Commit Graph

80 Commits

Author SHA1 Message Date
github-actions[bot] a39f132b91 Update versions to 1.19.0-SNAPSHOT and 1.19.0-beta29-SNAPSHOT 2026-07-17 13:42:56 +00:00
github-actions[bot] 66ad5ee6d5 Release versions 1.18.0 and 1.18.0-beta28 2026-07-17 12:34:45 +00:00
Eunbin Son 8cce321f0d
fix: Skills: Declare shell tool timeout_seconds as integer and route bad values through typed exception (#5752)
## Issue
Closes #5751

## Change

Two complementary changes so the run_shell_command tool handles
timeout_seconds robustly — prevention at the schema level, containment
at the parse level.

1. Schema (prevention). ShellSkills registered timeout_seconds via
addStringProperty, even though the value is semantically an integer
(ShellCommandRunner.run(..., Integer timeoutSeconds, ...), described as
"The command timeout in seconds"). Advertising it as a string invites
the LLM to return non-integer text like "30 seconds", "1.5", or "". This
changes it to addIntegerProperty, so the schema communicates the
constraint to the model. RunShellCommandToolExecutor.resolveTimeout(...)
already had a first-class Integer branch, so no executor change is
needed for the happy path.

2. Parse guard (containment). JSON-schema adherence is not guaranteed
across providers — a model can still emit a string (or free text) for an
integer property. resolveTimeout(...) parsed the value with
Integer.valueOf(timeoutSeconds.toString()) and no guard, so a bad value
produced a raw NumberFormatException that propagated out of
executeWithContext, bypassing the tool's argument-error contract that
every
other argument error in this class honors. This wraps the parse and
routes NumberFormatException through the existing throwException(...)
path, mirroring parseArguments. A malformed timeout_seconds now yields
ToolExecutionException by default (message returned to the LLM), or
ToolArgumentsException when throwToolArgumentsExceptions(true).

The string-parse fallback in resolveTimeout is intentionally kept — it
remains the containment layer for providers that don't emit a strict
integer. The two layers together mean bad timeout values become rare
  at the source and fail gracefully when they still occur.

Signature, public Java API, and the normal path (null, Integer, valid
numeric string) are unchanged. The schema type change affects only the
tool specification advertised to the LLM, in an experimental module.

Tests: two negative tests added — non-numeric timeout_seconds throws
ToolExecutionException under the default config and
ToolArgumentsException under throwToolArgumentsExceptions(true). The
existing positive
test_resolveTimeout still passes and covers both Integer (1) and String
("1") inputs, exercising the retained string fallback.


## General checklist
- [X] There are no breaking changes (API, behaviour)
- [X] I have added unit and/or integration tests for my change
- [X] The tests cover both positive and negative cases
- [X] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [ ] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green <!-- N/A — change is isolated to
experimental/langchain4j-experimental-skills-shell; core/main untouched
-->
- [ ] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
<!-- N/A — bug fix, no doc change -->
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features) <!-- N/A -->
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)

---------

Co-authored-by: Dmytro Liubarskyi <ljubarskij@gmail.com>
2026-07-13 11:40:51 +02:00
Benamira05 cfd90e52f3
fix: Avoid StringIndexOutOfBoundsException when cleaning unclosed code fence in SqlDatabaseContentRetriever (#5737)
## Issue
Closes #5736

## Change

`SqlDatabaseContentRetriever.clean()` strips a markdown code fence from
the generated SQL before executing it. When the response has an opening
fence (```sql```/``````) but no closing fence, `substring(start,
lastIndexOf("```"))` gets `end < start` (`lastIndexOf` matches the
opening fence's own backticks) and throws
`StringIndexOutOfBoundsException`. `clean()` runs outside `retrieve()`'s
`try/catch`, so the exception escapes the retry / `emptyList()` fallback
the method is designed around.

This extracts the shared boundary logic into a `stripCodeFence` helper:
it slices to the closing fence only when one follows the opening tag,
otherwise returns the text after the opening tag. Behaviour for
correctly closed fences is unchanged.

Same underlying bug as #5731, fixed for `HibernateContentRetriever` in
#5732 (both classes independently implement the same fence-stripping
logic; `SqlDatabaseContentRetriever` was missed in that fix).

Added `SqlDatabaseContentRetrieverTest` (the module's first unit test —
`clean()` is `protected` and pure, so no live database is needed)
covering closed fences (regression), unclosed fences for both fence
types, and plain text.

## General checklist
- [X] There are no breaking changes (API, behaviour)
- [X] I have added unit and/or integration tests for my change
- [X] The tests cover both positive and negative cases
- [X] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green

---------

Co-authored-by: Benamira05 <145583236+Benamira05@users.noreply.github.com>
2026-07-09 09:42:59 +02:00
Eunbin Son c2aa57844e
fix: Avoid StringIndexOutOfBoundsException when cleaning unclosed code fence in HibernateContentRetriever (#5732)
## Issue
Closes #5731

## Change

`HibernateContentRetriever.clean()` strips a markdown code fence from
the generated response before executing the HQL. When the response has
an opening fence (```` ```hql ````/```` ```sql ````/```` ``` ````) but
no closing fence, `substring(start, lastIndexOf("```"))` gets `end <
start` (`lastIndexOf` matches the opening fence's own backticks) and
throws `StringIndexOutOfBoundsException`. `clean()` runs outside
`retrieve()`'s `try/catch`, so the exception escapes the retry /
`emptyList()` fallback the method is designed around.

This extracts the shared boundary logic into a `stripCodeFence` helper:
it slices to the closing fence only when one follows the opening tag,
otherwise returns the text after the opening tag. Behaviour for
correctly closed fences is unchanged.

Added `HibernateContentRetrieverTest` (the module's first unit test —
`clean()` is `protected` and pure, so no live database is needed)
covering closed fences (regression), unclosed fences for all three fence
types, and plain text.

## General checklist
- [X] There are no breaking changes (API, behaviour)
- [X] I have added unit and/or integration tests for my change
- [X] The tests cover both positive and negative cases
- [X] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [ ] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green <!-- change confined to the
experimental-hibernate module; core/main not exercised -->
- [ ] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
<!-- wait until reviewed/approved -->
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features) <!-- N/A — small bug fix -->
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable) <!-- N/A -->

<!-- "new maven module" and "embedding store integration" checklists
omitted — not applicable to this bug fix. -->

<!-- Testing done: JDK 17, `./mvnw -pl
experimental/langchain4j-experimental-hibernate test
-Dtest=HibernateContentRetrieverTest` → 7 tests green. Spotless verified
clean. IntegrationTests (HibernateContentRetrieverIT,
Testcontainers/Postgres) not run locally. -->

Co-authored-by: Dmytro Liubarskyi <ljubarskij@gmail.com>
2026-07-08 09:34:44 +02:00
github-actions[bot] 7d7c3349d7 Update versions to 1.18.0-SNAPSHOT and 1.18.0-beta28-SNAPSHOT 2026-06-26 14:49:40 +00:00
github-actions[bot] 207407aec9 Release versions 1.17.0 and 1.17.0-beta27 2026-06-26 13:13:06 +00:00
Eunbin Son 43071f8140
fix: Throw typed exception for null-valued required shell tool argument (#5456)
## Issue
Closes #5455

## Change
`RunShellCommandToolExecutor.getRequiredArgument` guarded a missing
argument key, not a present-but-null value.
An LLM emitting `{"command": null}` produced `{command=null}`, so
`containsKey` passed the guard and `arguments.get(name).toString()`
threw a raw `NullPointerException`. That call runs before the `try` in
`executeWithContext`, so it escaped un-wrapped, bypassing the typed
`ToolExecutionException`/`ToolArgumentsException` selected by
`throwToolArgumentsExceptions`.
The fix resolves the value once and null-checks it, treating a null
value like a missing key with the same message. Backward compatible:
missing-key behavior and message unchanged; no signature change.

```java
private String getRequiredArgument(String argumentName, Map<String, Object> arguments) {
    Object value = isNullOrEmpty(arguments) ? null : arguments.get(argumentName);
    if (value == null) {
        throwException("Missing required tool argument '%s'".formatted(argumentName));
    }
    return value.toString();
}
```

Added two negative-case unit tests to `RunShellCommandToolExecutorTest`:
`{"command": null}` yields `ToolExecutionException` (default) and
`ToolArgumentsException` (when `throwToolArgumentsExceptions(true)`).

## General checklist
- [X] There are no breaking changes (API, behaviour)
- [X] I have added unit and/or integration tests for my change
- [ ] The tests cover both positive and negative cases
<!-- Negative cases are the essential coverage for this fix (null value
-> typed exception). The pre-existing happy-path command execution is
already covered by existing tests; no new positive case was added. -->
- [X] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [ ] I have manually run all the unit and integration tests in the core
and main modules, and they are all green
<!-- N/A: this change is in
experimental/langchain4j-experimental-skills-shell, not core/main. -->
- [ ] I have added/updated the documentation
- [ ] I have added an example in the examples repo (only for "big"
features)
- [ ] I have added/updated Spring Boot starter(s) (if applicable)
<!-- Docs/examples to be added after review, per project policy. -->

<!-- N/A: no new maven module added. -->
<!-- N/A: no embedding store integration added or changed. -->
2026-06-17 09:44:28 +02:00
github-actions[bot] 01de41d641 Update versions to 1.17.0-SNAPSHOT and 1.17.0-beta27-SNAPSHOT 2026-06-06 06:46:38 +00:00
github-actions[bot] cd836845dd Release versions 1.16.0 and 1.16.0-beta26 2026-06-05 15:46:56 +00:00
github-actions[bot] 6185599e37 Update versions to 1.16.0-SNAPSHOT and 1.16.0-beta26-SNAPSHOT 2026-05-15 16:21:14 +00:00
github-actions[bot] d0e54aa006 Release versions 1.15.0 and 1.15.0-beta25 2026-05-15 15:55:12 +00:00
renovate[bot] d913eab834
fix(deps): update dependency com.github.jsqlparser:jsqlparser to v4.9 (#5236)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[com.github.jsqlparser:jsqlparser](https://redirect.github.com/JSQLParser/JSqlParser)
| `4.8` → `4.9` |
![age](https://developer.mend.io/api/mc/badges/age/maven/com.github.jsqlparser:jsqlparser/4.9?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/maven/com.github.jsqlparser:jsqlparser/4.8/4.9?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/2069) for more information.

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/langchain4j/langchain4j).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzMuNiIsInVwZGF0ZWRJblZlciI6IjQzLjE3My42IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-05-14 15:24:57 +02:00
dependabot[bot] 1f1a4ca1da
build(deps-dev): bump org.postgresql:postgresql from 42.7.7 to 42.7.11 in /experimental/langchain4j-experimental-sql (#5117)
Bumps [org.postgresql:postgresql](https://github.com/pgjdbc/pgjdbc) from
42.7.7 to 42.7.11.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pgjdbc/pgjdbc/releases">org.postgresql:postgresql's
releases</a>.</em></p>
<blockquote>
<h2>v42.7.11</h2>
<h2>Security</h2>
<ul>
<li>fix: Limit SCRAM PBKDF2 iterations accepted from the server.
pgjdbc was vulnerable to a client-side denial of service in
SCRAM-SHA-256 authentication, where a malicious or compromised
PostgreSQL server could specify an extremely large PBKDF2 iteration
count, causing the client to consume unbounded CPU and potentially
exhaust connection pools. The fix introduces a new scramMaxIterations
connection property (defaulting to 100,000) to cap iteration counts
before computation begins.
See the <a
href="https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq">Security
Advisory</a> for more detail.
The following <a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-42198">CVE-2026-42198</a>
has been issued.</li>
</ul>
<h2>Changes</h2>
<ul>
<li>fix: Add sources and javadocs to shaded published lib generation <a
href="https://github.com/sehrope"><code>@​sehrope</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4043">#4043</a>)</li>
<li>update Changelog and website for release of 42.7.11 <a
href="https://github.com/davecramer"><code>@​davecramer</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4042">#4042</a>)</li>
<li>Fix scram fix location in changelog and update published artifact
developer list <a
href="https://github.com/sehrope"><code>@​sehrope</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4041">#4041</a>)</li>
<li>Restrict test with scram_iterations to v16+ and release notes <a
href="https://github.com/sehrope"><code>@​sehrope</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4040">#4040</a>)</li>
<li>chore(deps): update ubuntu:24.04 docker digest to 84e77de <a
href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a>
(<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4017">#4017</a>)</li>
<li>test: add tests for QueryExecutor#getTransactionState <a
href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4006">#4006</a>)</li>
<li>chore(deps): update actions/create-github-app-token action to v2.2.2
<a
href="https://github.com/renovate-bot"><code>@​renovate-bot</code></a>
(<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3983">#3983</a>)</li>
<li>fix: fix flaky CopyBothResponseTest by using WAL flush LSN <a
href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3979">#3979</a>)</li>
<li>fix: fix flaky replication restart tests by waiting for
confirmed_flush_lsn <a
href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3975">#3975</a>)</li>
<li>test: fix flaky LogicalReplicationStatusTest by polling
pg_stat_replication <a
href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3974">#3974</a>)</li>
<li>chore: replace Appveyor with ikalnytskyi/action-setup-postgres <a
href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3966">#3966</a>)</li>
<li>test: move test table creation from <a
href="https://github.com/BeforeEach"><code>@​BeforeEach</code></a> to <a
href="https://github.com/BeforeAll"><code>@​BeforeAll</code></a> <a
href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3967">#3967</a>)</li>
<li>Return jsonb as PGObject fixes Issue <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3926">#3926</a>
<a href="https://github.com/davecramer"><code>@​davecramer</code></a>
(<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3956">#3956</a>)</li>
<li>Update docker scripts <a
href="https://github.com/davecramer"><code>@​davecramer</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3958">#3958</a>)</li>
<li>implement require_auth, this is pretty much how libpq does this. <a
href="https://github.com/davecramer"><code>@​davecramer</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3895">#3895</a>)</li>
<li>docs: add SCRAM authentication test setup section to TESTING.md <a
href="https://github.com/emmaeng700"><code>@​emmaeng700</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3945">#3945</a>)</li>
<li>Add RequireServerVersion annotation for tests <a
href="https://github.com/sehrope"><code>@​sehrope</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3939">#3939</a>)</li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li>fix: ensure extended protocol messages end with Sync message <a
href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3728">#3728</a>)</li>
<li>fix: enable cursor-based fetching in extended protocol when
transaction started via SQL command <a
href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3996">#3996</a>)</li>
<li>fix: retry with SSL on IOException when sslMode=ALLOW <a
href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3973">#3973</a>)</li>
<li>fix: allow fallback to non-SSL connection when sslMode=prefer and
sslResponseTimeout kicks in <a
href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3968">#3968</a>)</li>
<li>fix: catch SecurityException from setContextClassLoader on
ForkJoinPool workers <a
href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3962">#3962</a>)</li>
<li>fix: use compareTo for LogSequenceNumber comparison <a
href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3961">#3961</a>)</li>
<li>fix: release COPY lock on IOException to prevent connection hang (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3957">#3957</a>)
<a href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3960">#3960</a>)</li>
</ul>
<h2>🧰 Maintenance</h2>
<ul>
<li>style: replace <a
href="https://github.com/exception"><code>@​exception</code></a> with <a
href="https://github.com/throws"><code>@​throws</code></a> in getBoolean
javadoc <a href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4035">#4035</a>)</li>
<li>chore: use <code>@​vlsi/github-actions-random-matrix</code> npm
package <a href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4008">#4008</a>)</li>
<li>chore: use tag names for pinning github actions, pin
ikalnytskyi/action-setup-postgres <a
href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4007">#4007</a>)</li>
<li>chore: bump errorprone to 2.48.0 <a
href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4005">#4005</a>)</li>
<li>test: add <a
href="https://github.com/DisableLogger"><code>@​DisableLogger</code></a>
annotation to suppress expected log warnings in tests <a
href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3971">#3971</a>)</li>
<li>chore: suppress deprecations in test code to reduce build verbosity
<a href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3972">#3972</a>)</li>
<li>chore: replace log warning in ConnectionFactory.closeStream with
Throwable.addSuppressed <a
href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3970">#3970</a>)</li>
<li>chore: use greedy pairwise coverage for CI matrix generation <a
href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3965">#3965</a>)</li>
<li>chore: use full version tags in GitHub Actions comments <a
href="https://github.com/vlsi"><code>@​vlsi</code></a> (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3963">#3963</a>)</li>
</ul>
<h2>⬆️ Dependencies</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pgjdbc/pgjdbc/blob/master/CHANGELOG.md">org.postgresql:postgresql's
changelog</a>.</em></p>
<blockquote>
<h2>[42.7.11] (2026-04-28)</h2>
<h3>Security</h3>
<ul>
<li>fix: Limit SCRAM PBKDF2 iterations accepted from the server.
pgjdbc was vulnerable to a client-side denial of service in
SCRAM-SHA-256 authentication, where a malicious or compromised
PostgreSQL server could specify an extremely large PBKDF2 iteration
count, causing the client to consume unbounded CPU and potentially
exhaust connection pools. The fix introduces a new scramMaxIterations
connection property (defaulting to 100,000) to cap iteration counts
before computation begins.
See the <a
href="https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq">Security
Advisory</a> for more detail.
The following <a
href="https://nvd.nist.gov/vuln/detail/CVE-2026-42198">CVE-2026-42198</a>
has been issued.</li>
</ul>
<h3>Added</h3>
<ul>
<li>feat: implement require_auth connection property, aligning with
libpq behavior [PR <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3895">#3895</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3895">pgjdbc/pgjdbc#3895</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>chore: replace Appveyor CI with ikalnytskyi/action-setup-postgres
[PR <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3966">#3966</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3966">pgjdbc/pgjdbc#3966</a>)</li>
<li>chore: upgrade Gradle to v9 [PR <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3978">#3978</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3978">pgjdbc/pgjdbc#3978</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>fix: ensure extended protocol messages end with Sync message [PR <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3728">#3728</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3728">pgjdbc/pgjdbc#3728</a>)</li>
<li>fix: enable cursor-based fetching in extended protocol when
transaction started via SQL command [PR <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3996">#3996</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3996">pgjdbc/pgjdbc#3996</a>)</li>
<li>fix: retry with SSL on IOException when sslMode=ALLOW [PR <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3973">#3973</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3973">pgjdbc/pgjdbc#3973</a>)</li>
<li>fix: make sure the driver honours connectTimeout when retrying the
connection [PR <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3968">#3968</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3968">pgjdbc/pgjdbc#3968</a>)</li>
<li>fix: allow fallback to non-SSL connection when sslMode=prefer and
sslResponseTimeout kicks in [PR <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3968">#3968</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3968">pgjdbc/pgjdbc#3968</a>)</li>
<li>fix: catch SecurityException from setContextClassLoader on
ForkJoinPool workers [PR <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3962">#3962</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3962">pgjdbc/pgjdbc#3962</a>)</li>
<li>fix: use compareTo for LogSequenceNumber comparison to handle
unsigned values correctly [PR <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3961">#3961</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3961">pgjdbc/pgjdbc#3961</a>)</li>
<li>fix: release COPY lock on IOException to prevent connection hang [PR
<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3957">#3957</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3957">pgjdbc/pgjdbc#3957</a>)</li>
<li>fix: return jsonb as PGObject instead of String [PR <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3956">#3956</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3956">pgjdbc/pgjdbc#3956</a>)</li>
<li>fix: align SSL key file permission check with libpq [PR <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3952">#3952</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3952">pgjdbc/pgjdbc#3952</a>)</li>
<li>fix: guard connection closed flag with a reentrant lock to protect
against concurrent close [PR <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3905">#3905</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3905">pgjdbc/pgjdbc#3905</a>)</li>
</ul>
<h2>[42.7.10] (2026-02-11)</h2>
<h3>Changed</h3>
<ul>
<li>chore: Migrate to Shadow 9 <a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3931">PR
3931</a></li>
<li>style: fix empty line before javadoc for checkstyle compliance [PR
<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3925">#3925</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3925">pgjdbc/pgjdbc#3925</a>)</li>
<li>style: fix lambda argument indentation for checkstyle compliance [PR
<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3922">#3922</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3922">pgjdbc/pgjdbc#3922</a>)</li>
<li>test: add autosave=always|never|conservative and
cleanupSavepoints=true|false to the randomized CI jobs [PR <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3917">#3917</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3917">pgjdbc/pgjdbc#3917</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>fix: non-standard strings failing test for version 19 [PR <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3934">#3934</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3934">pgjdbc/pgjdbc#3934</a>)</li>
<li>fix: small issues in ConnectionFactoryImpl [PR <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3929">#3929</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3929">pgjdbc/pgjdbc#3929</a>)</li>
<li>fix: process pending responses before fastpath to avoid protocol
errors <a href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3913">PR
# 3913</a></li>
<li>doc: use.md, fix typos [PR <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3911">#3911</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3911">pgjdbc/pgjdbc#3911</a>)</li>
<li>doc: datasource.md, fix minor formatting issue [PR <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3912">#3912</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3912">pgjdbc/pgjdbc#3912</a>)</li>
<li>doc: add the new PGP signing key to the official documentation [PR
<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3912">#3912</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3813">pgjdbc/pgjdbc#3813</a>)</li>
</ul>
<h3>Reverted</h3>
<ul>
<li>Revert &quot;fix: make all Calendar instances proleptic Gregorian
(<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3837">#3837</a>)
(<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3887">#3887</a>)&quot;
[PR <a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/3932">#3932</a>](<a
href="https://redirect.github.com/pgjdbc/pgjdbc/pull/3932">pgjdbc/pgjdbc#3932</a>)</li>
</ul>
<h2>[42.7.9] (2026-01-14)</h2>
<h3>Added</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="78e261ff2a"><code>78e261f</code></a>
fix: Add sources and javadocs to shaded published lib generation</li>
<li><a
href="1e09fa0496"><code>1e09fa0</code></a>
update Changelog and website for release of 42.7.11 (<a
href="https://redirect.github.com/pgjdbc/pgjdbc/issues/4042">#4042</a>)</li>
<li><a
href="d479fa5b8c"><code>d479fa5</code></a>
Fix scram fix location in changelog and update published artifact
developer l...</li>
<li><a
href="b04fc46af6"><code>b04fc46</code></a>
docs: Add scram max iters fix to changelog</li>
<li><a
href="cf548225b4"><code>cf54822</code></a>
test: Disable scram test on older version without scram_iterations
GUC</li>
<li><a
href="7dbcc79b2b"><code>7dbcc79</code></a>
test: Add SCRAM max iteration tests</li>
<li><a
href="c9d41d1332"><code>c9d41d1</code></a>
fix: Limit SCRAM PBKDF2 iterations accepted from the server</li>
<li><a
href="a340cb2b0a"><code>a340cb2</code></a>
style: replace <a
href="https://github.com/exception"><code>@​exception</code></a> with <a
href="https://github.com/throws"><code>@​throws</code></a> in getBoolean
javadoc</li>
<li><a
href="77837f80c0"><code>77837f8</code></a>
fix(deps): update dependency
org.openrewrite.rewrite:org.openrewrite.rewrite....</li>
<li><a
href="23af03bc83"><code>23af03b</code></a>
chore(deps): update actions/checkout action to v6</li>
<li>Additional commits viewable in <a
href="https://github.com/pgjdbc/pgjdbc/compare/REL42.7.7...REL42.7.11">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=org.postgresql:postgresql&package-manager=maven&previous-version=42.7.7&new-version=42.7.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain4j/langchain4j/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-07 10:49:53 +02:00
renovate[bot] 5dd5eb2182
Update dependency org.postgresql:postgresql to v42.7.11 [SECURITY] (#5118)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [org.postgresql:postgresql](https://jdbc.postgresql.org)
([source](https://redirect.github.com/pgjdbc/pgjdbc)) | `42.7.7` →
`42.7.11` |
![age](https://developer.mend.io/api/mc/badges/age/maven/org.postgresql:postgresql/42.7.11?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/maven/org.postgresql:postgresql/42.7.7/42.7.11?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/2069) for more information.

---

### pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows
CPU exhaustion DoS
[CVE-2026-42198](https://nvd.nist.gov/vuln/detail/CVE-2026-42198) /
[GHSA-98qh-xjc8-98pq](https://redirect.github.com/advisories/GHSA-98qh-xjc8-98pq)

<details>
<summary>More information</summary>

#### Details
##### Summary
pgjdbc is vulnerable to a client-side denial of service during
SCRAM-SHA-256 authentication.

##### Impact
A malicious server can instruct the driver to perform SCRAM
authentication with a very large iteration count.
With a large enough value, the client spends an unbounded amount of CPU
time inside PBKDF2 before authentication can fail.
A single attempt ties up a CPU core. Repeated or concurrent attempts
exhaust client CPU and can wedge connection pools.

In affected versions, `loginTimeout` did not fully mitigate this
problem. When `loginTimeout` expired, the caller could stop waiting, but
the worker thread performing the connection attempt could continue
running and burning CPU inside the SCRAM PBKDF2 computation.

This issue affects availability. It does **not** provide authentication
bypass, privilege escalation, or direct password disclosure.

A user is vulnerable when **all** of the following are true:

1. The connection uses **SCRAM-SHA-256** authentication.
2. The client reaches a **malicious, compromised, or attacker-controlled
PostgreSQL endpoint**.
3. That endpoint sends a very large SCRAM PBKDF2 iteration count in the
`server-first-message`.

In practice, that can happen in these situations:

- the application lets end users or tenants supply their own database
connection details (as in many BI, reporting, analytics, ETL, and
low-code platforms), so a user can point the shared client host at a
server they control
- the application accepts connection strings, hostnames, or JDBC URLs
from user input, configuration uploaded by users, or other untrusted
sources
- the application is configured to connect to a PostgreSQL server that
is itself malicious or later becomes compromised
- the application connects through an untrusted proxy, relay, tunnel,
bastion, or connection-pooling service that can act as the PostgreSQL
server
- an attacker can redirect the client to a fake PostgreSQL endpoint by
manipulating DNS, service discovery, Kubernetes service resolution,
`/etc/hosts`, environment variables, or similar indirection
- an active network attacker on the path can impersonate the server
because the connection does not strongly verify server identity (for
example, `sslmode` lower than `verify-full`, or trusting a CA that signs
hosts outside the operator's control)

The issue is **more damaging** when the application uses connection
retries, many parallel connection attempts, or `loginTimeout` and
assumes the timeout fully stops the work.

##### Patches
The patch introduces a new connection property, `scramMaxIterations`,
with a default of 100K. The client now rejects SCRAM server messages
that advertise more PBKDF2 iterations than the configured cap before
starting the PBKDF2 computation begins.

##### Workarounds

Until a patched version of pgjdbc is deployed, the following measures
reduce exposure:

1. **Only connect to trusted PostgreSQL servers whose identity is
verified.**
Connect only to trusted PostgreSQL servers, and verify server identity
with TLS using sslmode=verify-full and a trusted CA.
TLS without certificate and hostname verification is not sufficient as
an active network attacker can still impersonate the server.

2. **Do not rely on `loginTimeout` as a complete mitigation on unpatched
versions.**
On affected versions, `loginTimeout` can stop the waiting caller while
the worker thread continues spending CPU.

3. **Avoid SCRAM on untrusted or interceptable connection paths.**  
For those paths, use an authentication method that does not let the
server choose a SCRAM PBKDF2 iteration count.

4. **Reduce blast radius operationally.**  
Limit parallel connection attempts, add retry backoff, isolate
connection establishment in a separate worker or process when possible,
and apply CPU or container limits where appropriate.

5. **On trusted servers you control, keep SCRAM iteration counts at
ordinary values.**
This does not defend against an attacker-controlled server, but it
avoids unnecessary client cost when talking to legitimate servers.

#### Severity
- CVSS Score: 7.5 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

#### References
-
[https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq](https://redirect.github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-42198](https://nvd.nist.gov/vuln/detail/CVE-2026-42198)
-
[https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11](https://redirect.github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11)
-
[https://github.com/advisories/GHSA-98qh-xjc8-98pq](https://redirect.github.com/advisories/GHSA-98qh-xjc8-98pq)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-98qh-xjc8-98pq)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>pgjdbc/pgjdbc (org.postgresql:postgresql)</summary>

###
[`v42.7.11`](https://redirect.github.com/pgjdbc/pgjdbc/blob/HEAD/CHANGELOG.md#42711-2026-04-28)

##### Security

- fix: Limit SCRAM PBKDF2 iterations accepted from the server.
pgjdbc was vulnerable to a client-side denial of service in
SCRAM-SHA-256 authentication, where a malicious or compromised
PostgreSQL server could specify an extremely large PBKDF2 iteration
count, causing the client to consume unbounded CPU and potentially
exhaust connection pools. The fix introduces a new scramMaxIterations
connection property (defaulting to 100,000) to cap iteration counts
before computation begins.
See the [Security
Advisory](https://redirect.github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq)
for more detail.
The following
[CVE-2026-42198](https://nvd.nist.gov/vuln/detail/CVE-2026-42198) has
been issued.

##### Added

- feat: implement require\_auth connection property, aligning with libpq
behavior [PR
#&#8203;3895](https://redirect.github.com/pgjdbc/pgjdbc/pull/3895)

##### Changed

- chore: replace Appveyor CI with ikalnytskyi/action-setup-postgres [PR
#&#8203;3966](https://redirect.github.com/pgjdbc/pgjdbc/pull/3966)
- chore: upgrade Gradle to v9 [PR
#&#8203;3978](https://redirect.github.com/pgjdbc/pgjdbc/pull/3978)

##### Fixed

- fix: ensure extended protocol messages end with Sync message [PR
#&#8203;3728](https://redirect.github.com/pgjdbc/pgjdbc/pull/3728)
- fix: enable cursor-based fetching in extended protocol when
transaction started via SQL command [PR
#&#8203;3996](https://redirect.github.com/pgjdbc/pgjdbc/pull/3996)
- fix: retry with SSL on IOException when sslMode=ALLOW [PR
#&#8203;3973](https://redirect.github.com/pgjdbc/pgjdbc/pull/3973)
- fix: make sure the driver honours connectTimeout when retrying the
connection [PR
#&#8203;3968](https://redirect.github.com/pgjdbc/pgjdbc/pull/3968)
- fix: allow fallback to non-SSL connection when sslMode=prefer and
sslResponseTimeout kicks in [PR
#&#8203;3968](https://redirect.github.com/pgjdbc/pgjdbc/pull/3968)
- fix: catch SecurityException from setContextClassLoader on
ForkJoinPool workers [PR
#&#8203;3962](https://redirect.github.com/pgjdbc/pgjdbc/pull/3962)
- fix: use compareTo for LogSequenceNumber comparison to handle unsigned
values correctly [PR
#&#8203;3961](https://redirect.github.com/pgjdbc/pgjdbc/pull/3961)
- fix: release COPY lock on IOException to prevent connection hang [PR
#&#8203;3957](https://redirect.github.com/pgjdbc/pgjdbc/pull/3957)
- fix: return jsonb as PGObject instead of String [PR
#&#8203;3956](https://redirect.github.com/pgjdbc/pgjdbc/pull/3956)
- fix: align SSL key file permission check with libpq [PR
#&#8203;3952](https://redirect.github.com/pgjdbc/pgjdbc/pull/3952)
- fix: guard connection closed flag with a reentrant lock to protect
against concurrent close [PR
#&#8203;3905](https://redirect.github.com/pgjdbc/pgjdbc/pull/3905)

###
[`v42.7.10`](https://redirect.github.com/pgjdbc/pgjdbc/blob/HEAD/CHANGELOG.md#42710-2026-02-11)

##### Changed

- chore: Migrate to Shadow 9 [PR
3931](https://redirect.github.com/pgjdbc/pgjdbc/pull/3931)
- style: fix empty line before javadoc for checkstyle compliance [PR
#&#8203;3925](https://redirect.github.com/pgjdbc/pgjdbc/pull/3925)
- style: fix lambda argument indentation for checkstyle compliance [PR
#&#8203;3922](https://redirect.github.com/pgjdbc/pgjdbc/pull/3922)
- test: add autosave=always|never|conservative and
cleanupSavepoints=true|false to the randomized CI jobs [PR
#&#8203;3917](https://redirect.github.com/pgjdbc/pgjdbc/pull/3917)

##### Fixed

- fix: non-standard strings failing test for version 19 [PR
#&#8203;3934](https://redirect.github.com/pgjdbc/pgjdbc/pull/3934)
- fix: small issues in ConnectionFactoryImpl [PR
#&#8203;3929](https://redirect.github.com/pgjdbc/pgjdbc/pull/3929)
- fix: process pending responses before fastpath to avoid protocol
errors [PR # 3913](https://redirect.github.com/pgjdbc/pgjdbc/pull/3913)
- doc: use.md, fix typos [PR
#&#8203;3911](https://redirect.github.com/pgjdbc/pgjdbc/pull/3911)
- doc: datasource.md, fix minor formatting issue [PR
#&#8203;3912](https://redirect.github.com/pgjdbc/pgjdbc/pull/3912)
- doc: add the new PGP signing key to the official documentation [PR
#&#8203;3912](https://redirect.github.com/pgjdbc/pgjdbc/pull/3813)

##### Reverted

- Revert "fix: make all Calendar instances proleptic Gregorian
([#&#8203;3837](https://redirect.github.com/pgjdbc/pgjdbc/issues/3837))
([#&#8203;3887](https://redirect.github.com/pgjdbc/pgjdbc/issues/3887))"
[PR #&#8203;3932](https://redirect.github.com/pgjdbc/pgjdbc/pull/3932)

###
[`v42.7.9`](https://redirect.github.com/pgjdbc/pgjdbc/blob/HEAD/CHANGELOG.md#4279-2026-01-14)

##### Added

- feat: query timeout property [PR
#&#8203;3705](https://redirect.github.com/pgjdbc/pgjdbc/pull/3705)
- feat: Add PEMKeyManager to handle PEM based certs and keys [PR
#&#8203;3700](https://redirect.github.com/pgjdbc/pgjdbc/pull/3700)

##### Changed

- perf: optimize PGInterval.getValue() by replacing String.format with
StringBuilder
- doc: update property quoteReturningIdentifiers default value [PR
#&#8203;3847](https://redirect.github.com/pgjdbc/pgjdbc/pull/3847)
- security: Use a static method forName to load all user supplied
classes. Use the Class.forName 3 parameter method and do not initilize
it unless it is a subclass of the expected class

##### Fixed

- fix: incorrect pg\_stat\_replication.reply\_time calculation [PR
#&#8203;3906](https://redirect.github.com/pgjdbc/pgjdbc/pull/3906)
- fix: close temporary lob descriptors that are used internally in
PreparedStatement#setBlob
- fix: PGXAConnection.prepare(Xid) should return XA\_RDONLY if the
connection is read only [PR
#&#8203;3897](https://redirect.github.com/pgjdbc/pgjdbc/pull/3897)
- fix: make all Calendar instances proleptic Gregorian [PR
#&#8203;3837](https://redirect.github.com/pgjdbc/pgjdbc/pull/3887)
- fix: Simplify concurrency guards on QueryExecutorBase#transaction and
QueryExecutorBase#standardConformingStrings [PR
#&#8203;3897](https://redirect.github.com/pgjdbc/pgjdbc/pull/3849)
- fix: avoid memory leaks in Java <= 21 caused by
Thread.inheritedAccessControlContext [PR
#&#8203;3886](https://redirect.github.com/pgjdbc/pgjdbc/pull/3886)
- fix: Issue
[#&#8203;3784](https://redirect.github.com/pgjdbc/pgjdbc/issues/3784)
pgjdbc can't decode numeric arrays containing special numbers like NaN
[PR #&#8203;3838](https://redirect.github.com/pgjdbc/pgjdbc/pull/3838)
- fix: use ssl\_is\_used() to check for ssl connection [PR
#&#8203;3867](https://redirect.github.com/pgjdbc/pgjdbc/pull/3867)
- fix: the classloader is nullable [PR
#&#8203;3907](https://redirect.github.com/pgjdbc/pgjdbc/pull/3907)

###
[`v42.7.8`](https://redirect.github.com/pgjdbc/pgjdbc/blob/HEAD/CHANGELOG.md#4278-2025-09-18)

##### Added

- feat: Add configurable boolean-to-numeric conversion for ResultSet
getters [PR
#&#8203;3796](https://redirect.github.com/pgjdbc/pgjdbc/pull/3796)

##### Changed

- perf: remove QUERY\_ONESHOT flag when calling getMetaData [PR
#&#8203;3783](https://redirect.github.com/pgjdbc/pgjdbc/pull/3783)
- perf: use `BufferedInputStream` with `FileInputStream` [PR
#&#8203;3750](https://redirect.github.com/pgjdbc/pgjdbc/pull/3750)
- perf: enable server-prepared statements for DatabaseMetaData

##### Fixed

- fix: avoid NullPointerException when cancelling a query if cancel key
is not known yet
- fix: Change "PST" timezone in TimestampTest to "Pacific Standard Time"
[PR #&#8203;3774](https://redirect.github.com/pgjdbc/pgjdbc/pull/3774)
- fix: traverse the current dimension to get the correct pos in
PgArray#calcRemainingDataLength [PR
#&#8203;3746](https://redirect.github.com/pgjdbc/pgjdbc/pull/3746)
- fix: make sure getImportedExportedKeys returns columns in consistent
order
- fix: Add "SELF\_REFERENCING\_COL\_NAME" field to getTables'
ResultSetMetaData to fix NullPointerException [PR
#&#8203;3660](https://redirect.github.com/pgjdbc/pgjdbc/pull/3660)
- fix: unable to open replication connection to servers < 12
- fix: avoid closing statement caused by driver's internal
ResultSet#close()
- fix: return empty metadata for empty catalog names as it was before
- fix: Incorrect class comparison in PGXmlFactoryFactory validation

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - ""
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/langchain4j/langchain4j).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-05-07 10:46:01 +02:00
github-actions[bot] 628ac34c01 Update versions to 1.15.0-SNAPSHOT and 1.15.0-beta25-SNAPSHOT 2026-04-30 18:43:12 +00:00
github-actions[bot] 4917afa297 Release versions 1.14.0 and 1.14.0-beta24 2026-04-30 18:10:30 +00:00
Dmytro Liubarskyi 02b5cc8d70 enabled response caching for Anthropic ITs 2026-04-10 15:41:27 +02:00
Dmytro Liubarskyi 97201e1c29 enabled response caching for Anthropic ITs 2026-04-10 10:45:50 +02:00
github-actions[bot] 4798a89d66 Update versions to 1.14.0-SNAPSHOT and 1.14.0-beta24-SNAPSHOT 2026-04-09 14:41:27 +00:00
github-actions[bot] 759cd9a236 Release versions 1.13.0 and 1.13.0-beta23 2026-04-09 13:07:30 +00:00
Marco Belladelli fe26fbdf6a
Hibernate Content Retriever - use more deterministic test for flaky query generation (#4753)
Hopefully addresses flaky CI test:
https://github.com/langchain4j/langchain4j/pull/4728#issuecomment-4096543587
2026-03-20 11:25:01 +01:00
Marco Belladelli 0b5e2c6b61
Add HibernateContentRetriever for data retrieval through HQL queries (#4728)
<!--
Thank you so much for your contribution!

Please fill in all the sections below.
Please open the PR as a draft initially. Once it is reviewed and
approved, we will ask you to add documentation and examples.
Please note that PRs with breaking changes or without tests will be
rejected.

Please note that PRs will be reviewed based on the priority of the
issues they address.
We ask for your patience. We are doing our best to review your PR as
quickly as possible.
Please refrain from pinging and asking when it will be reviewed. Thank
you for understanding!
-->

## Issue

## Change
<!-- Please describe the changes you made. -->
Add new `HibernateContentRetriever`, similar to the existing SQL-based
one, but taking advantage of [Hibernate
ORM](https://github.com/hibernate/hibernate-orm/) and its new
`hibernate-assistant` module to provide:
- context initialization prompt based on the runtime metamodel (mapped
entity classes and corresponding db structures)
- constrained access only to the mapped tables and columns
- HQL (Hibernate Query Language) support, much closer to natural
language with advanced functionality
- `SELECT`-only queries, guaranteed by Hibernate's query parsing
- query results serialization, with handling of complex data types, lazy
properties and circular associations

## General checklist
<!-- Please double-check the following points and mark them like this:
[X] -->
- [X] There are no breaking changes (API, behaviour)
- [X] I have added unit and/or integration tests for my change
- [X] The tests cover both positive and negative cases
- [X] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [X] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
<!-- Before adding documentation and example(s) (below), please wait
until the PR is reviewed and approved. -->
- [ ] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)

## Checklist for adding new maven module
<!-- Please double-check the following points and mark them like this:
[X] -->
- [X] I have added my new module in the root `pom.xml` and
`langchain4j-bom/pom.xml`
2026-03-19 18:30:21 +01:00
Dmytro Liubarskyi e10abf04d0
Update versions to 1.13.0-SNAPSHOT and 1.13.0-beta23-SNAPSHOT (#4710)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-03-13 11:39:50 +01:00
Dmytro Liubarskyi c92ea033e4
Update versions to 1.13.0-SNAPSHOT and 1.13.0-beta22-SNAPSHOT (#4666)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-03-05 17:18:22 +01:00
Dmytro Liubarskyi cc971b0d37
Agent Skills support (#4646)
## Issue
Closes https://github.com/langchain4j/langchain4j/issues/4396

## Change

Introduces support for [Agent Skills](https://agentskills.io/home)

# Skills

:::note
The Skills API is experimental. APIs and behavior may still change in
future releases.
:::

Skills is a mechanism for equipping an LLM with reusable, self-contained
behavioral instructions.
A skill bundles a name, a short description, and a body of instructions
(its _content_),
together with optional resources (e.g., references, assets, templates,
etc.).
The LLM loads a skill on demand, keeping the initial context small and
only pulling in
the detailed instructions when they are actually needed.

:::note
Skills are designed according to the [Agent Skills
specification](https://agentskills.io).
:::

## Creating Skills

### From the File System

Typically, each skill lives in its own directory containing a `SKILL.md`
file.
The file must start with a YAML front matter block that declares the
skill's `name` and `description`.
Everything below the front matter becomes the skill's content — the
instructions given to the LLM
when it activates the skill.

```
skills/
├── docx/
│   ├── SKILL.md
│   └── references/
│       └── tracked-changes.md   ← loaded as a resource
└── data-analysis/
    └── SKILL.md
```

Example `SKILL.md`:

```markdown
---
name: docx
description: Edit and review Word documents using tracked changes
---

When the user asks you to edit a Word document:

1. Always use tracked changes so edits can be reviewed.
   ...
```

Any file in the skill directory (other than `SKILL.md` itself and files
under a `scripts/`
subdirectory) is automatically loaded as a `SkillResource` that the LLM
can read on demand.

Use `FileSystemSkillLoader` from the `langchain4j-skills` module to load
skills from the file system:

```xml
<dependency>
    <groupId>dev.langchain4j</groupId>
    <artifactId>langchain4j-skills</artifactId>
    <version>1.12.0-beta20</version>
</dependency>
```

```java
// Load all skills found in immediate subdirectories:
List<FileSystemSkill> skills = FileSystemSkillLoader.loadSkills(Path.of("skills/"));

// Or load a single skill by its directory:
FileSystemSkill skill = FileSystemSkillLoader.loadSkill(Path.of("skills/docx"));
```

### Programmatically

Skills do not have to be file-system based.
You can create them from any source — a database, a remote API,
generated at runtime — using the builder API:

```java
Skill skill = Skill.builder()
        .name("incident-response")
        .description("Step-by-step runbook for diagnosing and resolving production incidents")
        .content("""
                When a production alert fires:
                1. Call `fetchRecentLogs(serviceName)` to retrieve the last 5 minutes of logs.
                2. Call `checkServiceHealth(serviceName)` to get current health metrics.
                3. Based on the findings, call `createIncidentTicket(summary, severity)`.
                4. If severity is CRITICAL, also call `pageOnCall(incidentId)`.
                """)
        .build();
```

You can also attach resources programmatically:

```java
SkillResource reference = SkillResource.builder()
        .relativePath("references/tone-guide.md")
        .content("Use warm, concise language. Avoid jargon.")
        .build();

Skill skill = Skill.builder()
        .name("customer-support")
        .description("Handles customer support inquiries")
        .content("Follow the tone guide in references/tone-guide.md ...")
        .resources(List.of(reference))
        .build();
```

## Modes

Skills can be integrated with an AI Service in two distinct modes,
depending on how much
control and trust you need.

### Tool Mode (Recommended)

**Class:** `Skills` (from the `langchain4j-skills` module)

This corresponds to the **Tool-based agents** integration approach
described in the
[Agent Skills specification](https://agentskills.io/integrate-skills).

In this mode, the LLM activates a skill to receive step-by-step
instructions, then carries
them out by calling the [tools](/tutorials/tools) you have explicitly
registered.
**The LLM has no access to the file system at inference time** — all
skill content and
resources are loaded into memory upfront (e.g. via
`FileSystemSkillLoader`), and the `activate_skill`
and `read_skill_resource` tools returns that preloaded content rather
than reading from disk.
Because only your pre-defined tools can be invoked, **there is no risk
of arbitrary code execution**.

#### Registered Tools

| Tool | When registered |

|-----------------------|-----------------------------------------------------------------------------------------------|
| `activate_skill` | Always. The LLM calls this to load a skill's full
instructions into the context. |
| `read_skill_resource` | When at least one skill has resources. The LLM
calls this to read individual reference files. |

#### How It Works

1. The system message lists the available skills (names and
descriptions) so the LLM can choose.
2. The user asks a question that requires a specific skill.
3. The LLM calls `activate_skill("my-skill")` to receive its
instructions.
4. The LLM follows those instructions to complete the task, optionally
reading resource files along the way.

#### Example Skill

Skills describe the _policy_ — the exact order of calls, required
arguments, error-handling steps,
and worked examples — while the actual execution stays in type-safe,
tested Java code:

```markdown
---
name: process-order
description: Processes a customer order end-to-end
---

To process an order:

1. Call `validateOrder(orderId)` to check the order is valid.
2. Call `reserveInventory(orderId)` to reserve the required stock.
3. Only if reservation succeeds, call `chargePayment(orderId)`.
4. Finally, call `sendConfirmationEmail(orderId)`.

If any step fails, call `rollbackOrder(orderId)` before reporting the error.
```

#### Wiring It Up

Pass the `ToolProvider` from `Skills` to your AI Service builder
alongside your regular tools.
Use `formatAvailableSkills()` to inject the skill catalogue into the
system message so
the LLM knows which skills it can activate:

```java
Skills skills = Skills.from(FileSystemSkillLoader.loadSkills(Path.of("skills/")));

MyAiService service = AiServices.builder(MyAiService.class)
        .chatModel(chatModel)
        .tools(new OrderTools()) // your tools
        .toolProvider(skills.toolProvider()) // or .toolProviders(mcpToolProvider, skills.toolProvider())
        .systemMessage("You have access to the following skills:\n" + skills.formatAvailableSkills()
                + "\nWhen the user's request relates to one of these skills, activate it first using the `activate_skill` tool before proceeding.")
        .build();
```

`formatAvailableSkills()` returns an XML-formatted block listing each
skill's name and description:

```xml

<available_skills>
    <skill>
        <name>process-order</name>
        <description>Processes a customer order end-to-end</description>
    </skill>
    <skill>
        <name>data-analysis</name>
        <description>Analyse tabular data and produce charts</description>
    </skill>
</available_skills>
```

#### Customisation

The name, description, and parameter metadata of each tool can be
overridden through the
corresponding config class on the builder:

```java
Skills skills = Skills.builder()
        .skills(mySkills)
        .activateSkillToolConfig(ActivateSkillToolConfig.builder()
                .name(...)                    // tool name (default: "activate_skill")
                .description(...)             // tool description
                .parameterName(...)           // parameter name (default: "skill_name")
                .parameterDescription(...)    // parameter description
                .throwToolArgumentsExceptions(...) // throw ToolArgumentsException instead of ToolExecutionException (default: false)
                .build())
        .readResourceToolConfig(ReadResourceToolConfig.builder()
                .name(...)                              // tool name (default: "read_skill_resource")
                .description(...)                       // tool description
                .skillNameParameterName(...)             // skill_name parameter name (default: "skill_name")
                .skillNameParameterDescription(...)      // skill_name parameter description
                .relativePathParameterName(...)          // relative_path parameter name (default: "relative_path")
                .relativePathParameterDescription(...)   // static description (takes precedence over provider)
                .relativePathParameterDescriptionProvider(...) // dynamic description based on available resources
                .throwToolArgumentsExceptions(...)       // throw ToolArgumentsException instead of ToolExecutionException (default: false)
                .build())
        .build();
```

### Shell Mode (Experimental)

**Class:** `ShellSkills` (from the
`langchain4j-experimental-skills-shell` module)

This corresponds to the **Filesystem-based agents** integration approach
described in the
[Agent Skills specification](https://agentskills.io/integrate-skills).

:::warning
**Shell execution is inherently unsafe.**
Commands run directly in the host process environment **without any
sandboxing, containerization,
or privilege restriction**. A misbehaving or prompt-injected LLM can
execute arbitrary commands
on the machine running your application.
Only use this in controlled environments where you fully trust the input
and accept
the associated risks.
:::

In this mode, the LLM is given a single `run_shell_command` tool and
reads skill instructions
directly from the file system using shell commands. There is no
`activate_skill` or
`read_skill_resource` tool — the LLM navigates skill files like a human
developer would.

#### Registered Tools

| Tool | When registered |

|---------------------|---------------------------------------------------------------------------------------------------|
| `run_shell_command` | Always. The LLM runs shell commands to read
`SKILL.md` files, resource files and execute scripts. |

#### How It Works

1. The system message lists available skills with their absolute
filesystem paths.
2. The user asks a question that requires a specific skill.
3. The LLM runs `cat /path/to/skills/docx/SKILL.md` to read the
instructions.
4. The LLM follows those instructions by running further shell commands.

#### Dependency

Shell execution lives in a separate experimental artifact — add it to
your build:

```xml

<dependency>
    <groupId>dev.langchain4j</groupId>
    <artifactId>langchain4j-experimental-skills-shell</artifactId>
    <version>1.12.0-beta20</version>
</dependency>
```

#### Wiring It Up

All skills must be filesystem-based (loaded via
`FileSystemSkillLoader`).
Use `ShellSkills` instead of `Skills`:

```java
ShellSkills skills = ShellSkills.from(FileSystemSkillLoader.loadSkills(Path.of("skills/")));

MyAiService service = AiServices.builder(MyAiService.class)
        .chatModel(chatModel)
        .toolProvider(skills.toolProvider()) // or .toolProviders(mcpToolProvider, skills.toolProvider())
        .systemMessage("You have access to the following skills:\n" + skills.formatAvailableSkills()
                + "\nWhen the user's request relates to one of these skills, read its SKILL.md before proceeding.")
        .build();
```

`formatAvailableSkills()` includes a `<location>` field so the LLM knows
exactly where to find each `SKILL.md`:

```xml

<available_skills>
    <skill>
        <name>docx</name>
        <description>Edit and review Word documents using tracked changes</description>
        <location>/path/to/skills/docx/SKILL.md</location>
    </skill>
    <skill>
        <name>data-analysis</name>
        <description>Analyse tabular data and produce charts</description>
        <location>/path/to/skills/data-analysis/SKILL.md</location>
    </skill>
</available_skills>
```

#### When to Use Shell Mode

This mode is best suited for **experimentation and prototyping**, or
when you want to use
third-party skills published by the community (e.g. from the
[agentskills.io](https://agentskills.io) ecosystem) without first
porting them to Java.
It lets you wire up a working workflow quickly, then migrate individual
actions
to tools as the solution matures.

#### Customisation

Use `RunShellCommandToolConfig` to tune the working directory, output
limits,
and parameter names:

```java
ShellSkills skills = ShellSkills.builder()
        .skills(mySkills)
        .runShellCommandToolConfig(RunShellCommandToolConfig.builder()
                .name(...)                              // tool name (default: "run_shell_command")
                .description(...)                       // tool description (default: includes OS name)
                .commandParameterName(...)              // command parameter name (default: "command")
                .commandParameterDescription(...)       // command parameter description
                .timeoutSecondsParameterName(...)       // timeout parameter name (default: "timeout_seconds")
                .timeoutSecondsParameterDescription(...) // timeout parameter description
                .workingDirectory(...)                  // working directory for commands (default: JVM's user.dir)
                .maxStdOutChars(...)                    // max stdout chars in result (default: 10_000)
                .maxStdErrChars(...)                    // max stderr chars in result (default: 10_000)
                .executorService(...)                   // ExecutorService for reading stdout/stderr streams
                .throwToolArgumentsExceptions(...)      // throw ToolArgumentsException instead of ToolExecutionException (default: false)
                .build())
        .build();
```

## General checklist
- [X] There are no breaking changes (API, behaviour)
- [X] I have added unit and/or integration tests for my change
- [X] The tests cover both positive and negative cases
- [X] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [X] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
- [X] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)


## Checklist for adding new maven module
- [X] I have added my new module in the root `pom.xml` and
`langchain4j-bom/pom.xml`
2026-03-04 14:48:26 +01:00
Dmytro Liubarskyi 336b2accce
Update versions to 1.12.0-SNAPSHOT and 1.12.0-beta20-SNAPSHOT (#4537)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-02-04 14:27:44 +01:00
Dmytro Liubarskyi 778be1b360
Update versions to 1.11.0-SNAPSHOT and 1.11.0-beta19-SNAPSHOT (#4285)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2025-12-24 15:38:05 +01:00
Dmytro Liubarskyi 25d3b3ec87 cleaned up test dependencies 2025-12-10 10:18:30 +01:00
Dmytro Liubarskyi ca6097e35d
Update versions to 1.10.0-SNAPSHOT and 1.10.0-beta18-SNAPSHOT (#4152)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2025-11-28 12:21:30 +01:00
Dmytro Liubarskyi bc0801a4df
Update versions to 1.10.0-SNAPSHOT and 1.10.0-beta17-SNAPSHOT (#4140)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2025-11-26 17:38:36 +01:00
Dmytro Liubarskyi 1f38b0df0b ITs: added missing @EnabledIfEnvironmentVariable annotations 2025-11-24 17:52:11 +01:00
Dmytro Liubarskyi a473835133
Update versions to 1.9.0-SNAPSHOT and 1.9.0-beta16-SNAPSHOT (#3951)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2025-10-24 16:51:33 +02:00
Dmytro Liubarskyi 34632c06a2 nex dev iteration 2025-10-02 17:17:35 +02:00
Dmytro Liubarskyi 7add1a1b4e next dev iteration 2025-09-26 16:54:16 +02:00
Dmytro Liubarskyi afee79638b next dev iteration 2025-09-16 15:23:21 +02:00
Dmytro Liubarskyi 7cc34306db next dev iteration 2025-08-29 08:35:38 +02:00
Dmytro Liubarskyi 5b1b2e76d2 next dev iteration 2025-08-07 16:24:25 +02:00
Dmytro Liubarskyi 0a01b49951 next dev iteration 2025-07-29 17:50:28 +02:00
Dmytro Liubarskyi 7b1fdaf5ce fixed failing IT 2025-07-17 10:08:26 +02:00
Dmytro Liubarskyi 39a504a83e Updated to the next development version 2025-06-18 19:36:52 +02:00
renovate[bot] 370ea70154
Update dependency org.postgresql:postgresql to v42.7.7 [SECURITY] (#3200)
This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [org.postgresql:postgresql](https://jdbc.postgresql.org)
([source](https://redirect.github.com/pgjdbc/pgjdbc)) | `42.7.4` ->
`42.7.7` |
[![age](https://developer.mend.io/api/mc/badges/age/maven/org.postgresql:postgresql/42.7.7?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/maven/org.postgresql:postgresql/42.7.7?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/maven/org.postgresql:postgresql/42.7.4/42.7.7?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/maven/org.postgresql:postgresql/42.7.4/42.7.7?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

### GitHub Vulnerability Alerts

####
[CVE-2025-49146](https://redirect.github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hq9p-pm7w-8p54)

### Impact
When the PostgreSQL JDBC driver is configured with channel binding set
to `required` (default value is `prefer`), the driver would incorrectly
allow connections to proceed with authentication methods that do not
support channel binding (such as password, MD5, GSS, or SSPI
authentication). This could allow a man-in-the-middle attacker to
intercept connections that users believed were protected by channel
binding requirements.

### Patches
TBD

### Workarounds

Configure `sslMode=verify-full` to prevent MITM attacks.

### References

*
https://www.postgresql.org/docs/current/sasl-authentication.html#SASL-SCRAM-SHA-256
* https://datatracker.ietf.org/doc/html/rfc7677
* https://datatracker.ietf.org/doc/html/rfc5802

---

### Release Notes

<details>
<summary>pgjdbc/pgjdbc (org.postgresql:postgresql)</summary>

###
[`v42.7.7`](https://redirect.github.com/pgjdbc/pgjdbc/blob/HEAD/CHANGELOG.md#4277-2025-06-10)

##### Security

- security: **Client Allows Fallback to Insecure Authentication Despite
channelBinding=require configuration.**
Fix `channel binding required` handling to reject non-SASL
authentication
Previously, when channel binding was set to "require", the driver would
silently ignore this
requirement for non-SASL authentication methods. This could lead to a
false sense of security
when channel binding was explicitly requested but not actually enforced.
The fix ensures that when
channel binding is set to "require", the driver will reject connections
that use
non-SASL authentication methods or when SASL authentication has not
completed properly.
See the [Security
Advisory](https://redirect.github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hq9p-pm7w-8p54)
for more detail. Reported by [George
MacKerron](https://redirect.github.com/jawj)
The following
[CVE-2025-49146](https://nvd.nist.gov/vuln/detail/CVE-2025-49146) has
been issued

##### Added

- test: Added ChannelBindingRequiredTest to verify proper behavior of
channel binding settings

###
[`v42.7.6`](https://redirect.github.com/pgjdbc/pgjdbc/blob/HEAD/CHANGELOG.md#4276)

##### Features

- fix: Enhanced DatabaseMetadata.getIndexInfo() method, added index
comment as REMARKS property [PR
#&#8203;3513](https://redirect.github.com/pgjdbc/pgjdbc/pull/3513)

##### Performance Improvements

- performance: Improve ResultSetMetadata.fetchFieldMetaData by using IN
row values instead of UNION ALL for improved query performance (later
reverted) [PR
#&#8203;3510](https://redirect.github.com/pgjdbc/pgjdbc/pull/3510)
- feat:Use a single simple query for all startup parameters, so
groupStartupParameters is no longer needed [PR
#&#8203;3613](https://redirect.github.com/pgjdbc/pgjdbc/pull/3613)
-

###
[`v42.7.5`](https://redirect.github.com/pgjdbc/pgjdbc/blob/HEAD/CHANGELOG.md#4275-2025-01-14-080000--0400)

##### Added

- ci: Test with Java 23 [PR
#&#8203;3381](https://redirect.github.com/pgjdbc/pgjdbc/pull/3381)

##### Fixed

- regression: revert change in
[`fc60537`](https://redirect.github.com/pgjdbc/pgjdbc/commit/fc60537)
[PR #&#8203;3476](https://redirect.github.com/pgjdbc/pgjdbc/pull/3476)
- fix: PgDatabaseMetaData implementation of catalog as param and return
value [PR
#&#8203;3390](https://redirect.github.com/pgjdbc/pgjdbc/pull/3390)
- fix: Support default GSS credentials in the Java Postgres client [PR
#&#8203;3451](https://redirect.github.com/pgjdbc/pgjdbc/pull/3451)
- fix: return only the transactions accessible by the current_user in
XAResource.recover [PR
#&#8203;3450](https://redirect.github.com/pgjdbc/pgjdbc/pull/3450)
- feat: don't force send extra_float_digits for PostgreSQL >= 12 fix
[Issue
#&#8203;3432](https://redirect.github.com/pgjdbc/pgjdbc/issues/3432) [PR
#&#8203;3446](https://redirect.github.com/pgjdbc/pgjdbc/pull/3446)
- fix: exclude "include columns" from the list of primary keys [PR
#&#8203;3434](https://redirect.github.com/pgjdbc/pgjdbc/pull/3434)
- perf: Enhance the meta query performance by specifying the oid. [PR
#&#8203;3427](https://redirect.github.com/pgjdbc/pgjdbc/pull/3427)
- feat: support getObject(int, byte\[].class) for bytea [PR
#&#8203;3274](https://redirect.github.com/pgjdbc/pgjdbc/pull/3274)
- docs: document infinity and some minor edits [PR
#&#8203;3407](https://redirect.github.com/pgjdbc/pgjdbc/pull/3407)
- fix: Added way to check for major server version, fixed check for RULE
[PR #&#8203;3402](https://redirect.github.com/pgjdbc/pgjdbc/pull/3402)
- docs: fixed remaining paragraphs [PR
#&#8203;3398](https://redirect.github.com/pgjdbc/pgjdbc/pull/3398)
- docs: fixed paragraphs in javadoc comments [PR
#&#8203;3397](https://redirect.github.com/pgjdbc/pgjdbc/pull/3397)
- fix: Reuse buffers and reduce allocations in GSSInputStream addresses
[Issue
#&#8203;3251](https://redirect.github.com/pgjdbc/pgjdbc/issues/3251) [PR
#&#8203;3255](https://redirect.github.com/pgjdbc/pgjdbc/pull/3255)
- chore: Update Gradle to 8.10.2 [PR
#&#8203;3388](https://redirect.github.com/pgjdbc/pgjdbc/pull/3388)
- fix: getSchemas() [PR
#&#8203;3386](https://redirect.github.com/pgjdbc/pgjdbc/pull/3386)
- fix: Update rpm postgresql-jdbc.spec.tpl with scram-client [PR
#&#8203;3324](https://redirect.github.com/pgjdbc/pgjdbc/pull/3324)
- fix: Clearing thisRow and rowBuffer on close() of ResultSet [Issue
#&#8203;3383](https://redirect.github.com/pgjdbc/pgjdbc/issues/3383) [PR
#&#8203;3384](https://redirect.github.com/pgjdbc/pgjdbc/pull/3384)
- fix: Package was renamed to maven-bundle-plugin [PR
#&#8203;3382](https://redirect.github.com/pgjdbc/pgjdbc/pull/3382)
- fix: As of version 18 the RULE privilege has been removed [PR
#&#8203;3378](https://redirect.github.com/pgjdbc/pgjdbc/pull/3378)
- fix: use buffered inputstream to create GSSInputStream [PR
#&#8203;3373](https://redirect.github.com/pgjdbc/pgjdbc/pull/3373)
- test: get rid of 8.4, 9.0 pg versions and use >= jdk version 17 [PR
#&#8203;3372](https://redirect.github.com/pgjdbc/pgjdbc/pull/3372)
- Changed docker-compose version and renamed script file in instructions
to match the real file name [PR
#&#8203;3363](https://redirect.github.com/pgjdbc/pgjdbc/pull/3363)
- test:Do not assume "test" database in
DatabaseMetaDataTransactionIsolationTest [PR
#&#8203;3364](https://redirect.github.com/pgjdbc/pgjdbc/pull/3364)
- try to categorize dependencies [PR
#&#8203;3362](https://redirect.github.com/pgjdbc/pgjdbc/pull/3362)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/langchain4j/langchain4j).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC40OC41IiwidXBkYXRlZEluVmVyIjoiNDAuNTAuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-06-16 11:42:46 +02:00
Dmytro Liubarskyi 3fb258b009 - Updated to the next dev version
- Release to Maven central portal instead of s01
2025-05-20 15:55:12 +02:00
Dmytro Liubarskyi e19aceaf96
Fix #2918 (#2919)
## Issue
Fixes https://github.com/langchain4j/langchain4j/issues/2918

## Change
- Changed `maxRetry` parameter semantics from "max attempts" to "max
retries".
- Changed default value of the `maxRetry` parameter from 3 to 2, but it
does not change the default behaviour. When `maxRetries` parameter is
not specified explicitly, it will attempt to execute up to 3 times (as
it was before).

## Breaking Change

If you do **_not_** specify `maxRetries` parameter explicitly, there is
no breaking change and you do not need to do any changes to your code.

If you specify `maxRetries` parameter explicitly, you will need to
reduce it by 1, example:
```java
// before
OpenAiChatModel.builder()
            .apiKey(System.getenv("OPENAI_API_KEY"))
            .modelName(GPT_4_O_MINI)
            .maxRetries(1)
            .build();

// after
OpenAiChatModel.builder()
            .apiKey(System.getenv("OPENAI_API_KEY"))
            .modelName(GPT_4_O_MINI)
            .maxRetries(0)
            .build();
```

## General checklist
- [ ] There are no breaking changes
- [ ] I have added unit and/or integration tests for my change
- [ ] The tests cover both positive and negative cases
- [X] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [X] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
- [X] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)
2025-04-24 16:48:38 +02:00
Dmytro Liubarskyi 13ad410fe8
Rename ChatLanguageModel into ChatModel and StreamingChatLanguageModel into StreamingChatModel (#2866)
## Change
Renamed `ChatLanguageModel` into `ChatModel` and
`StreamingChatLanguageModel` into `StreamingChatModel`.
All `chatLanguageModel(...)` methods were renamed into `chatModel(...)`,
all `streamingChatLanguageModel(...)` methods were renamed into
`streamingChatModel(...)`.

`DisabledChatLanguageModel` was renamed into `DisabledChatModel`,
`DisabledStreamingChatLanguageModel` into `DisabledStreamingChatModel`.

### OpenRewrite recipe:
```yml
---
type: specs.openrewrite.org/v1beta/recipe
name: dev.langchain4j.RenameChatModels
recipeList:
  - org.openrewrite.java.ChangeType:
      oldFullyQualifiedTypeName: dev.langchain4j.model.chat.ChatLanguageModel
      newFullyQualifiedTypeName: dev.langchain4j.model.chat.ChatModel
  - org.openrewrite.java.ChangeType:
      oldFullyQualifiedTypeName: dev.langchain4j.model.chat.StreamingChatLanguageModel
      newFullyQualifiedTypeName: dev.langchain4j.model.chat.StreamingChatModel
  - org.openrewrite.java.ChangeType:
      oldFullyQualifiedTypeName: dev.langchain4j.model.chat.DisabledChatLanguageModel
      newFullyQualifiedTypeName: dev.langchain4j.model.chat.DisabledChatModel
  - org.openrewrite.java.ChangeType:
      oldFullyQualifiedTypeName: dev.langchain4j.model.chat.DisabledStreamingChatLanguageModel
      newFullyQualifiedTypeName: dev.langchain4j.model.chat.DisabledStreamingChatModel
  - org.openrewrite.java.ChangeMethodName:
      methodPattern: dev.langchain4j..* chatLanguageModel(..)
      newMethodName: chatModel
  - org.openrewrite.java.ChangeMethodName:
      methodPattern: dev.langchain4j..* streamingChatLanguageModel(..)
      newMethodName: streamingChatModel
```


## General checklist
- [ ] There are no breaking changes
- [ ] I have added unit and/or integration tests for my change
- [ ] The tests cover both positive and negative cases
- [x] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [x] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
- [x] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [x] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)
2025-04-15 10:38:49 +02:00
Dmytro Liubarskyi 3ab9218386 Updated version to 1.0.0-beta4-SNAPSHOT 2025-04-14 11:19:37 +02:00
Dmytro Liubarskyi 6ed38d4362
Release 1.0.0-beta3 (#2853) 2025-04-11 15:32:05 +02:00
Mario Fusco a6927bae6e
Delombok (#2751)
Delombok (almost) all.
2025-03-21 17:22:13 +01:00
Dmytro Liubarskyi a2f8e7f40a Update version to 1.0.0-beta3-SNAPSHOT 2025-03-14 10:00:39 +01:00
Dmytro Liubarskyi 2fcfa357ef
Release 1.0.0-beta2 (#2689) 2025-03-13 15:03:17 +01:00