[dependabot]

Bumps the gradle-dependencies group with 29 updates in the / directory:

Package	From	To
com.gradleup.nmcp.settings	1.6.1	1.6.2
gradle-wrapper	9.6.1	9.8.2
org.jspecify:jspecify	1.0.0	1.0.1
tools.jackson.core:jackson-databind	3.2.3	3.2.4
tools.jackson.dataformat:jackson-dataformat-yaml	3.2.3	3.2.4
tools.jackson.dataformat:jackson-dataformat-yaml	3.2.3	3.2.4
com.github.ben-manes.caffeine:caffeine	3.2.4	3.3.1
io.micrometer:micrometer-core	1.17.0	1.17.2
org.slf4j:slf4j-api	2.0.18	2.0.20
org.jdbi:jdbi3-core	3.54.0	3.55.0
org.postgresql:postgresql	42.7.13	42.7.14
io.lettuce:lettuce-core	7.6.0.RELEASE	7.9.0.RELEASE
io.swagger.parser.v3:swagger-parser	2.1.22	2.1.48
com.diffplug.spotless:spotless-plugin-gradle	8.8.0	8.10.4
com.diffplug.spotless	8.8.0	8.10.4
net.ltgt.gradle:gradle-errorprone-plugin	5.1.0	5.1.1
net.ltgt.errorprone	5.1.0	5.1.1
com.google.errorprone:error_prone_core	2.50.0	2.51.0
com.google.errorprone:error_prone_annotations	2.50.0	2.51.0
com.google.errorprone:error_prone_annotations	2.50.0	2.51.0
org.junit.jupiter:junit-jupiter	6.1.2	6.1.3
org.junit.platform:junit-platform-launcher	6.1.2	6.1.3
org.junit.platform:junit-platform-launcher	6.1.2	6.1.3
org.mockito:mockito-core	5.23.0	5.24.0
org.mockito:mockito-junit-jupiter	5.23.0	5.24.0
org.mockito:mockito-junit-jupiter	5.23.0	5.24.0
ch.qos.logback:logback-classic	1.5.38	1.6.5
ch.qos.logback:logback-core	1.5.38	1.6.5
io.netty:netty-bom	4.2.15.Final	4.2.19.Final
com.fasterxml.jackson:jackson-bom	2.21.5	2.22.4
ch.qos.logback:logback-core	1.5.38	1.6.5
org.apache.commons:commons-compress	1.26.0	1.28.0
org.apache.commons:commons-lang3	3.18.0	3.21.0
org.mozilla:rhino	1.7.14.1	1.9.1
com.diffplug.spotless	8.8.0	8.10.4
net.ltgt.errorprone	5.1.0	5.1.1

Updates com.gradleup.nmcp.settings from 1.6.1 to 1.6.2

Release notes

Sourced from com.gradleup.nmcp.settings's releases.

v1.6.2

Compatibility with Gradle 9.8.0-milestone-2 and fixed some warnings about Gradle 10 incompatibility. Many thanks @​breskeby and @​snazy for the contributions 💙

👷‍♂️ All changes:

• Add a group and description to all nmcp-prefixed tasks (#269)
• Fix Gradle 10 issue in DefaultNmcpSettings (#270)
• Remove deprecated Configuration.setVisible(boolean) call on Gradle 9.8+ (#271)

Changelog

Sourced from com.gradleup.nmcp.settings's changelog.

Version 1.6.2

2026-08-31

Compatibility with Gradle 9.8.0-milestone-2 and fixed some warnings about Gradle 10 incompatibility. Many thanks @​snazy and @​breskeby for the contributions 💙

👷‍♂️ All changes:

• Add a group and description to all nmcp-prefixed tasks (#269)
• Fix Gradle 10 issue in DefaultNmcpSettings (#270)
• Remove deprecated Configuration.setVisible(boolean) call on Gradle 9.8+ (#271)

Commits

• 59864f7 Update Gradle and build dependencies (#272)
• 6a82d12 Remove deprecated Configuration.setVisible(boolean) call (Gradle 9.8) (#271)
• 342716d Fix Gradle 10 issue in DefaultNmcpSettings (#270)
• 5af3aa6 Add a group and description to all nmcp-prefixes tasks. The non nmcp- pre...
• 5c9fc2e bump to 1.6.2 SNAPSHOT (#267)
• See full diff in compare view

Updates gradle-wrapper from 9.6.1 to 9.8.2

Release notes

Sourced from gradle-wrapper's releases.

9.8.2

The Gradle team is excited to announce Gradle 9.8.2.

Here are the highlights of this release:

• Java 27 support
• Maven mirror settings reuse
• Linked problem locations in build output

Read the Release Notes

We would like to thank the following community members for their contributions to this release of Gradle: Aman Gautam, Björn Kautler, Eng Zer Jun, Hashim Khan, Julian Krannich, KBS, Labh R Jethe, Mark Dodgson, Maxim, monkey, nataphon-ktsystems, Paul King, Qiu Tian, rg_sandesh, Roberto Perez Alcolea, Sean, Zongle Wang.

Upgrade instructions

Switch your build to use Gradle 9.8.2 by updating your wrapper:

./gradlew :wrapper --gradle-version=9.8.2 && ./gradlew :wrapper

See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.

For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.

Reporting problems

If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines. If you're not sure you're encountering a bug, please use the forum.

We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.

9.8.1

This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0.

This release addresses three high rated vulnerabilities:

... (truncated)

Commits

• 8de7bcf Speed up the AllVersionsCrossVersion flaky quarantine (#39494)
• 66805db Run all cross-version targets in flaky quarantine
• cdd4c8f Skip empty test tasks in the flaky test quarantine
• 6badb77 Split the AllVersionsCrossVersion quarantine across agents
• 1655e44 Prepare for 9.8.2 (#39492)
• 6702214 Prepare for 9.8.2
• 688c0c1 Fix false warning about unstable graph (#39479)
• 3601d4f Clarify selector reuse comments in SelectorState
• 6e836fd Fix false warning about unstable graph
• a0790e5 Fix hidden artifact cleanup pattern in CheckProject (#39451)
• Additional commits viewable in compare view

Updates org.jspecify:jspecify from 1.0.0 to 1.0.1

Release notes

Sourced from org.jspecify:jspecify's releases.

1.0.1

JSpecify 1.0.1 makes small changes to documentation and build setup but no semantic changes.

Artifacts

• Javadoc
• Maven Central: org.jspecify:jspecify

Changes since version 1.0.0

• The JSpecify module-info.class is now present at the root of the jar instead of under a multi-release root. This prevents the jar from containing a file at META-INF/versions/9/OSGI-INF/MANIFEST.MF, which was causing trouble for some users, particularly on Android.
• The JSpecify module-info.class now contains its version number.
• We have made various improvements to our Javadoc. While the latest docs are always available at jspecify.dev/docs/api, this release makes our improvements visible in the source files in your IDE.

Commits

• ce9bec0 Set version to 1.0.1.
• 7c7f0cf Migrate to com.vanniktech.maven.publish.
• 2789f67 Bump yaml from 1.10.2 to 1.10.3 in /docs (#853)
• 1638ca0 Bump svgo from 3.3.2 to 3.3.4 in /docs (#852)
• 4e80178 Place module-info in the root of the jar. (#809)
• 5b679e0 Codex found a few more questions the FAQ already answers. (#848)
• 2019899 Link to the new location of the design FAQ and to specific sections. (#845)
• f01eac9 batch of javadoc revisions for clarity and completeness (#671)
• c4eff31 Import the nullness design FAQ as Markdown. (#838)
• 75fb9cf Bump websocket-driver from 0.7.4 to 0.7.5 in /docs (#835)
• Additional commits viewable in compare view

Updates tools.jackson.core:jackson-databind from 3.2.3 to 3.2.4

Commits

• 461f8ec [maven-release-plugin] prepare release jackson-databind-3.2.4
• 2a502c9 Prep for 3.2.4 release
• 64a4813 Merge branch '3.1' into 3.2
• 5d64697 Post-release dep version bump
• 9b5fe86 [maven-release-plugin] prepare for next development iteration
• 893c391 [maven-release-plugin] prepare release jackson-databind-3.1.8
• 22442d0 Prep for 3.1.8 release
• df230c1 Merge branch '2.x' into 3.1
• 69ddc80 Merge branch '2.22' into 2.x
• 72bb78e Post-release dep version bump
• Additional commits viewable in compare view

Updates tools.jackson.dataformat:jackson-dataformat-yaml from 3.2.3 to 3.2.4

Commits

• 0733be3 [maven-release-plugin] prepare release jackson-dataformats-text-3.2.4
• 3d387c6 Prep for 3.2.4 release
• bb8b703 Merge branch '3.1' into 3.2
• e2b0d13 Post-release dep version bump
• 621486d [maven-release-plugin] prepare for next development iteration
• 1a9f03b [maven-release-plugin] prepare release jackson-dataformats-text-3.1.8
• 87a85a8 Prep for 3.1.8 release
• 255785a Merge branch '2.x' into 3.1
• a4ae420 Merge branch '2.22' into 2.x
• 55d3e60 Post-release dep version bump
• Additional commits viewable in compare view

Updates tools.jackson.dataformat:jackson-dataformat-yaml from 3.2.3 to 3.2.4

Commits

• 0733be3 [maven-release-plugin] prepare release jackson-dataformats-text-3.2.4
• 3d387c6 Prep for 3.2.4 release
• bb8b703 Merge branch '3.1' into 3.2
• e2b0d13 Post-release dep version bump
• 621486d [maven-release-plugin] prepare for next development iteration
• 1a9f03b [maven-release-plugin] prepare release jackson-dataformats-text-3.1.8
• 87a85a8 Prep for 3.1.8 release
• 255785a Merge branch '2.x' into 3.1
• a4ae420 Merge branch '2.22' into 2.x
• 55d3e60 Post-release dep version bump
• Additional commits viewable in compare view

Updates com.github.ben-manes.caffeine:caffeine from 3.2.4 to 3.3.1

Release notes

Sourced from com.github.ben-manes.caffeine:caffeine's releases.

3.3.1

• Added a workaround for ForkJoinPool queue corruption caused by resubmitting a reusable ForkJoinTask (#2021)
• Improved JCache read performance when using access expiration
• Fixed various minor issues found using AI audits

3.3.0

• Improved read performance by avoiding false sharing in the fast-path check
• Improved adaptive climber for small caches and shifting workloads
• Fixed various minor issues found using AI audits
• Fixed over-aggressive refresh discard (#1970)

Commits

• aabb242 record the prefix-cache and warm-up findings
• 0117302 stop JCache access expiry from writing every hit
• 27fc6b8 skip rewriting an unchanged deadline on a read
• 7f87a7e restore coverage lost to recent fixes
• 75e2dc0 minor polish
• 5155a5a use nullRef() for null futures rejected by NullAway's generic inference (#2023)
• 998978c Avoid reusing a ForkJoinTask for maintenance (fixes #2021)
• 6999bfd add the Qwen Bailian prefix-cache traces
• 76dcbb5 fix canary test races and misc cleanups
• 7f46a43 pad the eviction sizes off the hit path's lines
• Additional commits viewable in compare view

Updates io.micrometer:micrometer-core from 1.17.0 to 1.17.2

Release notes

Sourced from io.micrometer:micrometer-core's releases.

1.17.2

🐞 Bug Fixes

• Preserve whitespace in HTTP Basic authentication passwords #8015
• Missing reflection hint for getProcessCpuTime #7911
• Proxy JMS session results using the method's declared return type #7896
• Kotlin interoperability for CaffeineCacheMetrics broken/requires unchecked cast to work #7582
• Registering/Updating a MultiGauge while a Prometheus scrape occurs can lead to DuplicateLabelsException #6851
• OTLP histogram bucket count does not equal count intermittently #6006
• Statsd UDP epoll warn logs are verbose when statsd is down #2624

📔 Documentation

• Fix typos in docs #8000
• Add docs for @MeterTag when used on a method #7829
• Document best practice about configuring registries on a composite #7367
• Documentation on SpelValueExpressionResolver is unclear #6465
• Document how to customize tags in micrometer-java11 HttpClient instrumentation #4962

🔨 Dependency Upgrades

• Bump io.netty:netty-bom from 4.2.18.Final to 4.2.19.Final #8042

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Gaurav1112, @​LindseyZ1205, @​bogdandrutu, @​pchesneau, @​cfcromn, @​schiemon, @​officialasishkumar, @​AzazelSensei, @​nick-montana, @​ghdtjdwn, @​ninadsutrave

1.17.1

🐞 Bug Fixes

• ClassNotFoundException: org.LatencyUtils.PauseDetector is thrown when introspecting AbstractTimer #7815
• Prometheus custom meters: creation timestamps are incorrect #7798
• Fix memory leak/NPE in MicrometerHttpClientInterceptor (HC4 & HC5)
• Sanitize line terminators in Dogstatsd, Etsy StatsD, and LoggingMeterRegistry

🔨 Dependency Upgrades

• Bump io.netty:netty-bom from 4.2.15.Final to 4.2.17.Final #7822
• Bump software.amazon.awssdk:cloudwatch from 2.46.6 to 2.46.21 #7705

📝 Tasks

• Fix ineffective ExemplarSampler cache in DefaultExemplarSamplerFactory #7657
• Note micrometer-jetty11 deprecation in the artifact description #7651

❤️ Contributors

Thank you to all the contributors who worked on this release:

... (truncated)

Commits

• b52db89 Merge branch '1.16.x' into 1.17.x
• 3bf1fd5 Avoid logging a warning for every packet when the StatsD UDP server is down (...
• 801094f Merge branch '1.16.x' into 1.17.x
• 40aa268 Preserve whitespace in HTTP Basic authentication passwords (#8015)
• c61adef Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.4 to 5.6.5 (#8068)
• 328e98f Resolve compiler warnings and deprecations on 1.17.x (#8055)
• d31e871 Merge branch '1.16.x' into 1.17.x
• 4835582 Exclude web fonts from generated documentation only for JDK 23+
• be2a0e4 Disable build cache in release train build action
• b196978 Upgrade github-actions-workflow-generator to 0.0.7
• Additional commits viewable in compare view

Updates org.slf4j:slf4j-api from 2.0.18 to 2.0.20

Updates org.jdbi:jdbi3-core from 3.54.0 to 3.55.0

Release notes

Sourced from org.jdbi:jdbi3-core's releases.

3.55.0

Significant bugfix and small feature request sweep of the backlog:

• Bind and map types that are not public: a package-private bean class with public accessors, a non-public constructor or @JdbiConstructor factory method, or a package-private Immutables value type. mapToBean now also uses a non-public no-arg constructor, e.g. a private one on a public bean. The ReflectionMappers accessible object strategy controls this. Unlike FieldMapper, these mappers apply the strategy in effect when a type is first used and cache the result for the Jdbi instance, so set the strategy on the Jdbi before first use, not on a Handle or statement. A ConstructorMapper for a type that Jdbi can not access now fails on first use, with a message that names the fix, instead of at creation (#1684)
• Fix KotlinMapper ignoring a SQL NULL for a @PropagateNull constructor parameter or property of a non-null primitive type such as Long or Int. The column mapper returned 0 (or false) and the object was mapped instead of null. KotlinMapper now treats the NULL as null like the ConstructorMapper, FieldMapper, and BeanMapper do (#3048)
• Fix a @Nested Optional<T> attribute that held null instead of Optional.empty() when T used the class-level @PropagateNull("column") form and that column was null. A @PropagateNull on the Optional attribute itself no longer turns the parent into null in this case, which matches the attribute-level form (#3049)
• New JoinRowReducer (Beta) reduces the rows of a join query into root objects and links the joined objects to them, for to-one and to-many relations over inner and outer joins. Columns are named relative to the relation prefix, one type is one table, so a table row is one instance no matter through how many relations the query reaches it, and reducers nest for deeper graphs (#1574)
• New RowView.getColumn(String) and RowView.getColumn(int) return a column value as the JDBC driver returns it from ResultSet.getObject, without a column mapper. New RowView.getColumnNames() returns the column labels of the result set, and RowView.getRow(RowMapper) maps the current row with a given mapper (#1574)
• Add BindListStyle to render bindList / @BindList elements as single-column rows, (:a),(:b), for use with the SQL VALUES list constructor. Configure it with SqlStatements#setBindListStyle or @BindList(style = BindListStyle.ROWS) (#1550, Alpha)
• Add LocalTransactionHandler.managed(): Jdbi manages transactions on connections with autocommit disabled instead of joining them, e.g. on a pool that disables autocommit as a precaution. inTransaction commits, retry handlers such as SerializableTransactionRunner engage, and a statement executed outside of a transaction is not committed. (#2663, #1733)
• Add NoOpTransactionHandler for connections whose transactions an external framework manages, e.g. a Spring TransactionAwareDataSourceProxy or an XA data source. It never reads or changes the transaction state of the connection. CMTTransactionHandler now extends it, with unchanged behavior. (#2742, thanks @​bekoenig for the suggestion!)
• Document the transaction contract for connections with autocommit disabled: the handle joins the transaction that the connection owner manages. New "Transactions managed outside Jdbi" section in the User Guide, with tests that pin the contract. (#1039, #2663)
• Document how @PropagateNull resolves its column: on a class, the column name is relative to the mapper prefix (from @Nested or from a mapper made with a prefix), so one class maps under different prefixes. New "Using @PropagateNull" section in the User Guide, with tests for mappers made with a prefix. (#1764)
• Fix JdbiExtension losing its plugins and initializer after afterAll, so a static extension whose test class ran a second time in the same JVM (a Surefire rerun of a failed test, or a @Nested class selected as its own test class) restarted with a bare Jdbi and failed with NoSuchMapperException or NoSuchExtensionException (#3036)
• vavr: update to vavr 1.0.1. The vavr 1.0.0-alpha releases remain unsupported (#2350)
• Fix repeated @RegisterKotlinMapper annotations on one method or type. Kotlin wrapped them in a generated container that Jdbi did not process, so none of the mappers were registered and rows mapped through the

... (truncated)

Changelog

Sourced from org.jdbi:jdbi3-core's changelog.

3.55.0

• Bind and map types that are not public: a package-private bean class with public accessors, a non-public constructor or @JdbiConstructor factory method, or a package-private Immutables value type. mapToBean now also uses a non-public no-arg constructor, e.g. a private one on a public bean. The ReflectionMappers accessible object strategy controls this. Unlike FieldMapper, these mappers apply the strategy in effect when a type is first used and cache the result for the Jdbi instance, so set the strategy on the Jdbi before first use, not on a Handle or statement. A ConstructorMapper for a type that Jdbi can not access now fails on first use, with a message that names the fix, instead of at creation (#1684)
• Fix KotlinMapper ignoring a SQL NULL for a @PropagateNull constructor parameter or property of a non-null primitive type such as Long or Int. The column mapper returned 0 (or false) and the object was mapped instead of null. KotlinMapper now treats the NULL as null like the ConstructorMapper, FieldMapper, and BeanMapper do (#3048)
• Fix a @Nested Optional<T> attribute that held null instead of Optional.empty() when T used the class-level @PropagateNull("column") form and that column was null. A @PropagateNull on the Optional attribute itself no longer turns the parent into null in this case, which matches the attribute-level form (#3049)
• New JoinRowReducer (Beta) reduces the rows of a join query into root objects and links the joined objects to them, for to-one and to-many relations over inner and outer joins. Columns are named relative to the relation prefix, one type is one table, so a table row is one instance no matter through how many relations the query reaches it, and reducers nest for deeper graphs (#1574)
• New RowView.getColumn(String) and RowView.getColumn(int) return a column value as the JDBC driver returns it from ResultSet.getObject, without a column mapper. New RowView.getColumnNames() returns the column labels of the result set, and RowView.getRow(RowMapper) maps the current row with a given mapper (#1574)
• Add BindListStyle to render bindList / @BindList elements as single-column rows, (:a),(:b), for use with the SQL VALUES list constructor. Configure it with SqlStatements#setBindListStyle or @BindList(style = BindListStyle.ROWS) (#1550, Alpha)
• Add LocalTransactionHandler.managed(): Jdbi manages transactions on connections with autocommit disabled instead of joining them, e.g. on a pool that disables autocommit as a precaution. inTransaction commits, retry handlers such as SerializableTransactionRunner engage, and a statement executed outside of a transaction is not committed. (#2663, #1733)
• Add NoOpTransactionHandler for connections whose transactions an external framework manages, e.g. a Spring TransactionAwareDataSourceProxy or an XA data source. It never reads or changes the transaction state of the connection. CMTTransactionHandler now extends it, with unchanged behavior. (#2742, thanks @​bekoenig for the suggestion!)
• Document the transaction contract for connections with autocommit disabled: the handle joins the transaction that the connection owner manages. New "Transactions managed outside Jdbi" section in the User Guide, with tests that pin the contract. (#1039, #2663)
• Document how @PropagateNull resolves its column: on a class, the column name is relative to the mapper prefix (from @Nested or from a mapper made with a prefix), so one class maps under different prefixes. New "Using @PropagateNull" section in the User Guide, with tests for mappers made with a prefix. (#1764)
• Fix JdbiExtension losing its plugins and initializer after afterAll, so a static extension whose test class ran a second time in the same JVM (a Surefire rerun of a failed test, or a @Nested class selected as its own test class) restarted with a bare Jdbi and failed with NoSuchMapperException or NoSuchExtensionException (#3036)
• vavr: update to vavr 1.0.1. The vavr 1.0.0-alpha releases remain unsupported (#2350)
• Fix repeated @RegisterKotlinMapper annotations on one method or type. Kotlin wrapped them in a generated container that Jdbi did not process, so none of the mappers were registered and rows mapped through the unprefixed KotlinMapperFactory mapper, ignoring the prefix. The annotation now uses

... (truncated)

Commits

• a20642a [maven-release-plugin] prepare release v3.55.0
• a7df034 Release notes 3.55.0
• d43955b Merge remote-tracking branch 'origin/claude-nested-optional-propagate-null'
• 06b6682 Merge pull request #3048 from jdbi/claude-kotlin-propagate-null-primitive
• a3be71c Return Optional.empty() for a nested Optional with class-level @​PropagateNull
• c52bb43 Map a SQL NULL to null for a @​PropagateNull primitive in KotlinMapper
• 6f8de68 Merge pull request #3047 from jdbi/claude-accessible-lookup-1684
• 4570efc Merge pull request #3043 from jdbi/claude-propagate-null-docs-1764
• 793b789 Document how @​PropagateNull resolves its column under a mapper prefix
• 88a246a Apply the accessible object strategy to beans, constructors, and Immutables
• Additional commits viewable in compare view

Updates org.postgresql:postgresql from 42.7.13 to 42.7.14

Release notes

Sourced from org.postgresql:postgresql's releases.

v42.7.14

Security

This release fixes two security vulnerabilities.

requireAuth is silently not enforced when the value excludes every authentication method (GHSA-rhp9-mr79-r74h, CVE-2026-107314)

Severity: Moderate (CVSS 5.9) | Affected versions: 42.7.11 – 42.7.13

If the requireAuth connection property excluded all six authentication methods the driver knows (for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none) or contained no method at all (for example requireAuth=,), the driver applied no restriction and accepted whatever method the server asked for, including cleartext password. An attacker positioned between the application and the server could use this to request cleartext password authentication and receive the database password.

Unset values, positive lists (such as requireAuth=scram-sha-256) and partial exclusions (such as requireAuth=!password,!md5) were not affected, and neither were deployments that do not set requireAuth.

Behavior after upgrading:

• A value that excludes every method now refuses the connection with SQLState 08004 and the message Authentication method is not allowed by requireAuth (or the channel binding error when channelBinding=require is also set).
• A value that names no method is rejected as an invalid requireAuth value.

Because affected deployments had this value by mistake, and connections worked normally on affected versions, connections with such a value will fail after upgrading. Replace it with a positive list of the methods your server uses, for example requireAuth=scram-sha-256.

Independently of this fix, use sslmode=verify-full with a trusted CA so that an attacker cannot present a substitute server.

Thanks to @​manus-pi for finding and reporting this issue.

Driver stores bytes of earlier statements when it pads a value shorter than its declared length (GHSA-f64h-wr5q-3qf3, CVE-2026-107315)

Severity: Moderate (CVSS 5.3) | Affected versions: 42.7.4 – 42.7.13

When an application sent a value shorter than the length it declared, the driver padded the missing bytes with data from earlier messages on the same connection instead of zeros, and the server stored them. The stored value could contain SQL text and parameter values of earlier, unrelated statements (up to 8192 bytes, or 16320 with GSS encryption). On pooled connections, those statements could come from other requests. 42.7.3 and earlier padded with zeros.

This is reachable through the following public API when the declared length is larger than the data:

• PreparedStatement.setObject(int, ByteStreamWriter)
• CopyIn.writeToCopy(ByteStreamWriter) and CopyIn.writeToCopy(byte[], int, int)
• PGCopyOutputStream.write(byte[], int, int) (writes over 64 KiB)
• LargeObject.write(byte[], int, int)
• java.sql.Blob.setBytes(long, byte[], int, int)

Padding is now always zeros. Applications whose declared length always matches the data were not affected. Values stored by an affected version through such a call may already contain leaked data, so you may want to review affected columns. There is no connection property to disable the old behavior; the workaround on older versions is to make the declared length match the data.

Thanks to @​vlsi for finding and reporting this issue.

Full Changelog: pgjdbc/pgjdbc@REL42.7.13...REL42.7.14

Changelog

Sourced from org.postgresql:postgresql's changelog.

Changelog

Notable changes since version 42.0.0, read the complete History of Changes.

The format is based on Keep a Changelog.

[Unreleased]

Fixed

• fix: PGStream.skip no longer loops forever when the connection ends while the driver is discarding bytes, and no longer mistakes a stream that skips nothing for one that has ended. InputStream.skip may return zero with more data still coming, which a stream supplied through the socketFactory property is free to do; the driver now reads a byte in that case and treats only -1 as the end [PR #4358](pgjdbc/pgjdbc#4358)
• fix: LargeObjectManager operations now work inside an active XA transaction. Since 42.7.13 an XA branch keeps the caller's autoCommit=true, and the guard rejected large objects as if the connection were idle. It now checks the server transaction state (getTransactionState()) instead of autoCommit, so a genuine auto-commit connection with no open transaction is still refused [Issue #4309](pgjdbc/pgjdbc#4309) [PR #4310](pgjdbc/pgjdbc#4310)
• fix: batch update counts are no longer secured as committed inside an XA transaction. BatchResultHandler treated per-statement progress as durable whenever autoCommit=true, but an XA branch keeps autoCommit=true while the transaction is open, so a batch that flushed mid-way and then failed could report rolled-back statements as succeeded. Progress is now secured only when no server transaction is open [Issue #4309](pgjdbc/pgjdbc#4309) [PR #4311](pgjdbc/pgjdbc#4311)

Changed

• fix: backend message lengths are checked before anything is sized from them. Each length is checked against the message layout and a limit for its type, the lengths inside DataRow and FunctionCallResponse are checked against the message, and the NegotiateProtocolVersion option count is bounded. A hostile or out of sync backend could previously force an allocation of up to two gigabytes with a five byte header [Issue #4015](pgjdbc/pgjdbc#4015)
• fix: the read buffer is limited to 32 MiB and grows once per request rather than once per socket read. It previously doubled on every read while a large request was outstanding, so a peer that declared a large length and sent it slowly grew the buffer until the doubling past 1 GiB overflowed to a negative size [Issue #4015](pgjdbc/pgjdbc#4015)
• fix: a zero-length CopyData body is accepted. It is valid on the wire and was previously rejected by an assertion, so it failed only on JVMs started with -ea [Issue #4015](pgjdbc/pgjdbc#4015)
• fix: GSS packet lengths are bounded. The encrypted transport is limited to a 16380 byte payload and the handshake to a 65532 byte token, matching PQ_GSS_MAX_PACKET_SIZE and PQ_GSS_AUTH_BUFFER_SIZE [Issue #4015](pgjdbc/pgjdbc#4015)
• fix: a connection whose stream has been refused is no longer reusable. Any refused length or count marks the stream broken, so Connection.isClosed() reports it closed and a pool that tests on borrow discards it. The socket is dropped with SO_LINGER 0 [Issue #4015](pgjdbc/pgjdbc#4015)
• fix: a protocol violation before authentication is reported as PSQLException with SQLState 08P01 rather than as a plain I/O error, and is no longer retried under sslMode=allow or sslMode=prefer [Issue #4015](pgjdbc/pgjdbc#4015)
• fix: the counts inside RowDescription, ParameterDescription, CopyInResponse and CopyOutResponse are checked against the declared message length. A RowDescription claiming more fields than its length can hold previously read its field descriptions out of the messages that followed it [Issue #4015](pgjdbc/pgjdbc#4015)
• fix: the driver checks that each backend message was consumed exactly before reading the next message type, so a reader that stops short of its declared length is refused rather than misreading what follows [Issue #4015](pgjdbc/pgjdbc#4015)
• fix: the authentication loop, the GSS encryption handshake and the GSS authentication handshake each stop after 64 round trips. A zero-length GSS token is a valid continuation, so a server could previously keep a client exchanging tokens forever before any credentials were exchanged [Issue #4015](pgjdbc/pgjdbc#4015)
• fix: ErrorResponse before authentication is limited to 30000 bytes rather than 32 MiB, matching libpq's limit for messages outside VALID_LONG_MESSAGE_TYPE, and a C string inside a declared message is no longer scanned past the end of that message. Both were allocations an unauthenticated peer could cause [Issue #4015](pgjdbc/pgjdbc#4015)
• fix: an ErrorResponse or NoticeResponse longer than 32 MiB is truncated to that size rather than refused. The body past the limit is drained and the shortened message is delivered, so the connection stays usable [Issue #4015](pgjdbc/pgjdbc#4015)
• fix: the read buffer returns to its initial size once the message that grew it is drained, so a connection no longer retains 32 MiB after one large error [Issue #4015](pgjdbc/pgjdbc#4015)
• fix: exceeding maxResultBuffer closes the connection. The row is not read past the limit, so the connection cannot continue, and it is now dropped where the limit is exceeded rather than refused as a protocol violation at the next message. The error reported is the limit alone, with SQLState 08S01 as before [Issue #4015](pgjdbc/pgjdbc#4015)

Security

• fix: a requireAuth value that excludes every authentication method, such as !password,!md5,!gss,!sspi,!scram-sha-256,!none, now refuses every method. A connection with such a value now fails with SQLState 08004. Before, the driver treated the value as if requireAuth were not set, and used any method the server asked for, even a cleartext password. This affects 42.7.11 through 42.7.13 GHSA-rhp9-mr79-r74h
• fix: a requireAuth value without a method in it, such as , or ,,, now fails with SQLState 22023. Before, the driver treated it as if requireAuth were not set. Commas at the very end of a value are still ignored, as in password,. This affects 42.7.11 through 42.7.13 GHSA-rhp9-mr79-r74h

Commits

• ebdd9d0 chore: bump version to 42.7.14
• 0e764c8 test: Add additional PgBufferedOutputStream.writeZeros(...) tests
• c8998c8 fix: writeZeros() could send stale buffer contents instead of zeros
• a65ef98 fix: refuse every method when requireAuth excludes them all
• See full diff in compare view

Updates io.lettuce:lettuce-core from 7.6.0.RELEASE to 7.9.0.RELEASE

Release notes

Sourced from io.lettuce:lettuce-core's releases.

7.9.0.RELEASE

The Lettuce team is pleased to announce the Lettuce 7.9.0 minor release!

Lettuce 7.9.0 supports Redis 2.6+ up to Redis 8.x. In terms of Java runtime, Lettuce requires at least Java 8 and works with Java 24. The driver is tested against Redis 8.10, Redis 8.8, Redis 8.6, Redis 8.4, Redis 8.2, Redis 8.0, Redis 7.4 and Redis 7.2.

Thanks to all contributors who made Lettuce 7.9.0.RELEASE possible.

📗 Links Reference documentation: https://lettuce.io/core/7.9.0.RELEASE

🐞 Bug Fixes

• Fix GEODIST destination argument validation by @​codingkiddo in redis/lettuce#3934
• Fix snapshot and release publishing with Maven 3.10 credential scoping by @​uglide in redis/lettuce#3940
• RedisPublisher must not drop an error when the state changes concurrently #3942 by @​zenios in redis/lettuce#3943
• MultiOutput broken for boolean values by @​Dgramada in redis/lettuce#3932
• JSON.NUMINCRBY parsing broken for RESP2 by @​DgramadaDescription has been truncated