Navigation :

PostgreSQL JDBC Driver 42.7.11 Released

Notable changes

Security

  • fix: Limit SCRAM PBKDF2 iterations accepted from the server. pgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256 authentication, where a malicious or compromised PostgreSQL server could specify an extremely large PBKDF2 iteration count, causing the client to consume unbounded CPU and potentially exhaust connection pools. The fix introduces a new scramMaxIterations connection property (default 100000) to cap iteration counts before computation begins. See the Security Advisory for more detail. The following CVE-2026-42198 has been issued.

Added

  • feat: implement require_auth connection property, aligning with libpq behaviour PR #3895

Changed

  • chore: bump Gradle to 9.4.1, org.checkerframework to 1.0.2, com.gradleup.shadow to 9.4.0 PR #3978
  • chore: bump errorprone to 2.48.0 PR #4005
  • chore: replace Appveyor with ikalnytskyi/action-setup-postgres PR #3966
  • chore: use tag names for pinning GitHub Actions, pin ikalnytskyi/action-setup-postgres PR #4007
  • chore: use full version tags in GitHub Actions comments PR #3963
  • chore: use @vlsi/github-actions-random-matrix npm package PR #4008
  • chore: use greedy pairwise coverage for CI matrix generation PR #3965
  • chore: replace log warning in ConnectionFactory.closeStream with Throwable.addSuppressed PR #3970
  • chore: suppress deprecations in test code to reduce build verbosity PR #3972
  • ci: pass ${{ }} expressions via env to avoid shell injection PR #4006
  • style: replace @exception with @throws in getBoolean javadoc PR #4035
  • fix: Add sources and javadocs to shaded published lib generation PR #4043
  • docs: add SCRAM authentication test setup section to TESTING.md PR #3945
  • docs: fix location of 42.7.4 changelogs PR #3839
  • test: add tests for QueryExecutor#getTransactionState PR #4006
  • test: replace @DisabledIfServerVersion annotations with @EnabledForServerVersionRange PR #3939
  • test: increase timeouts for LogicalReplicationTest
  • test: move test table creation from @BeforeEach to @BeforeAll PR #3967
  • test: add @DisableLogger annotation to suppress expected log warnings in tests PR #3971

Fixed

  • fix: ensure extended protocol messages end with Sync message PR #3728
  • fix: enable cursor-based fetching in extended protocol when transaction started via SQL command PR #3996
  • fix: retry with SSL on IOException when sslMode=ALLOW PR #3973
  • fix: make sure the driver honours connectTimeout when retrying the connection PR #3968
  • fix: allow fallback to non-SSL connection when sslMode=prefer and sslResponseTimeout kicks in PR #3968
  • fix: catch SecurityException from setContextClassLoader on ForkJoinPool workers PR #3962
  • fix: use compareTo for LogSequenceNumber comparison to handle unsigned values correctly PR #3961
  • fix: release COPY lock on IOException to prevent connection hang PR #3957
  • fix: return jsonb as PGObject instead of String PR #3956
  • fix: align SSL key file permission check with libpq PR #3952
  • fix: guard connection closed flag with a reentrant lock to protect against concurrent close PR #3905
  • fix: flaky CopyBothResponseTest by using WAL flush LSN PR #3979
  • fix: flaky replication restart tests by waiting for confirmed_flush_lsn PR #3975
  • fix: flaky LogicalReplicationStatusTest by polling pg_stat_replication PR #3974
  • fix: update docker scripts so max_locks_per_transaction is the same in the replica as the primary; correct is_pg_version_less_than PR #3958
  • fix: add users to pg_hba.conf for head so require_auth tests pass PR #3954

Dependency updates

  • deps: Update Gradle to v9.4.1
  • deps: Update checkerframework to v3.55.1
  • deps: Update errorprone to v2.48.0
  • deps: Update logback to v1.5.32
  • deps: Update dependency net.bytebuddy:byte-buddy-parent to v1.18.8
  • deps: Update dependency net.bytebuddy:byte-buddy-agent to v1.18.8
  • deps: Update dependency org.junit:junit-bom to v5.14.3
  • deps: Update dependency org.mockito:mockito-bom to v5.23.0
  • deps: Update dependency org.ow2.asm:asm-bom to v9.9.1
  • deps: Update dependency org.apache.bcel:bcel to v6.12.0
  • deps: Update dependency org.roaringbitmap:roaringbitmap to v1.6.14
  • deps: Update dependency org.ops4j.pax.url:pax-url-aether to v3.0.2
  • deps: Update dependency org.openrewrite.rewrite:org.openrewrite.rewrite.gradle.plugin to v7.30.0
  • deps: Update com.gradleup.shadow Gradle plugin to v9.4.1
  • deps: Update com.gradleup.nmcp to v1.4.4
  • deps: Update plugin com.gradle.develocity to v4.4.0
  • deps: Update plugin biz.aqute.bnd.builder to v7.2.3
  • deps: Update plugin org.gradlex.build-parameters to v1.4.5
  • deps: Update plugin org.jetbrains.kotlin.jvm to v2.3.20
  • deps: Update plugin com.github.lburgazzoli.karaf to v0.5.7
  • deps: Update plugin com.github.burrunan.s3-build-cache to v1.9.5
  • deps: Update release-drafter/release-drafter action to v6.4.0
  • deps: Update github/codeql-action action to v3.35.1
  • deps: Update codecov/codecov-action action to v5.5.4
  • deps: Update actions/checkout action to v6
  • deps: Update actions/configure-pages action to v6
  • deps: Update actions/create-github-app-token action to v3
  • deps: Update sbt/sbt to v1.12.9
  • deps: Update ubuntu:24.04 docker digest

Commits by author

Vladimir Sitnikov (27 commits)

Sehrope Sarkuni (9 commits)

Dave Cramer (6 commits)

Harinath Kanchu (1 commit)

Emmanuel Oppong (1 commit)

pbe-axelor (1 commit)