flushes until response processing @​vlsi (#4196)

  • fix(build): resolve the Temurin 8 test toolchain by vendor @​vlsi (#4257)

  • build: include multi-release source sets in the JaCoCo coverage report @​vlsi (#4256)

  • fix(ci): read java_vendor before overwriting java_distribution @​vlsi (#4255)

  • ci: generate the whole matrix in one batch, coverage job included @​vlsi (#4253)

  • ci: pass CODECOV_TOKEN so protected-branch coverage uploads succeed @​vlsi (#4254)

  • ci: collect coverage on one pinned job @​vlsi (#4245)

  • ci: apply -DqueryTimeout from the matrix query_timeout axis @​vlsi (#4246)

  • ci: make Codecov project and patch statuses informational @​vlsi (#4244)

  • fix(build): restore JaCoCo XML report so Codecov receives coverage @​vlsi (#4240)

  • test(replication): shrink big-transaction inserts to avoid CI timeouts @​vlsi (#4243)

  • update maintainers @​davecramer (#4222)

  • test: add hermetic test for localSocketAddress @​vlsi (#4224)

  • docs(translation): clean up leftover German header in ja.po @​vlsi (#4206)

  • Update ja.po @​davecramer (#2004)

  • test: add PostgreSQL 18 to the CI test matrix @​vlsi (#4198)

  • test: silence expected SSPI warning stack trace in SSPIClientWaffleTest @​vlsi (#4197)

  • fix(ssl): build PKIX trust anchors without a KeyStore so FIPS-mode JVMs can load sslrootcert @​vlsi (#4193)

  • test: fix flaky sentLocationEqualToLastReceiveLSN replication test @​vlsi (#4175)

  • build: promote MethodCanBeStatic to error level @​vlsi (#4172)

  • Fix PGInterval.setSeconds to reject out of range and NaN values @​sehrope (#4194)

  • Replace connectThreadFactory with connectExecutor @​sehrope (#4165)

  • Fix deleting temp file when spooling large stream to disk in StreamWrapper @​sehrope (#4190)

  • chore: Add top level /scratch to gitignore @​sehrope (#4164)

  • refactor: favour composition over inheritance for Driver.ConnectTask @​vlsi (#4160)

  • Fix NumberParser.getFastLong(...) handling of overlong values @​sehrope (#4163)

  • build: produce a multi-release jar from reduced-pom.xml on Java 11+ @​vlsi (#4157)

  • Add connectThreadFactory and refactor Driver to use FutureTask for loginTimeout connection attempts @​sehrope (#4120)

  • test: verify custom properties reach socket factory @​vlsi (#4125)

  • test: fix LazyCleanerTest timeouts for the lingering Java 8 cleanup thread @​vlsi (#4122)

  • test: stabilise StatementTest.fastCloses on Windows @​vlsi (#4121)

  • fix: append default non-proxy hosts when socksNonProxyHosts is set @​davecramer (#4045)

  • test: budget terminating Sync in BatchDeadlockTest small-RETURNING branch @​vlsi (#4116)

  • test: make message assertions locale-independent @​vlsi (#4113)

  • build: drop xgettext default keywords; regenerate translations @​vlsi (#4100)

  • ci: opt-in scheduled workflows via ENABLE_SCHEDULED_JOBS repo variable @​vlsi (#4085)

  • Avoid direct java.lang.management dependency in maxResultBuffer parser @​mblakley-casana (#4069)

  • fix: restore pre-describe for generated-key batches @​bilalshehata (#4014)


<!-- raw HTML omitted -->

... (truncated)

Changelog

Sourced from org.postgresql:postgresql's changelog.



[42.7.13] (2026-07-06)


Added



  • feat: invalidate the prepared-statement cache when the server reports a search_path change via GUC_REPORT (PostgreSQL 18+), so cached plans are no longer used against the wrong schema [PR #4259](pgjdbc/pgjdbc#4259)

  • feat: reWriteBatchedInserts now merges up to 32768 rows into one multi-values INSERT (bounded by the 65535 bind-parameter limit on the extended protocol) instead of capping at 128, which speeds up batches of few-column rows. The new reWriteBatchedInsertsSize connection property lowers that cap when set; the default of 0 uses that maximum. [PR #4207](pgjdbc/pgjdbc#4207)

  • feat: invalidate the prepared-statement cache after CREATE/DROP/ALTER so callers no longer trip on "cached plan must not change result type" without opting into autosave=ALWAYS. Controlled by the new flushCacheOnDdl connection property (default true); set to false for the prior behaviour. [PR #4067](pgjdbc/pgjdbc#4067)

  • feat: add connectExecutor connection property to customize the Executor used to run the worker task that performs the connection attempt when loginTimeout is in effect. The value is the fully qualified name of a class implementing java.util.concurrent.Executor. With a null value, the default, the driver retains the prior behavior of running the connection attempt on a daemon thread named "PostgreSQL JDBC driver connection thread". The executor must run the task on a thread other than the caller's. Running the attempt on a named thread lets applications that monitor driver-created threads identify it. [PR #4165](pgjdbc/pgjdbc#4165)

  • feat: add classLoaderStrategy connection property to control which classloaders the driver searches when loading a class named by a connection property, for example socketFactory. The default driver-first now falls back to the thread context classloader when the driver's classloader cannot resolve the class, which fixes class loading in non-flat class paths such as Quarkus and OSGi. Set driver to keep the previous driver-classloader-only behaviour, or context-first to prefer the thread context classloader [Issue #2112](pgjdbc/pgjdbc#2112) [PR #4167](pgjdbc/pgjdbc#4167)

  • feat: add OID constants for geometric arrays, RECORD, and refcursor [PR #4220](pgjdbc/pgjdbc#4220)

  • feat: LargeObject BlobInputStream now skips by seeking instead of reading, and the driver exposes the server version so it can select the 64-bit large-object API where available [PR #4204](pgjdbc/pgjdbc#4204)


Changed



  • refactor: the worker that runs the connection attempt under loginTimeout is now a FutureTask (ConnectTask) instead of the hand-rolled ConnectThread. When the caller hits the timeout, the task is now cancelled with cancel(true), which interrupts the worker thread rather than letting it run to completion. This makes the connection attempt interruptible, so loginTimeout can stop a slow connection attempt instead of leaking a thread. As before, a connection that the worker still manages to establish after the caller gives up is closed by the worker so that it does not leak. There are no public API changes and this should only lead to faster background resource cleanup for connections that time out. [PR #4120](pgjdbc/pgjdbc#4120)

  • chore: PGXAConnection.ConnectionHandler now rejects setAutoCommit(false) and setSavepoint(...) during an active XA branch, in addition to the long-rejected setAutoCommit(true) / commit() / rollback(). The setSavepoint rejection was already meant to be in place but the guard misspelled the method name as setSavePoint, so savepoints silently went through. Both changes bring the proxy in line with JTA 1.2 §3.4. [PR #4114](pgjdbc/pgjdbc#4114)

  • chore: commitPrepared / rollback-of-prepared now return XAER_RMFAIL instead of XAER_RMERR when the underlying connection is left in a non-idle TransactionState. Transaction managers (Geronimo, Narayana, Atomikos) treat XAER_RMFAIL as retryable on a fresh XAResource; the prepared transaction is no longer abandoned. [PR #4114](pgjdbc/pgjdbc#4114)

  • refactor: derive getPrimaryKeys from pg_constraint.conkey [PR #4202](pgjdbc/pgjdbc#4202)


Fixed



  • fix: the published GitHub release now ships the released postgresql-<version>.jar and its detached PGP signature, taken from the same signed build that is uploaded to Maven Central, instead of a leftover SNAPSHOT jar [Issue #3812](pgjdbc/pgjdbc#3812) [PR #3814](pgjdbc/pgjdbc#3814)

  • fix: simplify the Statement#cancel state machine by dropping the redundant CANCELLED state. killTimerTask now waits for the state to return to IDLE directly, which removes a spin-forever case when more than one thread observes the cancel completing [PR #1827](pgjdbc/pgjdbc#1827).

  • perf: defer simple-query flushes until the driver reads the response, allowing BEGIN and the following query to share a network flush [Issue #3894](pgjdbc/pgjdbc#3894) [PR #4196](pgjdbc/pgjdbc#4196)

  • fix: reWriteBatchedInserts no longer throws IllegalArgumentException when batching a parameterless INSERT (for example INSERT INTO t VALUES (1, 2)) of 256 rows or more [PR #4207](pgjdbc/pgjdbc#4207)

  • fix: a comment before CALL in a CallableStatement no longer hides the native call, so OUT parameter registration works for /* comment / call proc(?, ?) and similar. Parser.modifyJdbcCall now skips leading whitespace and SQL comments (both -- and / */) before the call, tolerates a trailing comment after a { ... } escape, and no longer adds a spurious comma when moving an OUT parameter into a call whose arguments are only a comment [Issue #2538](pgjdbc/pgjdbc#2538) [PR #4209](pgjdbc/pgjdbc#4209)

  • fix: PreparedStatement.toString() no longer throws for a bytea value supplied as text via PGobject. Hex-format values (\x...) are validated and rendered as a bytea literal, and escape-format values are quoted and cast like any other literal [Issue #3757](pgjdbc/pgjdbc#3757) [PR #4201](pgjdbc/pgjdbc#4201)

  • fix: the driver no longer nulls the contextClassLoader of shared ForkJoinPool.commonPool() worker threads, which previously left unrelated tasks on those threads running with a null classloader [Issue #4155](pgjdbc/pgjdbc#4155) [PR #4156](pgjdbc/pgjdbc#4156)

  • fix: PgResultSet#getCharacterStream wraps String in a StringReader [PR #4063](pgjdbc/pgjdbc#4063)

  • fix: PGXAConnection no longer saves and restores the underlying connection's JDBC autoCommit flag. All XA-protocol SQL (BEGIN, PREPARE TRANSACTION, COMMIT, ROLLBACK, COMMIT PREPARED, ROLLBACK PREPARED, the recover() SELECT) is sent through QUERY_SUPPRESS_BEGIN, so the caller's autoCommit value is invariant across every XAResource call. Fixes the "2nd phase commit must be issued using an idle connection" failure during recovery on managed datasources that pool connections with autoCommit=false (TomEE, WildFly, WebSphere Liberty) [PR #4114](pgjdbc/pgjdbc#4114)

  • fix: PGXAConnection.prepare() now mutates XA state only after PREPARE TRANSACTION succeeds. A failed PREPARE previously left the driver thinking the branch was already prepared, so the follow-up rollback(xid) tried ROLLBACK PREPARED against a non-existent gid and returned XAER_RMERR. Transaction managers (Narayana) escalated this to HeuristicMixedException. With the fix, rollback(xid) takes the active-branch path and issues a plain ROLLBACK, which the server accepts cleanly. Fixes [Issue #3153](pgjdbc/pgjdbc#3153), [Issue #3123](pgjdbc/pgjdbc#3123). [PR #4114](pgjdbc/pgjdbc#4114)

  • fix: an updatable result set over an unqualified table name is now classified using only the table visible through search_path. When two schemas held a table with the same name and the same primary or unique index name but a different set of key columns, the driver took the union of both schemas' columns, so the result set could be wrongly rejected as not updatable [PR #4214](pgjdbc/pgjdbc#4214). Supersedes [PR #3400](pgjdbc/pgjdbc#3400).

  • fix: LargeObject.close() now flushes a buffered output stream before marking the object closed, so closing a large object without an explicit flush() no longer drops buffered writes. The flush runs while the object is still open (it calls back into LargeObject.write()), and lo_close always runs afterward; a failure from lo_close no longer masks an earlier flush error, and the transaction is not committed when the flush failed [Issue #4247](pgjdbc/pgjdbc#4247) [PR #4248](pgjdbc/pgjdbc#4248).

  • fix: reject empty timestamp, timestamptz, and date text with a clear SQLException (SQLState 22007) instead of an ArrayIndexOutOfBoundsException [PR #4278](pgjdbc/pgjdbc#4278)

  • fix: return null CHAR_OCTET_LENGTH for non-character columns [PR #4231](pgjdbc/pgjdbc#4231)

  • fix: honor scale in ResultSet.getBigDecimal(int, int) [PR #4211](pgjdbc/pgjdbc#4211...


Description has been truncated

5 total changed files
(1 file ignored)
Loading changes...
Loading changes...
Loading changes...
Loading changes...
That’s the last hunk
Consider your review checksum validated.
GitClear uses cookies to ensure you get the best experience on our website. Learn more about our cookie policy