Commit Graph

92 Commits

Author SHA1 Message Date
github-actions[bot] a39f132b91 Update versions to 1.19.0-SNAPSHOT and 1.19.0-beta29-SNAPSHOT 2026-07-17 13:42:56 +00:00
github-actions[bot] 66ad5ee6d5 Release versions 1.18.0 and 1.18.0-beta28 2026-07-17 12:34:45 +00:00
github-actions[bot] 7d7c3349d7 Update versions to 1.18.0-SNAPSHOT and 1.18.0-beta28-SNAPSHOT 2026-06-26 14:49:40 +00:00
github-actions[bot] 207407aec9 Release versions 1.17.0 and 1.17.0-beta27 2026-06-26 13:13:06 +00:00
github-actions[bot] 01de41d641 Update versions to 1.17.0-SNAPSHOT and 1.17.0-beta27-SNAPSHOT 2026-06-06 06:46:38 +00:00
github-actions[bot] cd836845dd Release versions 1.16.0 and 1.16.0-beta26 2026-06-05 15:46:56 +00:00
github-actions[bot] 6185599e37 Update versions to 1.16.0-SNAPSHOT and 1.16.0-beta26-SNAPSHOT 2026-05-15 16:21:14 +00:00
github-actions[bot] d0e54aa006 Release versions 1.15.0 and 1.15.0-beta25 2026-05-15 15:55:12 +00:00
renovate[bot] 5dd5eb2182
Update dependency org.postgresql:postgresql to v42.7.11 [SECURITY] (#5118)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [org.postgresql:postgresql](https://jdbc.postgresql.org)
([source](https://redirect.github.com/pgjdbc/pgjdbc)) | `42.7.7` →
`42.7.11` |
![age](https://developer.mend.io/api/mc/badges/age/maven/org.postgresql:postgresql/42.7.11?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/maven/org.postgresql:postgresql/42.7.7/42.7.11?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/2069) for more information.

---

### pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows
CPU exhaustion DoS
[CVE-2026-42198](https://nvd.nist.gov/vuln/detail/CVE-2026-42198) /
[GHSA-98qh-xjc8-98pq](https://redirect.github.com/advisories/GHSA-98qh-xjc8-98pq)

<details>
<summary>More information</summary>

#### Details
##### Summary
pgjdbc is vulnerable to a client-side denial of service during
SCRAM-SHA-256 authentication.

##### Impact
A malicious server can instruct the driver to perform SCRAM
authentication with a very large iteration count.
With a large enough value, the client spends an unbounded amount of CPU
time inside PBKDF2 before authentication can fail.
A single attempt ties up a CPU core. Repeated or concurrent attempts
exhaust client CPU and can wedge connection pools.

In affected versions, `loginTimeout` did not fully mitigate this
problem. When `loginTimeout` expired, the caller could stop waiting, but
the worker thread performing the connection attempt could continue
running and burning CPU inside the SCRAM PBKDF2 computation.

This issue affects availability. It does **not** provide authentication
bypass, privilege escalation, or direct password disclosure.

A user is vulnerable when **all** of the following are true:

1. The connection uses **SCRAM-SHA-256** authentication.
2. The client reaches a **malicious, compromised, or attacker-controlled
PostgreSQL endpoint**.
3. That endpoint sends a very large SCRAM PBKDF2 iteration count in the
`server-first-message`.

In practice, that can happen in these situations:

- the application lets end users or tenants supply their own database
connection details (as in many BI, reporting, analytics, ETL, and
low-code platforms), so a user can point the shared client host at a
server they control
- the application accepts connection strings, hostnames, or JDBC URLs
from user input, configuration uploaded by users, or other untrusted
sources
- the application is configured to connect to a PostgreSQL server that
is itself malicious or later becomes compromised
- the application connects through an untrusted proxy, relay, tunnel,
bastion, or connection-pooling service that can act as the PostgreSQL
server
- an attacker can redirect the client to a fake PostgreSQL endpoint by
manipulating DNS, service discovery, Kubernetes service resolution,
`/etc/hosts`, environment variables, or similar indirection
- an active network attacker on the path can impersonate the server
because the connection does not strongly verify server identity (for
example, `sslmode` lower than `verify-full`, or trusting a CA that signs
hosts outside the operator's control)

The issue is **more damaging** when the application uses connection
retries, many parallel connection attempts, or `loginTimeout` and
assumes the timeout fully stops the work.

##### Patches
The patch introduces a new connection property, `scramMaxIterations`,
with a default of 100K. The client now rejects SCRAM server messages
that advertise more PBKDF2 iterations than the configured cap before
starting the PBKDF2 computation begins.

##### Workarounds

Until a patched version of pgjdbc is deployed, the following measures
reduce exposure:

1. **Only connect to trusted PostgreSQL servers whose identity is
verified.**
Connect only to trusted PostgreSQL servers, and verify server identity
with TLS using sslmode=verify-full and a trusted CA.
TLS without certificate and hostname verification is not sufficient as
an active network attacker can still impersonate the server.

2. **Do not rely on `loginTimeout` as a complete mitigation on unpatched
versions.**
On affected versions, `loginTimeout` can stop the waiting caller while
the worker thread continues spending CPU.

3. **Avoid SCRAM on untrusted or interceptable connection paths.**  
For those paths, use an authentication method that does not let the
server choose a SCRAM PBKDF2 iteration count.

4. **Reduce blast radius operationally.**  
Limit parallel connection attempts, add retry backoff, isolate
connection establishment in a separate worker or process when possible,
and apply CPU or container limits where appropriate.

5. **On trusted servers you control, keep SCRAM iteration counts at
ordinary values.**
This does not defend against an attacker-controlled server, but it
avoids unnecessary client cost when talking to legitimate servers.

#### Severity
- CVSS Score: 7.5 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

#### References
-
[https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq](https://redirect.github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-42198](https://nvd.nist.gov/vuln/detail/CVE-2026-42198)
-
[https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11](https://redirect.github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11)
-
[https://github.com/advisories/GHSA-98qh-xjc8-98pq](https://redirect.github.com/advisories/GHSA-98qh-xjc8-98pq)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-98qh-xjc8-98pq)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>pgjdbc/pgjdbc (org.postgresql:postgresql)</summary>

###
[`v42.7.11`](https://redirect.github.com/pgjdbc/pgjdbc/blob/HEAD/CHANGELOG.md#42711-2026-04-28)

##### Security

- fix: Limit SCRAM PBKDF2 iterations accepted from the server.
pgjdbc was vulnerable to a client-side denial of service in
SCRAM-SHA-256 authentication, where a malicious or compromised
PostgreSQL server could specify an extremely large PBKDF2 iteration
count, causing the client to consume unbounded CPU and potentially
exhaust connection pools. The fix introduces a new scramMaxIterations
connection property (defaulting to 100,000) to cap iteration counts
before computation begins.
See the [Security
Advisory](https://redirect.github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq)
for more detail.
The following
[CVE-2026-42198](https://nvd.nist.gov/vuln/detail/CVE-2026-42198) has
been issued.

##### Added

- feat: implement require\_auth connection property, aligning with libpq
behavior [PR
#&#8203;3895](https://redirect.github.com/pgjdbc/pgjdbc/pull/3895)

##### Changed

- chore: replace Appveyor CI with ikalnytskyi/action-setup-postgres [PR
#&#8203;3966](https://redirect.github.com/pgjdbc/pgjdbc/pull/3966)
- chore: upgrade Gradle to v9 [PR
#&#8203;3978](https://redirect.github.com/pgjdbc/pgjdbc/pull/3978)

##### Fixed

- fix: ensure extended protocol messages end with Sync message [PR
#&#8203;3728](https://redirect.github.com/pgjdbc/pgjdbc/pull/3728)
- fix: enable cursor-based fetching in extended protocol when
transaction started via SQL command [PR
#&#8203;3996](https://redirect.github.com/pgjdbc/pgjdbc/pull/3996)
- fix: retry with SSL on IOException when sslMode=ALLOW [PR
#&#8203;3973](https://redirect.github.com/pgjdbc/pgjdbc/pull/3973)
- fix: make sure the driver honours connectTimeout when retrying the
connection [PR
#&#8203;3968](https://redirect.github.com/pgjdbc/pgjdbc/pull/3968)
- fix: allow fallback to non-SSL connection when sslMode=prefer and
sslResponseTimeout kicks in [PR
#&#8203;3968](https://redirect.github.com/pgjdbc/pgjdbc/pull/3968)
- fix: catch SecurityException from setContextClassLoader on
ForkJoinPool workers [PR
#&#8203;3962](https://redirect.github.com/pgjdbc/pgjdbc/pull/3962)
- fix: use compareTo for LogSequenceNumber comparison to handle unsigned
values correctly [PR
#&#8203;3961](https://redirect.github.com/pgjdbc/pgjdbc/pull/3961)
- fix: release COPY lock on IOException to prevent connection hang [PR
#&#8203;3957](https://redirect.github.com/pgjdbc/pgjdbc/pull/3957)
- fix: return jsonb as PGObject instead of String [PR
#&#8203;3956](https://redirect.github.com/pgjdbc/pgjdbc/pull/3956)
- fix: align SSL key file permission check with libpq [PR
#&#8203;3952](https://redirect.github.com/pgjdbc/pgjdbc/pull/3952)
- fix: guard connection closed flag with a reentrant lock to protect
against concurrent close [PR
#&#8203;3905](https://redirect.github.com/pgjdbc/pgjdbc/pull/3905)

###
[`v42.7.10`](https://redirect.github.com/pgjdbc/pgjdbc/blob/HEAD/CHANGELOG.md#42710-2026-02-11)

##### Changed

- chore: Migrate to Shadow 9 [PR
3931](https://redirect.github.com/pgjdbc/pgjdbc/pull/3931)
- style: fix empty line before javadoc for checkstyle compliance [PR
#&#8203;3925](https://redirect.github.com/pgjdbc/pgjdbc/pull/3925)
- style: fix lambda argument indentation for checkstyle compliance [PR
#&#8203;3922](https://redirect.github.com/pgjdbc/pgjdbc/pull/3922)
- test: add autosave=always|never|conservative and
cleanupSavepoints=true|false to the randomized CI jobs [PR
#&#8203;3917](https://redirect.github.com/pgjdbc/pgjdbc/pull/3917)

##### Fixed

- fix: non-standard strings failing test for version 19 [PR
#&#8203;3934](https://redirect.github.com/pgjdbc/pgjdbc/pull/3934)
- fix: small issues in ConnectionFactoryImpl [PR
#&#8203;3929](https://redirect.github.com/pgjdbc/pgjdbc/pull/3929)
- fix: process pending responses before fastpath to avoid protocol
errors [PR # 3913](https://redirect.github.com/pgjdbc/pgjdbc/pull/3913)
- doc: use.md, fix typos [PR
#&#8203;3911](https://redirect.github.com/pgjdbc/pgjdbc/pull/3911)
- doc: datasource.md, fix minor formatting issue [PR
#&#8203;3912](https://redirect.github.com/pgjdbc/pgjdbc/pull/3912)
- doc: add the new PGP signing key to the official documentation [PR
#&#8203;3912](https://redirect.github.com/pgjdbc/pgjdbc/pull/3813)

##### Reverted

- Revert "fix: make all Calendar instances proleptic Gregorian
([#&#8203;3837](https://redirect.github.com/pgjdbc/pgjdbc/issues/3837))
([#&#8203;3887](https://redirect.github.com/pgjdbc/pgjdbc/issues/3887))"
[PR #&#8203;3932](https://redirect.github.com/pgjdbc/pgjdbc/pull/3932)

###
[`v42.7.9`](https://redirect.github.com/pgjdbc/pgjdbc/blob/HEAD/CHANGELOG.md#4279-2026-01-14)

##### Added

- feat: query timeout property [PR
#&#8203;3705](https://redirect.github.com/pgjdbc/pgjdbc/pull/3705)
- feat: Add PEMKeyManager to handle PEM based certs and keys [PR
#&#8203;3700](https://redirect.github.com/pgjdbc/pgjdbc/pull/3700)

##### Changed

- perf: optimize PGInterval.getValue() by replacing String.format with
StringBuilder
- doc: update property quoteReturningIdentifiers default value [PR
#&#8203;3847](https://redirect.github.com/pgjdbc/pgjdbc/pull/3847)
- security: Use a static method forName to load all user supplied
classes. Use the Class.forName 3 parameter method and do not initilize
it unless it is a subclass of the expected class

##### Fixed

- fix: incorrect pg\_stat\_replication.reply\_time calculation [PR
#&#8203;3906](https://redirect.github.com/pgjdbc/pgjdbc/pull/3906)
- fix: close temporary lob descriptors that are used internally in
PreparedStatement#setBlob
- fix: PGXAConnection.prepare(Xid) should return XA\_RDONLY if the
connection is read only [PR
#&#8203;3897](https://redirect.github.com/pgjdbc/pgjdbc/pull/3897)
- fix: make all Calendar instances proleptic Gregorian [PR
#&#8203;3837](https://redirect.github.com/pgjdbc/pgjdbc/pull/3887)
- fix: Simplify concurrency guards on QueryExecutorBase#transaction and
QueryExecutorBase#standardConformingStrings [PR
#&#8203;3897](https://redirect.github.com/pgjdbc/pgjdbc/pull/3849)
- fix: avoid memory leaks in Java <= 21 caused by
Thread.inheritedAccessControlContext [PR
#&#8203;3886](https://redirect.github.com/pgjdbc/pgjdbc/pull/3886)
- fix: Issue
[#&#8203;3784](https://redirect.github.com/pgjdbc/pgjdbc/issues/3784)
pgjdbc can't decode numeric arrays containing special numbers like NaN
[PR #&#8203;3838](https://redirect.github.com/pgjdbc/pgjdbc/pull/3838)
- fix: use ssl\_is\_used() to check for ssl connection [PR
#&#8203;3867](https://redirect.github.com/pgjdbc/pgjdbc/pull/3867)
- fix: the classloader is nullable [PR
#&#8203;3907](https://redirect.github.com/pgjdbc/pgjdbc/pull/3907)

###
[`v42.7.8`](https://redirect.github.com/pgjdbc/pgjdbc/blob/HEAD/CHANGELOG.md#4278-2025-09-18)

##### Added

- feat: Add configurable boolean-to-numeric conversion for ResultSet
getters [PR
#&#8203;3796](https://redirect.github.com/pgjdbc/pgjdbc/pull/3796)

##### Changed

- perf: remove QUERY\_ONESHOT flag when calling getMetaData [PR
#&#8203;3783](https://redirect.github.com/pgjdbc/pgjdbc/pull/3783)
- perf: use `BufferedInputStream` with `FileInputStream` [PR
#&#8203;3750](https://redirect.github.com/pgjdbc/pgjdbc/pull/3750)
- perf: enable server-prepared statements for DatabaseMetaData

##### Fixed

- fix: avoid NullPointerException when cancelling a query if cancel key
is not known yet
- fix: Change "PST" timezone in TimestampTest to "Pacific Standard Time"
[PR #&#8203;3774](https://redirect.github.com/pgjdbc/pgjdbc/pull/3774)
- fix: traverse the current dimension to get the correct pos in
PgArray#calcRemainingDataLength [PR
#&#8203;3746](https://redirect.github.com/pgjdbc/pgjdbc/pull/3746)
- fix: make sure getImportedExportedKeys returns columns in consistent
order
- fix: Add "SELF\_REFERENCING\_COL\_NAME" field to getTables'
ResultSetMetaData to fix NullPointerException [PR
#&#8203;3660](https://redirect.github.com/pgjdbc/pgjdbc/pull/3660)
- fix: unable to open replication connection to servers < 12
- fix: avoid closing statement caused by driver's internal
ResultSet#close()
- fix: return empty metadata for empty catalog names as it was before
- fix: Incorrect class comparison in PGXmlFactoryFactory validation

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - ""
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/langchain4j/langchain4j).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-05-07 10:46:01 +02:00
github-actions[bot] 628ac34c01 Update versions to 1.15.0-SNAPSHOT and 1.15.0-beta25-SNAPSHOT 2026-04-30 18:43:12 +00:00
github-actions[bot] 4917afa297 Release versions 1.14.0 and 1.14.0-beta24 2026-04-30 18:10:30 +00:00
github-actions[bot] 4798a89d66 Update versions to 1.14.0-SNAPSHOT and 1.14.0-beta24-SNAPSHOT 2026-04-09 14:41:27 +00:00
github-actions[bot] 759cd9a236 Release versions 1.13.0 and 1.13.0-beta23 2026-04-09 13:07:30 +00:00
Dmytro Liubarskyi e10abf04d0
Update versions to 1.13.0-SNAPSHOT and 1.13.0-beta23-SNAPSHOT (#4710)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-03-13 11:39:50 +01:00
Dmytro Liubarskyi c92ea033e4
Update versions to 1.13.0-SNAPSHOT and 1.13.0-beta22-SNAPSHOT (#4666)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-03-05 17:18:22 +01:00
Dmytro Liubarskyi 336b2accce
Update versions to 1.12.0-SNAPSHOT and 1.12.0-beta20-SNAPSHOT (#4537)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-02-04 14:27:44 +01:00
Dmytro Liubarskyi 778be1b360
Update versions to 1.11.0-SNAPSHOT and 1.11.0-beta19-SNAPSHOT (#4285)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2025-12-24 15:38:05 +01:00
Dmytro Liubarskyi 25d3b3ec87 cleaned up test dependencies 2025-12-10 10:18:30 +01:00
Dmytro Liubarskyi ca6097e35d
Update versions to 1.10.0-SNAPSHOT and 1.10.0-beta18-SNAPSHOT (#4152)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2025-11-28 12:21:30 +01:00
Dmytro Liubarskyi bc0801a4df
Update versions to 1.10.0-SNAPSHOT and 1.10.0-beta17-SNAPSHOT (#4140)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2025-11-26 17:38:36 +01:00
Dmytro Liubarskyi a473835133
Update versions to 1.9.0-SNAPSHOT and 1.9.0-beta16-SNAPSHOT (#3951)
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2025-10-24 16:51:33 +02:00
Dmytro Liubarskyi 34632c06a2 nex dev iteration 2025-10-02 17:17:35 +02:00
Dmytro Liubarskyi 7add1a1b4e next dev iteration 2025-09-26 16:54:16 +02:00
Dmytro Liubarskyi afee79638b next dev iteration 2025-09-16 15:23:21 +02:00
Kushal Dixit 7cc5691b1a
Remove Lombok annotations from remaining code and replace with standard java checks and implementations. (#3685)
<!--
Thank you so much for your contribution!

Please fill in all the sections below.
Please open the PR as a draft initially. Once it is reviewed and
approved, we will ask you to add documentation and examples.
Please note that PRs with breaking changes or without tests will be
rejected.

Please note that PRs will be reviewed based on the priority of the
issues they address.
We ask for your patience. We are doing our best to review your PR as
quickly as possible.
Please refrain from pinging and asking when it will be reviewed. Thank
you for understanding!
-->

## Issue
<!-- Please specify the ID of the issue this PR is addressing. For
example: "Closes #1234" or "Fixes #1234" -->
Fixes #1636 (Probably fully as I removed Lombok from wherever it was
remaining).

## Change
<!-- Please describe the changes you made. -->
- Removed Lombok annotations and replaced with standard Java checks for
ex. `Objects.requireNonNull` or equivalent implementation.
- Removed dependency from pom.xml as well, as there is no Lombok
annotation remaining in code.

## General checklist
<!-- Please double-check the following points and mark them like this:
[X] -->
- [x] There are no breaking changes
- [ ] I have added unit and/or integration tests for my change
- [ ] The tests cover both positive and negative cases
- [x] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [x] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
<!-- Before adding documentation and example(s) (below), please wait
until the PR is reviewed and approved. -->
- [ ] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)


## Checklist for adding new maven module
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have added my new module in the root `pom.xml` and
`langchain4j-bom/pom.xml`


## Checklist for adding new embedding store integration
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have added a `{NameOfIntegration}EmbeddingStoreIT` that extends
from either `EmbeddingStoreIT` or `EmbeddingStoreWithFilteringIT`
- [ ] I have added a `{NameOfIntegration}EmbeddingStoreRemovalIT` that
extends from `EmbeddingStoreWithRemovalIT`

## Checklist for changing existing embedding store integration
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have manually verified that the
`{NameOfIntegration}EmbeddingStore` works correctly with the data
persisted using the latest released version of LangChain4j
2025-09-16 09:40:54 +02:00
Dmytro Liubarskyi 7cc34306db next dev iteration 2025-08-29 08:35:38 +02:00
Dmytro Liubarskyi 5b1b2e76d2 next dev iteration 2025-08-07 16:24:25 +02:00
Dmytro Liubarskyi 0a01b49951 next dev iteration 2025-07-29 17:50:28 +02:00
Dmytro Liubarskyi 39a504a83e Updated to the next development version 2025-06-18 19:36:52 +02:00
renovate[bot] 7745aa0e14
Update dependency org.postgresql:postgresql to v42.7.7 [SECURITY] (#3201)
This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [org.postgresql:postgresql](https://jdbc.postgresql.org)
([source](https://redirect.github.com/pgjdbc/pgjdbc)) | `42.7.4` ->
`42.7.7` |
[![age](https://developer.mend.io/api/mc/badges/age/maven/org.postgresql:postgresql/42.7.7?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/maven/org.postgresql:postgresql/42.7.7?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/maven/org.postgresql:postgresql/42.7.4/42.7.7?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/maven/org.postgresql:postgresql/42.7.4/42.7.7?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

### GitHub Vulnerability Alerts

####
[CVE-2025-49146](https://redirect.github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hq9p-pm7w-8p54)

### Impact
When the PostgreSQL JDBC driver is configured with channel binding set
to `required` (default value is `prefer`), the driver would incorrectly
allow connections to proceed with authentication methods that do not
support channel binding (such as password, MD5, GSS, or SSPI
authentication). This could allow a man-in-the-middle attacker to
intercept connections that users believed were protected by channel
binding requirements.

### Patches
TBD

### Workarounds

Configure `sslMode=verify-full` to prevent MITM attacks.

### References

*
https://www.postgresql.org/docs/current/sasl-authentication.html#SASL-SCRAM-SHA-256
* https://datatracker.ietf.org/doc/html/rfc7677
* https://datatracker.ietf.org/doc/html/rfc5802

---

### Release Notes

<details>
<summary>pgjdbc/pgjdbc (org.postgresql:postgresql)</summary>

###
[`v42.7.7`](https://redirect.github.com/pgjdbc/pgjdbc/blob/HEAD/CHANGELOG.md#4277-2025-06-10)

##### Security

- security: **Client Allows Fallback to Insecure Authentication Despite
channelBinding=require configuration.**
Fix `channel binding required` handling to reject non-SASL
authentication
Previously, when channel binding was set to "require", the driver would
silently ignore this
requirement for non-SASL authentication methods. This could lead to a
false sense of security
when channel binding was explicitly requested but not actually enforced.
The fix ensures that when
channel binding is set to "require", the driver will reject connections
that use
non-SASL authentication methods or when SASL authentication has not
completed properly.
See the [Security
Advisory](https://redirect.github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hq9p-pm7w-8p54)
for more detail. Reported by [George
MacKerron](https://redirect.github.com/jawj)
The following
[CVE-2025-49146](https://nvd.nist.gov/vuln/detail/CVE-2025-49146) has
been issued

##### Added

- test: Added ChannelBindingRequiredTest to verify proper behavior of
channel binding settings

###
[`v42.7.6`](https://redirect.github.com/pgjdbc/pgjdbc/blob/HEAD/CHANGELOG.md#4276)

##### Features

- fix: Enhanced DatabaseMetadata.getIndexInfo() method, added index
comment as REMARKS property [PR
#&#8203;3513](https://redirect.github.com/pgjdbc/pgjdbc/pull/3513)

##### Performance Improvements

- performance: Improve ResultSetMetadata.fetchFieldMetaData by using IN
row values instead of UNION ALL for improved query performance (later
reverted) [PR
#&#8203;3510](https://redirect.github.com/pgjdbc/pgjdbc/pull/3510)
- feat:Use a single simple query for all startup parameters, so
groupStartupParameters is no longer needed [PR
#&#8203;3613](https://redirect.github.com/pgjdbc/pgjdbc/pull/3613)
-

###
[`v42.7.5`](https://redirect.github.com/pgjdbc/pgjdbc/blob/HEAD/CHANGELOG.md#4275-2025-01-14-080000--0400)

##### Added

- ci: Test with Java 23 [PR
#&#8203;3381](https://redirect.github.com/pgjdbc/pgjdbc/pull/3381)

##### Fixed

- regression: revert change in
[`fc60537`](https://redirect.github.com/pgjdbc/pgjdbc/commit/fc60537)
[PR #&#8203;3476](https://redirect.github.com/pgjdbc/pgjdbc/pull/3476)
- fix: PgDatabaseMetaData implementation of catalog as param and return
value [PR
#&#8203;3390](https://redirect.github.com/pgjdbc/pgjdbc/pull/3390)
- fix: Support default GSS credentials in the Java Postgres client [PR
#&#8203;3451](https://redirect.github.com/pgjdbc/pgjdbc/pull/3451)
- fix: return only the transactions accessible by the current_user in
XAResource.recover [PR
#&#8203;3450](https://redirect.github.com/pgjdbc/pgjdbc/pull/3450)
- feat: don't force send extra_float_digits for PostgreSQL >= 12 fix
[Issue
#&#8203;3432](https://redirect.github.com/pgjdbc/pgjdbc/issues/3432) [PR
#&#8203;3446](https://redirect.github.com/pgjdbc/pgjdbc/pull/3446)
- fix: exclude "include columns" from the list of primary keys [PR
#&#8203;3434](https://redirect.github.com/pgjdbc/pgjdbc/pull/3434)
- perf: Enhance the meta query performance by specifying the oid. [PR
#&#8203;3427](https://redirect.github.com/pgjdbc/pgjdbc/pull/3427)
- feat: support getObject(int, byte\[].class) for bytea [PR
#&#8203;3274](https://redirect.github.com/pgjdbc/pgjdbc/pull/3274)
- docs: document infinity and some minor edits [PR
#&#8203;3407](https://redirect.github.com/pgjdbc/pgjdbc/pull/3407)
- fix: Added way to check for major server version, fixed check for RULE
[PR #&#8203;3402](https://redirect.github.com/pgjdbc/pgjdbc/pull/3402)
- docs: fixed remaining paragraphs [PR
#&#8203;3398](https://redirect.github.com/pgjdbc/pgjdbc/pull/3398)
- docs: fixed paragraphs in javadoc comments [PR
#&#8203;3397](https://redirect.github.com/pgjdbc/pgjdbc/pull/3397)
- fix: Reuse buffers and reduce allocations in GSSInputStream addresses
[Issue
#&#8203;3251](https://redirect.github.com/pgjdbc/pgjdbc/issues/3251) [PR
#&#8203;3255](https://redirect.github.com/pgjdbc/pgjdbc/pull/3255)
- chore: Update Gradle to 8.10.2 [PR
#&#8203;3388](https://redirect.github.com/pgjdbc/pgjdbc/pull/3388)
- fix: getSchemas() [PR
#&#8203;3386](https://redirect.github.com/pgjdbc/pgjdbc/pull/3386)
- fix: Update rpm postgresql-jdbc.spec.tpl with scram-client [PR
#&#8203;3324](https://redirect.github.com/pgjdbc/pgjdbc/pull/3324)
- fix: Clearing thisRow and rowBuffer on close() of ResultSet [Issue
#&#8203;3383](https://redirect.github.com/pgjdbc/pgjdbc/issues/3383) [PR
#&#8203;3384](https://redirect.github.com/pgjdbc/pgjdbc/pull/3384)
- fix: Package was renamed to maven-bundle-plugin [PR
#&#8203;3382](https://redirect.github.com/pgjdbc/pgjdbc/pull/3382)
- fix: As of version 18 the RULE privilege has been removed [PR
#&#8203;3378](https://redirect.github.com/pgjdbc/pgjdbc/pull/3378)
- fix: use buffered inputstream to create GSSInputStream [PR
#&#8203;3373](https://redirect.github.com/pgjdbc/pgjdbc/pull/3373)
- test: get rid of 8.4, 9.0 pg versions and use >= jdk version 17 [PR
#&#8203;3372](https://redirect.github.com/pgjdbc/pgjdbc/pull/3372)
- Changed docker-compose version and renamed script file in instructions
to match the real file name [PR
#&#8203;3363](https://redirect.github.com/pgjdbc/pgjdbc/pull/3363)
- test:Do not assume "test" database in
DatabaseMetaDataTransactionIsolationTest [PR
#&#8203;3364](https://redirect.github.com/pgjdbc/pgjdbc/pull/3364)
- try to categorize dependencies [PR
#&#8203;3362](https://redirect.github.com/pgjdbc/pgjdbc/pull/3362)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/langchain4j/langchain4j).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC40OC41IiwidXBkYXRlZEluVmVyIjoiNDAuNDguNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Titov, Alexey <a@koeg.de>
Co-authored-by: Alexey Titov <33568148+Heezer@users.noreply.github.com>
2025-06-17 14:09:44 +02:00
Dmytro Liubarskyi 3fb258b009 - Updated to the next dev version
- Release to Maven central portal instead of s01
2025-05-20 15:55:12 +02:00
Dmytro Liubarskyi a5313ffc0e
Added maven-flatten-plugin, cleaned up POMs (#2964)
## Change
- Added `maven-flatten-plugin` to `langchain4j-parent` and
`langchain4j-bom`
- Removed integration-specific dependencies from `langchain4j-parent`'s
`dependencyManagement` section and moved them to the modules where these
dependencies are used
- Explicitly added missing implicit dependencies
- Removed redundant `<maven.compiler.release>` for cassandra, infinispan
and opensearch modules
- Removed redundant license declarations and outdated properties


## General checklist
- [ ] There are no breaking changes
- [ ] I have added unit and/or integration tests for my change
- [ ] The tests cover both positive and negative cases
- [x] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [x] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
- [ ] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)
2025-05-08 17:55:51 +02:00
Dmytro Liubarskyi 3ab9218386 Updated version to 1.0.0-beta4-SNAPSHOT 2025-04-14 11:19:37 +02:00
Dmytro Liubarskyi 6ed38d4362
Release 1.0.0-beta3 (#2853) 2025-04-11 15:32:05 +02:00
Konstantin Pavlov f87fe40406
refactor-poms (#2723)
## Issue

Cleanup repeating dependencies in pom.xml. Better test assertions and
apidocs/javadoc generation.

## Change

Refactor project structure and remove unused test dependencies. 

- Repeating test dependencies like `tinylog`, `awaitility` and others
were removed from various modules and consolidated in the parent module.
This reduction in clutter helps to streamline the testing process.
- A separate `kotlin` profile was created to manage Kotlin-related
configurations and dependencies.

- Upgraded versions of dependencies like `ai-mocks` and `wiremock` were
implemented. Moved to wiremock-standalone (shaded jar) to avoid
potential version conflicts with runtime classes.

- The test changes in `ChatRequestExtensionsTest.kt` partially migrated
from AssertJ to Kotest assertions.

- Updated Dokka plugin configuration

## General checklist
<!-- Please double-check the following points and mark them like this:
[X] -->
- [x] There are no breaking changes
- [ ] I have added unit and/or integration tests for my change
- [ ] The tests cover both positive and negative cases
- [x] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [ ] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
<!-- Before adding documentation and example(s) (below), please wait
until the PR is reviewed and approved. -->
- [ ] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)


## Checklist for adding new maven module
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have added my new module in the root `pom.xml` and
`langchain4j-bom/pom.xml`


## Checklist for adding new embedding store integration
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have added a `{NameOfIntegration}EmbeddingStoreIT` that extends
from either `EmbeddingStoreIT` or `EmbeddingStoreWithFilteringIT`
- [ ] I have added a `{NameOfIntegration}EmbeddingStoreRemovalIT` that
extends from `EmbeddingStoreWithRemovalIT`

## Checklist for changing existing embedding store integration
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have manually verified that the
`{NameOfIntegration}EmbeddingStore` works correctly with the data
persisted using the latest released version of LangChain4j
2025-03-21 09:07:33 +01:00
Dmytro Liubarskyi a2f8e7f40a Update version to 1.0.0-beta3-SNAPSHOT 2025-03-14 10:00:39 +01:00
Dmytro Liubarskyi 2fcfa357ef
Release 1.0.0-beta2 (#2689) 2025-03-13 15:03:17 +01:00
Konstantin Pavlov ed08a0b8d9
Streamline dependencies (#2639)
## Issue

Streamline maven dependencies

Should fix [this
issue](https://github.com/langchain4j/langchain4j/actions/runs/13666001227/job/38207360909?pr=2640#step:5:16630)
```
2025/03/05 00:52:59,050 3922 [INFO  ] [main] netty.implementation.NettyUtility - {"az.sdk.message":"The following Netty versions were found on the classpath and have a mismatch with the versions used by azure-core-http-netty. If your application runs without issue this message can be ignored, otherwise please align the Netty versions used in your application. For more information, see https://aka.ms/azsdk/java/dependency/troubleshoot.","azure-netty-version":"4.1.118.Final","azure-netty-native-version":"2.0.70.Final","classpath-netty-version-io.netty:netty-common":"4.1.115.Final","classpath-netty-version-io.netty:netty-handler":"4.1.110.Final","classpath-netty-version-io.netty:netty-handler-proxy":"4.1.110.Final","classpath-netty-version-io.netty:netty-buffer":"4.1.110.Final","classpath-netty-version-io.netty:netty-codec":"4.1.110.Final","classpath-netty-version-io.netty:netty-codec-http":"4.1.110.Final","classpath-netty-version-io.netty:netty-codec-http2":"4.1.110.Final","classpath-netty-version-io.netty:netty-transport-native-unix-common":"4.1.110.Final","classpath-netty-version-io.netty:netty-transport-native-epoll":"4.1.110.Final","classpath-netty-version-io.netty:netty-transport-native-kqueue":"4.1.118.Final","classpath-native-netty-version-io.netty:netty-tcnative-boringssl-static":"2.0.70.Final"}
```

## Change

This pull request includes the following changes to improve project
dependency management:

- Removed unnecessary and redundant Netty dependencies and exclusions.
- Updated and reorganized dependency versions for consistency, including
new BOM imports for Azure SDK, Netty, and Reactor.
- Eliminated AWS SDK v1 dependencies, transitioning to
`software.amazon.awssdk` BOM for better compatibility and reduced
clutter.
- Removed redundant test dependencies like `assertj-core` and `mockito`
across modules, referring to the parent POM.
- Adjusted `kotlinx-coroutines-test` to use JVM-specific artifact and
standardized dependency version variables.
- Refined POM XML formatting for consistency and clarity (`mvn
spotless:apply`)


## General checklist
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] There are no breaking changes
- [ ] I have added unit and/or integration tests for my change
- [ ] The tests cover both positive and negative cases
- [ ] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [ ] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
<!-- Before adding documentation and example(s) (below), please wait
until the PR is reviewed and approved. -->
- [ ] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)


## Checklist for adding new maven module
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have added my new module in the root `pom.xml` and
`langchain4j-bom/pom.xml`


## Checklist for adding new embedding store integration
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have added a `{NameOfIntegration}EmbeddingStoreIT` that extends
from either `EmbeddingStoreIT` or `EmbeddingStoreWithFilteringIT`
- [ ] I have added a `{NameOfIntegration}EmbeddingStoreRemovalIT` that
extends from `EmbeddingStoreWithRemovalIT`

## Checklist for changing existing embedding store integration
<!-- Please double-check the following points and mark them like this:
[X] -->
- [ ] I have manually verified that the
`{NameOfIntegration}EmbeddingStore` works correctly with the data
persisted using the latest released version of LangChain4j

---------

Co-authored-by: kpavlov <{ID}+{username}@users.noreply.github.com>
Co-authored-by: Dmytro Liubarskyi <ljubarskij@gmail.com>
2025-03-11 09:57:05 +01:00
Dmytro Liubarskyi 0e5b1ece9c Updated version to 1.0.0-beta2-SNAPSHOT 2025-02-11 15:12:24 +01:00
Dmytro Liubarskyi bf4d9a200f
Release 1.0.0-beta1 (#2509) 2025-02-05 16:15:48 +01:00
LangChain4j e62db38df0 Update version to 1.0.0-alpha2-SNAPSHOT 2024-12-23 07:56:37 +01:00
LangChain4j 88adf9f1cb
Release 1.0.0-alpha1 (#2326) 2024-12-22 17:51:40 +01:00
Konstantin Pavlov 5706566222
#2109 Add Spotless Maven Plugin (#2153)
## Issue
Adds format consistency check for changed files. Closes #2109 

## Change

- Add [Spotless Maven plugin](https://github.com/diffplug/spotless) for
code java (eclipse java format) and pom.xml formatting
- Added the `<project.root.dir>` property across multiple POM files to
standardize the directory structure reference. This ensures consistent
project configurations and reduces redundancy in defining the root
project directory. Adjusted existing XML formatting minimally to
accommodate the new property integration.
- Cleanup duplicate settings in pgvector module
- Updated pom.xml files were reformatted according to
[defaults](https://github.com/diffplug/spotless/tree/main/plugin-maven#sortpom)
+ 4 spaces
- Adding linting and formatting commands to the `Makefile`, updating the
`pom.xml` files for better project configuration, and enhancing the
`CONTRIBUTING.md` guidelines.

## General checklist
- [x] There are no breaking changes
- [ ] I have added unit and integration tests for my change
- [ ] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [ ] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
- [ ] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)
2024-12-03 16:58:51 +01:00
renovate[bot] d64bb3d0ac
fix(deps): update dependency org.postgresql:postgresql to v42.7.4 (#2169)
This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [org.postgresql:postgresql](https://jdbc.postgresql.org)
([source](https://redirect.github.com/pgjdbc/pgjdbc)) | `42.7.3` ->
`42.7.4` |
[![age](https://developer.mend.io/api/mc/badges/age/maven/org.postgresql:postgresql/42.7.4?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/maven/org.postgresql:postgresql/42.7.4?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/maven/org.postgresql:postgresql/42.7.3/42.7.4?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/maven/org.postgresql:postgresql/42.7.3/42.7.4?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

### Release Notes

<details>
<summary>pgjdbc/pgjdbc (org.postgresql:postgresql)</summary>

###
[`v42.7.4`](https://redirect.github.com/pgjdbc/pgjdbc/blob/HEAD/CHANGELOG.md#4274-2024-08-22-080000--0400)

##### Added

- chore: SCRAM dependency to 3.1 and support channel binding [PR
#&#8203;3188](https://redirect.github.com/pgjdbc/pgjdbc/pull/3188)
- chore: Add PostgreSQL 15, 16, and 17beta1 to CI tests [PR
#&#8203;3299](https://redirect.github.com/pgjdbc/pgjdbc/pull/3299)
- test: Update to 17beta3 [PR
#&#8203;3308](https://redirect.github.com/pgjdbc/pgjdbc/pull/3308)
- chore: Implement direct SSL ALPN connections [PR
#&#8203;3252](https://redirect.github.com/pgjdbc/pgjdbc/pull/3252)
- translation: Add Korean translation file [PR
#&#8203;3276](https://redirect.github.com/pgjdbc/pgjdbc/pull/3276)

##### Fixed

- fix: PgInterval ignores case for represented interval string [PR
#&#8203;3344](https://redirect.github.com/pgjdbc/pgjdbc/pull/3344)
- perf: Avoid extra copies when receiving int4 and int2 in PGStream [PR
#&#8203;3295](https://redirect.github.com/pgjdbc/pgjdbc/pull/3295)
- fix: Add support for Infinity::numeric values in ResultSet.getObject
[PR #&#8203;3304](https://redirect.github.com/pgjdbc/pgjdbc/pull/3304)
- fix: Ensure order of results for getDouble [PR
#&#8203;3301](https://redirect.github.com/pgjdbc/pgjdbc/pull/3301)
- perf: Replace BufferedOutputStream with unsynchronized
PgBufferedOutputStream, allow configuring different Java and SO_SNDBUF
buffer sizes [PR
#&#8203;3248](https://redirect.github.com/pgjdbc/pgjdbc/pull/3248)
- fix: Fix SSL tests [PR
#&#8203;3260](https://redirect.github.com/pgjdbc/pgjdbc/pull/3260)
- fix: Support bytea in preferQueryMode=simple [PR
#&#8203;3243](https://redirect.github.com/pgjdbc/pgjdbc/pull/3243)
- fix: Fix
[#&#8203;3234](https://redirect.github.com/pgjdbc/pgjdbc/issues/3234) -
Return -1 as update count for stored procedure calls [PR
#&#8203;3235](https://redirect.github.com/pgjdbc/pgjdbc/pull/3235)
- fix: Fix
[#&#8203;3224](https://redirect.github.com/pgjdbc/pgjdbc/issues/3224) -
conversion for TIME '24:00' to LocalTime breaks in binary-mode [PR
#&#8203;3225](https://redirect.github.com/pgjdbc/pgjdbc/pull/3225)
- perf: Speed up getDate by parsing bytes instead of String [PR
#&#8203;3141](https://redirect.github.com/pgjdbc/pgjdbc/pull/3141)
- fix: support PreparedStatement.setBlob(1, Blob) and
PreparedStatement.setClob(1, Clob) for lobs that return -1 for length
[PR #&#8203;3136](https://redirect.github.com/pgjdbc/pgjdbc/pull/3136)
- fix: Validates resultset Params in PGStatement constructor. uses
assertThro… [PR
#&#8203;3171](https://redirect.github.com/pgjdbc/pgjdbc/pull/3171)
- fix: Validates resultset parameters [PR
#&#8203;3167](https://redirect.github.com/pgjdbc/pgjdbc/pull/3167)
- docs: Replace greater to with greater than [PR
#&#8203;3315](https://redirect.github.com/pgjdbc/pgjdbc/pull/3315)
- docs: Clarify binaryTransfer and prepareThreshold [PR
#&#8203;3338](https://redirect.github.com/pgjdbc/pgjdbc/pull/3338)
- docs: use.md, typo [PR
#&#8203;3314](https://redirect.github.com/pgjdbc/pgjdbc/pull/3314)
- test: Use docker v2 which changes docker-compose to docker compose
[#&#8203;3339](https://redirect.github.com/pgjdbc/pgjdbc/pull/3339)
- refactor: Merge PgPreparedStatement#setBinaryStream int and long
methods [PR
#&#8203;3165](https://redirect.github.com/pgjdbc/pgjdbc/pull/3165)
- test: Test both binaryMode=true,false when creating connections in
DatabaseMetaDataTest [PR
#&#8203;3231](https://redirect.github.com/pgjdbc/pgjdbc/pull/3231)
- docs: Fixed typos in all source code and documentations [PR
#&#8203;3242](https://redirect.github.com/pgjdbc/pgjdbc/pull/3242)
- chore: Remove self-hosted runner [PR
#&#8203;3227](https://redirect.github.com/pgjdbc/pgjdbc/pull/3227)
- docs: Add cancelSignalTimeout in README [PR
#&#8203;3190](https://redirect.github.com/pgjdbc/pgjdbc/pull/3190)
- docs: Document READ_ONLY_MODE in README [PR
#&#8203;3175](https://redirect.github.com/pgjdbc/pgjdbc/pull/3175)
- test: Test for +/- infinity double values [PR
#&#8203;3294](https://redirect.github.com/pgjdbc/pgjdbc/pull/3294)
- test: Switch localhost and auth-test around for test-gss [PR
#&#8203;3343](https://redirect.github.com/pgjdbc/pgjdbc/pull/3343)
- fix: remove preDescribe from internalExecuteBatch [PR
#&#8203;2883](https://redirect.github.com/pgjdbc/pgjdbc/pull/2883)

##### Deprecated

- test: Deprecate all PostgreSQL versions older than 9.1 [PR
#&#8203;3335](https://redirect.github.com/pgjdbc/pgjdbc/pull/3335)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/langchain4j/langchain4j).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xOS4wIiwidXBkYXRlZEluVmVyIjoiMzkuMTkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-11-27 09:53:50 +01:00
LangChain4j 0058c350b4 changed version to 0.37.0-SNAPSHOT 2024-11-19 16:54:25 +01:00
LangChain4j 8a1d755196
Release 0.36.1 (#2149) 2024-11-19 16:26:52 +01:00
LangChain4j 481426ffb4 change version to 0.37.0-SNAPSHOT 2024-11-13 17:14:47 +01:00
LangChain4j 4d6755161d
Release 0.36.0 (#2104) 2024-11-13 15:48:51 +01:00
renovate[bot] 52710489e5
fix(deps): update dependency com.pgvector:pgvector to v0.1.6 (#2087)
This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
|
[com.pgvector:pgvector](https://redirect.github.com/pgvector/pgvector-java)
| `0.1.4` -> `0.1.6` |
[![age](https://developer.mend.io/api/mc/badges/age/maven/com.pgvector:pgvector/0.1.6?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/maven/com.pgvector:pgvector/0.1.6?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/maven/com.pgvector:pgvector/0.1.4/0.1.6?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/maven/com.pgvector:pgvector/0.1.4/0.1.6?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

### Release Notes

<details>
<summary>pgvector/pgvector-java (com.pgvector:pgvector)</summary>

###
[`v0.1.6`](https://redirect.github.com/pgvector/pgvector-java/blob/HEAD/CHANGELOG.md#016-2024-07-17)

[Compare
Source](https://redirect.github.com/pgvector/pgvector-java/compare/v0.1.5...v0.1.6)

-   Added `byte[]` constructor to `PGbit`

###
[`v0.1.5`](https://redirect.github.com/pgvector/pgvector-java/blob/HEAD/CHANGELOG.md#015-2024-06-25)

[Compare
Source](https://redirect.github.com/pgvector/pgvector-java/compare/v0.1.4...v0.1.5)

-   Added support for `halfvec`, `bit`, and `sparsevec` types
-   Added `registerTypes` function

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/langchain4j/langchain4j).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS45LjUiLCJ1cGRhdGVkSW5WZXIiOiIzOS45LjUiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2024-11-13 10:31:33 +01:00
Konstantin Pavlov 1c481d13e2
Cleanup dependencies (#2059)
## Issue
Dependency cycles removed:
[langchain4j-core]->[langchain4j-parent]->[langchain4j-core]
This cycles prevented project fresh project correctly in Jetbrains Idea.
Cyclyc dependency between this repo and [langchain-embeddings
repo](https://github.com/langchain4j/langchain4j-embeddings) should be
fixed separately.

## Change

- Removed dependency cycles: Removed dependencies to project modules
from `langchain4j-parent`/dependencyManagement to avoid cycles. Added
explicit version number for
langchain4j-core,langchain4j,langchain4j-open-ai.
- Introduced `langchain4j-embeddings.version` for explicit dependency on
another repo.
- Added BOM dependencies to parent pom: junit-bom, mockito-bom. Remved
dependencies, defined in BOMs
- junit.version -> 5.11.3
- Upgraded maven-surefire-plugin, maven-failsafe-plugin. **NB! Renovate
bot is needed to do this automatically**

## General checklist
- [x] There are no breaking changes
- [ ] I have added unit and integration tests for my change
- [ ] I have manually run all the unit and integration tests in the
module I have added/changed, and they are all green
- [ ] I have manually run all the unit and integration tests in the
[core](https://github.com/langchain4j/langchain4j/tree/main/langchain4j-core)
and
[main](https://github.com/langchain4j/langchain4j/tree/main/langchain4j)
modules, and they are all green
- [ ] I have added/updated the
[documentation](https://github.com/langchain4j/langchain4j/tree/main/docs/docs)
- [ ] I have added an example in the [examples
repo](https://github.com/langchain4j/langchain4j-examples) (only for
"big" features)
- [ ] I have added/updated [Spring Boot
starter(s)](https://github.com/langchain4j/langchain4j-spring) (if
applicable)
2024-11-12 09:46:25 +01:00