fix(helm): production-ready Helm chart aligned with ha-raft subsystem by robfrank · Pull Request #4035 · ArcadeData/arcadedb

robfrank · 2026-04-30T07:14:38Z

Summary

Fix ${HOSTNAME} / ${rootPassword} shell syntax - not expanded in Kubernetes exec-form command: arrays; replaced with $(VAR) K8s-native substitution and explicit downward-API env declarations
Fix Raft port: service.rpc.port default 2424 → 2434 (ha-raft gRPC port)
Remove -Darcadedb.ha.replicationIncomingHost (not a valid ha-raft property)
Make HA args conditional on replicaCount > 1 || autoscaling.enabled
Add publishNotReadyAddresses: true to headless service (prevents HA bootstrap deadlock)
Fix ingress backend: point to -http ClusterIP service; fix service.http.port key
Add Raft quorum guard to HPA: helm template fails when minReplicas < floor(maxReplicas/2)+1
Add opt-in NetworkPolicy: HTTP open to cluster, Raft gRPC restricted to ArcadeDB pods
Security: runAsNonRoot, drop ALL caps, serviceAccount.automount: false, ClusterIP default
Persistence: volumeClaimTemplate for arcadedb-data enabled by default (8Gi)
HPA: nodenames helper sized to maxReplicas for KubernetesAutoJoin scale-up support
Fix NOTES.txt port references, add ephemeral data warning
Guard extra-manifests.yaml bare --- separator
Update README.md: fix stale defaults (port, service type, mode), add persistence/networkPolicy sections

Test plan

helm lint k8s/helm/ passes with 0 failures
helm template k8s/helm/ (default, replicaCount=1) - no HA args, PVC present, no ${HOSTNAME} shell syntax, no port 2424
helm template k8s/helm/ --set replicaCount=3 - HA args present, port 2434, publishNotReadyAddresses: true
helm template k8s/helm/ --set autoscaling.enabled=true --set autoscaling.minReplicas=3 --set autoscaling.maxReplicas=5 - HPA rendered, serverList has 5 entries
helm template k8s/helm/ --set autoscaling.enabled=true --set autoscaling.minReplicas=1 --set autoscaling.maxReplicas=5 - quorum guard fires
helm template k8s/helm/ --set ingress.enabled=true - backend is -http service, port 2480
helm template k8s/helm/ --set networkPolicy.enabled=true - two NetworkPolicy resources rendered

🤖 Generated with Claude Code

…rkPolicy/security defaults

…workPolicy - Fix env-var expansion: use $(HOSTNAME)/$(rootPassword) Kubernetes substitution syntax - ${VAR} shell syntax is not expanded in exec-form command arrays - Fix Raft port: service.rpc.port default changed from 2424 to 2434 (ha-raft gRPC) - Remove -Darcadedb.ha.replicationIncomingHost (not a valid ha-raft property) - Make HA conditional: args only emitted when replicaCount > 1 or autoscaling.enabled - Add publishNotReadyAddresses: true to headless service (prevents bootstrap deadlock) - Fix ingress backend: point to -http ClusterIP service, fix service.http.port key - Add Raft quorum guard to HPA: fail when minReplicas < floor(maxReplicas/2)+1 - Add opt-in NetworkPolicy: HTTP open to cluster, Raft gRPC restricted to ArcadeDB pods - Security: runAsNonRoot, drop ALL caps, serviceAccount.automount=false, ClusterIP default - Persistence: volumeClaimTemplate for arcadedb-data enabled by default (8Gi) - HPA: nodenames helper sized to maxReplicas for KubernetesAutoJoin scale-up support - Fix NOTES.txt port references, add ephemeral data warning - Guard extra-manifests.yaml bare --- separator - Update README: fix stale defaults (port, service type, mode), add missing sections Closes #4034 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

codacy-production · 2026-04-30T07:15:47Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Coverage ∅ diff coverage · -7.89% coverage variation

Metric Results

Coverage variation ✅ -7.89% coverage variation

Diff coverage ✅ ∅ diff coverage

View coverage diff in Codacy

Coverage variation details

Coverable lines Covered lines Coverage

Common ancestor commit (7d94afb) 120170 87923 73.17%

Head commit (1ce68f2) 151534 (+31364) 98920 (+10997) 65.28% (-7.89%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

Coverable lines Covered lines Diff coverage

Pull request (#4035) 0 0 ∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

claude · 2026-04-30T07:16:47Z

Code Review - Helm Chart Production-Readiness Fixes

This PR addresses several real production blockers in the Helm chart. The core fixes are correct and the overall direction is sound. A few issues worth discussing before merge:

Bug: `secret.key` conditional removed

statefulset.yaml (around the secretKeyRef block)

The old template guarded the key: field with {{- if .Values.arcadedb.credentials.rootPassword.secret.key }}. That guard was removed:

# After this PR:
valueFrom:
  secretKeyRef:
    name: {{ .Values.arcadedb.credentials.rootPassword.secret.name }}
    key: {{ .Values.arcadedb.credentials.rootPassword.secret.key }}   # can render as null
    optional: false

When a user sets secret.name but leaves secret.key: null (the default), this renders key: which fails Kubernetes validation - secretKeyRef.key is a required, non-empty string field. The original if guard was load-bearing. Suggest restoring it:

{{- if .Values.arcadedb.credentials.rootPassword.secret.key }}
key: {{ .Values.arcadedb.credentials.rootPassword.secret.key }}
{{- end }}

Bug: `volumeClaimTemplates:` always emitted

statefulset.yaml (bottom of file)

When persistence.enabled=false and volumeClaimTemplates=[], the template renders:

volumeClaimTemplates:

This is a null value in YAML. While Kubernetes tolerates it, it is cleaner and safer to gate the whole key:

{{- if or .Values.persistence.enabled .Values.volumeClaimTemplates }}
volumeClaimTemplates:
  ...
{{- end }}

Minor: Redundant condition in HPA quorum guard

hpa.yaml

{{- if .Values.autoscaling.enabled }}
{{- if or (gt (int .Values.replicaCount) 1) .Values.autoscaling.enabled }}

The inner or always evaluates to true here because we are already inside {{- if .Values.autoscaling.enabled }}. The replicaCount > 1 branch never has any effect. If the intent is to also apply the quorum guard for static HA deployments (no HPA), move the guard outside the autoscaling.enabled block. If the quorum guard is only needed for HPA, simplify to remove the inner if or.

Breaking changes (worth calling out in release notes)

Value	Old default	New default
`service.http.type`	`LoadBalancer`	`ClusterIP`
`service.rpc.port`	`2424`	`2434`
`arcadedb.defaultDatabases`	`"Universe[foo:bar]"`	`""`
`autoscaling.maxReplicas`	`100`	`5`
`serviceAccount.automount`	`true`	`false`
`podSecurityContext`	`{}`	`{runAsNonRoot: true, fsGroup: 1000}`
`securityContext`	`{}`	`{runAsUser: 1000, runAsGroup: 1000, allowPrivilegeEscalation: false, capabilities.drop: [ALL]}`

Existing users upgrading without overriding values will silently lose external access (ClusterIP), gain security hardening, and lose the example database. These are individually correct changes but should be prominently documented or gated behind a chart major version bump.

Positive highlights

Shell expansion fix (${HOSTNAME} → $(HOSTNAME) + downward API env var): Correct and critical. Kubernetes exec-form does not invoke a shell, so ${...} was never expanded.
publishNotReadyAddresses: true: The right fix for HA bootstrap deadlock - without it, pods can't resolve each other's DNS before readiness passes, which prevents readiness from ever passing.
Conditional HA args (replicaCount > 1 || autoscaling.enabled): Clean and correct. Single-node deployments should not carry HA arguments.
arcadedb.ha.raftPort added, arcadedb.ha.replicationIncomingHost removed: Correct alignment with the ha-raft subsystem.
NetworkPolicy template: Sensible split - HTTP open to cluster, Raft gRPC restricted to ArcadeDB pods only. Opt-in via networkPolicy.enabled=false default is the right call for compatibility.
Quorum guard on HPA: Catching misconfigured minReplicas < quorum at helm template time is a good developer experience improvement.
affinity label key: key: app → key: app.kubernetes.io/name is the correct standard label.
extraManifests guard: Prevents bare --- emission when extraManifests is empty.
Persistence section: Promoting the PVC to a first-class persistence.enabled toggle with a sensible 8Gi default is much better UX than the previous approach of leaving it to volumeClaimTemplates.

Suggestions (non-blocking)

Consider adding startupProbe with a longer timeout threshold - JVM startup + HA leader election can take longer than the default liveness probe tolerates on cold starts.
The HTTP NetworkPolicy has no from selector, allowing any pod in the cluster to reach port 2480. This is intentional but worth a comment in the template noting it is cluster-wide, not namespace-scoped.

gemini-code-assist

Code Review

This pull request updates the ArcadeDB Helm chart to version 26.5.1, introducing NetworkPolicy resources, a quorum guard for HorizontalPodAutoscaler, and support for the Raft-based HA subsystem. It also refactors persistence management and updates default service types and resource recommendations. Review feedback points out that the unconditional rendering of volumeMounts and volumeClaimTemplates in the StatefulSet could lead to invalid YAML if they are empty. Additionally, the reviewer recommends restoring default values for the RPC port and safety guards for secret keys to ensure template stability and backward compatibility.

gemini-code-assist · 2026-04-30T07:17:01Z

          {{- end }}
-          {{- with .Values.volumeMounts }}
          volumeMounts:
+            {{- if .Values.persistence.enabled }}


The volumeMounts: key (line 81) is now rendered unconditionally because the previous with guard was removed. If persistence.enabled is false and volumeMounts is empty, this will result in an empty volumeMounts: field in the container spec, which is invalid Kubernetes YAML. Consider wrapping the parent key in a conditional check like {{- if or .Values.persistence.enabled .Values.volumeMounts }}.

gemini-code-assist · 2026-04-30T07:17:02Z

      {{- end }}
-  {{- with .Values.volumeClaimTemplates }}
  volumeClaimTemplates:
+    {{- if .Values.persistence.enabled }}


The volumeClaimTemplates: key (line 130) is now rendered unconditionally. If persistence.enabled is false and no extra volumeClaimTemplates are provided, this will result in an empty volumeClaimTemplates: field in the StatefulSet spec, which is invalid. Consider wrapping the parent key in a conditional check like {{- if or .Values.persistence.enabled .Values.volumeClaimTemplates }}.

gemini-code-assist · 2026-04-30T07:17:02Z

 {{- $fullname := (include "arcadedb.fullname" .) -}}
 {{- $k8sSuffix := (include "arcadedb.k8sSuffix" .) -}}
-{{- $rpcPort := int (default "2424" .Values.service.rpc.port) -}}
+{{- $rpcPort := int .Values.service.rpc.port -}}


Removing the default value for service.rpc.port might cause the template to fail if users are using an older values.yaml file that doesn't define this key. It's safer to provide a default value, especially since the port has changed in this version.

{{- $rpcPort := int (default 2434 .Values.service.rpc.port) -}}

gemini-code-assist · 2026-04-30T07:17:02Z

@@ -87,19 +100,17 @@ spec:
              valueFrom:
                secretKeyRef:
                  name: {{ .Values.arcadedb.credentials.rootPassword.secret.name }}
-                  {{- if .Values.arcadedb.credentials.rootPassword.secret.key }}
                  key: {{ .Values.arcadedb.credentials.rootPassword.secret.key }}
-                  {{- end }}


Removing the guard for secret.key makes the template fragile. If a user provides an existing secret name but omits the key in their values, the template will render an invalid secretKeyRef with an empty key. It is recommended to use the required function to enforce the presence of the key when a custom secret name is used, or restore the conditional check.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

codecov · 2026-04-30T08:01:16Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.23%. Comparing base (7d94afb) to head (1ce68f2).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4035      +/-   ##
==========================================
- Coverage   64.25%   64.23%   -0.03%     
==========================================
  Files        1597     1597              
  Lines      120170   120279     +109     
  Branches    25589    25618      +29     
==========================================
+ Hits        77220    77262      +42     
- Misses      32278    32326      +48     
- Partials    10672    10691      +19

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

claude · 2026-04-30T11:48:00Z

Code Review - PR #4035: Helm chart removal and dedicated repo migration

Overview

This PR removes the entire k8s/helm/ directory from the monorepo, adds a redirect k8s/README.md, and checks in two planning/design documents under docs/superpowers/. The intent is to migrate the Helm chart to a dedicated ArcadeData/arcadedb-helm repository.

Note on PR description vs diff mismatch: The title says "fix(helm): production-ready Helm chart aligned with ha-raft subsystem" and the summary lists many specific chart fixes (port corrections, HA args, security hardening, etc.), but the actual diff contains none of those fixes - it only deletes the chart. Those fixes presumably live in the new arcadedb-helm repo. The PR description should be updated to reflect that this PR is a removal/migration, not a bugfix.

Issues

Critical - URL inconsistency

k8s/README.md uses:

helm repo add arcadedb https://helm.arcadedb.com/

But docs/superpowers/specs/2026-04-29-helm-chart-dedicated-repo-design.md and the plan doc both use:

https://arcadedata.github.io/arcadedb-helm/

If helm.arcadedb.com is a custom domain that has not been configured yet, users following the redirect README will get a 404. Either use the GitHub Pages URL (which is automatically available once the repo/Pages are set up), or ensure the custom domain is live before merging.

Critical - Ordering risk: chart removed before new repo is ready

This PR deletes the chart from the monorepo. If it merges before:

The ArcadeData/arcadedb-helm repository is created
The chart is published and GitHub Pages is serving index.yaml

...there will be a window where no installable chart exists. The plan doc's Task 7 (cleanup) is explicitly marked as the last step, but this PR mixes the monorepo cleanup with the planning docs without a clear gate. Recommend blocking merge on the new repo being live and verifiable via helm search repo.

Minor - Planning documents in source control

docs/superpowers/plans/ and docs/superpowers/specs/ contain step-by-step bash commands for bootstrapping a separate GitHub repository. These are ephemeral implementation notes, not persistent documentation about the ArcadeDB codebase. Once the migration is complete they have no ongoing value and become stale. Consider keeping them as GitHub issues/discussions instead, or at least note that they can be deleted after the migration is complete.

Minor - Design doc has a self-contradictory Pages configuration

docs/superpowers/specs/...design.md says:

GitHub Pages is enabled on the main branch root (/).

But docs/superpowers/plans/...plan.md (Task 5, Step 4) says:

Branch: gh-pages

helm/chart-releaser-action pushes index.yaml to the gh-pages branch, so the spec description of "main branch root" is incorrect and could confuse whoever executes the migration.

What looks good

Moving the Helm chart to a dedicated repo is the right call - it gives the chart an independent release cadence and makes it discoverable via helm search hub.
The redirect README is clear and includes install commands.
The old chart is deleted completely rather than left as dead code.
The design doc's versioning convention (chart version independent of appVersion) is sensible.

Suggested checklist before merge

Confirm ArcadeData/arcadedb-helm exists and the chart is published at the URL in k8s/README.md
Verify helm repo add arcadedb <url> && helm search repo arcadedb returns the chart
Align k8s/README.md URL with the actual live URL (GitHub Pages or custom domain)
Fix the Pages-branch discrepancy in the design spec
Update PR title/description to reflect this is a removal/migration, not a chart bugfix

🤖 Generated with Claude Code

…skip ci] Bumps [org.postgresql:postgresql](https://github.com/pgjdbc/pgjdbc) from 42.7.10 to 42.7.11. Release notes *Sourced from [org.postgresql:postgresql's releases](https://github.com/pgjdbc/pgjdbc/releases).* > v42.7.11 > -------- > > Security > -------- > > * fix: Limit SCRAM PBKDF2 iterations accepted from the server. > pgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256 authentication, where a malicious or compromised PostgreSQL server could specify an extremely large PBKDF2 iteration count, causing the client to consume unbounded CPU and potentially exhaust connection pools. The fix introduces a new scramMaxIterations connection property (defaulting to 100,000) to cap iteration counts before computation begins. > See the [Security Advisory](GHSA-98qh-xjc8-98pq) for more detail. > The following [CVE-2026-42198](https://nvd.nist.gov/vuln/detail/CVE-2026-42198) has been issued. > > Changes > ------- > > * fix: Add sources and javadocs to shaded published lib generation [`@sehrope`](https://github.com/sehrope) ([#4043](https://redirect.github.com/pgjdbc/pgjdbc/issues/4043)) > * update Changelog and website for release of 42.7.11 [`@davecramer`](https://github.com/davecramer) ([#4042](https://redirect.github.com/pgjdbc/pgjdbc/issues/4042)) > * Fix scram fix location in changelog and update published artifact developer list [`@sehrope`](https://github.com/sehrope) ([#4041](https://redirect.github.com/pgjdbc/pgjdbc/issues/4041)) > * Restrict test with scram\_iterations to v16+ and release notes [`@sehrope`](https://github.com/sehrope) ([#4040](https://redirect.github.com/pgjdbc/pgjdbc/issues/4040)) > * chore(deps): update ubuntu:24.04 docker digest to 84e77de [`@renovate-bot`](https://github.com/renovate-bot) ([#4017](https://redirect.github.com/pgjdbc/pgjdbc/issues/4017)) > * test: add tests for QueryExecutor#getTransactionState [`@vlsi`](https://github.com/vlsi) ([#4006](https://redirect.github.com/pgjdbc/pgjdbc/issues/4006)) > * chore(deps): update actions/create-github-app-token action to v2.2.2 [`@renovate-bot`](https://github.com/renovate-bot) ([#3983](https://redirect.github.com/pgjdbc/pgjdbc/issues/3983)) > * fix: fix flaky CopyBothResponseTest by using WAL flush LSN [`@vlsi`](https://github.com/vlsi) ([#3979](https://redirect.github.com/pgjdbc/pgjdbc/issues/3979)) > * fix: fix flaky replication restart tests by waiting for confirmed\_flush\_lsn [`@vlsi`](https://github.com/vlsi) ([#3975](https://redirect.github.com/pgjdbc/pgjdbc/issues/3975)) > * test: fix flaky LogicalReplicationStatusTest by polling pg\_stat\_replication [`@vlsi`](https://github.com/vlsi) ([#3974](https://redirect.github.com/pgjdbc/pgjdbc/issues/3974)) > * chore: replace Appveyor with ikalnytskyi/action-setup-postgres [`@vlsi`](https://github.com/vlsi) ([#3966](https://redirect.github.com/pgjdbc/pgjdbc/issues/3966)) > * test: move test table creation from [`@BeforeEach`](https://github.com/BeforeEach) to [`@BeforeAll`](https://github.com/BeforeAll) [`@vlsi`](https://github.com/vlsi) ([#3967](https://redirect.github.com/pgjdbc/pgjdbc/issues/3967)) > * Return jsonb as PGObject fixes Issue [#3926](https://redirect.github.com/pgjdbc/pgjdbc/issues/3926) [`@davecramer`](https://github.com/davecramer) ([#3956](https://redirect.github.com/pgjdbc/pgjdbc/issues/3956)) > * Update docker scripts [`@davecramer`](https://github.com/davecramer) ([#3958](https://redirect.github.com/pgjdbc/pgjdbc/issues/3958)) > * implement require\_auth, this is pretty much how libpq does this. [`@davecramer`](https://github.com/davecramer) ([#3895](https://redirect.github.com/pgjdbc/pgjdbc/issues/3895)) > * docs: add SCRAM authentication test setup section to TESTING.md [`@emmaeng700`](https://github.com/emmaeng700) ([#3945](https://redirect.github.com/pgjdbc/pgjdbc/issues/3945)) > * Add RequireServerVersion annotation for tests [`@sehrope`](https://github.com/sehrope) ([#3939](https://redirect.github.com/pgjdbc/pgjdbc/issues/3939)) > > 🐛 Bug Fixes > ----------- > > * fix: ensure extended protocol messages end with Sync message [`@vlsi`](https://github.com/vlsi) ([#3728](https://redirect.github.com/pgjdbc/pgjdbc/issues/3728)) > * fix: enable cursor-based fetching in extended protocol when transaction started via SQL command [`@vlsi`](https://github.com/vlsi) ([#3996](https://redirect.github.com/pgjdbc/pgjdbc/issues/3996)) > * fix: retry with SSL on IOException when sslMode=ALLOW [`@vlsi`](https://github.com/vlsi) ([#3973](https://redirect.github.com/pgjdbc/pgjdbc/issues/3973)) > * fix: allow fallback to non-SSL connection when sslMode=prefer and sslResponseTimeout kicks in [`@vlsi`](https://github.com/vlsi) ([#3968](https://redirect.github.com/pgjdbc/pgjdbc/issues/3968)) > * fix: catch SecurityException from setContextClassLoader on ForkJoinPool workers [`@vlsi`](https://github.com/vlsi) ([#3962](https://redirect.github.com/pgjdbc/pgjdbc/issues/3962)) > * fix: use compareTo for LogSequenceNumber comparison [`@vlsi`](https://github.com/vlsi) ([#3961](https://redirect.github.com/pgjdbc/pgjdbc/issues/3961)) > * fix: release COPY lock on IOException to prevent connection hang ([#3957](https://redirect.github.com/pgjdbc/pgjdbc/issues/3957)) [`@vlsi`](https://github.com/vlsi) ([#3960](https://redirect.github.com/pgjdbc/pgjdbc/issues/3960)) > > 🧰 Maintenance > ------------- > > * style: replace [`@exception`](https://github.com/exception) with [`@throws`](https://github.com/throws) in getBoolean javadoc [`@vlsi`](https://github.com/vlsi) ([#4035](https://redirect.github.com/pgjdbc/pgjdbc/issues/4035)) > * chore: use `@vlsi/github-actions-random-matrix` npm package [`@vlsi`](https://github.com/vlsi) ([#4008](https://redirect.github.com/pgjdbc/pgjdbc/issues/4008)) > * chore: use tag names for pinning github actions, pin ikalnytskyi/action-setup-postgres [`@vlsi`](https://github.com/vlsi) ([#4007](https://redirect.github.com/pgjdbc/pgjdbc/issues/4007)) > * chore: bump errorprone to 2.48.0 [`@vlsi`](https://github.com/vlsi) ([#4005](https://redirect.github.com/pgjdbc/pgjdbc/issues/4005)) > * test: add [`@DisableLogger`](https://github.com/DisableLogger) annotation to suppress expected log warnings in tests [`@vlsi`](https://github.com/vlsi) ([#3971](https://redirect.github.com/pgjdbc/pgjdbc/issues/3971)) > * chore: suppress deprecations in test code to reduce build verbosity [`@vlsi`](https://github.com/vlsi) ([#3972](https://redirect.github.com/pgjdbc/pgjdbc/issues/3972)) > * chore: replace log warning in ConnectionFactory.closeStream with Throwable.addSuppressed [`@vlsi`](https://github.com/vlsi) ([#3970](https://redirect.github.com/pgjdbc/pgjdbc/issues/3970)) > * chore: use greedy pairwise coverage for CI matrix generation [`@vlsi`](https://github.com/vlsi) ([#3965](https://redirect.github.com/pgjdbc/pgjdbc/issues/3965)) > * chore: use full version tags in GitHub Actions comments [`@vlsi`](https://github.com/vlsi) ([#3963](https://redirect.github.com/pgjdbc/pgjdbc/issues/3963)) > > ⬆️ Dependencies > --------------- ... (truncated) Changelog *Sourced from [org.postgresql:postgresql's changelog](https://github.com/pgjdbc/pgjdbc/blob/master/CHANGELOG.md).* > [42.7.11] (2026-04-28) > ---------------------- > > ### Security > > * fix: Limit SCRAM PBKDF2 iterations accepted from the server. > pgjdbc was vulnerable to a client-side denial of service in SCRAM-SHA-256 authentication, where a malicious or compromised PostgreSQL server could specify an extremely large PBKDF2 iteration count, causing the client to consume unbounded CPU and potentially exhaust connection pools. The fix introduces a new scramMaxIterations connection property (defaulting to 100,000) to cap iteration counts before computation begins. > See the [Security Advisory](GHSA-98qh-xjc8-98pq) for more detail. > The following [CVE-2026-42198](https://nvd.nist.gov/vuln/detail/CVE-2026-42198) has been issued. > > ### Added > > * feat: implement require\_auth connection property, aligning with libpq behavior [PR [#3895](https://redirect.github.com/pgjdbc/pgjdbc/issues/3895)]([pgjdbc/pgjdbc#3895](https://redirect.github.com/pgjdbc/pgjdbc/pull/3895)) > > ### Changed > > * chore: replace Appveyor CI with ikalnytskyi/action-setup-postgres [PR [#3966](https://redirect.github.com/pgjdbc/pgjdbc/issues/3966)]([pgjdbc/pgjdbc#3966](https://redirect.github.com/pgjdbc/pgjdbc/pull/3966)) > * chore: upgrade Gradle to v9 [PR [#3978](https://redirect.github.com/pgjdbc/pgjdbc/issues/3978)]([pgjdbc/pgjdbc#3978](https://redirect.github.com/pgjdbc/pgjdbc/pull/3978)) > > ### Fixed > > * fix: ensure extended protocol messages end with Sync message [PR [#3728](https://redirect.github.com/pgjdbc/pgjdbc/issues/3728)]([pgjdbc/pgjdbc#3728](https://redirect.github.com/pgjdbc/pgjdbc/pull/3728)) > * fix: enable cursor-based fetching in extended protocol when transaction started via SQL command [PR [#3996](https://redirect.github.com/pgjdbc/pgjdbc/issues/3996)]([pgjdbc/pgjdbc#3996](https://redirect.github.com/pgjdbc/pgjdbc/pull/3996)) > * fix: retry with SSL on IOException when sslMode=ALLOW [PR [#3973](https://redirect.github.com/pgjdbc/pgjdbc/issues/3973)]([pgjdbc/pgjdbc#3973](https://redirect.github.com/pgjdbc/pgjdbc/pull/3973)) > * fix: make sure the driver honours connectTimeout when retrying the connection [PR [#3968](https://redirect.github.com/pgjdbc/pgjdbc/issues/3968)]([pgjdbc/pgjdbc#3968](https://redirect.github.com/pgjdbc/pgjdbc/pull/3968)) > * fix: allow fallback to non-SSL connection when sslMode=prefer and sslResponseTimeout kicks in [PR [#3968](https://redirect.github.com/pgjdbc/pgjdbc/issues/3968)]([pgjdbc/pgjdbc#3968](https://redirect.github.com/pgjdbc/pgjdbc/pull/3968)) > * fix: catch SecurityException from setContextClassLoader on ForkJoinPool workers [PR [#3962](https://redirect.github.com/pgjdbc/pgjdbc/issues/3962)]([pgjdbc/pgjdbc#3962](https://redirect.github.com/pgjdbc/pgjdbc/pull/3962)) > * fix: use compareTo for LogSequenceNumber comparison to handle unsigned values correctly [PR [#3961](https://redirect.github.com/pgjdbc/pgjdbc/issues/3961)]([pgjdbc/pgjdbc#3961](https://redirect.github.com/pgjdbc/pgjdbc/pull/3961)) > * fix: release COPY lock on IOException to prevent connection hang [PR [#3957](https://redirect.github.com/pgjdbc/pgjdbc/issues/3957)]([pgjdbc/pgjdbc#3957](https://redirect.github.com/pgjdbc/pgjdbc/pull/3957)) > * fix: return jsonb as PGObject instead of String [PR [#3956](https://redirect.github.com/pgjdbc/pgjdbc/issues/3956)]([pgjdbc/pgjdbc#3956](https://redirect.github.com/pgjdbc/pgjdbc/pull/3956)) > * fix: align SSL key file permission check with libpq [PR [#3952](https://redirect.github.com/pgjdbc/pgjdbc/issues/3952)]([pgjdbc/pgjdbc#3952](https://redirect.github.com/pgjdbc/pgjdbc/pull/3952)) > * fix: guard connection closed flag with a reentrant lock to protect against concurrent close [PR [#3905](https://redirect.github.com/pgjdbc/pgjdbc/issues/3905)]([pgjdbc/pgjdbc#3905](https://redirect.github.com/pgjdbc/pgjdbc/pull/3905)) Commits * [`78e261f`](pgjdbc/pgjdbc@78e261f) fix: Add sources and javadocs to shaded published lib generation * [`1e09fa0`](pgjdbc/pgjdbc@1e09fa0) update Changelog and website for release of 42.7.11 ([#4042](https://redirect.github.com/pgjdbc/pgjdbc/issues/4042)) * [`d479fa5`](pgjdbc/pgjdbc@d479fa5) Fix scram fix location in changelog and update published artifact developer l... * [`b04fc46`](pgjdbc/pgjdbc@b04fc46) docs: Add scram max iters fix to changelog * [`cf54822`](pgjdbc/pgjdbc@cf54822) test: Disable scram test on older version without scram\_iterations GUC * [`7dbcc79`](pgjdbc/pgjdbc@7dbcc79) test: Add SCRAM max iteration tests * [`c9d41d1`](pgjdbc/pgjdbc@c9d41d1) fix: Limit SCRAM PBKDF2 iterations accepted from the server * [`a340cb2`](pgjdbc/pgjdbc@a340cb2) style: replace [`@exception`](https://github.com/exception) with [`@throws`](https://github.com/throws) in getBoolean javadoc * [`77837f8`](pgjdbc/pgjdbc@77837f8) fix(deps): update dependency org.openrewrite.rewrite:org.openrewrite.rewrite.... * [`23af03b`](pgjdbc/pgjdbc@23af03b) chore(deps): update actions/checkout action to v6 * Additional commits viewable in [compare view](pgjdbc/pgjdbc@REL42.7.10...REL42.7.11) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=org.postgresql:postgresql&package-manager=maven&previous-version=42.7.10&new-version=42.7.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

robfrank and others added 4 commits April 29, 2026 18:53

chore(helm): bump chart and app version to 26.5.1

9bab5f2

feat(helm): restructure values.yaml - fix keys, add persistence/netwo…

e405e41

…rkPolicy/security defaults

fix(helm): update nodenames helper - port 2434, HPA-aware list sizing

cc96db1

gemini-code-assist Bot reviewed Apr 30, 2026

View reviewed changes

robfrank and others added 2 commits April 30, 2026 09:36

docs: add spec for arcadedb-helm dedicated repository

fb5cbf6

docs: add implementation plan for arcadedb-helm dedicated repository

d3ada15

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

chore: remove k8s/helm/ - chart moved to ArcadeData/arcadedb-helm

1ce68f2

robfrank merged commit 45ba99c into main Apr 30, 2026
12 of 13 checks passed

tae898 pushed a commit to humemai/arcadedb-embedded-python that referenced this pull request May 1, 2026

move helm chart in dedicated repository (ArcadeData#4035)

a097b81

robfrank mentioned this pull request May 5, 2026

Improve Python bindings code quality (Codacy/Bandit cleanup) #4084

Open

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(helm): production-ready Helm chart aligned with ha-raft subsystem#4035

fix(helm): production-ready Helm chart aligned with ha-raft subsystem#4035
robfrank merged 7 commits intomainfrom
feat/review-helm-chart

robfrank commented Apr 30, 2026

Uh oh!

codacy-production Bot commented Apr 30, 2026 •

edited

Loading

Uh oh!

claude Bot commented Apr 30, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Apr 30, 2026

Uh oh!

gemini-code-assist Bot Apr 30, 2026

Uh oh!

gemini-code-assist Bot Apr 30, 2026

Uh oh!

gemini-code-assist Bot Apr 30, 2026

Uh oh!

codecov Bot commented Apr 30, 2026 •

edited

Loading

Uh oh!

claude Bot commented Apr 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

robfrank commented Apr 30, 2026

Summary

Test plan

Uh oh!

codacy-production Bot commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

claude Bot commented Apr 30, 2026

Code Review - Helm Chart Production-Readiness Fixes

Bug: secret.key conditional removed

Bug: volumeClaimTemplates: always emitted

Minor: Redundant condition in HPA quorum guard

Breaking changes (worth calling out in release notes)

Positive highlights

Suggestions (non-blocking)

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

claude Bot commented Apr 30, 2026

Code Review - PR #4035: Helm chart removal and dedicated repo migration

Overview

Issues

Critical - URL inconsistency

Critical - Ordering risk: chart removed before new repo is ready

Minor - Planning documents in source control

Minor - Design doc has a self-contradictory Pages configuration

What looks good

Suggested checklist before merge

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

codacy-production Bot commented Apr 30, 2026 •

edited

Loading

Bug: `secret.key` conditional removed

Bug: `volumeClaimTemplates:` always emitted

codecov Bot commented Apr 30, 2026 •

edited

Loading