This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [org.postgresql:postgresql](https://jdbc.postgresql.org)
([source](https://redirect.github.com/pgjdbc/pgjdbc)) | `42.7.11` →
`42.7.12` |
|
|
---
> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/2069) for more information.
---
### PostgreSQL JDBC Driver: Silent channel-binding authentication
downgrade via unsupported certificate algorithms
[CVE-2026-54291](https://nvd.nist.gov/vuln/detail/CVE-2026-54291) /
[GHSA-j92g-9f8w-j867](https://redirect.github.com/advisories/GHSA-j92g-9f8w-j867)
<details>
<summary>More information</summary>
#### Details
##### Impact
`channelBinding=require` connections can be silently downgraded from
`SCRAM-SHA-256-PLUS` (with channel binding) to plain `SCRAM-SHA-256`
(without it), losing the man-in-the-middle protection the setting is
meant to guarantee. An attacker who can intercept the TLS connection
triggers the downgrade with a certificate whose signature algorithm has
no `tls-server-end-point` channel-binding hash. Examples are `Ed25519`,
`Ed448`, and post-quantum algorithms.
Two issues combine in releases 42.7.4 through 42.7.11:
1. The bundled `com.ongres.scram:scram-client` (3.1 or 3.2) returns an
empty byte array instead of failing when it cannot derive the binding
hash for such a certificate. This is the library issue tracked as
[GHSA-p9jg-fcr6-3mhf](https://redirect.github.com/ongres/scram/security/advisories/GHSA-p9jg-fcr6-3mhf).
2. pgJDBC does not enforce `channelBinding=require` where it matters.
`ScramAuthenticator` checks only that the server *advertised* a `-PLUS`
mechanism; it neither rejects the empty binding nor checks that the
*negotiated* mechanism uses channel binding. The connection therefore
downgrades silently, and would do so even against a fixed
`scram-client`, because the missing enforcement is in pgJDBC's own code.
Only connections that set `channelBinding=require` are affected. Under
the default `prefer` policy, and under `allow` or `disable`, falling
back to plain SCRAM is the documented behaviour. Releases before 42.7.4
are unaffected, because they do not support channel binding.
##### Patches
Fixed in pgJDBC 42.7.12. pgJDBC now enforces channel binding in its own
code, independently of the `scram-client` version:
- Under `channelBinding=require`, it fails the connection when no
channel-binding data can be extracted from the server certificate,
instead of passing an empty value to the SCRAM client. The error names
the certificate signature algorithm.
- After negotiation, it requires the selected mechanism to use channel
binding (a `-PLUS` mechanism) whenever `channelBinding=require` is set,
regardless of how negotiation resolved.
Upgrade to 42.7.12 or later.
##### Workarounds
No pgJDBC setting restores channel-binding enforcement on an affected
release; upgrading is the fix.
If you cannot upgrade immediately, verify the server certificate at the
TLS layer so that a man-in-the-middle cannot present a substitute
certificate. Set `sslmode=verify-full` with a truststore that contains
only your server's CA. This defence is independent of channel binding
and blocks the same attacker. Connections that rely on
`channelBinding=require` in place of certificate verification have no
equivalent workaround and should upgrade.
##### References
-
[GHSA-p9jg-fcr6-3mhf](https://redirect.github.com/ongres/scram/security/advisories/GHSA-p9jg-fcr6-3mhf)
— the related `com.ongres.scram:scram-client` issue (root cause of the
empty channel-binding value).
- `scram-client` 3.3 release (library fix):
https://github.com/ongres/scram/releases/tag/3.3
- pgJDBC fix in 42.7.12:
[commit](77df98e4e6)
#### Severity
- CVSS Score: 8.2 / 10 (High)
- Vector String:
`CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N`
#### References
-
[https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867](https://redirect.github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-54291](https://nvd.nist.gov/vuln/detail/CVE-2026-54291)
-
[77df98e4e6)
-
[https://github.com/ongres/scram/releases/tag/3.3](https://redirect.github.com/ongres/scram/releases/tag/3.3)
-
[https://github.com/advisories/GHSA-j92g-9f8w-j867](https://redirect.github.com/advisories/GHSA-j92g-9f8w-j867)
This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-j92g-9f8w-j867)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
---
### Release Notes
<details>
<summary>pgjdbc/pgjdbc (org.postgresql:postgresql)</summary>
###
[`v42.7.12`](https://redirect.github.com/pgjdbc/pgjdbc/blob/HEAD/CHANGELOG.md#42712-2026-06-29)
##### Security
- fix: Enforce SCRAM channel-binding policy and prevent silent
downgrade.
Under `channelBinding=require`, the driver silently downgraded from
`SCRAM-SHA-256-PLUS` (with channel binding) to plain `SCRAM-SHA-256`
(without it) when the server presented a certificate whose signature
algorithm has no `tls-server-end-point` channel-binding hash (e.g.
[`Ed25519`](https://redirect.github.com/pgjdbc/pgjdbc/commit/Ed25519),
Ed448, or post-quantum algorithms). An attacker who can intercept the
TLS connection could exploit this to strip channel-binding protection.
The fix enforces channel binding in the driver's own code: it now fails
the connection when no binding data can be extracted, and verifies the
negotiated mechanism uses channel binding (`-PLUS`) when `require` is
set.
Only connections that set `channelBinding=require` are affected. The
default `prefer` policy and releases before 42.7.4 (which introduced
channel-binding support) are unaffected.
See the [Security
Advisory](https://redirect.github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867)
for more detail.
The following
[CVE-2026-54291](https://nvd.nist.gov/vuln/detail/CVE-2026-54291) has
been issued.
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/langchain4j/langchain4j).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzUuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI3NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
## Issue
Closes#5784
## Change
`PgVectorEmbeddingStore.builder().skipCreateVectorExtension(true)` had
no effect. The
`PgVectorEmbeddingStoreBuilder` constructor routed through an older
constructor that passes
`skipCreateVectorExtension(null)`, so the value set on the builder never
reached the store and defaulted to `false`.
The store kept running `CREATE EXTENSION IF NOT EXISTS vector` on every
connection. The `datasourceBuilder()` path
was not affected.
Fix: build the store through `DatasourceBuilder` directly and pass
`skipCreateVectorExtension` with the other
settings. No API change.
## Tests
Added `PgVectorEmbeddingStoreBuilderTest` (offline):
`skipCreateVectorExtension(true)` on the builder now reaches
the store (fails on current `main`), and stays `false` when unset. Full
module `verify` is green (unit +
Testcontainers integration tests).
## General checklist
- [x] There are no breaking changes (API, behaviour)
- [x] I have added unit and/or integration tests for my change
- [x] The tests cover both positive and negative cases
- [x] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [x] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
- [ ] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)
## Issue
Closes#5594
## Change
`PgVectorFilterMapper.mapContains()` mapped the `ContainsString` filter
to the PostgreSQL `~` operator, which is POSIX regular-expression
matching. The core `ContainsString` contract is literal substring
containment (`str.contains`), so values with regex metacharacters were
misinterpreted: `"a.b"` also matched `axb`, `"C++"` matched `CC` but not
`C++`, and an unbalanced `"["` raised `invalid regular expression` at
query time.
This replaces `~` with the native literal-substring function
`position(value in column) > 0`. It matches the core contract and the
sibling MongoDB (`Pattern.quote`) and Milvus (`LIKE`) mappers. The
existing single-quote escaping in `formatValue` still covers SQL-literal
safety, so no metacharacter escaping table is needed.
Added three unit tests in `PgVectorFilterMapperTest` (JSON and column
mappers, plus single-quote escaping). Each fails on the old `~` mapping
and passes after the fix.
## General checklist
- [ ] There are no breaking changes (API, behaviour)
<!-- API unchanged. Behaviour changes only for values containing regex
metacharacters — that misinterpretation is exactly the bug being fixed;
correct literal-substring usage is unaffected. -->
- [X] I have added unit and/or integration tests for my change
- [ ] The tests cover both positive and negative cases
<!-- This corrects the generated SQL for a filter mapping, so the tests
assert the correct literal-substring output; there is no reject/negative
path to cover. -->
- [X] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
<!-- PgVectorFilterMapperTest: 13 tests green (JDK 17). *IT require a
live PostgreSQL/Testcontainers and were not run locally. -->
- [ ] I have manually run all the unit and integration tests in the core
and main modules, and they are all green
- [ ] I have added/updated the documentation
- [ ] I have added an example in the examples repo (only for "big"
features)
- [ ] I have added/updated Spring Boot starter(s) (if applicable)
<!-- 신규 maven 모듈/신규 embedding store 체크리스트: 해당 없음(기존 모듈 버그픽스). -->
## Checklist for changing existing embedding store integration
- [ ] I have manually verified that the `PgVectorEmbeddingStore` works
correctly with the data persisted using the latest released version of
LangChain4j
<!-- This changes only the WHERE-clause generation for the
ContainsString filter; stored data format is unchanged. -->
---
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Summary
- Wrap the `is null or ...` clauses produced by `mapNotIn` and
`mapNotEqual` in parentheses. Without them,
`someFilter.and(metadataKey("id").isNotIn(...))` rendered as `something
AND id is null OR id not in (...)`, which SQL parses as `(something AND
id is null) OR (id not in (...))` — silently matching rows that should
be filtered out.
- Matches the parenthesization already used in `MariaDbFilterMapper`.
Closes#2513.
## Test plan
- [x] New `PgVectorFilterMapperTest` asserts the parens for both
`JSONFilterMapper` and `ColumnFilterMapper`, and that AND-combined
queries keep correct precedence
- [x] `mvn -pl langchain4j-pgvector test` passes (10/10 unit tests)
## Issue
Closes#4591
## Change
Add a clean-up step on the table name and use the cleaned name to create
the indices
## General checklist
- [X] There are no breaking changes (API, behaviour)
- [ ] I have added unit and/or integration tests for my change
- [ ] The tests cover both positive and negative cases
- [X] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [ ] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
- [ ] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)
## Checklist for adding new maven module
- [ ] I have added my new module in the root `pom.xml` and
`langchain4j-bom/pom.xml`
## Checklist for adding new embedding store integration
- [ ] I have added a `{NameOfIntegration}EmbeddingStoreIT` that extends
from either `EmbeddingStoreIT` or `EmbeddingStoreWithFilteringIT`
- [ ] I have added a `{NameOfIntegration}EmbeddingStoreRemovalIT` that
extends from `EmbeddingStoreWithRemovalIT`
## Checklist for changing existing embedding store integration
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have manually verified that the
`{NameOfIntegration}EmbeddingStore` works correctly with the data
persisted using the latest released version of LangChain4j
Co-authored-by: Andreas Avgousti <a.avgousti@albourne.com>
## Issue
<!-- Please specify the ID of the issue this PR is addressing. For
example: "Closes #1234" or "Fixes #1234" -->
Closes#4575
## Change
<!-- Please describe the changes you made. -->
Added flag skipCreateVectorExtension to the PgVectorEmbeddingStore. Its
default value does not change the current behaviour,
When set to true, the CREATE EXTENSION statement is not executed when a
new connection is created.
## General checklist
<!-- Please double-check the following points and mark them like this:
[X] -->
- [X] There are no breaking changes (API, behaviour)
- [ ] I have added unit and/or integration tests for my change
- [ ] The tests cover both positive and negative cases
- [X] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [ ] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
<!-- Before adding documentation and example(s) (below), please wait
until the PR is reviewed and approved. -->
- [ ] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)
## Checklist for changing existing embedding store integration
<!-- Please double-check the following points and mark them like this:
[X] -->
- [X] I have manually verified that the `PgVectorEmbeddingStore` works
correctly with the data persisted using the latest released version of
LangChain4j
<!--
Thank you so much for your contribution!
Please fill in all the sections below.
Please open the PR as a draft initially. Once it is reviewed and
approved, we will ask you to add documentation and examples.
Please note that PRs with breaking changes or without tests will be
rejected.
Please note that PRs will be reviewed based on the priority of the
issues they address.
We ask for your patience. We are doing our best to review your PR as
quickly as possible.
Please refrain from pinging and asking when it will be reviewed. Thank
you for understanding!
-->
## Issue
<!-- Please specify the ID of the issue this PR is addressing. For
example: "Closes #1234" or "Fixes #1234" -->
Closes#1599
## Change
<!-- Please describe the changes you made. -->
## General checklist
<!-- Please double-check the following points and mark them like this:
[X] -->
- [x] There are no breaking changes (API, behaviour)
- [x] I have added unit and/or integration tests for my change
- [x] The tests cover both positive and negative cases
- [x] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [x] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
<!-- Before adding documentation and example(s) (below), please wait
until the PR is reviewed and approved. -->
- [ ] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)
## Checklist for adding new maven module
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have added my new module in the root `pom.xml` and
`langchain4j-bom/pom.xml`
## Checklist for adding new embedding store integration
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have added a `{NameOfIntegration}EmbeddingStoreIT` that extends
from either `EmbeddingStoreIT` or `EmbeddingStoreWithFilteringIT`
- [ ] I have added a `{NameOfIntegration}EmbeddingStoreRemovalIT` that
extends from `EmbeddingStoreWithRemovalIT`
## Checklist for changing existing embedding store integration
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have manually verified that the
`{NameOfIntegration}EmbeddingStore` works correctly with the data
persisted using the latest released version of LangChain4j
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Dmytro Liubarskyi <ljubarskij@gmail.com>
## Change
The body of `initTable` method of `PgVectorEmbeddingStore` requires
connection even no database operation is going to happen. This change
wrap the call to the method to the condition that checks that some DB
operation will happen.
## General checklist
<!-- Please double-check the following points and mark them like this:
[X] -->
- [x] There are no breaking changes (API, behaviour)
- [x] I have added unit and/or integration tests for my change
- [x] The tests cover both positive and negative cases (via current IT)
- [x] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [x] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
<!-- Before adding documentation and example(s) (below), please wait
until the PR is reviewed and approved. -->
- [ ] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)
## Checklist for adding new maven module
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have added my new module in the root `pom.xml` and
`langchain4j-bom/pom.xml`
## Checklist for adding new embedding store integration
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have added a `{NameOfIntegration}EmbeddingStoreIT` that extends
from either `EmbeddingStoreIT` or `EmbeddingStoreWithFilteringIT`
- [ ] I have added a `{NameOfIntegration}EmbeddingStoreRemovalIT` that
extends from `EmbeddingStoreWithRemovalIT`
## Checklist for changing existing embedding store integration
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have manually verified that the
`{NameOfIntegration}EmbeddingStore` works correctly with the data
persisted using the latest released version of LangChain4j
<!--
Thank you so much for your contribution!
Please fill in all the sections below.
Please open the PR as a draft initially. Once it is reviewed and
approved, we will ask you to add documentation and examples.
Please note that PRs with breaking changes or without tests will be
rejected.
Please note that PRs will be reviewed based on the priority of the
issues they address.
We ask for your patience. We are doing our best to review your PR as
quickly as possible.
Please refrain from pinging and asking when it will be reviewed. Thank
you for understanding!
-->
## Issue
<!-- Please specify the ID of the issue this PR is addressing. For
example: "Closes #1234" or "Fixes #1234" -->
Fixes#4413
## Change
<!-- Please describe the changes you made. -->
Changed the method
`dev.langchain4j.store.embedding.pgvector.PgVectorFilterMapper#formatValuesAsString`.
Instead of formatting always the value as '<value>', now, for String
values, we call to the method `formatValue` that is already used in the
other filters that does not use collections.
It is important that for values that are not String, we return a text
value ('<value>') instead of the `value.toString()` that returns the
`formatValue` method because otherwise, IN filters with integer (for
instance) will fail with a required CAST between text and integer. With
the changes of this PR, I just keep the current behaviour of the filter.
## General checklist
<!-- Please double-check the following points and mark them like this:
[X] -->
- [X] There are no breaking changes (API, behaviour)
- [X] I have added unit and/or integration tests for my change
- [X] The tests cover both positive and negative cases (existing tests
already cover negative cases)
- [X] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [ ] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
<!-- Before adding documentation and example(s) (below), please wait
until the PR is reviewed and approved. -->
- [ ] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)
## Checklist for adding new maven module
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have added my new module in the root `pom.xml` and
`langchain4j-bom/pom.xml`
## Checklist for adding new embedding store integration
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have added a `{NameOfIntegration}EmbeddingStoreIT` that extends
from either `EmbeddingStoreIT` or `EmbeddingStoreWithFilteringIT`
- [ ] I have added a `{NameOfIntegration}EmbeddingStoreRemovalIT` that
extends from `EmbeddingStoreWithRemovalIT`
## Checklist for changing existing embedding store integration
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have manually verified that the
`{NameOfIntegration}EmbeddingStore` works correctly with the data
persisted using the latest released version of LangChain4j
<!--
Thank you so much for your contribution!
Please fill in all the sections below.
Please open the PR as a draft initially. Once it is reviewed and
approved, we will ask you to add documentation and examples.
Please note that PRs with breaking changes or without tests will be
rejected.
Please note that PRs will be reviewed based on the priority of the
issues they address.
We ask for your patience. We are doing our best to review your PR as
quickly as possible.
Please refrain from pinging and asking when it will be reviewed. Thank
you for understanding!
-->
## Issue
<!-- Please specify the ID of the issue this PR is addressing. For
example: "Closes #1234" or "Fixes #1234" -->
Fixes#1636 (Probably fully as I removed Lombok from wherever it was
remaining).
## Change
<!-- Please describe the changes you made. -->
- Removed Lombok annotations and replaced with standard Java checks for
ex. `Objects.requireNonNull` or equivalent implementation.
- Removed dependency from pom.xml as well, as there is no Lombok
annotation remaining in code.
## General checklist
<!-- Please double-check the following points and mark them like this:
[X] -->
- [x] There are no breaking changes
- [ ] I have added unit and/or integration tests for my change
- [ ] The tests cover both positive and negative cases
- [x] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [x] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
<!-- Before adding documentation and example(s) (below), please wait
until the PR is reviewed and approved. -->
- [ ] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)
## Checklist for adding new maven module
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have added my new module in the root `pom.xml` and
`langchain4j-bom/pom.xml`
## Checklist for adding new embedding store integration
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have added a `{NameOfIntegration}EmbeddingStoreIT` that extends
from either `EmbeddingStoreIT` or `EmbeddingStoreWithFilteringIT`
- [ ] I have added a `{NameOfIntegration}EmbeddingStoreRemovalIT` that
extends from `EmbeddingStoreWithRemovalIT`
## Checklist for changing existing embedding store integration
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have manually verified that the
`{NameOfIntegration}EmbeddingStore` works correctly with the data
persisted using the latest released version of LangChain4j
* Fix SQL injection vulnerability with PGVector, MariaDB and Milvus
- Add a test case for each database
- Fix the SQL injection vulnerability
- This is the same issue for all 3 databases, only Milvus has a different escape character
- I ran the full test suite for all 3 databases to test there is no regression
- This should fix the security warning at https://github.com/langchain4j/langchain4j/security/advisories/GHSA-hvxq-w43p-3ccr
* updated tests
* Fix Milvus test
---------
Co-authored-by: Dmytro Liubarskyi <ljubarskij@gmail.com>
## Change
- Added `maven-flatten-plugin` to `langchain4j-parent` and
`langchain4j-bom`
- Removed integration-specific dependencies from `langchain4j-parent`'s
`dependencyManagement` section and moved them to the modules where these
dependencies are used
- Explicitly added missing implicit dependencies
- Removed redundant `<maven.compiler.release>` for cassandra, infinispan
and opensearch modules
- Removed redundant license declarations and outdated properties
## General checklist
- [ ] There are no breaking changes
- [ ] I have added unit and/or integration tests for my change
- [ ] The tests cover both positive and negative cases
- [x] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [x] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
- [ ] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)
## Issue
Cleanup repeating dependencies in pom.xml. Better test assertions and
apidocs/javadoc generation.
## Change
Refactor project structure and remove unused test dependencies.
- Repeating test dependencies like `tinylog`, `awaitility` and others
were removed from various modules and consolidated in the parent module.
This reduction in clutter helps to streamline the testing process.
- A separate `kotlin` profile was created to manage Kotlin-related
configurations and dependencies.
- Upgraded versions of dependencies like `ai-mocks` and `wiremock` were
implemented. Moved to wiremock-standalone (shaded jar) to avoid
potential version conflicts with runtime classes.
- The test changes in `ChatRequestExtensionsTest.kt` partially migrated
from AssertJ to Kotest assertions.
- Updated Dokka plugin configuration
## General checklist
<!-- Please double-check the following points and mark them like this:
[X] -->
- [x] There are no breaking changes
- [ ] I have added unit and/or integration tests for my change
- [ ] The tests cover both positive and negative cases
- [x] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [ ] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
<!-- Before adding documentation and example(s) (below), please wait
until the PR is reviewed and approved. -->
- [ ] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)
## Checklist for adding new maven module
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have added my new module in the root `pom.xml` and
`langchain4j-bom/pom.xml`
## Checklist for adding new embedding store integration
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have added a `{NameOfIntegration}EmbeddingStoreIT` that extends
from either `EmbeddingStoreIT` or `EmbeddingStoreWithFilteringIT`
- [ ] I have added a `{NameOfIntegration}EmbeddingStoreRemovalIT` that
extends from `EmbeddingStoreWithRemovalIT`
## Checklist for changing existing embedding store integration
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have manually verified that the
`{NameOfIntegration}EmbeddingStore` works correctly with the data
persisted using the latest released version of LangChain4j
## Change
Removed:
- `ChatMessage.text()`
- `Document.metadata(String)` -> Replaced by:
`Document.metadata().get{Type}(String)`
- `TextSegment.metadata(String)` -> Replaced by:
`TextSegment.metadata().get{Type}(String)`
- `Metadata.get(String)` -> Replaced by: `Metadata.get{Type}(String)`
- `Metadata.add(String, Object)` -> Replaced by: `Metadata.put(String,
{Type})`
- `Metadata.add(String, String)` -> Replaced by: `Metadata.put(String,
{Type})`
- `Metadata.asMap()` -> Replaced by: `Metadata.toMap()`
- `Metadata.from(String, Object)` -> Replaced by: `Metadata.from(String,
String)`
- `Metadata.metadata(String, Object)` -> Replaced by:
`Metadata.metadata(String, String)`
- `RetrievalAugmentor.augment(UserMessage, Metadata)` -> Replaced by:
`RetrievalAugmentor.augment(AugmentationRequest)`
- `ContentInjector.inject(List, UserMessage)` -> Replaced by:
`ContentInjector.inject(List, ChatMessage)`
- `Retriever` -> Replaced by: `ContentRetriever`
- `EmbeddingStoreRetriever` -> Replaced by:
`EmbeddingStoreContentRetriever`
- `Utils.isCollectionEmpty(Collection)` -> Replaced by:
`Utils.isNullOrEmpty(Collection)`
- `JsonObjectSchema.Builder.properties()` -> Replaced by:
`JsonObjectSchema.Builder.addProperties()`
## General checklist
- [ ] There are no breaking changes
- [ ] I have added unit and/or integration tests for my change
- [ ] The tests cover both positive and negative cases
- [ ] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [ ] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
- [x] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)
renovate[bot]