Skip to content

Bump the development-dependencies group with 2 updates#10982

Merged
github-actions[bot] merged 1 commit into
6.5.xfrom
dependabot/gradle/6.5.x/development-dependencies-e383c9e38f
May 3, 2026
Merged

Bump the development-dependencies group with 2 updates#10982
github-actions[bot] merged 1 commit into
6.5.xfrom
dependabot/gradle/6.5.x/development-dependencies-e383c9e38f

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 3, 2026

Bumps the development-dependencies group with 2 updates: org.postgresql:postgresql and org.hibernate.orm:hibernate-core.

Updates org.postgresql:postgresql from 42.7.10 to 42.7.11

Release notes

Sourced from org.postgresql:postgresql's releases.

v42.7.11

Security

  • fix: Limit SCRAM PBKDF2 iterations accepted from the server. pgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256 authentication, where a malicious or compromised PostgreSQL server could specify an extremely large PBKDF2 iteration count, causing the client to consume unbounded CPU and potentially exhaust connection pools. The fix introduces a new scramMaxIterations connection property (defaulting to 100,000) to cap iteration counts before computation begins. See the Security Advisory for more detail. The following CVE-2026-42198 has been issued.

Changes

🐛 Bug Fixes

  • fix: ensure extended protocol messages end with Sync message @​vlsi (#3728)
  • fix: enable cursor-based fetching in extended protocol when transaction started via SQL command @​vlsi (#3996)
  • fix: retry with SSL on IOException when sslMode=ALLOW @​vlsi (#3973)
  • fix: allow fallback to non-SSL connection when sslMode=prefer and sslResponseTimeout kicks in @​vlsi (#3968)
  • fix: catch SecurityException from setContextClassLoader on ForkJoinPool workers @​vlsi (#3962)
  • fix: use compareTo for LogSequenceNumber comparison @​vlsi (#3961)
  • fix: release COPY lock on IOException to prevent connection hang (#3957) @​vlsi (#3960)

🧰 Maintenance

⬆️ Dependencies

... (truncated)

Changelog

Sourced from org.postgresql:postgresql's changelog.

[42.7.11] (2026-04-28)

Security

  • fix: Limit SCRAM PBKDF2 iterations accepted from the server. pgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256 authentication, where a malicious or compromised PostgreSQL server could specify an extremely large PBKDF2 iteration count, causing the client to consume unbounded CPU and potentially exhaust connection pools. The fix introduces a new scramMaxIterations connection property (defaulting to 100,000) to cap iteration counts before computation begins. See the Security Advisory for more detail. The following CVE-2026-42198 has been issued.

Added

Changed

Fixed

Commits
  • 78e261f fix: Add sources and javadocs to shaded published lib generation
  • 1e09fa0 update Changelog and website for release of 42.7.11 (#4042)
  • d479fa5 Fix scram fix location in changelog and update published artifact developer l...
  • b04fc46 docs: Add scram max iters fix to changelog
  • cf54822 test: Disable scram test on older version without scram_iterations GUC
  • 7dbcc79 test: Add SCRAM max iteration tests
  • c9d41d1 fix: Limit SCRAM PBKDF2 iterations accepted from the server
  • a340cb2 style: replace @​exception with @​throws in getBoolean javadoc
  • 77837f8 fix(deps): update dependency org.openrewrite.rewrite:org.openrewrite.rewrite....
  • 23af03b chore(deps): update actions/checkout action to v6
  • Additional commits viewable in compare view

Updates org.hibernate.orm:hibernate-core from 6.6.49.Final to 6.6.50.Final

Release notes

Sourced from org.hibernate.orm:hibernate-core's releases.

Release 6.6.50

Hibernate ORM 6.6.50.Final released

Today, we published a new release of Hibernate ORM 6.6: 6.6.50.Final.

You can find the full list of 6.6.50.Final changes here.

What's new

  • See the website for requirements and compatibilities.
  • See the What's New guide for details about new features and capabilities.
  • See the Migration Guide for details about migration to 6.6 version.

Conclusion

For additional details, see:

See also the following resources related to supported APIs:

Visit the website for details on getting in touch with us.

Changelog

Sourced from org.hibernate.orm:hibernate-core's changelog.

Changes in 6.6.50.Final (May 03, 2026)

https://hibernate.atlassian.net/projects/HHH/versions/38830

** Bug * HHH-20356 NPE when mapping embedded property as @​MappedSuperclass * HHH-20339 MappedSuperclass query with embeddable path comparison against parameter throws UnsupportedOperationException * HHH-19020 NullPointerException in ClassPropertyHolder.addPropertyToMappedSuperclass()

Commits
  • 3219bb9 [Jenkins release job] Preparing release 6.6.50.Final
  • 39c6aa1 [Jenkins release job] changelog.txt updated by release build 6.6.50.Final
  • 72ed6c2 HHH-20339 Remove unreachable CompositeSqmPathSource throw in resolveMappingEx...
  • 19c8bd8 HHH-20356 HHH-19020 NPE in ClassPropertyHolder#addPropertyToMappedSuperclass ...
  • e53f69d HHH-19020 Add test for issue
  • a484868 HHH-20356 Add test for issue
  • dcb9b0d Backport some of the workflow updates (sonar, version updates, OTP)
  • 88e0d54 [Jenkins release job] Preparing next development iteration
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the development-dependencies group with 2 updates: [org.postgresql:postgresql](https://github.com/pgjdbc/pgjdbc) and [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm).


Updates `org.postgresql:postgresql` from 42.7.10 to 42.7.11
- [Release notes](https://github.com/pgjdbc/pgjdbc/releases)
- [Changelog](https://github.com/pgjdbc/pgjdbc/blob/master/CHANGELOG.md)
- [Commits](pgjdbc/pgjdbc@REL42.7.10...REL42.7.11)

Updates `org.hibernate.orm:hibernate-core` from 6.6.49.Final to 6.6.50.Final
- [Release notes](https://github.com/hibernate/hibernate-orm/releases)
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/6.6.50/changelog.txt)
- [Commits](hibernate/hibernate-orm@6.6.49...6.6.50)

---
updated-dependencies:
- dependency-name: org.postgresql:postgresql
  dependency-version: 42.7.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: org.hibernate.orm:hibernate-core
  dependency-version: 6.6.50.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the type: dependency-upgrade Pull requests that update a dependency file label May 3, 2026
@github-actions github-actions Bot added type: task and removed type: dependency-upgrade Pull requests that update a dependency file labels May 3, 2026
@github-actions github-actions Bot added this to the 6.5.9 milestone May 3, 2026
@github-actions github-actions Bot enabled auto-merge (squash) May 3, 2026 00:52
@github-actions github-actions Bot merged commit 8fc4ad1 into 6.5.x May 3, 2026
3 checks passed
@github-actions github-actions Bot deleted the dependabot/gradle/6.5.x/development-dependencies-e383c9e38f branch May 3, 2026 00:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants