Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build(deps): bump postgresql from 42.5.0 to 42.5.1 #1260

Merged
merged 2 commits into from
Feb 16, 2023

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 24, 2022

Bumps postgresql from 42.5.0 to 42.5.1.

Changelog

Sourced from postgresql's changelog.

Changelog

Notable changes since version 42.0.0, read the complete History of Changes.

The format is based on Keep a Changelog.

[Unreleased]

Changed

Added

Fixed

[42.5.1] (2022-11-21 15:21:59 -0500)

Security

  • security: StreamWrapper spills to disk if setText, or setBytea sends very large Strings or arrays to the server. createTempFile creates a file which can be read by other users on unix like systems (Not macos). This has been fixed in this version fixes CVE-2022-41946 see the security advisory for more details. Reported by Jonathan Leitschuh This has been fixed in versions 42.5.1, 42.4.3 42.3.8, 42.2.27.jre7. Note there is no fix for 42.2.26.jre6. See the security advisory for work arounds.

Fixed

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot added chore Refactor, rename, cleanup, etc. dependencies Pull requests that update a dependency file safe-to-test labels Nov 24, 2022
@dependabot dependabot bot requested a review from a team November 24, 2022 00:09
@github-actions
Copy link
Contributor

Test image available:

$ CRYOSTAT_IMAGE=ghcr.io/cryostatio/cryostat:pr-1260-9c0855dee0a001378026932a943c494b35bc81c0 sh smoketest.sh

Copy link
Member

@ebaron ebaron left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No usable downstream build for this yet

@andrewazores andrewazores marked this pull request as draft November 30, 2022 16:48
@dependabot dependabot bot force-pushed the dependabot/maven/org.postgresql-postgresql-42.5.1 branch from 9c0855d to a2beae8 Compare December 15, 2022 01:57
@github-actions github-actions bot added the needs-triage Needs thorough attention from code reviewers label Dec 15, 2022
@dependabot dependabot bot force-pushed the dependabot/maven/org.postgresql-postgresql-42.5.1 branch 2 times, most recently from 948bb06 to 9c9003a Compare December 23, 2022 17:38
@dependabot dependabot bot force-pushed the dependabot/maven/org.postgresql-postgresql-42.5.1 branch 9 times, most recently from 5e10232 to 80303be Compare January 6, 2023 21:34
@dependabot dependabot bot force-pushed the dependabot/maven/org.postgresql-postgresql-42.5.1 branch 7 times, most recently from 26ac20b to 7b965a6 Compare January 17, 2023 15:41
@dependabot dependabot bot force-pushed the dependabot/maven/org.postgresql-postgresql-42.5.1 branch 2 times, most recently from 477081e to 40fa3fc Compare January 30, 2023 15:56
Bumps [postgresql](https://github.com/pgjdbc/pgjdbc) from 42.5.0 to 42.5.1.
- [Release notes](https://github.com/pgjdbc/pgjdbc/releases)
- [Changelog](https://github.com/pgjdbc/pgjdbc/blob/master/CHANGELOG.md)
- [Commits](pgjdbc/pgjdbc@REL42.5.0...REL42.5.1)

---
updated-dependencies:
- dependency-name: org.postgresql:postgresql
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/maven/org.postgresql-postgresql-42.5.1 branch from 40fa3fc to a181b6f Compare January 31, 2023 14:15
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Feb 1, 2023

Superseded by #1349.

@dependabot dependabot bot closed this Feb 1, 2023
@dependabot dependabot bot deleted the dependabot/maven/org.postgresql-postgresql-42.5.1 branch February 1, 2023 00:10
@ebaron
Copy link
Member

ebaron commented Feb 16, 2023

@dependabot reopen

@dependabot dependabot bot reopened this Feb 16, 2023
@dependabot dependabot bot restored the dependabot/maven/org.postgresql-postgresql-42.5.1 branch February 16, 2023 20:05
@ebaron ebaron marked this pull request as ready for review February 16, 2023 20:05
@ebaron ebaron removed blocked needs-triage Needs thorough attention from code reviewers labels Feb 16, 2023
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Feb 16, 2023

A newer version of org.postgresql:postgresql exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

@github-actions
Copy link
Contributor

Test image available:

$ CRYOSTAT_IMAGE=ghcr.io/cryostatio/cryostat:pr-1260-b68541b1698f066aa582868df5ea58a5a57d05c3 sh smoketest.sh

@ebaron ebaron merged commit f72d7fe into main Feb 16, 2023
@dependabot dependabot bot deleted the dependabot/maven/org.postgresql-postgresql-42.5.1 branch February 16, 2023 20:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
chore Refactor, rename, cleanup, etc. dependencies Pull requests that update a dependency file safe-to-test
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants