[SPARK-56749][BUILD] Upgrade PostgreSQL JDBC driver to 42.7.11#55713
Closed
dongjoon-hyun wants to merge 1 commit intoapache:masterfrom
Closed
[SPARK-56749][BUILD] Upgrade PostgreSQL JDBC driver to 42.7.11#55713dongjoon-hyun wants to merge 1 commit intoapache:masterfrom
dongjoon-hyun wants to merge 1 commit intoapache:masterfrom
Conversation
Member
Author
|
cc @peter-toth . This is just a test dependency update to suppress misleading GitHub Alerts in the public repos and downstream repos too. |
peter-toth
approved these changes
May 6, 2026
Contributor
peter-toth
left a comment
peter-toth
left a comment
There was a problem hiding this comment.
LGTM, thanks @dongjoon-hyun!
Member
Author
|
Thank you, @peter-toth ~ |
dongjoon-hyun
added a commit
that referenced
this pull request
May 6, 2026
### What changes were proposed in this pull request? This PR aims to upgrade the test dependency `PostgreSQL` JDBC driver to `42.7.11` which was released on 2026-04-28. The one-week dependency-update grace-period passed. - https://github.com/apache/spark/security/dependabot/186 ### Why are the changes needed? To maintain `PostgreSQL` JDBC driver test coverage up-to-date. - https://jdbc.postgresql.org/changelogs/2026-04-28-42/ (42.7.11) - Security: Limit SCRAM PBKDF2 iterations accepted from the server (new `scramMaxIterations` property capped at 100,000) to mitigate DoS by malicious servers. - Feature: Support for `require_auth` connection property (libpq-aligned authentication requirement validation). - Fixes: extended-protocol `Sync` handling, cursor-based fetching when SQL initiates transactions, SSL fallback/retry across `sslMode` values, connect timeout honored during retries, JSONB returned as `PGObject` instead of `String`, thread safety on concurrent connection close, unsigned `LogSequenceNumber` comparison, `COPY` lock release on I/O error. ### Does this PR introduce _any_ user-facing change? No, this is a test dependency. ### How was this patch tested? Pass the CIs. ### Was this patch authored or co-authored using generative AI tooling? Generated-by: `Claude Opus 4.7 (1M context)` Closes #55713 from dongjoon-hyun/SPARK-56749. Authored-by: Dongjoon Hyun <dongjoon@apache.org> Signed-off-by: Dongjoon Hyun <dongjoon@apache.org> (cherry picked from commit 1317aa7) Signed-off-by: Dongjoon Hyun <dongjoon@apache.org>
Member
Author
|
Merged to master. |
Member
Author
|
I realized that we decided not to backport dependency changes to |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
This PR aims to upgrade the test dependency
PostgreSQLJDBC driver to42.7.11which was released on 2026-04-28. The one-week dependency-update grace-period passed.Why are the changes needed?
To maintain
PostgreSQLJDBC driver test coverage up-to-date.scramMaxIterationsproperty capped at 100,000) to mitigate DoS by malicious servers.require_authconnection property (libpq-aligned authentication requirement validation).Synchandling, cursor-based fetching when SQL initiates transactions, SSL fallback/retry acrosssslModevalues, connect timeout honored during retries, JSONB returned asPGObjectinstead ofString, thread safety on concurrent connection close, unsignedLogSequenceNumbercomparison,COPYlock release on I/O error.Does this PR introduce any user-facing change?
No, this is a test dependency.
How was this patch tested?
Pass the CIs.
Was this patch authored or co-authored using generative AI tooling?
Generated-by:
Claude Opus 4.7 (1M context)