From 205e057bdbf46474df7675bff7e54b9e416b480b Mon Sep 17 00:00:00 2001
From: Julian Ladisch <julianladisch@users.noreply.github.com>
Date: Fri, 17 Jul 2026 15:40:23 +0200
Subject: [PATCH] [5.1] Bump scram-client from 3.2 to 3.3 fixing CVE-2026-53712

scram-client 3.3 fixes a flaw that allows an attacker capable of performing
a TLS machine-in-the-middle (MITM) attack to silently downgrade a connection
from SCRAM-SHA-256-PLUS (with channel binding)
to standard SCRAM-SHA-256 (without channel binding),
bypassing strict client-side enforcement policies.

See https://github.com/advisories/GHSA-p9jg-fcr6-3mhf
and https://github.com/ongres/scram/releases/tag/3.3
---
 vertx-pg-client/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/vertx-pg-client/pom.xml b/vertx-pg-client/pom.xml
index b58fc1797..8a74d37b7 100644
--- a/vertx-pg-client/pom.xml
+++ b/vertx-pg-client/pom.xml
@@ -51,7 +51,7 @@
     <dependency>
       <groupId>com.ongres.scram</groupId>
       <artifactId>scram-client</artifactId>
-      <version>3.2</version>
+      <version>3.3</version>
     </dependency>
 
     <!-- Testing purposes -->