Bump the maven group across 5 directories with 5 updates by dependabot[bot] · Pull Request #37 · aktin/dwh-query

dependabot · 2026-05-06T17:36:06Z

Bumps the maven group with 1 update in the /generic-imports-manager directory: org.postgresql:postgresql.
Bumps the maven group with 2 updates in the /report-archive directory: org.hsqldb:hsqldb and org.liquibase:liquibase-core.
Bumps the maven group with 2 updates in the /report-manager directory: org.apache.xmlgraphics:fop and xerces:xercesImpl.
Bumps the maven group with 1 update in the /request-manager directory: org.hsqldb:hsqldb.
Bumps the maven group with 1 update in the /study-manager directory: org.hsqldb:hsqldb.

Updates org.postgresql:postgresql from 42.7.7 to 42.7.11

Release notes

Sourced from org.postgresql:postgresql's releases.

v42.7.11

Security

fix: Limit SCRAM PBKDF2 iterations accepted from the server. pgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256 authentication, where a malicious or compromised PostgreSQL server could specify an extremely large PBKDF2 iteration count, causing the client to consume unbounded CPU and potentially exhaust connection pools. The fix introduces a new scramMaxIterations connection property (defaulting to 100,000) to cap iteration counts before computation begins. See the Security Advisory for more detail. The following CVE-2026-42198 has been issued.

Changes

fix: Add sources and javadocs to shaded published lib generation @sehrope (#4043)

update Changelog and website for release of 42.7.11 @davecramer (#4042)

Fix scram fix location in changelog and update published artifact developer list @sehrope (#4041)

Restrict test with scram_iterations to v16+ and release notes @sehrope (#4040)

chore(deps): update ubuntu:24.04 docker digest to 84e77de @renovate-bot (#4017)

test: add tests for QueryExecutor#getTransactionState @vlsi (#4006)

chore(deps): update actions/create-github-app-token action to v2.2.2 @renovate-bot (#3983)

fix: fix flaky CopyBothResponseTest by using WAL flush LSN @vlsi (#3979)

fix: fix flaky replication restart tests by waiting for confirmed_flush_lsn @vlsi (#3975)

test: fix flaky LogicalReplicationStatusTest by polling pg_stat_replication @vlsi (#3974)

chore: replace Appveyor with ikalnytskyi/action-setup-postgres @vlsi (#3966)

test: move test table creation from @BeforeEach to @BeforeAll @vlsi (#3967)

Return jsonb as PGObject fixes Issue #3926 @davecramer (#3956)

Update docker scripts @davecramer (#3958)

implement require_auth, this is pretty much how libpq does this. @davecramer (#3895)

docs: add SCRAM authentication test setup section to TESTING.md @emmaeng700 (#3945)

Add RequireServerVersion annotation for tests @sehrope (#3939)

🐛 Bug Fixes

fix: ensure extended protocol messages end with Sync message @vlsi (#3728)

fix: enable cursor-based fetching in extended protocol when transaction started via SQL command @vlsi (#3996)

fix: retry with SSL on IOException when sslMode=ALLOW @vlsi (#3973)

fix: allow fallback to non-SSL connection when sslMode=prefer and sslResponseTimeout kicks in @vlsi (#3968)

fix: catch SecurityException from setContextClassLoader on ForkJoinPool workers @vlsi (#3962)

fix: use compareTo for LogSequenceNumber comparison @vlsi (#3961)

fix: release COPY lock on IOException to prevent connection hang (#3957) @vlsi (#3960)

🧰 Maintenance

style: replace @exception with @throws in getBoolean javadoc @vlsi (#4035)

chore: use @vlsi/github-actions-random-matrix npm package @vlsi (#4008)

chore: use tag names for pinning github actions, pin ikalnytskyi/action-setup-postgres @vlsi (#4007)

chore: bump errorprone to 2.48.0 @vlsi (#4005)

test: add @DisableLogger annotation to suppress expected log warnings in tests @vlsi (#3971)

chore: suppress deprecations in test code to reduce build verbosity @vlsi (#3972)

chore: replace log warning in ConnectionFactory.closeStream with Throwable.addSuppressed @vlsi (#3970)

chore: use greedy pairwise coverage for CI matrix generation @vlsi (#3965)

chore: use full version tags in GitHub Actions comments @vlsi (#3963)

⬆️ Dependencies

... (truncated)

Changelog

Sourced from org.postgresql:postgresql's changelog.

[42.7.11] (2026-04-28)

Security

fix: Limit SCRAM PBKDF2 iterations accepted from the server. pgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256 authentication, where a malicious or compromised PostgreSQL server could specify an extremely large PBKDF2 iteration count, causing the client to consume unbounded CPU and potentially exhaust connection pools. The fix introduces a new scramMaxIterations connection property (defaulting to 100,000) to cap iteration counts before computation begins. See the Security Advisory for more detail. The following CVE-2026-42198 has been issued.

Added

feat: implement require_auth connection property, aligning with libpq behavior [PR #3895](pgjdbc/pgjdbc#3895)

Changed

chore: replace Appveyor CI with ikalnytskyi/action-setup-postgres [PR #3966](pgjdbc/pgjdbc#3966)

chore: upgrade Gradle to v9 [PR #3978](pgjdbc/pgjdbc#3978)

Fixed

fix: ensure extended protocol messages end with Sync message [PR #3728](pgjdbc/pgjdbc#3728)

fix: enable cursor-based fetching in extended protocol when transaction started via SQL command [PR #3996](pgjdbc/pgjdbc#3996)

fix: retry with SSL on IOException when sslMode=ALLOW [PR #3973](pgjdbc/pgjdbc#3973)

fix: make sure the driver honours connectTimeout when retrying the connection [PR #3968](pgjdbc/pgjdbc#3968)

fix: allow fallback to non-SSL connection when sslMode=prefer and sslResponseTimeout kicks in [PR #3968](pgjdbc/pgjdbc#3968)

fix: catch SecurityException from setContextClassLoader on ForkJoinPool workers [PR #3962](pgjdbc/pgjdbc#3962)

fix: use compareTo for LogSequenceNumber comparison to handle unsigned values correctly [PR #3961](pgjdbc/pgjdbc#3961)

fix: release COPY lock on IOException to prevent connection hang [PR #3957](pgjdbc/pgjdbc#3957)

fix: return jsonb as PGObject instead of String [PR #3956](pgjdbc/pgjdbc#3956)

fix: align SSL key file permission check with libpq [PR #3952](pgjdbc/pgjdbc#3952)

fix: guard connection closed flag with a reentrant lock to protect against concurrent close [PR #3905](pgjdbc/pgjdbc#3905)

[42.7.10] (2026-02-11)

Changed

chore: Migrate to Shadow 9 PR 3931

style: fix empty line before javadoc for checkstyle compliance [PR #3925](pgjdbc/pgjdbc#3925)

style: fix lambda argument indentation for checkstyle compliance [PR #3922](pgjdbc/pgjdbc#3922)

test: add autosave=always|never|conservative and cleanupSavepoints=true|false to the randomized CI jobs [PR #3917](pgjdbc/pgjdbc#3917)

Fixed

fix: non-standard strings failing test for version 19 [PR #3934](pgjdbc/pgjdbc#3934)

fix: small issues in ConnectionFactoryImpl [PR #3929](pgjdbc/pgjdbc#3929)

fix: process pending responses before fastpath to avoid protocol errors PR # 3913

doc: use.md, fix typos [PR #3911](pgjdbc/pgjdbc#3911)

doc: datasource.md, fix minor formatting issue [PR #3912](pgjdbc/pgjdbc#3912)

doc: add the new PGP signing key to the official documentation [PR #3912](pgjdbc/pgjdbc#3813)

Reverted

Revert "fix: make all Calendar instances proleptic Gregorian (#3837) (#3887)" [PR #3932](pgjdbc/pgjdbc#3932)

[42.7.9] (2026-01-14)

Added

... (truncated)

Commits

78e261f fix: Add sources and javadocs to shaded published lib generation
1e09fa0 update Changelog and website for release of 42.7.11 (#4042)
d479fa5 Fix scram fix location in changelog and update published artifact developer l...
b04fc46 docs: Add scram max iters fix to changelog
cf54822 test: Disable scram test on older version without scram_iterations GUC
7dbcc79 test: Add SCRAM max iteration tests
c9d41d1 fix: Limit SCRAM PBKDF2 iterations accepted from the server
a340cb2 style: replace @exception with @throws in getBoolean javadoc
77837f8 fix(deps): update dependency org.openrewrite.rewrite:org.openrewrite.rewrite....
23af03b chore(deps): update actions/checkout action to v6
Additional commits viewable in compare view

Updates org.hsqldb:hsqldb from 2.3.3 to 2.7.1

Updates org.liquibase:liquibase-core from 3.5.3 to 4.8.0

Release notes

Sourced from org.liquibase:liquibase-core's releases.

v4.8.0

Liquibase 4.8.0 release

Please report any issues to https://github.com/liquibase/liquibase/issues.

Notable Changes

Liquibase 4.8.0 introduces the following functionality:

The init hub subcommand that connects your local Liquibase activity to Liquibase Hub and sets up the Liquibase environment to use Liquibase Hub. [DAT-8769]

Note: For more information, see init hub and Getting Started with Liquibase Hub.

[PRO] The sqlcmd utility support to process complex SQL for MSSQL Server. Liquibase provides the liquibase.sqlcmd.conf file to pass arguments to your executor when running Liquibase Pro. [DAT-7447]

Note: For more information, see Using the SQLCMD integration and runWith attribute with Liquibase Pro and MSSQL Server.

Changes to the behavior of the XML parser, which no longer allows referencing external DTD files for security reasons. If you use externally defined entities or any other potentially insecure XML feature in your changelogs, set liquibase.secureParsing=false. [PR#2384] [LB-2218]

Note: For more information about the ways to set the parameter, see Command Parameters.

The upgrade of the postgresql (from 42.2.12 to 42.3.2) and h2 (from 2.0.206 to 2.1.210) drivers that Liquibase includes in the installation package. If you use those drivers and upgrade an existing Liquibase installation, remove the earlier versions of drivers from the LIQUIBASE_HOME/lib directory.

Enhancements

Implemented the SimpleObjectConstructor interface for DB2 on z/OS [DAT-8580]

Included the CLI instructions on how to use the properties file with a nonstandard name when running the init project subcommand [DAT-9041]

Improved the output message for init start-h2 when the H2 database driver is specified, but there is no connection detected [DAT-8992]

Added validation errors for the enableCheckConstraint, disableCheckConstraint, dropPackage, dropPackageBody Change Types [DAT-9017]

[PR#2367] [Mike Olivas] Added example rollback scripts to the example-changelog.sql file [LB-2220]

[PR#1648] [Daniel Gray] Improved the exception error message for the customChange node with no class attribute [LB-1144]

[PR#2222] [msimko81] Added the offline mode support for the rollback-sql <tag> operation [LB-2198]

[PR#2273] [Tsvi Zandany] Added the autocomplete quality checks commands for macOS

[PR#2308] [Valentin Blistin] Added the close method for the ClassLoaderResourceAccessor class [LB-2205]

Fixes

Fixed the renameSequence Change Type generating an uppercase SQL instead of lowercase and causing failures with case-sensitive databases [LB-1763]

Fixed the generate-changelog and diff commands to show and generate a proper SQL with autoincrement for PostgreSQL [DAT-8779]

[PR#1320] [PR#2329] [Anatoly S] [Nathan Voxland] [Matteo Turra] Improved the UTF-8 character support in the <sql> tags [LB-562]

[PR#2139] [wziebicki] Improved the UniqueConstraintSnapshotGenerator class to add a table name to the Oracle database query so that the cache key can contain it, and the unique constraint can be read from cache [LB-2206]

[PR#2335] [erzsebet] Removed duplicated DATABASECHANGELOGLOCK SQL statements when running the update-sql command against a new database [LB-2208]

[PR#2505] [Nathan Voxland] [Dries Samyn] [erzsebet] Fixed the OSGI support with the MANIFEST.MF file in the liquibase-core-4.7.0.jar file. The PR fixes PR#2361.

[PR#2366] [Steven Massaro] Made the sp_rename function to be lowercase when using MSSQL Server

[PR#2429] [Nathan Voxland] [Mirko Dostmann] [Alex Litovsky] Fixed the Ant and Apache Derby support. The PR fixes PR#2388 and PR#2391. [LB-2222]

[PR#2397] [Nathan Voxland] [maxencelaurent] Implemented the logging of exceptions in the CDI integration. The PR fixes PR#2354. [LB-2223]

[PR#2398] [Nathan Voxland] [urvanov-ru] Fixed the handling of schema snapshots with an underscore. The PR fixes PR#1604. [LB-2219]

[PR#2340] [Nathan Voxland] [nickshoe] Enabled adding the computed=true columns with no type set in the createTable Change Type. The PR fixes PR#2283. [LB-2215]

[PR#2372] [Nathan Voxland] [Henrik Sachse] [rburgst] Fixed the autoincrement syntax for H2 2.0 and later versions. The PR fixes PR#2362. [LB-2216]

[PR#2549] [Nathan Voxland] [jenhae] Added validation errors for Liquibase and MSSQL Server if the ordered clause is specified in the createSequence or alterSequence Change Type. The PR fixes PR#2528.

[PR#2351] [Wesley Willard] [Joseph Cen] Fixed the handling of properties defined with different dbms filters. The PR fixes PR#2231. [LB-2217]

... (truncated)

Changelog

Sourced from org.liquibase:liquibase-core's changelog.

Liquibase Core Changelog

Changes in version 5.0.2 (2026.03.03)

Liquibase Community 5.0.2 is a minor patch release

See the Liquibase Community 5.0.2 Release Notes for the complete set of release information.

Changes

(#7540) DAT-21768: Fix sonar workflow inputs and add missing thisSha output @jnewton03

(#7483) Fix: Flush BufferedWriter in YamlSnapshotSerializer to prevent snapshot file truncation @Folgerjun

(#7510) feat: add comprehensive job summary to dry-run release workflow @jandroav

(#7509) fix: remove workflow-logs option to eliminate skipped job warnings @jandroav

(#7508) fix: add contents:write permission for draft release download @jandroav

(#7507) fix: add retry logic for draft release download in Maven job @jandroav

(#7506) fix: use gh CLI for dry-run Maven download in release-published.yml @jandroav

(#7425) Fixed Issue #7413: SQL Anywhere: Constraint name is not considered for PRIMARY KEY @mkarg

(#7380) Gh7374 remove oss mentions @petepickerill

Notable Changes

(#7439) Fix performance degradation since implementing analytics @tati-qalified

New Features

(#7452) fix: detect comment changes on columns and tables @peteraisher

(#7537) fix: Use default logger service instead of throwing exception in Scope#getCurrentScope() @jnewton03

(#7487) Creates a test to ensure all COMMAND_NAME and *_ARG constants are always public static final @tati-qalified

(#7448) rewrite: Simplified MSSQLDatabase escaping @mkarg

(#7539) fix(build): configure GMavenPlus 4.3.0 to detect Groovy in test scope @filipelautert

(#7528) DAT-21265 :: Jdbc drivers upgrade @MalloD12

(#7493) chore: update workflow permissions for release and test jobs @sayaliM0412

(#7479) Extract checksum compatibility logic in StandardChangeLogHistoryService @maximevw

(#7478) feat: Upgrade Ubuntu version in CI workflow to 24.04 @sayaliM0412

(#7465) DAT-21398: fix(tests): update macOS version in test matrix to macos-15-intel @sayaliM0412

(#7378) Add defensive null pointer checks across codebase @filipelautert

(#7401) chore: update Liquibase Pro reference to Liquibase Secure in README.md @filipelautert

Bug Fixes

(#7532) Fix clearCheckSums so checksums are correctly re-evaluated @MalloD12

(#7457) Fix issue 7184 @MalloD12

(#7468) Fix #7385: Fix PostgreSQL rollback with quoted numeric schema names @RohanMittal-01

(#7521) fix: Use correct grammar when reporting unexpected changes @Vampire

(#7569) Fix failing test @MalloD12

(#7451) Fixed undesired logicalFilePath inheritance of included changesets @MalloD12

(#7489) showSummaryOutput set to LOG by default for Liquibase API @MalloD12

(#7501) INT-1717: fix missing quotes in query in SetColumnRemarksGeneratorSnowflake @HorbatenkoYehor

(#7464) fix(mysql/mariadb): respect columnDataType in renameColumn for modern versions @filipelautert

(#7395) Liquibase throws exception when the filePath property is empty #7320 @Parthiee

(#7505) fix: use gh CLI for Maven dry-run release downloads @jandroav

(#7504) fix: use tag instead of releaseId for dry-run Maven downloads @jandroav

(#7503) fix: add id-token permission to package job in release-published.yml @jandroav

... (truncated)

Commits

887e441 Fixing re-version check
74bfc03 Fixing re-version check
efab2bd Fixing re-version check
0892c27 Merge pull request #2559 from liquibase/update-changelog-4.8.0
bb76633 Updated changelog
4549314 updated changelog txt
3a76197 Merge pull request #2560 from liquibase/updated-xsd-4.8.0
abb4d77 create liquibase changelog xsd 4.8.0
221f681 update changelog 4.8.0
0bb2eae DAT-8615: init hub command (#2326)
Additional commits viewable in compare view

Updates org.apache.xmlgraphics:fop from 2.1 to 2.2

Updates xerces:xercesImpl from 2.11.0 to 2.12.2

Updates org.hsqldb:hsqldb from 2.4.1 to 2.7.1

Updates org.hsqldb:hsqldb from 2.3.3 to 2.7.1

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the maven group with 1 update in the /generic-imports-manager directory: [org.postgresql:postgresql](https://github.com/pgjdbc/pgjdbc). Bumps the maven group with 2 updates in the /report-archive directory: org.hsqldb:hsqldb and [org.liquibase:liquibase-core](https://github.com/liquibase/liquibase). Bumps the maven group with 2 updates in the /report-manager directory: org.apache.xmlgraphics:fop and xerces:xercesImpl. Bumps the maven group with 1 update in the /request-manager directory: org.hsqldb:hsqldb. Bumps the maven group with 1 update in the /study-manager directory: org.hsqldb:hsqldb. Updates `org.postgresql:postgresql` from 42.7.7 to 42.7.11 - [Release notes](https://github.com/pgjdbc/pgjdbc/releases) - [Changelog](https://github.com/pgjdbc/pgjdbc/blob/master/CHANGELOG.md) - [Commits](pgjdbc/pgjdbc@REL42.7.7...REL42.7.11) Updates `org.hsqldb:hsqldb` from 2.3.3 to 2.7.1 Updates `org.liquibase:liquibase-core` from 3.5.3 to 4.8.0 - [Release notes](https://github.com/liquibase/liquibase/releases) - [Changelog](https://github.com/liquibase/liquibase/blob/main/changelog.txt) - [Commits](liquibase/liquibase@liquibase-parent-3.5.3...v4.8.0) Updates `org.apache.xmlgraphics:fop` from 2.1 to 2.2 Updates `xerces:xercesImpl` from 2.11.0 to 2.12.2 Updates `org.hsqldb:hsqldb` from 2.4.1 to 2.7.1 Updates `org.hsqldb:hsqldb` from 2.3.3 to 2.7.1 --- updated-dependencies: - dependency-name: org.postgresql:postgresql dependency-version: 42.7.11 dependency-type: direct:development dependency-group: maven - dependency-name: org.hsqldb:hsqldb dependency-version: 2.7.1 dependency-type: direct:development dependency-group: maven - dependency-name: org.liquibase:liquibase-core dependency-version: 4.8.0 dependency-type: direct:development dependency-group: maven - dependency-name: org.apache.xmlgraphics:fop dependency-version: '2.2' dependency-type: direct:production dependency-group: maven - dependency-name: xerces:xercesImpl dependency-version: 2.12.2 dependency-type: direct:production dependency-group: maven - dependency-name: org.hsqldb:hsqldb dependency-version: 2.7.1 dependency-type: direct:development dependency-group: maven - dependency-name: org.hsqldb:hsqldb dependency-version: 2.7.1 dependency-type: direct:development dependency-group: maven ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels May 6, 2026

Navigation Menu

Uh oh!

Bump the maven group across 5 directories with 5 updates - #37

Bump the maven group across 5 directories with 5 updates#37
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/generic-imports-manager/maven-117164cd8d

dependabot Bot commented on behalf of github May 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github May 6, 2026

v42.7.11

Security

Changes

🐛 Bug Fixes

🧰 Maintenance

⬆️ Dependencies

[42.7.11] (2026-04-28)

Security

Added

Changed

Fixed

[42.7.10] (2026-02-11)

Changed

Fixed

Reverted

[42.7.9] (2026-01-14)

Added

v4.8.0

Liquibase 4.8.0 release

Notable Changes

Enhancements

Fixes

Liquibase Core Changelog

Liquibase Community 5.0.2 is a minor patch release

Changes

Notable Changes

New Features

Bug Fixes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants