Subject: [pgjdbc/pgjdbc] PR #3799: fix(deps): update dependency com.ongres.scram:scram-client to 3.2

From: "jorsol (@jorsol)" <[email-masked]>
Date: Tue, 16 Sep 2025 20:29:37 +0000

### All Submissions:

* [x] Have you followed the guidelines in our [Contributing](https://github.com/pgjdbc/pgjdbc/blob/master/CONTRIBUTING.md) document?
* [x] Have you checked to ensure there aren't other open [Pull Requests](../../pulls) for the same update/change?

<!-- You can erase any parts of this template not applicable to your Pull Request. -->

### New Feature Submissions:

1. [x] Does your submission pass tests?
2. [ ] Does `./gradlew styleCheck` pass ?
3. [ ] Have you added your new test classes to an existing test suite in alphabetical order?

### Changes to Existing Features:

* [ ] Does this break existing behaviour? If so please explain.
* [ ] Have you added an explanation of what your changes do and why you'd like us to include them?
* [ ] Have you written new tests for your core changes, as applicable?
* [ ] Have you successfully run tests with your changes locally?

---

From: "sehrope (@sehrope)" <[email-masked]>
Date: Wed, 17 Sep 2025 12:57:37 +0000

Thanks for updating this @jorsol 

Looks like the only meaningful change is the fix for that timing safe comparison: https://github.com/ongres/scram/commit/e0b0cf99f05406a0d26682c72fcb5728e95124b3

Considering that the usage in pgjdbc of this is as a client, not a server, should we even consider this to be a security issue for this driver?

I'm leaning toward "no" as the connections are initiated by the client.  The only way this would be an issue is if the client was actively helping a malicious server by repeatedly trying to connect to it (an insanely large number of times to get meaningful timing attack numbers).

---

From: "jorsol (@jorsol)" <[email-masked]>
Date: Wed, 17 Sep 2025 14:55:17 +0000

Hi @sehrope — the only relevant change is a security fix. The attack would be highly complex and likely impractical, but we’re addressing it to be on the safe side.

I’d lean “no” as well on marking it as a driver security issue.