Security

This release fixes two security vulnerabilities.

requireAuth is silently not enforced when the value excludes every authentication method (GHSA-rhp9-mr79-r74h, CVE-2026-107314)

Severity: Moderate (CVSS 5.9) | Affected versions: 42.7.11 – 42.7.13

If the requireAuth connection property excluded all six authentication methods the driver knows (for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none) or contained no method at all (for example requireAuth=,), the driver applied no restriction and accepted whatever method the server asked for, including cleartext password. An attacker positioned between the application and the server could use this to request cleartext password authentication and receive the database password.

Unset values, positive lists (such as requireAuth=scram-sha-256) and partial exclusions (such as requireAuth=!password,!md5) were not affected, and neither were deployments that do not set requireAuth.

Behavior after upgrading:

• A value that excludes every method now refuses the connection with SQLState 08004 and the message Authentication method is not allowed by requireAuth (or the channel binding error when channelBinding=require is also set).
• A value that names no method is rejected as an invalid requireAuth value.

Because affected deployments had this value by mistake, and connections worked normally on affected versions, connections with such a value will fail after upgrading. Replace it with a positive list of the methods your server uses, for example requireAuth=scram-sha-256.

Independently of this fix, use sslmode=verify-full with a trusted CA so that an attacker cannot present a substitute server.

Thanks to @manus-pi for finding and reporting this issue.

Driver stores bytes of earlier statements when it pads a value shorter than its declared length (GHSA-f64h-wr5q-3qf3, CVE-2026-107315)

Severity: Moderate (CVSS 5.3) | Affected versions: 42.7.4 – 42.7.13

When an application sent a value shorter than the length it declared, the driver padded the missing bytes with data from earlier messages on the same connection instead of zeros, and the server stored them. The stored value could contain SQL text and parameter values of earlier, unrelated statements (up to 8192 bytes, or 16320 with GSS encryption). On pooled connections, those statements could come from other requests. 42.7.3 and earlier padded with zeros.

This is reachable through the following public API when the declared length is larger than the data:

• PreparedStatement.setObject(int, ByteStreamWriter)
• CopyIn.writeToCopy(ByteStreamWriter) and CopyIn.writeToCopy(byte[], int, int)
• PGCopyOutputStream.write(byte[], int, int) (writes over 64 KiB)
• LargeObject.write(byte[], int, int)
• java.sql.Blob.setBytes(long, byte[], int, int)

Padding is now always zeros. Applications whose declared length always matches the data were not affected. Values stored by an affected version through such a call may already contain leaked data, so you may want to review affected columns. There is no connection property to disable the old behavior; the workaround on older versions is to make the declared length match the data.

Thanks to @vlsi for finding and reporting this issue.

Full Changelog: REL42.7.13...REL42.7.14

Changes

• docs: add 42.7.13 release changelog @davecramer (#4270)
• Adjust EditorConfig für Makefile @BaumiCoder (#4279)
• fix(scram): fail closed on channel-binding downgrade (no scram bump) @vlsi (#4272)
• Bump pgjdbc version from 42.7.12 to 42.7.13 @davecramer (#4269)
• chore: remove test-anorm-sbt module and its disabled CI wiring @vlsi (#4261)
• refactor(test-gss): convert to Java/JUnit 5 submodule of the main build @vlsi (#4166)
• ci: derive PG test versions from a Renovate-managed maxPgVersion @vlsi (#4218)
• feat(insert): cap reWriteBatchedInserts by the protocol limit, not 128 @vlsi (#4207)
• refactor(metadata): derive getPrimaryKeys from pg_constraint.conkey @vlsi (#4202)
• fix(protocol): defer flushes until response processing @vlsi (#4196)
• fix(build): resolve the Temurin 8 test toolchain by vendor @vlsi (#4257)
• build: include multi-release source sets in the JaCoCo coverage report @vlsi (#4256)
• fix(ci): read java_vendor before overwriting java_distribution @vlsi (#4255)
• ci: generate the whole matrix in one batch, coverage job included @vlsi (#4253)
• ci: pass CODECOV_TOKEN so protected-branch coverage uploads succeed @vlsi (#4254)
• ci: collect coverage on one pinned job @vlsi (#4245)
• ci: apply -DqueryTimeout from the matrix query_timeout axis @vlsi (#4246)
• ci: make Codecov project and patch statuses informational @vlsi (#4244)
• fix(build): restore JaCoCo XML report so Codecov receives coverage @vlsi (#4240)
• test(replication): shrink big-transaction inserts to avoid CI timeouts @vlsi (#4243)
• update maintainers @davecramer (#4222)
• test: add hermetic test for localSocketAddress @vlsi (#4224)
• docs(translation): clean up leftover German header in ja.po @vlsi (#4206)
• Update ja.po @davecramer (#2004)
• test: add PostgreSQL 18 to the CI test matrix @vlsi (#4198)
• test: silence expected SSPI warning stack trace in SSPIClientWaffleTest @vlsi (#4197)
• fix(ssl): build PKIX trust anchors without a KeyStore so FIPS-mode JVMs can load sslrootcert @vlsi (#4193)
• test: fix flaky sentLocationEqualToLastReceiveLSN replication test @vlsi (#4175)
• build: promote MethodCanBeStatic to error level @vlsi (#4172)
• Fix PGInterval.setSeconds to reject out of range and NaN values @sehrope (#4194)
• Replace connectThreadFactory with connectExecutor @sehrope (#4165)
• Fix deleting temp file when spooling large stream to disk in StreamWrapper @sehrope (#4190)
• chore: Add top level /scratch to gitignore @sehrope (#4164)
• refactor: favour composition over inheritance for Driver.ConnectTask @vlsi (#4160)
• Fix NumberParser.getFastLong(...) handling of overlong values @sehrope (#4163)
• build: produce a multi-release jar from reduced-pom.xml on Java 11+ @vlsi (#4157)
• Add connectThreadFactory and refactor Driver to use FutureTask for loginTimeout connection attempts @sehrope (#4120)
• test: verify custom properties reach socket factory @vlsi (#4125)
• test: fix LazyCleanerTest timeouts for the lingering Java 8 cleanup thread @vlsi (#4122)
• test: stabilise StatementTest.fastCloses on Windows @vlsi (#4121)
• fix: append default non-proxy hosts when socksNonProxyHosts is set @davecramer (#4045)
• test: budget terminating Sync in BatchDeadlockTest small-RETURNING branch @vlsi (#4116)
• test: make message assertions locale-independent @vlsi (#4113)
• build: drop xgettext default keywords; regenerate translations @vlsi (#4100)
• ci: opt-in scheduled workflows via ENABLE_SCHEDULED_JOBS repo variable @vlsi (#4085)
• Avoid direct java.lang.management dependency in maxResultBuffer parser @mblakley-casana (#4069)
• fix: restore pre-describe for generated-key batches @bilalshehata (#4014)
• revert: drop unrelated whitespace changes in CHANGELOG.md @dfa1 (#4065)
• fix: getCharacterStream wraps String in StringReader @dfa1 (#4063)

🚀 Features

• feat: invalidate prepared statement cache via search_path GUC_REPORT (PG 18+) @vlsi (#4259)
• feat: add classLoaderStrategy for thread-context classloader fallback @vlsi (#4167)

🐛 Bug Fixes

• fix(jdbc): reject empty timestamp/date/time text with a clear error @vlsi (#4278)
• fix: flush LargeObject output stream before marking closed @davecramer (#4248)
• fix(jdbc): classify updatable result set by search_path visibility @vlsi (#4214)
• fix: render bytea text parameters in PreparedStatement#toString @vlsi (#4201)
• feat: invalidate prepared statement cache via search_path GUC_REPORT (PG 18+) @vlsi (#4259)
• fix: detect native CALL preceded by a comment in CallableStatement (#2538) @vlsi (#4209)
• fix(jdbc): return null CHAR_OCTET_LENGTH for non-character columns @vlsi (#4231)
• fix(jdbc): honor scale in ResultSet.getBigDecimal(int, int) @vlsi (#4211)
• fix(largeobject): correct BlobInputStream mark/reset position and add efficient skip @vlsi (#4204)
• fix(core): detect search_path changes case-insensitively @vlsi (#4216)
• fix(build): restore checker-qual and waffle-jna in the published pom @vlsi (#4199)
• fix: clear ResourceBundle cache on deregister so the driver can unload @vlsi (#4237)
• fix: support java.time values in updatable ResultSet updateRow()/insertRow() @devs-lair (#3848)
• fix: skip autosave savepoint for SET LOCAL/SESSION TRANSACTION (#3307) @vlsi (#4203)
• fix: simplify implementation of Statement#cancel @vlsi (#1827)
• fix: auto-detect SSL key format instead of relying on .key extension @vlsi (#3946)
• fix: avoid AssertionError in BatchResultHandler when the connection is closed @vlsi (#4187)
• fix: close socket when PgConnection setup fails after connect @vlsi (#4161)
• fix: avoid nulling contextClassLoader on shared commonPool workers @vlsi (#4156)
• fix: keep LazyCleanerImpl cleanup task alive across transient empty queue @vlsi (#4038)
• fix: PGXAConnection no longer saves and restores the caller's autoCommit @vlsi (#4114)
• i18n: use MessageFormat placeholders in three GT.tr call sites @vlsi (#4105)
• feat: flushCacheOnDdl — transparent re-prepare after CREATE/DROP/ALTER @vlsi (#4067)
• fix: make sure GSS connection uses gssResponseTimeout rather than sslResponseTimeout @vlsi (#4076)

📝 Documentation

• Maintain consistency with the use of the word maintainer vs comitter @davecramer (#4234)
• test: guard authentication-plugin test against trust auth (#2442) @vlsi (#4239)
• feat: invalidate prepared statement cache via search_path GUC_REPORT (PG 18+) @vlsi (#4259)
• docs: note PKCS-12 client certificate chain requirement @vlsi (#4200)
• docs: clarify search_path correctness for server-prepared statements @vlsi (#4227)
• i18n(it): fill untranslated messages salvaged from #1278 @vlsi (#4225)
• docs: advertise RSS feeds with an autodiscovery link @vlsi (#4250)
• docs: redirect legacy documentation URLs to their new Hugo pages @vlsi (#4238)
• docs: remove null check that can never fail @djarnis73 (#4242)
• fix: reject SQL_TSI_FRAC_SECOND with an explicit, explained error @vlsi (#4229)
• i18n(zh_CN): fill untranslated messages salvaged from #2123 @vlsi (#4208)
• docs: clarify URL connection options fixes Issue #2526 @davecramer (#2532)
• docs: add 42.7.11 release changelog @vlsi (#4078)
• i18n: russian translation @vlsi (#1280)

🧰 Maintenance

• build: check docs/ and .github/ formatting with Autostyle @vlsi (#4276)
• ci: skip Codecov upload on failed branch builds @vlsi (#4260)
• feat(core): add OID constants for geometric arrays, RECORD, refcursor @vlsi (#4220)
• ci: upload heap dumps from all modules and on push failures @vlsi (#4236)
• fix: reject null URL in Driver.acceptsURL with a clear NullPointerException @vlsi (#4205)
• refactor(core): drop unused encoding Writer plumbing from PGStream @vlsi (#4215)
• build: verify benchmarks under check and CI, skip Jandex for them @vlsi (#4235)
• fix: attach the released jar and signature to the GitHub release @vlsi (#3814)
• build: ignore .codex-review scratch folder @vlsi (#4219)
• test: add CI testing against PostgreSQL HEAD @vlsi (#3257)
• ci: group Renovate updates by Maven groupId @vlsi (#4184)
• build: tidy .gitattributes for generated files and java diffs @vlsi (#4118)
• build: use explicit fileTree for gettext .po inputs @vlsi (#4106)
• i18n: convert ISO-8859-x .po files to UTF-8 @vlsi (#4115)
• ci: validate renovate.json on push and pull request @vlsi (#4112)
• ci(renovate): cap junit-bom <6.0 and checkerframework <4.0 @vlsi (#4111)

⬆️ Dependencies

Silent channel-binding authentication downgrade (CVE-2026-54291)

channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS (with channel binding) to plain SCRAM-SHA-256 (without it), losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection triggers the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash. Examples are Ed25519, Ed448, and post-quantum algorithms.

Two issues combine in releases 42.7.4 through 42.7.11:

The bundled com.ongres.scram:scram-client (3.1 or 3.2) returns an empty byte array instead of failing when it cannot derive the binding hash for such a certificate. This is the library issue tracked as GHSA-p9jg-fcr6-3mhf.

pgJDBC does not enforce channelBinding=require where it matters. ScramAuthenticator checks only that the server advertised a -PLUS mechanism; it neither rejects the empty binding nor checks that the negotiated mechanism uses channel binding. The connection therefore downgrades silently.

Only connections that set channelBinding=require are affected. Under the default prefer policy, and under allow or disable, falling back to plain SCRAM is the documented behaviour.

Releases before 42.7.4 are unaffected, because they do not support channel binding.

Security

• fix: Limit SCRAM PBKDF2 iterations accepted from the server.
  pgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256 authentication, where a malicious or compromised PostgreSQL server could specify an extremely large PBKDF2 iteration count, causing the client to consume unbounded CPU and potentially exhaust connection pools. The fix introduces a new scramMaxIterations connection property (defaulting to 100,000) to cap iteration counts before computation begins.
  See the Security Advisory for more detail.
  The following CVE-2026-42198 has been issued.

Changes

• fix: Add sources and javadocs to shaded published lib generation @sehrope (#4043)
• update Changelog and website for release of 42.7.11 @davecramer (#4042)
• Fix scram fix location in changelog and update published artifact developer list @sehrope (#4041)
• Restrict test with scram_iterations to v16+ and release notes @sehrope (#4040)
• chore(deps): update ubuntu:24.04 docker digest to 84e77de @renovate-bot (#4017)
• test: add tests for QueryExecutor#getTransactionState @vlsi (#4006)
• chore(deps): update actions/create-github-app-token action to v2.2.2 @renovate-bot (#3983)
• fix: fix flaky CopyBothResponseTest by using WAL flush LSN @vlsi (#3979)
• fix: fix flaky replication restart tests by waiting for confirmed_flush_lsn @vlsi (#3975)
• test: fix flaky LogicalReplicationStatusTest by polling pg_stat_replication @vlsi (#3974)
• chore: replace Appveyor with ikalnytskyi/action-setup-postgres @vlsi (#3966)
• test: move test table creation from @beforeeach to @BeforeAll @vlsi (#3967)
• Return jsonb as PGObject fixes Issue #3926 @davecramer (#3956)
• Update docker scripts @davecramer (#3958)
• implement require_auth, this is pretty much how libpq does this. @davecramer (#3895)
• docs: add SCRAM authentication test setup section to TESTING.md @emmaeng700 (#3945)
• Add RequireServerVersion annotation for tests @sehrope (#3939)

🐛 Bug Fixes

• fix: ensure extended protocol messages end with Sync message @vlsi (#3728)
• fix: enable cursor-based fetching in extended protocol when transaction started via SQL command @vlsi (#3996)
• fix: retry with SSL on IOException when sslMode=ALLOW @vlsi (#3973)
• fix: allow fallback to non-SSL connection when sslMode=prefer and sslResponseTimeout kicks in @vlsi (#3968)
• fix: catch SecurityException from setContextClassLoader on ForkJoinPool workers @vlsi (#3962)
• fix: use compareTo for LogSequenceNumber comparison @vlsi (#3961)
• fix: release COPY lock on IOException to prevent connection hang (#3957) @vlsi (#3960)

🧰 Maintenance

• style: replace @exception with @throws in getBoolean javadoc @vlsi (#4035)
• chore: use @vlsi/github-actions-random-matrix npm package @vlsi (#4008)
• chore: use tag names for pinning github actions, pin ikalnytskyi/action-setup-postgres @vlsi (#4007)
• chore: bump errorprone to 2.48.0 @vlsi (#4005)
• test: add @DisableLogger annotation to suppress expected log warnings in tests @vlsi (#3971)
• chore: suppress deprecations in test code to reduce build verbosity @vlsi (#3972)
• chore: replace log warning in ConnectionFactory.closeStream with Throwable.addSuppressed @vlsi (#3970)
• chore: use greedy pairwise coverage for CI matrix generation @vlsi (#3965)
• chore: use full version tags in GitHub Actions comments @vlsi (#3963)

⬆️ Dependencies

Changes

• Update site for 42.7.10 release @davecramer (#3936)
• Create DisabledIfServerGreater annotation @davecramer (#3937)
• fix non-standard strings failing test for version 19 @davecramer (#3934)
• Revert "fix: make all Calendar instances proleptic Gregorian (#3837)" @davecramer (#3932)
• fix small issues in ConnectionFactoryImpl @davecramer (#3929)
• Migrate to Shadow 9 @Goooler (#3931)
• style: fix empty line before javadoc for checkstyle compliance @Praveen7294 (#3925)
• style: fix lambda argument indentation for checkstyle compliance @aclfe (#3922)
• test: add autosave=always|never|conservative and cleanupSavepoints=true|false to the randomized CI jobs @vlsi (#3917)
• doc: use.md, fix typos @mjschwaiger (#3911)
• doc: datasource.md, fix minor formatting issue @mjschwaiger (#3912)
• lastEditYear to 2026 and bump version @davecramer (#3909)

🐛 Bug Fixes

• fix: process pending responses before fastpath to avoid protocol errors @vlsi (#3913)

⬆️ Dependencies

• chore(deps): update github/codeql-action digest to 4bdb89f @renovate-bot (#3914)
• chore(deps): update ubuntu:24.04 docker digest to cd1dba6 @renovate-bot (#3915)
• chore(deps): update dependency com.typesafe.play:sbt-plugin to v2.9.10 @renovate-bot (#3916)

Changes

• Added changelogs for version 42.7.9 @davecramer (#3908)
• the classloader is nullable, and remove a space @davecramer (#3907)
• fix: incorrect pg_stat_replication.reply_time calculation @atorik (#3906)
• fix: issue #3892, PGXAConnection.prepare(Xid) should return XA_RDONLY if the connection is read only @davecramer (#3897)
• fix badges for maven central and search paths. Sonatype has changed the search paths @davecramer (#3901)
• fix: make all Calendar instances proleptic Gregorian (#3837) @m-van-tilburg (#3887)
• test: add CI tests with Java 26 @vlsi (#3893)
• perf: optimize PGInterval.getValue() by replacing String.format with StringBuilder @vlsi (#3866)
• use ssl_is_used() to check for ssl connection @davecramer (#3867)
• Add PEMKeyManager to handle PEM based certs and keys. @harinath001 (#3700)
• Comment and simplify the complex state machine logic in QueryExecutorImpl @davecramer (#3850)
• Revert "fix: Issue #3784 pgjdbc can't decode numeric arrays containing special numbers like NaN" @davecramer (#3851)
• fix: Issue #3784 pgjdbc can't decode numeric arrays containing special numbers like NaN @ShenFeng312 (#3838)
• Small simplication of locking patterns in QueryExecutorBase @Sanne (#3849)
• doc: update property quoteReturningIdentifiers default value @sodekim (#3847)
• feat: default query timeout property @cfredri4 (#3705)
• create action to deploy docs to https://pgjdbc.github.io/ @davecramer (#3819)
• fix homepage release note @davecramer (#3817)

🐛 Bug Fixes

• fix: close temporary lob descriptors that are used internally in PreparedStatement#setBlob @vlsi (#3903)
• fix: avoid memory leaks in Java <= 21 caused by Thread.inheritedAccessControlContext @vlsi (#3886)

📝 Documentation

• doc: add the new PGP signing key to the official documentation @vlsi (#3813)

🧰 Maintenance

• chore: remove unused com.github.spotbugs Gradle plugin dependency @vlsi (#3868)
• chore: drop SpotBugs as we do not seem to use it @vlsi (#3834)
• chore: bump version to 42.7.9 after 42.7.8 release @vlsi (#3810)

⬆️ Dependencies

Notable changes:

• Releases are signed with a new PGP key which is generated at GitHub Actions and stored only there @vlsi (#3701)

Changes

• fix: Update release plugin config to use .set(...) for props and inject nexus secrets via props @sehrope (#3802)
• update version to 42.7.8 @davecramer (#3801)
• change logs for version 42.7.8 @davecramer (#3797)
• Fix getNotifications() documentation @pdewacht (#3800)
• fix(deps): update dependency om.ongres.scram:scram-client to 3.2 @jorsol (#3799)
• Add configurable boolean-to-numeric conversion for ResultSet getters @vwassan (#3796)
• Update CONTRIBUTING.md @davecramer (#3794)
• perf: remove QUERY_ONESHOT flag when calling getMetaData @ShenFeng312 (#3783)
• test: add bench for batch insert via unnest with arrays @lantalex (#3782)
• fix: Change "PST" timezone in TimestampTest to "Pacific Standard Time" @simon-greatrix (#3774)
• Use BufferedInputStream with FileInputStream @jgardn3r (#3750)
• Fix #3747: Incorrect class comparison in PGXmlFactoryFactory validation @eitch (#3748)
• fix: traverse the current dimension to get the correct pos in PgArray#calcRemainingDataLength @sly461 (#3746)
• test: add channelBinding to SslTest @vlsi (#3665)
• fix: remove excessive ReentrantLock.lock usages @vlsi (#3703)
• test: add ossf-scorecard security scanning @vlsi (#3695)
• fix indentation to let CI pass @mohitsatr (#3682)
• test: extract pgjdbc/testFixtures to testkit project @vlsi (#3666)
• fix: make sure getImportedExportedKeys returns columns in consistent order @vlsi (#3663)
• feat: use PreparedStatement for DatabaseMetaData.getCrossReference, getImportedKeys, getExportedKeys @vlsi (#3641)
• Add "SELF_REFERENCING_COL_NAME" field to getTables' ResultSetMetaData to fix NullPointerException @SophiahHo (#3660)

🐛 Bug Fixes

• fix: avoid IllegalStateException: Timer already cancelled when StatementCancelTimerTask.run throws a runtime error @vlsi (#3778)
• fix: avoid NullPointerException when cancelling a query if cancel key is not known yet @vlsi (#3780)
• fix: unable to open replication connection to servers < 12 @vlsi (#3678)

🧰 Maintenance

• chore: fix published project name @vlsi (#3809)
• chore: update publish to Central Portal task name after bumping nmcp @vlsi (#3808)
• fix(deps): update com.gradleup.nmcp to 1.1.0 @vlsi (#3807)
• Revert "fix: Update release plugin config to use .set(...) for props and inject nexus creds via gradle props" @vlsi (#3803)
• chore: group com.gradleup.nmcp version updates @vlsi (#3805)
• chore: use bump org.apache.bcel:bcel test dependency in testCompileClasspath as well @vlsi (#3775)
• Fix typo in PGReplicationStream.java @atorik (#3758)
• chore: remove JDK versions from the key workflow names @vlsi (#3759)
• chore: add GitHub Actions workflow for generating release PGP key @vlsi (#3701)
• chore: replace StandardCharsets with Charsets to simplify code @vlsi (#3751)
• chore: migrate publish workflow to Central Portal publishing via com.gradleup.nmcp @vlsi (#3686)
• chore: adjust the default branch name for ossf scorecard scan @vlsi (#3697)
• chore: add top-level read-only permissions for GitHub Actions when missing @vlsi (#3696)
• chore: use config:best-practices preset for Renovate @vlsi (#3687)
• refactor: pass ChannelBinding to ScramAuthenticator instead of passing full Properties @vlsi (#3667)
• chore: update JUnit to 5.13, use @ParameterizedClass @vlsi (#3652)

⬆️ Dependencies

Changes

Security

• security: Client Allows Fallback to Insecure Authentication Despite channelBinding=require configuration.
  Fix channel binding required handling to reject non-SASL authentication
  Previously, when channel binding was set to "require", the driver would silently ignore this
  requirement for non-SASL authentication methods. This could lead to a false sense of security
  when channel binding was explicitly requested but not actually enforced. The fix ensures that when
  channel binding is set to "require", the driver will reject connections that use
  non-SASL authentication methods or when SASL authentication has not completed properly.
  See the Security Advisory for more detail. Reported by George MacKerron
  The following CVE-2025-49146 has been issued

Added

• test: Added ChannelBindingRequiredTest to verify proper behavior of channel binding settings

🐛 Bug Fixes

• fix: ensure Connection.isValid() returns true even if prepared statements deallocate @vlsi (#3655)

🧰 Maintenance

• chore: bump slf4j and logback versions used for pgjdbc-osgi-test @vlsi (#3653)
• chore: fix the default branch name for dependency-submission action @vlsi (#3650)
• chore: add gradle/actions/dependency-submission so GitHub shows all dependencies used when building pgjdbc @vlsi (#3646)

⬆️ Dependencies

Changes

• Prepare release notes for release 42_7_6 (new format) @davecramer (#3628)
• fix: isValid incorrectly called execute, instead of executeWithFlags fixes Issue #3630 @davecramer (#3631)
• add override @davecramer (#3629)
• add the ability to turn off automatic LSN flush @davecramer (#3403)
• test: add tests with reWriteBatchedInserts=true @vlsi (#3616)
• test: add CI executions with adaptive_fetch=true by default @vlsi (#3615)
• test: simplify TestUtil.openDB, add tests with various assumeMinServerVersion values @vlsi (#3614)
• Deprecate group startup parms @davecramer (#3613)
• Add back application name setting @joejensen (#3509)
• Copr: Use Java 21 as the build dependency @mkoncek (#3607)
• fix indentation of return child to allow built pass in Checkstyle's CIs @mohitsatr (#3611)
• Set column name explicitely when using current_database() in queries @kneth (#3526)
• add PgMessageType and use static variables for protocol literals @davecramer (#3609)
• Handle protocol 3.2 and wider cancel keys. @davecramer (#3592)
• refactor empty resultset to use empty result set if the catalog is not correct @davecramer (#3588)
• Use query to find the current catalog instead of relying on the database in the connection URL or connection properties as this could be different if connected through a pooler or proxy @davecramer (#3565)
• ci: add Java 24 tests @davecramer (#3580)
• docs: Relabel 42.7.4 as past version as it is no longer the latest @sehrope (#3586)
• test: remove stale logging message from SslTest @vlsi (#3584)
• chore: appply the latest byte-buddy version for tests so we support the latest Java versions @vlsi (#3583)
• fix: make PgConnection#abort compatible with Java 24 @vlsi (#3582)
• chore(deps): update plugin com.github.burrunan.s3-build-cache to v1.8.5 @renovate-bot (#3573)
• Fix JavadocTagContinuationIndentation in AfterBeforeParameterResolver @Anmol202005 (#3566)
• Revert "use in row values instead of union all (#3510)" @vlsi (#3524)
• use in row values instead of union all @davecramer (#3510)
• feat: enhanced DatabaseMetadata.getIndexInfo() method, added index comment as REMARKS property @raminorujov (#3513)
• Nit: correct message in main.yml test action @ecki (#3503)
• chore: use import instead of require to support modern NodeJS @vlsi (#3502)
• chore: use PostgreSQL 17 rather than 17rc1 for CI tests @vlsi (#3501)
• chore: add ErrorProne verification to catch bugs ealier @vlsi (#3493)
• fix: ArrayIndexOutOfBounds when write big object into GSS enabled connection, make GSSInputStream robust in face of streams that produce incomplete reads @vlsi (#3500)
• refactor: factor out duplicated .getBytes() when converting date/time to Date/Time/Timestamp @vlsi (#3497)
• chore: exclude Oracle Java 17 from CI tests @vlsi (#3499)
• chore: remove unused Travis CI configuration @vlsi (#3498)
• Undeprecate sslfactoryarg connection property @sehrope (#3496)
• fix:Fix sending extra_float_digits @davecramer (#3491)

🐛 Bug Fixes

• fix: EOFException on PreparedStatement#toString with unset bytea parameter since 42.7.4 @MrEasy (#3369)

🧰 Maintenance

• chore: use Java 21 for building pgjdbc by default @vlsi (#3612)

⬆️ Dependencies

What's Changed

• fix:Fix sending extra_float_digits by @davecramer in #3491
• chore(deps): update plugin com.gradle.develocity to v3.19.1 by @renovate-bot in #3488
• Undeprecate sslfactoryarg connection property by @sehrope in #3496
• fix(deps): update dependency checkstyle to v10.21.1 by @renovate-bot in #3489
• fix(deps): update dependency com.github.spotbugs:com.github.spotbugs.gradle.plugin to v6.1.2 by @renovate-bot in #3486
• chore(deps): update codecov/codecov-action digest to 0da7aa6 by @renovate-bot in #3484
• chore: remove unused Travis CI configuration by @vlsi in #3498
• chore: exclude Oracle Java 17 from CI tests by @vlsi in #3499
• refactor: factor out duplicated .getBytes() when converting date/time to Date/Time/Timestamp by @vlsi in #3497
• fix: ArrayIndexOutOfBounds when write big object into GSS enabled connection, make GSSInputStream robust in face of streams that produce incomplete reads by @vlsi in #3500
• chore: add ErrorProne verification to catch bugs ealier by @vlsi in #3493
• fix(deps): update checkerframework by @renovate-bot in #3485
• chore: use PostgreSQL 17 rather than 17rc1 for CI tests by @vlsi in #3501
• chore: use import instead of require to support modern NodeJS by @vlsi in http...

Changes

• update changelogs and increment version in gradle.properties for release @davecramer (#3478)
• regression: revert change in fc60537 @davecramer (#3476)
• Fix PgDatabaseMetaData implementation of catalog as param and return value @SophiahHo (#3390)
• Support default GSS credentials in the Java Postgres client @nrhall (#3451)
• fix: return only the transactions accessible by the current_user in XAResource.recover @vlsi (#3450)
• feat: don't force send extra_float_digits for PostgreSQL >= 12 (#3432) @damienb-opt (#3446)
• fix: exclude "include columns" from the list of primary keys @priteshranjan01 (#3434)
• Enhance the meta query performance by specifying the oid. @dh-cloud (#3427)
• feat: support getObject(int, byte[].class) for bytea @anesterenok (#3274)
• docs: document infinity and some minor edits @davecramer (#3407)
• Added way to check for major server version, fixed check for RULE @davecramer (#3402)
• fixed remaining paragraphs @Zopsss (#3398)
• fixed paragraphs in javadoc comments @Zopsss (#3397)
• Reuse buffers and reduce allocations in GSSInputStream addresses Issue #3251 @davecramer (#3255)
• chore: Update Gradle to 8.10.2 @jorsol (#3388)
• ci: Test with Java 23 @jorsol (#3381)
• Fix getSchemas() @SophiahHo (#3386)
• Update rpm postgresql-jdbc.spec.tpl with scram-client @jorsol (#3324)
• Clearing thisRow and rowBuffer on close() of ResultSet @reallyinsane (#3384)
• Package was renamed to maven-bundle-plugin @ljavorsk (#3382)
• As of version 18 the RULE privilege has been removed @davecramer (#3378)
• fix: use buffered inputstream to create GSSInputStream @Sasasu (#3373)
• get rid of 8.4, 9.0 pg versions and use >= jdk version 17 @davecramer (#3372)
• Changed docker-compose version and renamed script file in instructions to match the real file name @MohanadKh03 (#3363)
• Do not assume "test" database in DatabaseMetaDataTransactionIsolationTest @nvanbenschoten (#3364)
• try to categorize dependencies @davecramer (#3362)

⬆️ Dependencies