TonyOlaCodes opened a new pull request, #7218: URL: https://github.com/apache/incubator-kie/pull/7218
## Summary Upgrade the PostgreSQL JDBC driver (`org.postgresql:postgresql`) to 42.7.14 to fix: - CVE-2026-107314 (GHSA-rhp9-mr79-r74h): the driver does not enforce `requireAuth` when the value excludes every authentication method it knows. Affects 42.7.11 - 42.7.13. - CVE-2026-107315 (GHSA-f64h-wr5q-3qf3): the driver pads a value shorter than its declared length with bytes from earlier statements instead of zeros. Affects 42.7.4 - 42.7.13. ## Changes - `kie-parent/pom.xml`: `version.org.postgresql` 42.7.12 -> 42.7.14 - `kogito-quarkus/bom/pom.xml`: `version.org.postgresql` 42.7.13 -> 42.7.14 Both are the only places the driver version is pinned on main, so they are the only changes. `kogito-quarkus/bom` overrides the Quarkus BOM (which manages 42.7.13). ## Verification - Both POMs are well-formed and the diff is limited to the two version values. - `42.7.14` is published on Maven Central. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
