Skip to content

Bump exposed from 1.2.0 to 1.5.1 - #101

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/exposed-1.5.1
Closed

Bump exposed from 1.2.0 to 1.5.1#101
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/gradle/exposed-1.5.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 13, 2026

Copy link
Copy Markdown
Contributor

Bumps exposed from 1.2.0 to 1.5.1.
Updates org.jetbrains.exposed:exposed-core from 1.2.0 to 1.5.1

Release notes

Sourced from org.jetbrains.exposed:exposed-core's releases.

1.5.1

Change log

  • Fixes CVE-2026-108474: SQL injection through the string arguments of SQL functions, fixed by EXPOSED-1093

New Contributors

1.5.0

Change log

New Contributors

1.4.0

Change log

New Contributors

1.3.1

Change log

New Contributors

1.3.0

Change log

New Contributors

Changelog

Sourced from org.jetbrains.exposed:exposed-core's changelog.

1.5.1

Security:

  • Fixes CVE-2026-108474: SQL injection through the string arguments of SQL functions, fixed by EXPOSED-1093 below

Bug fixes:

  • fix: EXPOSED-909 Escape single quotes in locate() substring by @​kwy404 in JetBrains/Exposed#2946
  • fix: EXPOSED-1093 Bind string arguments of SQL functions instead of concatenating them into SQL by @​obabichevjb in JetBrains/Exposed#2957
    • The string arguments of locate(), concat(), groupConcat(), match() and the JSON extract(), exists() and contains() are now bound as query parameters, so they are always treated as data.
    • Where a database does not accept a parameter in that position, the argument is written into the statement as a string literal with its single quotes escaped instead:
      • Oracle: the JSON path of extract() and exists()
      • SQL Server: the separator of groupConcat()
    • These arguments must be passed as is. A value that was escaped on the client side, for example with its single quotes doubled, now reaches the database with the escaping intact.

1.5.0

Infrastructure:

  • Flyway 13.3.0

Features:

Bug fixes:

Docs:

1.4.0

Infrastructure:

  • log4j2 2.26.1
  • postgresql-jdbc 42.7.13
  • flyway 13.1.0

... (truncated)

Commits
  • b4039ac chore: Bump Exposed version from 1.5.0 to 1.5.1
  • 4cf829b fix: EXPOSED-1093 Bind string arguments instead of concatenating them into SQ...
  • 3689785 fix: EXPOSED-909 Escape single quotes in locate() substring (#2946)
  • 8436120 chore: Bump Exposed version from 1.4.0 to 1.5.0
  • 5d7adb1 chore: Bump Exposed version from 1.4.0 to 1.5.0
  • 0941b5b chore: Bump Exposed version from 1.3.0 to 1.3.1
  • 1a700f3 feat: EXPOSED-924 Extend multi-row values batch insert to all DB and drivers ...
  • f10b115 fix(plugin): Prevent timestamp migration version collisions with generateMigr...
  • 8b5d251 fix(r2dbc): EXPOSED-1047 Release R2DBC connection on failure of beginTransact...
  • cdfe1a6 fix: Nullable enumeration columns not handled by r2dbc-postgresql 1.0.5 or ol...
  • Additional commits viewable in compare view

Updates org.jetbrains.exposed:exposed-jdbc from 1.2.0 to 1.5.1

Release notes

Sourced from org.jetbrains.exposed:exposed-jdbc's releases.

1.5.1

Change log

  • Fixes CVE-2026-108474: SQL injection through the string arguments of SQL functions, fixed by EXPOSED-1093

New Contributors

1.5.0

Change log

New Contributors

1.4.0

Change log

New Contributors

1.3.1

Change log

New Contributors

1.3.0

Change log

New Contributors

Changelog

Sourced from org.jetbrains.exposed:exposed-jdbc's changelog.

1.5.1

Security:

  • Fixes CVE-2026-108474: SQL injection through the string arguments of SQL functions, fixed by EXPOSED-1093 below

Bug fixes:

  • fix: EXPOSED-909 Escape single quotes in locate() substring by @​kwy404 in JetBrains/Exposed#2946
  • fix: EXPOSED-1093 Bind string arguments of SQL functions instead of concatenating them into SQL by @​obabichevjb in JetBrains/Exposed#2957
    • The string arguments of locate(), concat(), groupConcat(), match() and the JSON extract(), exists() and contains() are now bound as query parameters, so they are always treated as data.
    • Where a database does not accept a parameter in that position, the argument is written into the statement as a string literal with its single quotes escaped instead:
      • Oracle: the JSON path of extract() and exists()
      • SQL Server: the separator of groupConcat()
    • These arguments must be passed as is. A value that was escaped on the client side, for example with its single quotes doubled, now reaches the database with the escaping intact.

1.5.0

Infrastructure:

  • Flyway 13.3.0

Features:

Bug fixes:

Docs:

1.4.0

Infrastructure:

  • log4j2 2.26.1
  • postgresql-jdbc 42.7.13
  • flyway 13.1.0

... (truncated)

Commits
  • b4039ac chore: Bump Exposed version from 1.5.0 to 1.5.1
  • 4cf829b fix: EXPOSED-1093 Bind string arguments instead of concatenating them into SQ...
  • 3689785 fix: EXPOSED-909 Escape single quotes in locate() substring (#2946)
  • 8436120 chore: Bump Exposed version from 1.4.0 to 1.5.0
  • 5d7adb1 chore: Bump Exposed version from 1.4.0 to 1.5.0
  • 0941b5b chore: Bump Exposed version from 1.3.0 to 1.3.1
  • 1a700f3 feat: EXPOSED-924 Extend multi-row values batch insert to all DB and drivers ...
  • f10b115 fix(plugin): Prevent timestamp migration version collisions with generateMigr...
  • 8b5d251 fix(r2dbc): EXPOSED-1047 Release R2DBC connection on failure of beginTransact...
  • cdfe1a6 fix: Nullable enumeration columns not handled by r2dbc-postgresql 1.0.5 or ol...
  • Additional commits viewable in compare view

Updates org.jetbrains.exposed:exposed-dao from 1.2.0 to 1.5.1

Release notes

Sourced from org.jetbrains.exposed:exposed-dao's releases.

1.5.1

Change log

  • Fixes CVE-2026-108474: SQL injection through the string arguments of SQL functions, fixed by EXPOSED-1093

New Contributors

1.5.0

Change log

New Contributors

1.4.0

Change log

New Contributors

1.3.1

Change log

New Contributors

1.3.0

Change log

New Contributors

Changelog

Sourced from org.jetbrains.exposed:exposed-dao's changelog.

1.5.1

Security:

  • Fixes CVE-2026-108474: SQL injection through the string arguments of SQL functions, fixed by EXPOSED-1093 below

Bug fixes:

  • fix: EXPOSED-909 Escape single quotes in locate() substring by @​kwy404 in JetBrains/Exposed#2946
  • fix: EXPOSED-1093 Bind string arguments of SQL functions instead of concatenating them into SQL by @​obabichevjb in JetBrains/Exposed#2957
    • The string arguments of locate(), concat(), groupConcat(), match() and the JSON extract(), exists() and contains() are now bound as query parameters, so they are always treated as data.
    • Where a database does not accept a parameter in that position, the argument is written into the statement as a string literal with its single quotes escaped instead:
      • Oracle: the JSON path of extract() and exists()
      • SQL Server: the separator of groupConcat()
    • These arguments must be passed as is. A value that was escaped on the client side, for example with its single quotes doubled, now reaches the database with the escaping intact.

1.5.0

Infrastructure:

  • Flyway 13.3.0

Features:

Bug fixes:

Docs:

1.4.0

Infrastructure:

  • log4j2 2.26.1
  • postgresql-jdbc 42.7.13
  • flyway 13.1.0

... (truncated)

Commits
  • b4039ac chore: Bump Exposed version from 1.5.0 to 1.5.1
  • 4cf829b fix: EXPOSED-1093 Bind string arguments instead of concatenating them into SQ...
  • 3689785 fix: EXPOSED-909 Escape single quotes in locate() substring (#2946)
  • 8436120 chore: Bump Exposed version from 1.4.0 to 1.5.0
  • 5d7adb1 chore: Bump Exposed version from 1.4.0 to 1.5.0
  • 0941b5b chore: Bump Exposed version from 1.3.0 to 1.3.1
  • 1a700f3 feat: EXPOSED-924 Extend multi-row values batch insert to all DB and drivers ...
  • f10b115 fix(plugin): Prevent timestamp migration version collisions with generateMigr...
  • 8b5d251 fix(r2dbc): EXPOSED-1047 Release R2DBC connection on failure of beginTransact...
  • cdfe1a6 fix: Nullable enumeration columns not handled by r2dbc-postgresql 1.0.5 or ol...
  • Additional commits viewable in compare view

Updates org.jetbrains.exposed:exposed-java-time from 1.2.0 to 1.5.1

Release notes

Sourced from org.jetbrains.exposed:exposed-java-time's releases.

1.5.1

Change log

  • Fixes CVE-2026-108474: SQL injection through the string arguments of SQL functions, fixed by EXPOSED-1093

New Contributors

1.5.0

Change log

New Contributors

1.4.0

Change log

New Contributors

1.3.1

Change log

New Contributors

1.3.0

Change log

New Contributors

Changelog

Sourced from org.jetbrains.exposed:exposed-java-time's changelog.

1.5.1

Security:

  • Fixes CVE-2026-108474: SQL injection through the string arguments of SQL functions, fixed by EXPOSED-1093 below

Bug fixes:

  • fix: EXPOSED-909 Escape single quotes in locate() substring by @​kwy404 in JetBrains/Exposed#2946
  • fix: EXPOSED-1093 Bind string arguments of SQL functions instead of concatenating them into SQL by @​obabichevjb in JetBrains/Exposed#2957
    • The string arguments of locate(), concat(), groupConcat(), match() and the JSON extract(), exists() and contains() are now bound as query parameters, so they are always treated as data.
    • Where a database does not accept a parameter in that position, the argument is written into the statement as a string literal with its single quotes escaped instead:
      • Oracle: the JSON path of extract() and exists()
      • SQL Server: the separator of groupConcat()
    • These arguments must be passed as is. A value that was escaped on the client side, for example with its single quotes doubled, now reaches the database with the escaping intact.

1.5.0

Infrastructure:

  • Flyway 13.3.0

Features:

Bug fixes:

Docs:

1.4.0

Infrastructure:

  • log4j2 2.26.1
  • postgresql-jdbc 42.7.13
  • flyway 13.1.0

... (truncated)

Commits
  • b4039ac chore: Bump Exposed version from 1.5.0 to 1.5.1
  • 4cf829b fix: EXPOSED-1093 Bind string arguments instead of concatenating them into SQ...
  • 3689785 fix: EXPOSED-909 Escape single quotes in locate() substring (#2946)
  • 8436120 chore: Bump Exposed version from 1.4.0 to 1.5.0
  • 5d7adb1 chore: Bump Exposed version from 1.4.0 to 1.5.0
  • 0941b5b chore: Bump Exposed version from 1.3.0 to 1.3.1
  • 1a700f3 feat: EXPOSED-924 Extend multi-row values batch insert to all DB and drivers ...
  • f10b115 fix(plugin): Prevent timestamp migration version collisions with generateMigr...
  • 8b5d251 fix(r2dbc): EXPOSED-1047 Release R2DBC connection on failure of beginTransact...
  • cdfe1a6 fix: Nullable enumeration columns not handled by r2dbc-postgresql 1.0.5 or ol...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump exposed from 1.2.0 to 1.5.1
63e98fd 
Bumps `exposed` from 1.2.0 to 1.5.1.

Updates `org.jetbrains.exposed:exposed-core` from 1.2.0 to 1.5.1
- [Release notes](https://github.com/JetBrains/Exposed/releases)
- [Changelog](https://github.com/JetBrains/Exposed/blob/main/CHANGELOG.md)
- [Commits](JetBrains/Exposed@1.2.0...1.5.1)

Updates `org.jetbrains.exposed:exposed-jdbc` from 1.2.0 to 1.5.1
- [Release notes](https://github.com/JetBrains/Exposed/releases)
- [Changelog](https://github.com/JetBrains/Exposed/blob/main/CHANGELOG.md)
- [Commits](JetBrains/Exposed@1.2.0...1.5.1)

Updates `org.jetbrains.exposed:exposed-dao` from 1.2.0 to 1.5.1
- [Release notes](https://github.com/JetBrains/Exposed/releases)
- [Changelog](https://github.com/JetBrains/Exposed/blob/main/CHANGELOG.md)
- [Commits](JetBrains/Exposed@1.2.0...1.5.1)

Updates `org.jetbrains.exposed:exposed-java-time` from 1.2.0 to 1.5.1
- [Release notes](https://github.com/JetBrains/Exposed/releases)
- [Changelog](https://github.com/JetBrains/Exposed/blob/main/CHANGELOG.md)
- [Commits](JetBrains/Exposed@1.2.0...1.5.1)

---
updated-dependencies:
- dependency-name: org.jetbrains.exposed:exposed-core
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.jetbrains.exposed:exposed-jdbc
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.jetbrains.exposed:exposed-dao
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.jetbrains.exposed:exposed-java-time
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Dependencies Label label Oct 13, 2026
@dependabot dependabot Bot mentioned this pull request Oct 13, 2026
Closed
@github-actions

github-actions Bot commented Oct 13, 2026

Copy link
Copy Markdown

Qodana for JVM

2 new problems were found

Inspection name Severity Problems
Unstable API Usage 🔶 Warning 2
View the detailed Qodana report

To be able to view the detailed Qodana report, you can either:

To get *.log files or any other Qodana artifacts, run the action with upload-result option set to true,
so that the action will upload the files as the job artifacts:

      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v2026.2.2
        with:
          upload-result: true
Contact Qodana team

Contact us at qodana-support@jetbrains.com

@dependabot @github

dependabot Bot commented on behalf of github Oct 20, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #105.

@dependabot dependabot Bot closed this Oct 20, 2026
@dependabot
dependabot Bot deleted the dependabot/gradle/exposed-1.5.1 branch October 20, 2026 13:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Dependencies Label

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants