PostgreSQL 16.7 → 16.9
2 releases · 1 breaking change · 2 security fixes · 0 advisories fixed
2security1breaking0deprecated7feature20fix
Breaking changes
- breaking Remove incorrect assertion in pgstat_report_stat() (Michael Paquier) in 16.9
Security changes
- security Avoid one-byte buffer overread when examining invalidly-encoded strings that are claimed to be in GB18030 encoding (Noah Misch, Andres Freund) While unlikely, a SIGSEGV crash could occur if an incomplete multibyte character appeared at the end of memory. This was possible both in the server and in… in 16.9
- security Improve behavior of libpq's quoting functions (Andres Freund, Tom Lane) The changes made for CVE-2025-1094 had one serious oversight: PQescapeLiteral() and PQescapeIdentifier() failed to honor their string length parameter, instead always reading to the input string's trailing null. This resulted… in 16.8
Every release in between
securityAvoid one-byte buffer overread when examining invalidly-encoded strings that are claimed to be in GB18030 encoding (Noah Misch, Andres Freund) While unlikely, a SIGSEGV crash could occur if an incomplete multibyte character appeared at the end of memory. This was possible both in the server and in…
otherHandle self-referential foreign keys on partitioned tables correctly (Álvaro Herrera) Creating or attaching partitions failed to make the required catalog entries for a foreign-key constraint, if the table referenced by the constraint was the same partitioned table. This resulted in failure to…
featureAvoid data loss when merging compressed BRIN summaries in brin_bloom_union() (Tomas Vondra) The code failed to account for decompression results not being identical to the input objects, which would result in failure to add some of the data to the merged summary, leading to missed rows in index…
fixFix unexpected “attribute has wrong type” errors in UPDATE, DELETE, and MERGE queries that use whole-row table references to views or functions in FROM (Tom Lane)
fixFix MERGE into a partitioned table with DO NOTHING actions (Tender Wang) Some cases failed with “unknown action in MERGE WHEN clause” errors.
otherPrevent failure in INSERT commands when the table has a GENERATED column of a domain data type and the domain's constraints disallow null values (Jian He) Constraint failure was reported even if the generation expression produced a perfectly okay result.
otherCorrectly process references to outer CTE names that appear within a WITH clause attached to an INSERT/UPDATE/DELETE/MERGE command that's inside WITH (Tom Lane) The parser failed to detect disallowed recursion cases, nor did it account for such references when sorting CTEs into a usable order.
otherDon't try to parallelize array_agg() when the argument is of an anonymous record type (Richard Guo, Tom Lane) The protocol for communicating with parallel workers doesn't support identifying the concrete record type that a worker is returning.
fixFix ARRAY(subquery) and ARRAY[expression, ...] constructs to produce sane results when the input is of type int2vector or oidvector (Tom Lane) This patch restores the behavior that existed before PostgreSQL 9.5: the result is of type int2vector[] or oidvector[].
fixFix possible erroneous reports of invalid affixes while parsing Ispell dictionaries (Jacob Brazeal)
fixFix ALTER TABLE ADD COLUMN to correctly handle the case of a domain type that has a default (Jian He, Tom Lane, Tender Wang) If a domain type has a default, adding a column of that type (without any explicit DEFAULT clause) failed to install the domain's default value in existing rows, instead…
otherRepair misbehavior when there are duplicate column names in a foreign key constraint's ON DELETE SET DEFAULT or SET NULL action (Tom Lane)
otherImprove the error message for disallowed attempts to alter the properties of a foreign key constraint (Álvaro Herrera)
otherAvoid error when resetting the relhassubclass flag of a temporary table that's marked ON COMMIT DELETE ROWS (Noah Misch)
featureAdd missing deparsing of the INDENT option of XMLSERIALIZE() (Jim Jones) Previously, views or rules using XMLSERIALIZE(... INDENT) were dumped without the INDENT clause, causing incorrect results after restore.
otherAvoid premature evaluation of the arguments of an aggregate function that has both FILTER and ORDER BY (or DISTINCT) options (David Rowley) If there is ORDER BY or DISTINCT, we consider pre-sorting the aggregate input values rather than doing the sort within the Agg plan node. But this is…
fixFix planner's failure to identify more than one hashable ScalarArrayOpExpr subexpression within a top-level expression (David Geier) This resulted in unnecessarily-inefficient execution of any additional subexpressions that could have been processed with a hash table (that is, IN, NOT IN, or = ANY…
otherDisable “skip fetch” optimization in bitmap heap scan (Matthias van de Meent) It turns out that this optimization can result in returning dead tuples when a concurrent vacuum marks a page all-visible.
fixFix performance issues in GIN index search startup when there are many search keys (Tom Lane, Vinod Sridharan) An indexable clause with many keys (for example, jsonbcol ?| array[...] with tens of thousands of array elements) took O(N2) time to start up, and was uncancelable for that interval too.
fixDetect missing support procedures in a BRIN index operator class, and report an error instead of crashing (Álvaro Herrera)
otherRespond to interrupts (such as query cancel) while waiting for asynchronous subplans of an Append plan node (Heikki Linnakangas) Previously, nothing would happen until one of the subplans becomes ready.
otherReport the I/O statistics of active WAL senders more frequently (Bertrand Drouvot) Previously, the pg_stat_io view failed to accumulate I/O performed by a WAL sender until that process exited. Now such I/O will be reported after at most one second's delay.
fixFix race condition in handling of synchronous_standby_names immediately after startup (Melnikov Maksim, Michael Paquier) For a short period after system startup, backends might fail to wait for synchronous commit even though synchronous_standby_names is enabled.
otherAvoid infinite loop if scram_iterations is set to INT_MAX (Kevin K Biju)
fixAvoid possible crashes due to double transformation of json_array()'s subquery (Tom Lane)
fixFix pg_strtof() to not crash with null endptr (Alexander Lakhin, Tom Lane)
fixFix crash after out-of-memory in certain GUC assignments (Daniel Gustafsson)
fixAvoid crash when a Snowball stemmer encounters an out-of-memory condition (Maksim Korotkov)
featurePrevent over-advancement of catalog xmin in “fast forward” mode of logical decoding (Zhijie Hou) This mistake could allow deleted catalog entries to be vacuumed away even though they were still potentially needed by the WAL-reading process.
featurePrevent incorrect reset of replication origin when an apply worker encounters an error but the error is caught and does not result in worker exit (Hayato Kuroda) This mistake could allow duplicate data to be applied.
fixFix wrong checkpoint details in error message about incorrect recovery timeline choice (David Steele) If the requested recovery timeline is not reachable, the reported checkpoint and timeline should be the values read from the backup_label, if there is one. This message previously reported values…
breakingRemove incorrect assertion in pgstat_report_stat() (Michael Paquier)
fixFix overly-strict assertion in gistFindCorrectParent() (Heikki Linnakangas)
fixFix rare assertion failure in standby servers when the primary is restarted (Heikki Linnakangas)
fixIn pg_amcheck and pg_upgrade, use the correct function to free allocations made by libpq (Michael Paquier, Ranier Vilela) These oversights could result in crashes in certain Windows build configurations, such as a debug build of libpq used by a non-debug build of the calling application.
featureAllow contrib/dblink queries to be interrupted by query cancel (Noah Misch) This change back-patches a v17-era fix. It prevents possible hangs in CREATE DATABASE and DROP DATABASE due to failure to detect deadlocks.
fixAvoid crashing with corrupt input data in contrib/pageinspect's heap_page_items() (Dmitry Kovalenko)
featurePrevent assertion failure in contrib/pg_freespacemap's pg_freespacemap() (Tender Wang) Applying pg_freespacemap() to a relation lacking storage (such as a view) caused an assertion failure, although there was no ill effect in non-assert builds. Add an error check to reject that case.
fixFix build failure on macOS 15.4 (Tom Lane, Peter Eisentraut) This macOS update broke our configuration probe for strchrnul().
featureUpdate time zone data files to tzdata release 2025b for DST law changes in Chile, plus historical corrections for Iran (Tom Lane) There is a new time zone America/Coyhaique for Chile's Aysén Region, to account for it changing to UTC-03 year-round and thus diverging from America/Santiago.
+8 more items in the release notessecurityImprove behavior of libpq's quoting functions (Andres Freund, Tom Lane) The changes made for CVE-2025-1094 had one serious oversight: PQescapeLiteral() and PQescapeIdentifier() failed to honor their string length parameter, instead always reading to the input string's trailing null. This resulted…
fixFix meson build system to correctly detect availability of the bsd_auth.h system header (Nazir Bilal Yavuz)