Bump org.postgresql:postgresql from 42.7.11 to 42.7.12 in the maven group across 1 directory

[dependabot]

Bumps the maven group with 1 update in the / directory: org.postgresql:postgresql.

Updates org.postgresql:postgresql from 42.7.11 to 42.7.12

Release notes

Sourced from org.postgresql:postgresql's releases.

v42.7.12: security

Silent channel-binding authentication downgrade (CVE-2026-54291)

channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS (with channel binding) to plain SCRAM-SHA-256 (without it), losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection triggers the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash. Examples are Ed25519, Ed448, and post-quantum algorithms.

Two issues combine in releases 42.7.4 through 42.7.11:

The bundled com.ongres.scram:scram-client (3.1 or 3.2) returns an empty byte array instead of failing when it cannot derive the binding hash for such a certificate. This is the library issue tracked as GHSA-p9jg-fcr6-3mhf.

pgJDBC does not enforce channelBinding=require where it matters. ScramAuthenticator checks only that the server advertised a -PLUS mechanism; it neither rejects the empty binding nor checks that the negotiated mechanism uses channel binding. The connection therefore downgrades silently.

Only connections that set channelBinding=require are affected. Under the default prefer policy, and under allow or disable, falling back to plain SCRAM is the documented behaviour.

Releases before 42.7.4 are unaffected, because they do not support channel binding.

Changelog

Sourced from org.postgresql:postgresql's changelog.

[42.7.12] (2026-06-29)

Security

• fix: Enforce SCRAM channel-binding policy and prevent silent downgrade. Under channelBinding=require, the driver silently downgraded from SCRAM-SHA-256-PLUS (with channel binding) to plain SCRAM-SHA-256 (without it) when the server presented a certificate whose signature algorithm has no tls-server-end-point channel-binding hash (e.g. Ed25519, Ed448, or post-quantum algorithms). An attacker who can intercept the TLS connection could exploit this to strip channel-binding protection. The fix enforces channel binding in the driver's own code: it now fails the connection when no binding data can be extracted, and verifies the negotiated mechanism uses channel binding (-PLUS) when require is set. Only connections that set channelBinding=require are affected. The default prefer policy and releases before 42.7.4 (which introduced channel-binding support) are unaffected. See the Security Advisory for more detail. The following CVE-2026-54291 has been issued.

Commits

• 77df98e Merge commit from fork
• 68c53a4 chore: bump version to 42.7.12
• See full diff in compare view

[senzingdevops]

Automated: approving this pull request because it includes a patch update

[github-actions]

🤖 Claude Code Review

PR Code Review

Change: Bumps org.postgresql:postgresql dependency from 42.7.11 → 42.7.12 in pom.xml (single line change, line 105).

Code Quality

• ✅ Style conventions — trivial version bump, follows existing XML formatting in pom.xml
• ✅ No commented-out code
• ✅ N/A — no new variables/functions introduced
• ✅ DRY — not applicable, single dependency version change
• ✅ No defects — patch version bump within the same minor version (42.7.x), low risk. No API surface change expected for a JDBC driver patch release.
• ✅ CLAUDE.md — not modified by this PR; no local-environment-specific content introduced

Testing

• ⚠️ No unit/integration tests added — none needed for a dependency version bump
• ✅ N/A — no new edge cases introduced
• N/A — test coverage unaffected by this change

Documentation

• ⚠️ CHANGELOG.md not updated — minor dependency bumps in this repo's history (e.g. jackson-bom, maven-surefire-plugin bumps in recent commits) don't appear to require CHANGELOG entries either, so this is consistent with prior practice
• ✅ No README/API doc changes needed
• ✅ No inline comments needed for this trivial change

Security

• ✅ No hardcoded credentials
• ✅ N/A — no input handling changed
• ✅ N/A — no error handling changed
• ✅ No sensitive data in logs
• ✅ No .lic files or AQAAAD-prefixed license strings present in this diff

Summary

This is a routine automated dependency bump (postgresql JDBC driver 42.7.11 → 42.7.12), consistent with the pattern of other recent dependency-bump commits in this repo's history (jackson-bom, maven-surefire-plugin, jacoco-report). No concerns — safe to merge pending CI passing.

Automated code review analyzing defects and coding standards

[senzingdevops]

Automated: approving this pull request because it includes a patch update

[github-actions]

🤖 Claude Code Review

This confirms the project convention: dependency bumps get a CHANGELOG entry (e.g., the 42.7.10 → 42.7.11 bump was logged in the 2.0.0 entry). This PR's CHANGELOG.md is not updated for the 42.7.11 → 42.7.12 bump.

Review: pom.xml postgresql 42.7.11 → 42.7.12

Code Quality

• ✅ Trivial patch-version bump, correctly formatted, no style issues.
• ✅ No commented-out code.
• N/A Variable names / DRY — not applicable to a single dependency version change.
• ✅ No logic/defect concerns — this is a passive JDBC driver version bump.
• ✅ No .claude/CLAUDE.md changes in this diff.

Testing

• N/A No new functions/endpoints. A dependency bump like this typically relies on existing test suite (mvn test) to catch regressions; nothing in the diff itself is untestable, but I can't confirm CI ran against this new version from the diff alone.

Documentation

• ❌ CHANGELOG.md not updated. This repo's established convention (see entries for 2.0.0 and 2.0.1) is to log every dependency bump, e.g. Updated postgresql from version 42.7.10 to 42.7.11. This PR should add an entry documenting postgresql 42.7.11 → 42.7.12, ideally noting the reason (e.g., CVE fix) if known.
• N/A README/API docs — not affected by this change.
• N/A Inline comments — not applicable.

Security

• ✅ No hardcoded credentials.
• N/A Input validation / error handling — not applicable to this diff.
• ✅ No sensitive data in logs.
• ✅ No .lic files or AQAAAD-prefixed strings present in this diff.
• ℹ️ Worth checking (outside the diff, can't verify without network access): whether 42.7.12 fixes a known CVE in the PostgreSQL JDBC driver — if this is a Dependabot-style security bump, the CHANGELOG entry should say so, consistent with how the netty-bom CVE fixes were documented in prior entries.

Summary

Only one actionable finding: add a CHANGELOG.md entry for this dependency bump, matching the project's established pattern.

Automated code review analyzing defects and coding standards