PostgreSQL 16.5 → 16.7
2 releases · 1 breaking change · 4 security fixes · 0 advisories fixed
4security1breaking0deprecated2feature27fix
Breaking changes
- breaking Fix cases where a logical replication slot's restart_lsn could go backwards (Masahiko Sawada) Previously, restarting logical replication could sometimes cause the slot's restart point to be recomputed as an older value than had previously been advertised in pg_replication_slots. This is bad, since… in 16.6
Security changes
- security Harden PQescapeString and allied functions against invalidly-encoded input strings (Andres Freund, Noah Misch) Data-quoting functions supplied by libpq now fully check the encoding validity of their input. If invalid characters are detected, they report an error if possible. For the ones that lack… in 16.7
- security Fix cases where an operator family member operator or support procedure could become a dangling reference (Tom Lane) In some cases a data type could be dropped while references to its OID still remain in pg_amop or pg_amproc. While that caused no immediate issues, an attempt to drop the owning… in 16.7
- security Use SQL-standard function bodies in the declarations of contrib/earthdistance's SQL-language functions (Tom Lane, Ronan Dunklau) This change allows their references to contrib/cube to be resolved during extension creation, reducing the risk of search-path-based failures and possible attacks. In… in 16.7
- security Restore functionality of ALTER {ROLE|DATABASE} SET role (Tom Lane, Noah Misch) The fix for CVE-2024-10978 accidentally caused settings for role to not be applied if they come from non-interactive sources, including previous ALTER {ROLE|DATABASE} commands and the PGOPTIONS environment variable. in 16.6
Every release in between
securityHarden PQescapeString and allied functions against invalidly-encoded input strings (Andres Freund, Noah Misch) Data-quoting functions supplied by libpq now fully check the encoding validity of their input. If invalid characters are detected, they report an error if possible. For the ones that lack…
otherExclude parallel workers from connection privilege checks and limits (Tom Lane) Do not check datallowconn, rolcanlogin, and ACL_CONNECT privileges when starting a parallel worker, instead assuming that it's enough for the leader process to have passed similar checks originally. This avoids, for…
fixFix possible re-use of stale results in window aggregates (David Rowley) A window aggregate with a “run condition” optimization and a pass-by-reference result type might incorrectly return the result from the previous partition instead of performing a fresh calculation.
otherKeep TransactionXmin in sync with MyProc->xmin (Heikki Linnakangas) This oversight could permit a process to try to access data that had already been vacuumed away. One known consequence is transient “could not access status of transaction” errors.
fixFix race condition that could cause failure to add a newly-inserted catalog entry to a catalog cache list (Heikki Linnakangas) This could result, for example, in failure to use a newly-created function within an existing session.
otherPrevent possible catalog corruption when a system catalog is vacuumed concurrently with an update (Noah Misch)
fixFix data corruption when relation truncation fails (Thomas Munro) The filesystem calls needed to perform relation truncation could fail, leaving inconsistent state on disk (for example, effectively reviving deleted data). We can't really prevent that, but we can recover by dint of making such…
fixPrevent checkpoints from starting during relation truncation (Robert Haas) This avoids a race condition wherein the modified file might not get fsync'd before completing the checkpoint, creating a risk of data corruption if the operating system crashes soon after.
otherAvoid possibly losing an update of pg_database.datfrozenxid when VACUUM runs concurrently with a REASSIGN OWNED that changes that database's owner (Kirill Reshke)
fixFix incorrect tg_updatedcols values passed to AFTER UPDATE triggers (Tom Lane) In some cases the tg_updatedcols bitmap could describe the set of columns updated by an earlier command in the same transaction, fooling the trigger into doing the wrong thing. Also, prevent memory bloat caused by…
fixFix detach of a partition that has its own foreign-key constraint referencing a partitioned table (Amul Sul) In common cases, foreign keys are defined on a partitioned table's top level; but if instead one is defined on a partition and references a partitioned table, and the referencing partition…
fixFix mis-processing of to_timestamp's FFn format codes (Tom Lane) An integer format code immediately preceding FFn would consume all available digits, leaving none for FFn.
otherWhen deparsing an XMLTABLE() expression, ensure that XML namespace names are double-quoted when necessary (Dean Rasheed)
otherInclude the ldapscheme option in pg_hba_file_rules() output (Laurenz Albe)
featureDon't merge UNION operations if their column collations aren't consistent (Tom Lane) Previously we ignored collations when deciding if it's safe to merge UNION steps into a single N-way UNION operation. This was arguably valid before the introduction of nondeterministic collations, but it's not…
otherPrevent “wrong varnullingrels” planner errors after pulling up a subquery that's underneath an outer join (Tom Lane)
otherIgnore nulling-relation marker bits when looking up statistics (Richard Guo) This oversight could lead to failure to use relevant statistics about expressions, or to “corrupt MVNDistinct entry” errors.
fixFix missed expression processing for partition pruning steps (Tom Lane) This oversight could lead to “unrecognized node type” errors, and perhaps other problems, in queries accessing partitioned tables.
featureAllow dshash tables to grow past 1GB (Matthias van de Meent) This avoids errors like “invalid DSA memory alloc request size”. The case can occur for example in transactions that process several million tables.
otherAvoid possible integer overflow in bringetbitmap() (James Hunter, Evgeniy Gorbanyov) Since the result is only used for statistical purposes, the effects of this error were mostly cosmetic.
otherEnsure that an already-set process latch doesn't prevent the postmaster from noticing socket events (Thomas Munro) An extremely heavy workload of backends launching workers and workers exiting could prevent the postmaster from responding to incoming client connections in a timely fashion.
otherPrevent streaming standby servers from looping infinitely when reading a WAL record that crosses pages (Kyotaro Horiguchi, Alexander Kukushkin) This would happen when the record's continuation is on a page that needs to be read from a different WAL source.
fixFix unintended promotion of FATAL errors to PANIC during early process startup (Noah Misch) This fixes some unlikely cases that would result in “PANIC: proc_exit() called in child process”.
securityFix cases where an operator family member operator or support procedure could become a dangling reference (Tom Lane) In some cases a data type could be dropped while references to its OID still remain in pg_amop or pg_amproc. While that caused no immediate issues, an attempt to drop the owning…
fixFix multiple memory leaks in logical decoding output (Vignesh C, Masahiko Sawada, Boyu Yang)
fixFix small memory leak when updating the application_name or cluster_name settings (Tofig Aliev)
fixFix unsafe order of operations during cache lookups (Noah Misch) The only known consequence was a usually-harmless “you don't own a lock of type ExclusiveLock” warning during GRANT TABLESPACE.
fixFix possible “failed to resolve name” failures when using JIT on older ARM platforms (Thomas Munro) This could occur as a consequence of inconsistency about the default setting of -moutline-atomics between gcc and clang. At least Debian and Ubuntu are known to ship gcc and clang compilers that…
fixFix assertion failure in WITH RECURSIVE ... UNION queries (David Rowley)
fixFix assertion failure at shutdown when writing out the statistics file (Michael Paquier)
fixFix PL/Tcl to compile with Tcl 9 (Peter Eisentraut)
fixFix psql to safely handle file path names that are encoded in SJIS (Tom Lane) Some two-byte characters in SJIS have a second byte that is equal to ASCII backslash (\). These characters were corrupted by path name normalization, preventing access to files whose names include such characters.
fixFix use of wrong version of pqsignal() in pgbench and psql (Fujii Masao, Tom Lane) This error could lead to misbehavior when using the -T option in pgbench or the \watch command in psql, due to interrupted system calls not being resumed as expected.
fixFix misexecution of some nested \if constructs in pgbench (Michail Nikolaev) An \if command appearing within a false (not-being-executed) \if branch was incorrectly treated the same as \elif.
fixFix possible crash in pg_dump with identity sequences attached to tables that are extension members (Tom Lane)
fixFix memory leak in pg_restore with zstd-compressed data (Tom Lane) The leak was per-decompression-operation, so would be most noticeable with a dump containing many tables or large objects.
fixFix pg_basebackup to correctly handle pg_wal.tar files exceeding 2GB on Windows (Davinder Singh, Thomas Munro)
securityUse SQL-standard function bodies in the declarations of contrib/earthdistance's SQL-language functions (Tom Lane, Ronan Dunklau) This change allows their references to contrib/cube to be resolved during extension creation, reducing the risk of search-path-based failures and possible attacks. In…
fixFix meson build system to support old OpenSSL libraries on Windows (Darek Slusarczyk) Add support for the legacy library names ssleay32 and libeay32.
fixFix meson configuration process to correctly detect OSSP's uuid.h header file under MSVC (Andrew Dunstan)
+15 more items in the release notesotherRepair ABI break for extensions that work with struct ResultRelInfo (Tom Lane) Last week's minor releases unintentionally broke binary compatibility with timescaledb and several other extensions. Restore the affected structure to its previous size, so that such extensions need not be rebuilt.
securityRestore functionality of ALTER {ROLE|DATABASE} SET role (Tom Lane, Noah Misch) The fix for CVE-2024-10978 accidentally caused settings for role to not be applied if they come from non-interactive sources, including previous ALTER {ROLE|DATABASE} commands and the PGOPTIONS environment variable.
breakingFix cases where a logical replication slot's restart_lsn could go backwards (Masahiko Sawada) Previously, restarting logical replication could sometimes cause the slot's restart point to be recomputed as an older value than had previously been advertised in pg_replication_slots. This is bad, since…
otherAvoid deleting still-needed WAL files during pg_rewind (Polina Bungina, Alexander Kukushkin) Previously, in unlucky cases, it was possible for pg_rewind to remove important WAL files from the rewound demoted primary. In particular this happens if those files have been marked for archival (i.e.,…
fixFix race conditions associated with dropping shared statistics entries (Kyotaro Horiguchi, Michael Paquier) These bugs could lead to loss of statistics data, assertion failures, or “can only drop stats once” errors.
otherCount index scans in contrib/bloom indexes in the statistics views, such as the pg_stat_user_indexes.idx_scan counter (Masahiro Ikeda)
fixFix crash when checking to see if an index's opclass options have changed (Alexander Korotkov) Some forms of ALTER TABLE would fail if the table has an index with non-default operator class options.
fixAvoid assertion failure caused by disconnected NFA sub-graphs in regular expression parsing (Tom Lane) This bug does not appear to have any visible consequences in non-assert builds.