Last week’s PostgreSQL ecosystem news has one item that belongs at the top of your Monday queue: the PostgreSQL JDBC team shipped 42.7.14, a security release fixing two CVEs in the driver that essentially every JVM service uses to talk to Postgres. The rest of the week — Citus query routers, a new open-source client, and the start of the autumn conference run — can wait until that driver is bumped.

PostgreSQL JDBC 42.7.14 fixes two CVEs

The release announcement covers two advisories, both with full details in the 42.7.14 changelog.

CVE-2026-107314 — a configuration check that silently passed. If your requireAuth value excludes every authentication method — for example !password,!md5,!gss,!sspi,!scram-sha-256,!none — the driver should refuse every method. Releases 42.7.11 through 42.7.13 instead treated that value as if requireAuth were not set at all, and accepted whatever method the server asked for, including cleartext password. A malformed value with no method name in it, such as ,, was treated the same way. See the advisory and CVE-2026-107314.

CVE-2026-107315 — value padding leaked earlier statements. When an application sends a value shorter than its declared length — for example a ByteStreamWriter whose getLength() is larger than what writeTo() actually writes — the driver pads the value out to the declared length. Releases 42.7.4 through 42.7.13 padded it with bytes of messages sent earlier on the same connection, so the value stored in the table could contain SQL text and parameter values from earlier statements on that connection. 42.7.14 pads with zeros. See the advisory and CVE-2026-107315.

The second bug is the more interesting one for regulated workloads: it is not a remote attacker reaching in, it is your own earlier query text landing in a column you later read back. In Houston that pattern shows up on trading and nominations feeds, clinical integration engines behind an EHR, and terminal-operating systems tracking containers — all places where a value that quietly contains another statement’s text is a data-integrity problem, not just a security one.

The upgrade has one breaking edge

42.7.14 is not a drop-in in every configuration. If you are running with one of the broken requireAuth values, the corrected driver will now refuse to connect. You will get SQLState 08004 with Authentication method is not allowed by requireAuth, or SQLState 22023 with Invalid authentication method: <value> when the value contains no method at all. With channelBinding=require also set, the channel binding message comes instead.

The fix is to state the methods you accept, positively:

# Will be refused by 42.7.14 — this value excludes every method
jdbc:postgresql://db:5432/app?requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none

# Write the methods your server actually offers
jdbc:postgresql://db:5432/app?requireAuth=scram-sha-256
jdbc:postgresql://db:5432/app?requireAuth=scram-sha-256&channelBinding=require

Bump the driver in your build file and let the resolver do the rest:

<!-- Maven -->
<dependency>
  <groupId>org.postgresql</groupId>
  <artifactId>postgresql</artifactId>
  <version>42.7.14</version>
</dependency>

// Gradle
implementation 'org.postgresql:postgresql:42.7.14'

Finding every copy in a JVM fleet

The awkward part is not the upgrade, it is the inventory. The driver hides inside Kafka Connect images, Flyway and Liquibase runners, Debezium connectors, Spark and Flink jobs, Logstash pipelines, BI tools like Metabase and Superset, Airflow JDBC hooks, and every hand-written Spring Boot service. Start from the dependency tree, not from a memory of who wrote what:

# Maven
mvn dependency:tree -Dincludes=org.postgresql:postgresql

# Gradle
./gradlew dependencyInsight \
  --dependency org.postgresql:postgresql \
  --configuration runtimeClasspath

# Anything still shipping an old jar
find . -name 'postgresql-42.7.*.jar'

Jars are published on the JDBC download page. If your containers pin a base image with the driver baked in, that image needs a rebuild, not just a lockfile edit.

Also shipped: Citus query routers in StackGres 1.19

StackGres 1.19 (release notes) introduces Query Routers for Citus, an answer to the long-standing complaint that Citus sharding is capped by its single coordinator. A query router holds the Citus metadata and plans and routes queries, but stores no sharded data. You add as many as you need, declaratively, and StackGres fronts the whole set with a Kubernetes Service named <cluster>-routers, so clients point at one address and the load spreads. In Ongres’ benchmark, three routers took the cluster to 1.43M tps at p50 of 1 ms and p99 of 4 ms, with the workers still at 81% CPU. Query Routers are open source.

pgNimbus 1.0, plus the quieter releases

• pgNimbus 1.0 — the first stable release of an open-source Postgres GUI client, following a security audit, and notable for its telemetry-free posture. Worth a look in shops where an outbound-connected SQL client will not clear security review.
• pg_ivm 1.16 — incremental view maintenance that stops you paying the REFRESH MATERIALIZED VIEW tax; we covered the upgrade path here.
• pg_plan_filter 1.0.0 — a cost-based guard rail that kills runaway queries before they execute; our walkthrough is here.
• pgx-bm25 1.0 — BM25-ranked full-text search as a native index; see our tutorial.
• pg_vault_tde 1.7.2 — if you run transparent data encryption, this is the release with the on-disk format change: clean shutdown, primary and standbys upgraded together, and VACUUM FULL on every encrypted table afterwards. Our upgrade notes cover the sequence.
• parallel_leader_participation — a short, sharp post from The Build on when to turn it off, including when you are measuring how a query scales with worker count.

Community: the autumn conference run starts next week

The October cluster of Postgres community events is unusually dense this year:

• PGConf.EU 2026 — Valencia, Spain, October 20–23. The largest Postgres event in Europe: three days of talks plus a day of community activities and workshops.
• PGDay Israel 2026 — Tel Aviv, October 25.
• PG Down Under 2026 — Sydney, October 30, the sixth annual conference for the Australia/New Zealand community.
• PGDay São Paulo — October 17, and PGDay Goiânia — October 19. Both are free, in Portuguese, and registrations close October 15.

On the release side, the 19 cycle is still in beta — PostgreSQL 19 Beta 4 is the current snapshot — so the useful work now is testing your extensions against it rather than planning a production move.

Your Monday checklist

1. Bump the JDBC driver to 42.7.14 everywhere, including images that bake it in.
2. Grep your connection strings for requireAuth and convert any negative list to a positive one before you deploy.
3. Confirm you were never on 42.7.4–42.7.13 with ByteStreamWriter short writes; if you were, audit the affected columns rather than assuming they are clean.
4. If you run Citus on Kubernetes, read the query router benchmarks before your next coordinator capacity conversation.

The driver patch is the only genuinely urgent item. Everything else on this list is a good week’s work.