fix(deps): update dependency org.jdbi:jdbi3-core to v3.53.0 (release/5.0.x)#5198
Merged
Merged
Conversation
888e172 to
b18f703
Compare
109d0c3 to
b094c00
Compare
b094c00 to
506c48c
Compare
f77d640 to
2823f00
Compare
2823f00 to
11e4208
Compare
11e4208 to
b9c89d9
Compare
|
6ac6489 to
3a0f4d8
Compare
3a0f4d8 to
d790d61
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.



This PR contains the following updates:
3.51.0→3.53.0Release Notes
jdbi/jdbi (org.jdbi:jdbi3-core)
v3.53.0Fixes: Jdbi-Freemarker Security Advisory GHSA-mggx-p7jf-jgw4
The Freemarker configuration allows templates to construct arbitrary
Java types, including
freemarker.template.utility.Execute.While exploiting this requires other unsafe practices (letting a user
dictate template input), it seems prudent to disable template class resolution.
Please see GHSA-mggx-p7jf-jgw4 for more details.
Upgrade to testcontainers 2.x
While this required no code changes, the testcontainers project has
renamed a number of their jar files. Jdbi still supports
testcontainers 1.x and now also testcontainers 2.x:
If you are using testcontainers with Jdbi today and can not update to
2.x, make sure that you reference the
org.testcontainers:jdbcandorg.testcontainers:junit-jupiterdependencies. Those used to beavailable as transitive dependency from
jdbi3-testcontainers.If you upgrade to testcontainers 2.x, the
org.testcontainers:testcontainers-jdbcandorg.testcontainers:testcontainers-junit-jupiterdependencies must beavailable.
v3.52.1java.time.Instantmapping from 3.52.0 (#2955, reported by @Eng-Fouad and @toadzky)java.time.OffsetTimejava.time.ZoneOffsetv3.52.0Changes to java.time related classes
JDBC 4.2 added full support to map java.time classes onto SQL types
in 2014. This release of Jdbi switches from mapping these objects onto
"classic" (
java.sql.Date,Time,Timestamp) to using the JDBC 4.2 API(
PreparedStatement#setObjectandResultSet#getObject).These changes should not be visible for any database, except if you
were brave enough to map types with time zones or offsets
(
ZonedDateTimeandOffsetDateTime) onto SQL types that have notimezone (
TIMESTAMPorDATETIME). This affects databases that donot support the
TIMESTAMP WITH TIMEZONEdata type. IAW MySQL.If you use MySQL with Jdbi and map any of these data types, you are
already losing the zone/offset information. Now you actually get an
error (which is the correct behavior of the driver!) unless you load
the new
MysqlPluginwhich restores the mapping.If your application relies on legacy mappings, you can also use the
new
@Legacyannotation to force the old behavior. See thedocumentation at https://jdbi.org/ for details.
@Legacyannotation to restore old timestamp mapping behavior@BindMethodsListwork with the String template engine (fixes #2917, reported by @agavrilov76, fixed by @JScodeconcise)Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.