Skip to content

Conversation

@labkey-susanh
Copy link
Contributor

Rationale

CVE-2025-49146 Affects versions from 42.7.4 until 42.7.7. We are not at risk since we do not configure channel binding, but good to update just the same.

Changes

  • Update postgresDriverVersion

Copy link
Contributor

@labkey-jeckels labkey-jeckels left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, pending positive feedback from TeamCity.

@labkey-susanh labkey-susanh merged commit c2239a7 into release25.3-SNAPSHOT Jun 13, 2025
10 checks passed
@labkey-susanh labkey-susanh deleted the 25.3_fb_postgresDriver branch June 13, 2025 00:21
@labkey-adam
Copy link
Contributor

@labkey-susanh @labkey-jeckels As mentioned in the "Upgrade Dependencies" doc, we've been holding off upgrading the PG JDBC driver due to a metadata retrieval performance issue that @labkey-tchad filed. Doesn't look like that's been fixed... or has it? Are we okay upgrading with this degradation in place?

@labkey-susanh
Copy link
Contributor Author

@labkey-susanh @labkey-jeckels As mentioned in the "Upgrade Dependencies" doc, we've been holding off upgrading the PG JDBC driver due to a metadata retrieval performance issue that @labkey-tchad filed. Doesn't look like that's been fixed... or has it? Are we okay upgrading with this degradation in place?

Thanks, @labkey-adam. I didn't realize/remember that this was a thing. I think we're probably safe to suppress this CVE since it's related to functionality that we do not use. Anyone disagree?

@labkey-jeckels
Copy link
Contributor

@labkey-susanh @labkey-jeckels As mentioned in the "Upgrade Dependencies" doc, we've been holding off upgrading the PG JDBC driver due to a metadata retrieval performance issue that @labkey-tchad filed. Doesn't look like that's been fixed... or has it? Are we okay upgrading with this degradation in place?

Thanks, @labkey-adam. I didn't realize/remember that this was a thing. I think we're probably safe to suppress this CVE since it's related to functionality that we do not use. Anyone disagree?

Sounds correct to me.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants