diff --git a/drivers/jdbc/gradle/wrapper/gradle-wrapper.properties b/drivers/jdbc/gradle/wrapper/gradle-wrapper.properties index 3cd913fbb..f938bb815 100644 --- a/drivers/jdbc/gradle/wrapper/gradle-wrapper.properties +++ b/drivers/jdbc/gradle/wrapper/gradle-wrapper.properties @@ -17,6 +17,6 @@ distributionBase=GRADLE_USER_HOME distributionPath=wrapper/dists -distributionUrl=https\://services.gradle.org/distributions/gradle-7.0-bin.zip +distributionUrl=https\://services.gradle.org/distributions/gradle-8.5-bin.zip zipStoreBase=GRADLE_USER_HOME zipStorePath=wrapper/dists diff --git a/drivers/jdbc/lib/build.gradle.kts b/drivers/jdbc/lib/build.gradle.kts index 0b63bc5a6..07e543d70 100644 --- a/drivers/jdbc/lib/build.gradle.kts +++ b/drivers/jdbc/lib/build.gradle.kts @@ -30,19 +30,24 @@ repositories { } dependencies { - implementation("org.postgresql:postgresql:42.6.0") - api("org.apache.commons:commons-text:1.10.0") - antlr("org.antlr:antlr4:4.12.0") + // SECURITY: Updated from 42.6.0 - fixes CVE-2024-1597 (Critical: SQL injection + // in simple query mode) and CVE-2025-49146 (High: auth bypass with + // channelBinding=require). See: + // https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56 + // https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hq9p-pm7w-8p54 + implementation("org.postgresql:postgresql:42.7.5") + api("org.apache.commons:commons-text:1.13.0") + antlr("org.antlr:antlr4:4.13.2") - testImplementation("org.junit.jupiter:junit-jupiter-api:5.9.3") + testImplementation("org.junit.jupiter:junit-jupiter-api:5.11.4") testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine") testRuntimeOnly("org.junit.platform:junit-platform-launcher") - testImplementation("org.testcontainers:testcontainers:1.18.0") - testImplementation("org.postgresql:postgresql:42.6.0") + testImplementation("org.testcontainers:testcontainers:1.20.4") + testImplementation("org.postgresql:postgresql:42.7.5") - testImplementation("org.slf4j:slf4j-api:2.0.7") - testImplementation("org.slf4j:slf4j-simple:2.0.7") + testImplementation("org.slf4j:slf4j-api:2.0.16") + testImplementation("org.slf4j:slf4j-simple:2.0.16") } tasks.generateGrammarSource { diff --git a/drivers/jdbc/lib/src/test/java/org/apache/age/jdbc/BaseDockerizedTest.java b/drivers/jdbc/lib/src/test/java/org/apache/age/jdbc/BaseDockerizedTest.java index 393175c3d..86b120574 100644 --- a/drivers/jdbc/lib/src/test/java/org/apache/age/jdbc/BaseDockerizedTest.java +++ b/drivers/jdbc/lib/src/test/java/org/apache/age/jdbc/BaseDockerizedTest.java @@ -21,6 +21,7 @@ import java.sql.DriverManager; import java.sql.Statement; +import java.time.Duration; import org.apache.age.jdbc.base.Agtype; import org.junit.jupiter.api.AfterAll; import org.junit.jupiter.api.BeforeAll; @@ -28,6 +29,7 @@ import org.junit.jupiter.api.TestInstance.Lifecycle; import org.postgresql.jdbc.PgConnection; import org.testcontainers.containers.GenericContainer; +import org.testcontainers.containers.wait.strategy.Wait; import org.testcontainers.utility.DockerImageName; @TestInstance(Lifecycle.PER_CLASS) @@ -54,20 +56,18 @@ public void beforeAll() throws Exception { agensGraphContainer = new GenericContainer<>(DockerImageName .parse("apache/age:dev_snapshot_master")) .withEnv("POSTGRES_PASSWORD", CORRECT_DB_PASSWORDS) - .withExposedPorts(5432); + .withExposedPorts(5432) + .waitingFor(Wait.forLogMessage(".*database system is ready to accept connections.*\\n", 2) + .withStartupTimeout(Duration.ofSeconds(60))); agensGraphContainer.start(); int mappedPort = agensGraphContainer.getMappedPort(5432); String jdbcUrl = String - .format("jdbc:postgresql://%s:%d/%s", "localhost", mappedPort, "postgres"); + .format("jdbc:postgresql://%s:%d/%s?sslmode=disable", "localhost", mappedPort, "postgres"); - try { - this.connection = DriverManager.getConnection(jdbcUrl, "postgres", CORRECT_DB_PASSWORDS) - .unwrap(PgConnection.class); - this.connection.addDataType("agtype", Agtype.class); - } catch (Exception e) { - System.out.println(e); - } + this.connection = DriverManager.getConnection(jdbcUrl, "postgres", CORRECT_DB_PASSWORDS) + .unwrap(PgConnection.class); + this.connection.addDataType("agtype", Agtype.class); try (Statement statement = connection.createStatement()) { statement.execute("CREATE EXTENSION IF NOT EXISTS age;"); statement.execute("LOAD 'age'");