PostgreSQL 17.1 → 17.5
4 releases · 2 breaking changes · 6 security fixes · 0 advisories fixed
6security2breaking0deprecated9feature65fix
Breaking changes
- breaking Remove incorrect assertion in pgstat_report_stat() (Michael Paquier) in 17.5
- breaking Fix cases where a logical replication slot's restart_lsn could go backwards (Masahiko Sawada) Previously, restarting logical replication could sometimes cause the slot's restart point to be recomputed as an older value than had previously been advertised in pg_replication_slots. This is bad, since… in 17.2
Security changes
- security Avoid one-byte buffer overread when examining invalidly-encoded strings that are claimed to be in GB18030 encoding (Noah Misch, Andres Freund) While unlikely, a SIGSEGV crash could occur if an incomplete multibyte character appeared at the end of memory. This was possible both in the server and in… in 17.5
- security Improve behavior of libpq's quoting functions (Andres Freund, Tom Lane) The changes made for CVE-2025-1094 had one serious oversight: PQescapeLiteral() and PQescapeIdentifier() failed to honor their string length parameter, instead always reading to the input string's trailing null. This resulted… in 17.4
- security Harden PQescapeString and allied functions against invalidly-encoded input strings (Andres Freund, Noah Misch) Data-quoting functions supplied by libpq now fully check the encoding validity of their input. If invalid characters are detected, they report an error if possible. For the ones that lack… in 17.3
- security Fix cases where an operator family member operator or support procedure could become a dangling reference (Tom Lane) In some cases a data type could be dropped while references to its OID still remain in pg_amop or pg_amproc. While that caused no immediate issues, an attempt to drop the owning… in 17.3
- security Use SQL-standard function bodies in the declarations of contrib/earthdistance's SQL-language functions (Tom Lane, Ronan Dunklau) This change allows their references to contrib/cube to be resolved during extension creation, reducing the risk of search-path-based failures and possible attacks. In… in 17.3
- security Restore functionality of ALTER {ROLE|DATABASE} SET role (Tom Lane, Noah Misch) The fix for CVE-2024-10978 accidentally caused settings for role to not be applied if they come from non-interactive sources, including previous ALTER {ROLE|DATABASE} commands and the PGOPTIONS environment variable. in 17.2
Every release in between
securityAvoid one-byte buffer overread when examining invalidly-encoded strings that are claimed to be in GB18030 encoding (Noah Misch, Andres Freund) While unlikely, a SIGSEGV crash could occur if an incomplete multibyte character appeared at the end of memory. This was possible both in the server and in…
otherHandle self-referential foreign keys on partitioned tables correctly (Álvaro Herrera) Creating or attaching partitions failed to make the required catalog entries for a foreign-key constraint, if the table referenced by the constraint was the same partitioned table. This resulted in failure to…
featureAvoid data loss when merging compressed BRIN summaries in brin_bloom_union() (Tomas Vondra) The code failed to account for decompression results not being identical to the input objects, which would result in failure to add some of the data to the merged summary, leading to missed rows in index…
fixFix unexpected “attribute has wrong type” errors in UPDATE, DELETE, and MERGE queries that use whole-row table references to views or functions in FROM (Tom Lane)
fixFix MERGE into a partitioned table with DO NOTHING actions (Tender Wang) Some cases failed with “unknown action in MERGE WHEN clause” errors.
otherPrevent failure in INSERT commands when the table has a GENERATED column of a domain data type and the domain's constraints disallow null values (Jian He) Constraint failure was reported even if the generation expression produced a perfectly okay result.
otherCorrectly process references to outer CTE names that appear within a WITH clause attached to an INSERT/UPDATE/DELETE/MERGE command that's inside WITH (Tom Lane) The parser failed to detect disallowed recursion cases, nor did it account for such references when sorting CTEs into a usable order.
fixFix misprocessing of casts within the keys of JSON constructor expressions (Amit Langote)
otherDon't try to parallelize array_agg() when the argument is of an anonymous record type (Richard Guo, Tom Lane) The protocol for communicating with parallel workers doesn't support identifying the concrete record type that a worker is returning.
fixFix ARRAY(subquery) and ARRAY[expression, ...] constructs to produce sane results when the input is of type int2vector or oidvector (Tom Lane) This patch restores the behavior that existed before PostgreSQL 9.5: the result is of type int2vector[] or oidvector[].
fixFix possible erroneous reports of invalid affixes while parsing Ispell dictionaries (Jacob Brazeal)
fixFix ALTER TABLE ADD COLUMN to correctly handle the case of a domain type that has a default (Jian He, Tom Lane, Tender Wang) If a domain type has a default, adding a column of that type (without any explicit DEFAULT clause) failed to install the domain's default value in existing rows, instead…
featureAdd missing deparsing of the INDENT option of XMLSERIALIZE() (Jim Jones) Previously, views or rules using XMLSERIALIZE(... INDENT) were dumped without the INDENT clause, causing incorrect results after restore.
fixFix erroneous deductions from column NOT NULL constraints in the presence of outer joins (Richard Guo) In some cases the planner would discard an IS NOT NULL query condition, even though the condition applies after an outer join and thus is not redundant.
fixFix planner's failure to identify more than one hashable ScalarArrayOpExpr subexpression within a top-level expression (David Geier) This resulted in unnecessarily-inefficient execution of any additional subexpressions that could have been processed with a hash table (that is, IN, NOT IN, or = ANY…
fixFix incorrect table size estimate with low fill factor (Tomas Vondra) When the planner estimates the number of rows in a never-yet-analyzed table, it uses the table's fillfactor setting in the estimation, but it neglected to clamp the result to at least one row per page. A low fillfactor could…
fixFix performance issues in GIN index search startup when there are many search keys (Tom Lane, Vinod Sridharan) An indexable clause with many keys (for example, jsonbcol ?| array[...] with tens of thousands of array elements) took O(N2) time to start up, and was uncancelable for that interval too.
fixDetect missing support procedures in a BRIN index operator class, and report an error instead of crashing (Álvaro Herrera)
fixFix race condition in handling of synchronous_standby_names immediately after startup (Melnikov Maksim, Michael Paquier) For a short period after system startup, backends might fail to wait for synchronous commit even though synchronous_standby_names is enabled.
fixAvoid possible crashes due to double transformation of json_array()'s subquery (Tom Lane)
fixFix pg_strtof() to not crash with null endptr (Alexander Lakhin, Tom Lane)
fixFix crash after out-of-memory in certain GUC assignments (Daniel Gustafsson)
fixAvoid crash when a Snowball stemmer encounters an out-of-memory condition (Maksim Korotkov)
fixFix over-enthusiastic freeing of SpecialJoinInfo structs during planning (Richard Guo) This led to crashes during planning if partitionwise joining is enabled.
featurePrevent over-advancement of catalog xmin in “fast forward” mode of logical decoding (Zhijie Hou) This mistake could allow deleted catalog entries to be vacuumed away even though they were still potentially needed by the WAL-reading process.
featurePrevent incorrect reset of replication origin when an apply worker encounters an error but the error is caught and does not result in worker exit (Hayato Kuroda) This mistake could allow duplicate data to be applied.
fixFix crash in logical replication if the subscriber's partitioned table has a BRIN index (Tom Lane)
fixFix wrong checkpoint details in error message about incorrect recovery timeline choice (David Steele) If the requested recovery timeline is not reachable, the reported checkpoint and timeline should be the values read from the backup_label, if there is one. This message previously reported values…
fixFix order of operations in smgropen() (Andres Freund) Ensure that the SMgrRelation object is fully initialized before calling the smgr_open callback, so that it can be cleaned up properly if the callback fails.
breakingRemove incorrect assertion in pgstat_report_stat() (Michael Paquier)
fixFix overly-strict assertion in gistFindCorrectParent() (Heikki Linnakangas)
fixFix rare assertion failure in standby servers when the primary is restarted (Heikki Linnakangas)
fixIn pg_amcheck and pg_upgrade, use the correct function to free allocations made by libpq (Michael Paquier, Ranier Vilela) These oversights could result in crashes in certain Windows build configurations, such as a debug build of libpq used by a non-debug build of the calling application.
fixFix reindexdb's scheduling of parallel reindex operations (Alexander Korotkov) The original coding failed to achieve the expected amount of parallelism.
fixAvoid crashing with corrupt input data in contrib/pageinspect's heap_page_items() (Dmitry Kovalenko)
featurePrevent assertion failure in contrib/pg_freespacemap's pg_freespacemap() (Tender Wang) Applying pg_freespacemap() to a relation lacking storage (such as a view) caused an assertion failure, although there was no ill effect in non-assert builds. Add an error check to reject that case.
fixFix build failure when an old version of libpq_fe.h is present in system include directories (Tom Lane)
fixFix build failure on macOS 15.4 (Tom Lane, Peter Eisentraut) This macOS update broke our configuration probe for strchrnul().
fixFix valgrind labeling of per-buffer data of read streams (Thomas Munro) This affects no core code in released versions of PostgreSQL, but an extension using the per-buffer data feature might have encountered spurious failures when being tested under valgrind.
featureUpdate time zone data files to tzdata release 2025b for DST law changes in Chile, plus historical corrections for Iran (Tom Lane) There is a new time zone America/Coyhaique for Chile's Aysén Region, to account for it changing to UTC-03 year-round and thus diverging from America/Santiago.
+21 more items in the release notessecurityImprove behavior of libpq's quoting functions (Andres Freund, Tom Lane) The changes made for CVE-2025-1094 had one serious oversight: PQescapeLiteral() and PQescapeIdentifier() failed to honor their string length parameter, instead always reading to the input string's trailing null. This resulted…
fixFix small memory leak in pg_createsubscriber (Ranier Vilela)
fixFix meson build system to correctly detect availability of the bsd_auth.h system header (Nazir Bilal Yavuz)
securityHarden PQescapeString and allied functions against invalidly-encoded input strings (Andres Freund, Noah Misch) Data-quoting functions supplied by libpq now fully check the encoding validity of their input. If invalid characters are detected, they report an error if possible. For the ones that lack…
otherRestore auto-truncation of database and user names appearing in connection requests (Nathan Bossart) This reverts a v17 change that proved to cause trouble for some users. Over-length names should be truncated in an encoding-aware fashion, but for now just return to the former behavior of blind…
otherExclude parallel workers from connection privilege checks and limits (Tom Lane) Do not check datallowconn, rolcanlogin, and ACL_CONNECT privileges when starting a parallel worker, instead assuming that it's enough for the leader process to have passed similar checks originally. This avoids, for…
fixFix possible failure to return all matching tuples for a btree index scan with a ScalarArrayOp (= ANY) condition (Peter Geoghegan)
fixFix possible re-use of stale results in window aggregates (David Rowley) A window aggregate with a “run condition” optimization and a pass-by-reference result type might incorrectly return the result from the previous partition instead of performing a fresh calculation.
fixFix race condition that could cause failure to add a newly-inserted catalog entry to a catalog cache list (Heikki Linnakangas) This could result, for example, in failure to use a newly-created function within an existing session.
fixFix data corruption when relation truncation fails (Thomas Munro) The filesystem calls needed to perform relation truncation could fail, leaving inconsistent state on disk (for example, effectively reviving deleted data). We can't really prevent that, but we can recover by dint of making such…
fixPrevent checkpoints from starting during relation truncation (Robert Haas) This avoids a race condition wherein the modified file might not get fsync'd before completing the checkpoint, creating a risk of data corruption if the operating system crashes soon after.
fixFix incorrect tg_updatedcols values passed to AFTER UPDATE triggers (Tom Lane) In some cases the tg_updatedcols bitmap could describe the set of columns updated by an earlier command in the same transaction, fooling the trigger into doing the wrong thing. Also, prevent memory bloat caused by…
fixFix detach of a partition that has its own foreign-key constraint referencing a partitioned table (Amul Sul) In common cases, foreign keys are defined on a partitioned table's top level; but if instead one is defined on a partition and references a partitioned table, and the referencing partition…
fixFix pg_get_constraintdef's support for NOT NULL constraints on domains (Álvaro Herrera)
fixFix mis-processing of to_timestamp's FFn format codes (Tom Lane) An integer format code immediately preceding FFn would consume all available digits, leaving none for FFn.
fixFix planning of pre-sorted UNION operations for cases where the input column datatypes don't all match (David Rowley) This error could lead to sorting data with the wrong sort operator, with consequences ranging from no visible problem to core dumps.
featureDon't merge UNION operations if their column collations aren't consistent (Tom Lane) Previously we ignored collations when deciding if it's safe to merge UNION steps into a single N-way UNION operation. This was arguably valid before the introduction of nondeterministic collations, but it's not…
fixFix missed expression processing for partition pruning steps (Tom Lane) This oversight could lead to “unrecognized node type” errors, and perhaps other problems, in queries accessing partitioned tables.
featureAllow dshash tables to grow past 1GB (Matthias van de Meent) This avoids errors like “invalid DSA memory alloc request size”. The case can occur for example in transactions that process several million tables.
fixFix unintended promotion of FATAL errors to PANIC during early process startup (Noah Misch) This fixes some unlikely cases that would result in “PANIC: proc_exit() called in child process”.
securityFix cases where an operator family member operator or support procedure could become a dangling reference (Tom Lane) In some cases a data type could be dropped while references to its OID still remain in pg_amop or pg_amproc. While that caused no immediate issues, an attempt to drop the owning…
fixFix multiple memory leaks in logical decoding output (Vignesh C, Masahiko Sawada, Boyu Yang)
fixFix small memory leak when updating the application_name or cluster_name settings (Tofig Aliev)
fixAvoid crash when a background process tries to check a new value of synchronized_standby_slots (Álvaro Herrera)
fixFix unsafe order of operations during cache lookups (Noah Misch) The only known consequence was a usually-harmless “you don't own a lock of type ExclusiveLock” warning during GRANT TABLESPACE.
fixAvoid potential use-after-free in parallel vacuum (Vallimaharajan G, John Naylor) This bug seems to have no consequences in standard builds, but it's theoretically a hazard.
fixFix possible “failed to resolve name” failures when using JIT on older ARM platforms (Thomas Munro) This could occur as a consequence of inconsistency about the default setting of -moutline-atomics between gcc and clang. At least Debian and Ubuntu are known to ship gcc and clang compilers that…
fixFix assertion failure in WITH RECURSIVE ... UNION queries (David Rowley)
fixFix assertion failure at shutdown when writing out the statistics file (Michael Paquier)
fixAvoid crash if a server process tried to iterate over a shared radix tree that it didn't create (Masahiko Sawada) There is no code in core PostgreSQL that does this, but an extension might wish to.
fixFix PL/Tcl to compile with Tcl 9 (Peter Eisentraut)
fixFix psql to safely handle file path names that are encoded in SJIS (Tom Lane) Some two-byte characters in SJIS have a second byte that is equal to ASCII backslash (\). These characters were corrupted by path name normalization, preventing access to files whose names include such characters.
featureAdd psql tab completion for COPY (MERGE INTO) (Jian He)
fixFix use of wrong version of pqsignal() in pgbench and psql (Fujii Masao, Tom Lane) This error could lead to misbehavior when using the -T option in pgbench or the \watch command in psql, due to interrupted system calls not being resumed as expected.
fixFix misexecution of some nested \if constructs in pgbench (Michail Nikolaev) An \if command appearing within a false (not-being-executed) \if branch was incorrectly treated the same as \elif.
fixFix possible crash in pg_dump with identity sequences attached to tables that are extension members (Tom Lane)
fixFix memory leak in pg_restore with zstd-compressed data (Tom Lane) The leak was per-decompression-operation, so would be most noticeable with a dump containing many tables or large objects.
fixFix pg_basebackup to correctly handle pg_wal.tar files exceeding 2GB on Windows (Davinder Singh, Thomas Munro)
securityUse SQL-standard function bodies in the declarations of contrib/earthdistance's SQL-language functions (Tom Lane, Ronan Dunklau) This change allows their references to contrib/cube to be resolved during extension creation, reducing the risk of search-path-based failures and possible attacks. In…
fixDetect version mismatch between contrib/pageinspect's SQL declarations and the underlying shared library (Tomas Vondra) Previously, such a mismatch could result in a crash while calling brin_page_items(). Instead throw an error recommending updating the extension.
fixWhen trying to cancel a remote query in contrib/postgres_fdw, re-issue the cancel request a few times if it didn't seem to do anything (Tom Lane) This fixes a race condition where we might try to cancel a just-sent query before the remote server has started to process it, so that the initial…
fixFix meson build system to support old OpenSSL libraries on Windows (Darek Slusarczyk) Add support for the legacy library names ssleay32 and libeay32.
fixFix meson configuration process to correctly detect OSSP's uuid.h header file under MSVC (Andrew Dunstan)
+31 more items in the release notesotherRepair ABI break for extensions that work with struct ResultRelInfo (Tom Lane) Last week's minor releases unintentionally broke binary compatibility with timescaledb and several other extensions. Restore the affected structure to its previous size, so that such extensions need not be rebuilt.
securityRestore functionality of ALTER {ROLE|DATABASE} SET role (Tom Lane, Noah Misch) The fix for CVE-2024-10978 accidentally caused settings for role to not be applied if they come from non-interactive sources, including previous ALTER {ROLE|DATABASE} commands and the PGOPTIONS environment variable.
breakingFix cases where a logical replication slot's restart_lsn could go backwards (Masahiko Sawada) Previously, restarting logical replication could sometimes cause the slot's restart point to be recomputed as an older value than had previously been advertised in pg_replication_slots. This is bad, since…
otherAvoid deleting still-needed WAL files during pg_rewind (Polina Bungina, Alexander Kukushkin) Previously, in unlucky cases, it was possible for pg_rewind to remove important WAL files from the rewound demoted primary. In particular this happens if those files have been marked for archival (i.e.,…
fixFix race conditions associated with dropping shared statistics entries (Kyotaro Horiguchi, Michael Paquier) These bugs could lead to loss of statistics data, assertion failures, or “can only drop stats once” errors.
otherCount index scans in contrib/bloom indexes in the statistics views, such as the pg_stat_user_indexes.idx_scan counter (Masahiro Ikeda)
fixFix crash when checking to see if an index's opclass options have changed (Alexander Korotkov) Some forms of ALTER TABLE would fail if the table has an index with non-default operator class options.
fixAvoid assertion failure caused by disconnected NFA sub-graphs in regular expression parsing (Tom Lane) This bug does not appear to have any visible consequences in non-assert builds.