PostgreSQL JDBC 42.7.12 Security Release

PostgreSQL JDBC driver version 42.7.12 patches a security vulnerability (CVE-2026-54291) affecting releases 42.7.4 through 42.7.11. When channelBinding=require is set, connections can be silently downgraded from SCRAM-SHA-256-PLUS (with channel binding) to plain SCRAM-SHA-256 (without), eliminating man-in-the-middle protection. The issue stems from two combined bugs: the bundled scram-client library returns an empty byte array instead of failing when it cannot derive a binding hash for certain certificate types (Ed25519, Ed448, post-quantum algorithms), and pgJDBC's ScramAuthenticator fails to enforce the channel binding requirement. Only connections explicitly configured with channelBinding=require are affected.