chore(deps): update dependency pgbouncer/pgbouncer to pgbouncer_1_25_2

[renovate]

This PR contains the following updates:

Package	Update	Change
pgbouncer/pgbouncer	patch	pgbouncer_1_25_1 → pgbouncer_1_25_2

---

Release Notes

pgbouncer/pgbouncer (pgbouncer/pgbouncer)

vpgbouncer_1_25_2: PgBouncer 1.25.2

Compare Source

2026-05-08 - PgBouncer 1.25.2 - "Human touch with fresh twist in title race full of uncertainties"

• Security

  • Fix CVE-2026-6664: An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet.
  • Fix CVE-2026-6665: The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM server-final-message with a long nonce can trigger a stack overflow.
  • Fix CVE-2026-6666: A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE field.
  • Fix CVE-2026-6667: PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console (which itself requires authorization) could run this command. It would have been correct to allow only users listed in the admin_users parameter.

• Fixes

  • Clarify documentation of default_pool_size parameter.
  • Correct documentation regarding client_tls13_ciphers and server_tls13_ciphers.

New Contributors

• @​jedwards1211 made their first contribution in #​1475

Full Changelog: pgbouncer/pgbouncer@pgbouncer_1_25_1...pgbouncer_1_25_2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.