sqldelight
sqldelight copied to clipboard
Update dependency org.postgresql:postgresql to v42.7.2
This PR contains the following updates:
Package | Change | Age | Adoption | Passing | Confidence |
---|---|---|---|---|---|
org.postgresql:postgresql (source) | 42.7.1 -> 42.7.2 |
Release Notes
pgjdbc/pgjdbc (org.postgresql:postgresql)
v42.7.2
Security
- security: SQL Injection via line comment generation, it is possible in
SimpleQuery
mode to generate a line comment by having a placeholder for a numeric with a-
such as-?
. There must be second placeholder for a string immediately after. Setting the parameter to a -ve value creates a line comment. This has been fixed in this version fixes CVE-2024-1597. Reported by Paul Gerste. See the security advisory for more details. This has been fixed in versions 42.7.2, 42.6.1 42.5.5, 42.4.4, 42.3.9, 42.2.28.jre7. See the security advisory for work arounds.
Changed
- fix: Use simple query for isValid. Using Extended query sends two messages checkConnectionQuery was never ever set or used, removed PR #3101
- perf: Avoid autoboxing bind indexes by @bokken in PR #1244
- refactor: Document that encodePassword will zero out the password array, and remove driver's default encodePassword by @vlsi in PR #3084
Added
- feat: Add PasswordUtil for encrypting passwords client side PR #3082
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- [ ] If you want to rebase/retry this PR, check this box
This PR has been generated by Mend Renovate. View repository job log here.