Bump the dependencies group across 1 directory with 23 updates

[dependabot]

Bumps the dependencies group with 21 updates in the / directory:

Package	From	To
com.github.rfresh2:JDA	6.4.31	6.4.32
com.github.rfresh2:MCProtocolLib	1.21.4.49	26.1.2.10
io.netty:netty-bom	4.2.12.Final	4.2.15.Final
org.redisson:redisson	4.3.1	4.5.0
com.viaversion:viaversion-common	5.9.0-20260417.203614-32	5.9.1
com.viaversion:viabackwards-common	5.9.0-20260417.203715-15	5.9.1
com.viaversion:viarewind-common	4.1.0-20260409.155713-7	4.1.1
org.jline:jline	4.0.12	4.1.3
org.postgresql:postgresql	42.7.10	42.7.11
org.jdbi:jdbi3-postgres	3.52.1	3.53.0
com.google.guava:guava	33.5.0-jre	33.6.0-jre
ch.qos.logback:logback-classic	1.5.32	1.5.34
org.slf4j:slf4j-api	2.0.17	2.0.18
tools.jackson:jackson-bom	3.1.2	3.2.0
org.junit:junit-bom	6.0.3	6.1.0
org.testcontainers:testcontainers	2.0.4	2.0.5
org.graalvm.sdk:nativeimage	25.0.2	25.0.3
org.graalvm.buildtools.native	1.0.0	1.1.2
com.gradleup.shadow	9.4.1	9.4.2
io.freefair.lombok	9.2.0	9.5.0
gradle-wrapper	9.4.1	9.5.1

Updates com.github.rfresh2:JDA from 6.4.31 to 6.4.32

Release notes

Sourced from com.github.rfresh2:JDA's releases.

v5.0.0-alpha.8 | alpha.6 Hotfix 2: Electric Boogaloo

Changelog

This release is a follow up hotfix release for 5.0.0-alpha.6 that wasn't completely mitigated by the 5.0.0-alpha.7 hotfix.

Check out the patch notes on 5.0.0-alpha.6 for the cool new stuff.

New Features

N/A

Changes

• Restructure message creation to handle a lack of guild_id by @​DV8FromTheWorld in DV8FromTheWorld/JDA#2039

Removed

N/A

Full Changelog: discord-jda/JDA@v5.0.0-alpha.7...v5.0.0-alpha.8

Installation

Gradle

repositories {
    mavenCentral()
}
dependencies {
    implementation("net.dv8tion:JDA:5.0.0-alpha.8")
}

Maven

<dependency>
    <groupId>net.dv8tion</groupId>
    <artifactId>JDA</artifactId>
    <version>5.0.0-alpha.8</version> 
</dependency>

v5.0.0-alpha.7 | Hotfix for alpha.6

Changelog

This release is a hotfix release for 5.0.0-alpha.6. Check out the patch notes on that version for the cool stuff.

New Features

N/A

Changes

• Make javadocs fail on error by @​Sanduhr32 in DV8FromTheWorld/JDA#2033

... (truncated)

Commits

• See full diff in compare view

Updates com.github.rfresh2:MCProtocolLib from 1.21.4.49 to 26.1.2.10

Updates io.netty:netty-bom from 4.2.12.Final to 4.2.15.Final

Release notes

Sourced from io.netty:netty-bom's releases.

netty-4.2.15.Final

Security fixes

• CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy (high).
• CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns (high).
• CVE-2026-50560: DDoS in io.netty:netty-codec-http2.
• CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-50009: information disclosure and denial of service in io.netty:netty-codec-classes-quic.
• CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high).
• CVE-2026-50020: request smuggling in io.netty:netty-codec-http.
• CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high).
• CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high).
• CVE-2026-44894: traffic amplification in io.netty:netty-codec-classes-quic (high).
• CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high).
• CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns.
• CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high).
• CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue.
• CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high).
• CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high).
• CVE-2026-47244: denial of service in io.netty:netty-codec-http2.
• CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high).
• CVE-2026-48748: memory exhaustion in io.netty:netty-codec-http3 (high).
• CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2.

What's Changed

• Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup by @​dreamlike-ocean in netty/netty#16836
• HTTP/2: Parse request-target path like Vert.x by @​yawkat in netty/netty#16810
• Auto-port 4.2: ChannelInitializer: correct misleading comment on exceptionCaught route by @​netty-project-bot in netty/netty#16853
• FlowControlHandler: Suppress duplicate channelReadComplete after draining queue (#15053) by @​schiemon in netty/netty#16837
• Pass maxAllocation to Brotli and Zstd decoders by @​fedinskiy in netty/netty#16844
• Fix revapi warnings by @​chrisvest in netty/netty#16885
• Fix SCTP and Redis tests by @​chrisvest in netty/netty#16893
• Add maxWindowLog parameter to ZstdDecoder to bound memory allocation by @​skyguard1 in netty/netty#16850
• Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by @​netty-project-bot in netty/netty#16890

New Contributors

• @​schiemon made their first contribution in netty/netty#16837
• @​fedinskiy made their first contribution in netty/netty#16844

Full Changelog: netty/netty@netty-4.2.14.Final...netty-4.2.15.Final

netty-4.2.14.Final

What's Changed

• HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by @​normanmaurer in netty/netty#16748
• HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by @​normanmaurer in netty/netty#16747
• Marshalling: Explicit document security requirements by @​normanmaurer in netty/netty#16752
• Fix io_uring op completion TRACE logging by @​chrisvest in netty/netty#16755
• Quic: Ensure writes are done before notify close promise of QuicheQui… by @​normanmaurer in netty/netty#16758
• Avoid re-parsing openssl key material with non-cached provider by @​chrisvest in netty/netty#16759

... (truncated)

Commits

• a41f7b2 [maven-release-plugin] prepare release netty-4.2.15.Final
• 2394530 Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remain...
• 0bd1657 Add maxWindowLog parameter to ZstdDecoder to bound memory allocation (#16850)
• 76291f5 Fix SCTP and Redis tests (#16893)
• e067b6e Fix revapi warnings (#16885)
• 5a52600 Pass maxAllocation to Brotli and Zstd decoders (#16844)
• 541add0 Merge commit from fork
• 270800e Merge commit from fork
• 3d45a1e Merge commit from fork
• 75127ca Merge commit from fork
• Additional commits viewable in compare view

Updates org.redisson:redisson from 4.3.1 to 4.5.0

Release notes

Sourced from org.redisson:redisson's releases.

redisson-4.5.0

Feature - Array object added (thanks to @​lamnt2008)
Feature - BitVector Store object added
Feature - Fory lib upgraded to 1.1.0
Feature - Micronaut 5.0 support
Feature - readMode setting added for MapOptions, PlainOptions, LocalCachedMapOptions objects
Feature - extended incrementAndGet() method added to RAtomicLong, RAtomicDouble (thanks to @​lamnt2008)
Feature - contains(), range(), iterator() methods added to RVectorSet object
Feature - RMap.keysAsync() method added (thanks to @​sywu14)
Feature - RVectorSet added to RBatch object (thanks to @​sywu14)

Breaking change - map listeners signature changed, field name added (thanks to @​lamnt2008)

Improvement - refactor: remove unnecessary boxing of primitives (thanks to @​MukjepScarlet)

Fixed - RScoredSortedSet Rx and Reactive must handle empty results as absent (thanks to @​ngyngcphu)
Fixed - RGeo Rx and Reactive must handle empty results as absent (thanks to @​lamnt2008)
Fixed - RSet Rx and Reactive must handle empty results as absent (thanks to @​lamnt2008)
Fixed - RVectorSet Rx and Reactive must handle empty results as absent (thanks to @​lamnt2008)
Fixed - PingConnectionHandler race condition
Fixed - UUID type metadata leak in TypedJsonJacksonCodec (thanks to @​wushiyuanmaimob)
Fixed - UUID type inclusion by TypedJsonJackson3Codec
Fixed - buffer truncation in LZ4CodecV2
Fixed - WRONGPASS error on cluster slaves with TLS when password is set at root Config level (regression since 4.4.0) (thanks to @​seakider)
Fixed - release locks for non-existent keys in transactional RMap.fastRemove() (thanks to @​sywu14)

redisson-4.4.0

Feature - Hibernate 7.3.x support Feature - GCRA Rate Limiter added (thanks to @​bandalgomsu) Feature - Non-Reentrant Locks implemented: RLock and RFairLock Feature - entries(count), values(count), keySet(count) methods added to RMultimap Feature - fallbackLoadingToMaster setting added (thanks to @​bandalgomsu) Feature - RRateLimiter.set(RateLimiterArgs) method added (thanks to @​nhancdt2602) Feature - RRateLimiter.update(RateLimiterArgs) method added (thanks to @​nhancdt2602) Feature - RMapCache.putAll() method added with idleTime parameter Feature - RBloomFilter.exists(Collection) method added (thanks to @​nhancdt2602) Feature - MapIncrListener, DequeAddFirstListener, DequeAddLastListener added (thanks to @​nhancdt2602) Feature - SetInterStoreListener, SetUnionStoreListener, SetDiffStoreListener, ScoredSortedSetIncrListener, ScoredSortedSetUnionStoreListener, ScoredSortedSetInterStoreListener, ScoredSortedSetDiffStoreListener added Feature - profileSearch() and profileAggregate() methods added to RSearch Feature - collection field index support for RLiveObject (thanks to @​ngyngcphu) Feature - dnsMonitoringTimes setting added (thanks to @​seakider) Feature - RScoredSortedSet.Aggregate.COUNT option added (thanks to @​TrietMinh23) Feature - RJsonBucket.set() method added with Floating-point homogeneous array precision type (thanks to @​TrietMinh23) ‎Feature - yieldDistanceAs() and shardKRatio() methods added to VectorSimilarityNearestNeighbors params (thanks to @​TrietMinh23) Feature - RedissonClient.shutdownAsync() method added (thanks to @​TrietMinh23) Feature - RStream.nack() method added (thanks to @​lamnt2008) Feature - datastoreMode, primaryDiscoveryMode settings added to Multi Sentinel mode Feature - setSyncConfig(), setQueueSyncConfig(), setTopicSyncConfig() methods added to JMS RedissonConnectionFactory

Improvement - io_uring migration from Netty incubator to graduated transport (4.2)

... (truncated)

Changelog

Sourced from org.redisson:redisson's changelog.

05-June-2026 - 4.5.0 released

Feature - Array object added (thanks to @​lamnt2008)
Feature - BitVector Store object added
Feature - Fory lib upgraded to 1.0.0
Feature - Micronaut 5.0 support
Feature - readMode setting added for MapOptions, PlainOptions, LocalCachedMapOptions objects
Feature - extended incrementAndGet() method added to RAtomicLong, RAtomicDouble (thanks to @​lamnt2008)
Feature - contains(), range(), iterator() methods added to RVectorSet object
Feature - RMap.keysAsync() method added (thanks to @​sywu14)
Feature - RVectorSet added to RBatch object (thanks to @​sywu14)

Breaking change - map listeners signature changed, field name added (thanks to @​lamnt2008)

Improvement - refactor: remove unnecessary boxing of primitives (thanks to @​MukjepScarlet)

Fixed - RScoredSortedSet Rx and Reactive must handle empty results as absent (thanks to @​ngyngcphu)
Fixed - RGeo Rx and Reactive must handle empty results as absent (thanks to @​lamnt2008)
Fixed - RSet Rx and Reactive must handle empty results as absent (thanks to @​lamnt2008)
Fixed - RVectorSet Rx and Reactive must handle empty results as absent (thanks to @​lamnt2008)
Fixed - PingConnectionHandler race condition
Fixed - UUID type metadata leak in TypedJsonJacksonCodec (thanks to @​wushiyuanmaimob)
Fixed - UUID type inclusion by TypedJsonJackson3Codec
Fixed - buffer truncation in LZ4CodecV2
Fixed - WRONGPASS error on cluster slaves with TLS when password is set at root Config level (regression since 4.4.0) (thanks to @​seakider)
Fixed - release locks for non-existent keys in transactional RMap.fastRemove() (thanks to @​sywu14)

12-May-2026 - 4.4.0 released

Feature - Hibernate 7.3.x support
Feature - GCRA Rate Limiter added (thanks to @​bandalgomsu)
Feature - Non-Reentrant Locks implemented: RLock and RFairLock
Feature - entries(count), values(count), keySet(count) methods added to RMultimap
Feature - fallbackLoadingToMaster setting added (thanks to @​bandalgomsu)
Feature - RRateLimiter.set(RateLimiterArgs) method added (thanks to @​nhancdt2602)
Feature - RRateLimiter.update(RateLimiterArgs) method added (thanks to @​nhancdt2602)
Feature - RMapCache.putAll() method added with idleTime parameter
Feature - RBloomFilter.exists(Collection<T>) method added (thanks to @​nhancdt2602)
Feature - MapIncrListener, DequeAddFirstListener, DequeAddLastListener added (thanks to @​nhancdt2602)
Feature - SetInterStoreListener, SetUnionStoreListener, SetDiffStoreListener, ScoredSortedSetIncrListener, ScoredSortedSetUnionStoreListener, ScoredSortedSetInterStoreListener, ScoredSortedSetDiffStoreListener added
Feature - profileSearch() and profileAggregate() methods added to RSearch
Feature - collection field index support for RLiveObject (thanks to @​ngyngcphu)
Feature - dnsMonitoringTimes setting added (thanks to @​seakider)
Feature - RScoredSortedSet.Aggregate.COUNT option added (thanks to @​TrietMinh23)
Feature - RJsonBucket.set() method added with Floating-point homogeneous array precision type (thanks to @​TrietMinh23)
‎Feature - yieldDistanceAs() and shardKRatio() methods added to VectorSimilarityNearestNeighbors params (thanks to @​TrietMinh23)
Feature - RedissonClient.shutdownAsync() method added (thanks to @​TrietMinh23)
Feature - RStream.nack() method added (thanks to @​lamnt2008)
Feature - datastoreMode, primaryDiscoveryMode settings added to Multi Sentinel mode
Feature - setSyncConfig(), setQueueSyncConfig(), setTopicSyncConfig() methods added to JMS RedissonConnectionFactory

... (truncated)

Commits

• 85b4ac1 [maven-release-plugin] prepare release redisson-4.5.0
• d0d7bf0 docs updated
• c7f01dd Update CHANGELOG.md
• 16ab190 Update CHANGELOG.md
• b56a2fa Update CHANGELOG.md
• 4f0e593 compilation fixed
• b347da4 Merge branch 'master' of github.com:redisson/redisson
• f9d02d6 API updated
• ec211f2 Update README.md
• 50b3399 Update README.md
• Additional commits viewable in compare view

Updates com.viaversion:viaversion-common from 5.9.0-20260417.203614-32 to 5.9.1

Updates com.viaversion:viabackwards-common from 5.9.0-20260417.203715-15 to 5.9.1

Updates com.viaversion:viarewind-common from 4.1.0-20260409.155713-7 to 4.1.1

Commits

• See full diff in compare view

Updates org.jline:jline from 4.0.12 to 4.1.3

Release notes

Sourced from org.jline:jline's releases.

JLine 4.1.3 is a patch release with important fixes for terminal close handling, raw mode signal behavior, FFM memory management, and shell command argument parsing.

Bug Fixes

• fix: terminal.close() blocks when pump thread is reading stdin (#1911, fixes #1909)
• fix: clear ISIG in enterRawMode so Ctrl+C reaches raw-mode readers (#1912)
• fix: use confined arenas instead of auto arenas in FFM CLibrary (#1913, fixes #1872)
• fix: swap rows/columns in openpty winsize constructor call (#1914, fixes #1910)
• fix: fix command argument parsing in DefaultCommandDispatcher (#1924)

Chores

• chore: add OSS AI helper rules for project conventions (#1917)

Dependencies

• chore: Bump org.graalvm.buildtools:native-maven-plugin from 1.1.0 to 1.1.1 (#1915)
• chore: Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 (#1918)
• chore: Bump com.diffplug.spotless:spotless-maven-plugin from 3.5.1 to 3.6.0 (#1919)

Full Changelog: jline/jline3@4.1.2...4.1.3

JLine 4.1.2 is a patch release focused on correctness fixes across the parser, terminal I/O, and shell modules.

Bug Fixes

• fix: echo preserves backslash before unrecognised escape sequences (#1901, fixes #1863)
• fix: DefaultParser preserves backslashes inside quotes (#1902, fixes #1877)
• fix: NonBlockingInputStream keeps thread alive after EOF (#1903, fixes #1879)
• fix: ensure cursor position after alternate screen init (#1904, fixes #1883)
• fix: use parser for command argument splitting (#1907, fixes #1876)

Dependencies

• chore: Bump eu.maveniverse.maven.nisse:extension from 0.9.1 to 0.9.2 (#1905)

Full Changelog: jline/jline3@4.1.1...4.1.2

JLine 4.1.1 is a patch release focused on stability fixes. The most notable change corrects the POSIX raw mode defaults (VMIN/VTIME) in enterRawMode, which could cause shell REPL sessions to hang or malfunction on certain platforms. This release also fixes a Display bug where the internal line buffer could alias or reject immutable caller-provided lists, hardens signal registration against null returns, and corrects alternate charset handling in ScreenTerminal.

🐛 Bug Fixes

• fix: Fixed Display oldLines being set as possible immutable lists. (#1878) @​Elec332
• fix: use POSIX cfmakeraw defaults (VMIN=1, VTIME=0) in enterRawMode (#1871) @​BryanSant
• fix: skip null returns from signal registration in AbstractUnixSysTerminal (#1869) @​BryanSant
• fix: Fixed ScreenTerminal alt-charset (#1867) @​Elec332

📦 Dependency updates

• chore: Bump com.palantir.javaformat:palantir-java-format from 2.90.0 to 2.91.0 (#1898) @​dependabot

... (truncated)

Commits

• 7f44a23 fix: fix command argument parsing in DefaultCommandDispatcher (#1924)
• 911e3d6 chore: Bump com.diffplug.spotless:spotless-maven-plugin from 3.5.1 to 3.6.0 (...
• 15cdac5 chore: Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5....
• 2d3e1ff chore: Bump org.graalvm.buildtools:native-maven-plugin from 1.1.0 to 1.1.1 (#...
• 0ac019a fix: terminal.close() blocks when pump thread is reading stdin (#1911)
• 1d63740 fix: use confined arenas instead of auto arenas in FFM CLibrary (fixes #1872)
• 1604643 Merge pull request #1912 from jline/dot-tarragon
• 147ee9c chore: add OSS AI helper rules for project conventions (#1917)
• 1735c1f fix: swap rows/columns in openpty winsize constructor call (fixes #1910)
• d9f6b86 fix: add PromptCancelTest from #1908 with timeout and fixture patterns
• Additional commits viewable in compare view

Updates org.postgresql:postgresql from 42.7.10 to 42.7.11

Release notes

Sourced from org.postgresql:postgresql's releases.

v42.7.11

Security

• fix: Limit SCRAM PBKDF2 iterations accepted from the server. pgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256 authentication, where a malicious or compromised PostgreSQL server could specify an extremely large PBKDF2 iteration count, causing the client to consume unbounded CPU and potentially exhaust connection pools. The fix introduces a new scramMaxIterations connection property (defaulting to 100,000) to cap iteration counts before computation begins. See the Security Advisory for more detail. The following CVE-2026-42198 has been issued.

Changes

• fix: Add sources and javadocs to shaded published lib generation @​sehrope (#4043)
• update Changelog and website for release of 42.7.11 @​davecramer (#4042)
• Fix scram fix location in changelog and update published artifact developer list @​sehrope (#4041)
• Restrict test with scram_iterations to v16+ and release notes @​sehrope (#4040)
• chore(deps): update ubuntu:24.04 docker digest to 84e77de @​renovate-bot (#4017)
• test: add tests for QueryExecutor#getTransactionState @​vlsi (#4006)
• chore(deps): update actions/create-github-app-token action to v2.2.2 @​renovate-bot (#3983)
• fix: fix flaky CopyBothResponseTest by using WAL flush LSN @​vlsi (#3979)
• fix: fix flaky replication restart tests by waiting for confirmed_flush_lsn @​vlsi (#3975)
• test: fix flaky LogicalReplicationStatusTest by polling pg_stat_replication @​vlsi (#3974)
• chore: replace Appveyor with ikalnytskyi/action-setup-postgres @​vlsi (#3966)
• test: move test table creation from @​BeforeEach to @​BeforeAll @​vlsi (#3967)
• Return jsonb as PGObject fixes Issue #3926 @​davecramer (#3956)
• Update docker scripts @​davecramer (#3958)
• implement require_auth, this is pretty much how libpq does this. @​davecramer (#3895)
• docs: add SCRAM authentication test setup section to TESTING.md @​emmaeng700 (#3945)
• Add RequireServerVersion annotation for tests @​sehrope (#3939)

🐛 Bug Fixes

• fix: ensure extended protocol messages end with Sync message @​vlsi (#3728)
• fix: enable cursor-based fetching in extended protocol when transaction started via SQL command @​vlsi (#3996)
• fix: retry with SSL on IOException when sslMode=ALLOW @​vlsi (#3973)
• fix: allow fallback to non-SSL connection when sslMode=prefer and sslResponseTimeout kicks in @​vlsi (#3968)
• fix: catch SecurityException from setContextClassLoader on ForkJoinPool workers @​vlsi (#3962)
• fix: use compareTo for LogSequenceNumber comparison @​vlsi (#3961)
• fix: release COPY lock on IOException to prevent connection hang (#3957) @​vlsi (#3960)

🧰 Maintenance

• style: replace @​exception with @​throws in getBoolean javadoc @​vlsi (#4035)
• chore: use @​vlsi/github-actions-random-matrix npm package @​vlsi (#4008)
• chore: use tag names for pinning github actions, pin ikalnytskyi/action-setup-postgres @​vlsi (#4007)
• chore: bump errorprone to 2.48.0 @​vlsi (#4005)
• test: add @​DisableLogger annotation to suppress expected log warnings in tests @​vlsi (#3971)
• chore: suppress deprecations in test code to reduce build verbosity @​vlsi (#3972)
• chore: replace log warning in ConnectionFactory.closeStream with Throwable.addSuppressed @​vlsi (#3970)
• chore: use greedy pairwise coverage for CI matrix generation @​vlsi (#3965)
• chore: use full version tags in GitHub Actions comments @​vlsi (#3963)

⬆️ Dependencies

... (truncated)

Changelog

Sourced from org.postgresql:postgresql's changelog.

[42.7.11] (2026-04-28)

Security

• fix: Limit SCRAM PBKDF2 iterations accepted from the server. pgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256 authentication, where a malicious or compromised PostgreSQL server could specify an extremely large PBKDF2 iteration count, causing the client to consume unbounded CPU and potentially exhaust connection pools. The fix introduces a new scramMaxIterations connection property (defaulting to 100,000) to cap iteration counts before computation begins. See the Security Advisory for more detail. The following CVE-2026-42198 has been issued.

Added

• feat: implement require_auth connection property, aligning with libpq behavior [PR #3895](pgjdbc/pgjdbc#3895)

Changed

• chore: replace Appveyor CI with ikalnytskyi/action-setup-postgres [PR #3966](pgjdbc/pgjdbc#3966)
• chore: upgrade Gradle to v9 [PR #3978](pgjdbc/pgjdbc#3978)

Fixed

• fix: ensure extended protocol messages end with Sync message [PR #3728](pgjdbc/pgjdbc#3728)
• fix: enable cursor-based fetching in extended protocol when transaction started via SQL command [PR #3996](pgjdbc/pgjdbc#3996)
• fix: retry with SSL on IOException when sslMode=ALLOW [PR #3973](pgjdbc/pgjdbc#3973)
• fix: make sure the driver honours connectTimeout when retrying the connection [PR #3968](pgjdbc/pgjdbc#3968)
• fix: allow fallback to non-SSL connection when sslMode=prefer and sslResponseTimeout kicks in [PR #3968](pgjdbc/pgjdbc#3968)
• fix: catch SecurityException from setContextClassLoader on ForkJoinPool workers [PR #3962](pgjdbc/pgjdbc#3962)
• fix: use compareTo for LogSequenceNumber comparison to handle unsigned values correctly [PR #3961](pgjdbc/pgjdbc#3961)
• fix: release COPY lock on IOException to prevent connection hang [PR #3957](pgjdbc/pgjdbc#3957)
• fix: return jsonb as PGObject instead of String [PR #3956](pgjdbc/pgjdbc#3956)
• fix: align SSL key file permission check with libpq [PR #3952](pgjdbc/pgjdbc#3952)
• fix: guard connection closed flag with a reentrant lock to protect against concurrent close [PR #3905](pgjdbc/pgjdbc#3905)

Commits

• 78e261f fix: Add sources and javadocs to shaded published lib generation
• 1e09fa0 update Changelog and website for release of 42.7.11 (#4042)
• d479fa5 Fix scram fix location in changelog and update published artifact developer l...
• b04fc46 docs: Add scram max iters fix to changelog
• cf54822 test: Disable scram test on older version without scram_iterations GUC
• 7dbcc79 test: Add SCRAM max iteration tests
• c9d41d1 fix: Limit SCRAM PBKDF2 iterations accepted from the server
• a340cb2 style: replace @​exception with @​throws in getBoolean javadoc
• 77837f8 fix(deps): update dependency org.openrewrite.rewrite:org.openrewrite.rewrite....
• 23af03b chore(deps): update actions/checkout action to v6
• Additional commits viewable in compare view

Updates org.jdbi:jdbi3-postgres from 3.52.1 to 3.53.0

Release notes

Sourced from org.jdbi:jdbi3-postgres's releases.

3.53.0

Fixes: Jdbi-Freemarker Security Advisory GHSA-mggx-p7jf-jgw4

The Freemarker configuration allows templates to construct arbitrary Java types, including freemarker.template.utility.Execute.

While exploiting this requires other unsafe practices (letting a user dictate template input), it seems prudent to disable template class resolution.

Please see GHSA-mggx-p7jf-jgw4 for more details.

Upgrade to testcontainers 2.x

While this required no code changes, the testcontainers project has renamed a number of their jar files. Jdbi still supports testcontainers 1.x and now also testcontainers 2.x:

If you are using testcontainers with Jdbi today and can not update to 2.x, make sure that you reference the org.testcontainers:jdbc and org.testcontainers:junit-jupiter dependencies. Those used to be available as transitive dependency from jdbi3-testcontainers.

If you upgrade to testcontainers 2.x, the org.testcontainers:testcontainers-jdbc and org.testcontainers:testcontainers-junit-jupiter dependencies must be available.

• Update testcontainers dependency to 2.0.5 (from 1.21.4)
• Add StatementContext parameter to SqlExceptionHandler and remove return value

Changelog

Sourced from org.jdbi:jdbi3-postgres's changelog.

3.53.0

Fixes: Jdbi-Freemarker Security Advisory GHSA-mggx-p7jf-jgw4

The Freemarker configuration allows templates to construct arbitrary Java types, including freemarker.template.utility.Execute.

While exploiting this requires other unsafe practices (letting a user dictate template input), it seems prudent to disable template class resolution.

Please see GHSA-mggx-p7jf-jgw4 for more details.

Upgrade to testcontainers 2.x

While this required no code changes, the testcontainers project has renamed a number of their jar files. Jdbi still supports testcontainers 1.x and now also testcontainers 2.x:

If you are using testcontainers with Jdbi today and can not update to 2.x, make sure that you reference the org.testcontainers:jdbc and org.testcontainers:junit-jupiter dependencies. Those used to be available as transitive dependency from jdbi3-testcontainers.

If you upgrade to testcontainers 2.x, the org.testcontainers:testcontainers-jdbc and org.testcontainers:testcontainers-junit-jupiter dependencies must be available.

• Update testcontainers dependency to 2.0.5 (from 1.21.4)
• Add StatementContext parameter to SqlExceptionHandler and remove return value

Commits

• 5361840 [maven-release-plugin] prepare release v3.53.0
• 59a8376 Release notes 3.53.0
• 1f1a5c5 freemarker: disable template class resolution
• 83465ac Merge remote-tracking branch 'origin/master' into sqlexception-handler-statem...
• 5d4191f Merge pull request #2969 from hgschmie/testcontainers2
• 05f9bdb align mysql docker image property name
• ce9f12c align oracle docker image property name
• ebceb8a move to testcontainers 2.x
• 9a42863 add documentation and example
• d53118f SqlExceptionHandler: add StatementContext parameter, remove confusing return ...
• Additional commits viewable in compare view

Updates com.google.guava:guava from 33.5.0-jre to 33.6.0-jre

Release notes

Sourced from com.google.guava:guava's releases.

33.6.0

Maven

<dependency>
  <groupId>com.google.guava</groupId>
  <artifactId>guava</artifactId>
  <version>33.6.0-jre</version>
  <!-- or, for Android: -->
  <version>33.6.0-android</version>
</dependency>

Jar files

• 33.6.0-jre.jar
• 33.6.0-android.jar

Guava requires one runtime dependency, which you can download here:

• failureaccess-1.0.3.jar

Javadoc

• 33.6.0-jre
• 33.6.0-android

JDiff

• 33.6.0-jre vs. 33.5.0-jre
• 33.6.0-android vs. 33.5.0-android
• 33.6.0-android vs. 33.6.0-jre

Changelog

• Migrated some classes from finalize() to PhantomReference in preparation for the removal of finalization. (786b619dd6, 7c6b17c, aeef90988d)
• cache: Deprecated CacheBuilder APIs that use TimeUnit in favor of those that use Duration. (73f8b0bb84)
• collect: Added toImmutableSortedMap collectors that use the natural comparator. (64d70b9f94)
• collect: Changed ConcurrentHashMultiset, ImmutableMap and TreeMultiset deserialization to avoid mutating final fields. In extremely unlikely scenarios in which an instance of that type contains an object that refers back to that instance, this could lead to a broken instance that throws NullPointerException when used. (8240c7e596, 046468055f)
• graph: Removed @Beta from all APIs in the package. (dae9566b73)
• graph: Added support to Graphs.transitiveClosure() for different strategies for adding self-loops. (2e13df25b2)
• graph: Added an asNetwork() view to Graph and ValueGraph. (909c593c61)
• hash: Added BloomFilter.serializedSize(). (df9bcc251a)
• net: Added HttpHeaders.CDN_CACHE_CONTROL. (75331b5030)

Commits

• See full diff in compare view

Updates ch.qos.logback:logback-classic from 1.5.32 to 1.5.34

Release notes

Sourced from ch.qos.logback:logback-classic's releases.

Logback 1.5.34

2026-06-01 Release of logback version 1.5.34

• In case certain StackTraceElement values returned by the Throwable.getStackTrace method are null, StackTraceElementProxy substitutes a dummy instance instead of throwing an IllegalArgumentException. This resolves [issues #1040](qos-ch/logback#1040), reported by Naotsugu Kobayashi.

• HardenedObjectInputStream will now throw an InvalidClassException during deserialization attempts of Proxy classes. This change addresses potential deserialization whitelist bypass vulnerability reported by York Shen and registered as CVE-2026-10532.

• A bitwise identical binary of this version can be reproduced by building from source code at commit e62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag v_1.5.34. This release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Logback 1.5.33

2026-05-27 Release of logback version 1.5.33

• PropertiesConfiguratorModelHandler now registers properties file URLs to the ConfigurationWatchList when scan is enabled (via local scan="true" attribute or top-level configuration scan), ensuring changes are detected and reconfiguration occurs. This problem was reported in issues/1034.

• When processing <conversionRule> elements and both class and converterClass attributes are specified, silently use the class attribute without issuing a warning. However, if the attribute values differ, a warning will be issued. This change was requested in issues/1031.

• HardenedModelInputStream will no longer accept to deserialize all classes locate...

Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.