PostgreSQL 17.4 → 17.6
2 releases · 4 breaking changes · 4 security fixes · 0 advisories fixed
4security4breaking1deprecated16feature51fix
Breaking changes
- breaking Fix inconsistent spelling of LWLock names for MultiXactOffsetSLRU and MultiXactMemberSLRU (Bertrand Drouvot) This resulted in different wait-event names being displayed in pg_wait_events and pg_stat_activity, potentially breaking monitoring queries that join those views. in 17.6
- breaking Avoid premature removal of old WAL during checkpoints (Vitaly Davydov) If a replication slot's restart point is advanced while a checkpoint is in progress, no-longer-needed WAL segments could get removed too soon, leading to recovery failure if the database crashes immediately afterwards. Fix by… in 17.6
- breaking Remove faulty assertion that a command tag must have been determined by the end of PortalRunMulti() (Álvaro Herrera) This failed in edge cases such as an empty prepared statement. in 17.6
- breaking Remove incorrect assertion in pgstat_report_stat() (Michael Paquier) in 17.5
Security changes
- security Tighten security checks in planner estimation functions (Dean Rasheed) The fix for CVE-2017-7484, plus followup fixes, intended to prevent leaky functions from being applied to statistics data for columns that the calling user does not have permission to read. Two gaps in that protection have been… in 17.6
- security Prevent pg_dump scripts from being used to attack the user running the restore (Nathan Bossart) Since dump/restore operations typically involve running SQL commands as superuser, the target database installation must trust the source server. However, it does not follow that the operating system… in 17.6
- security Convert newlines to spaces in names included in comments in pg_dump output (Noah Misch) Object names containing newlines offered the ability to inject arbitrary SQL commands into the output script. (Without the preceding fix, injection of psql meta-commands would also be possible this way.)… in 17.6
- security Avoid one-byte buffer overread when examining invalidly-encoded strings that are claimed to be in GB18030 encoding (Noah Misch, Andres Freund) While unlikely, a SIGSEGV crash could occur if an incomplete multibyte character appeared at the end of memory. This was possible both in the server and in… in 17.5
Deprecations
- deprecated Avoid deprecation warnings when building with libxml2 2.14 and later (Michael Paquier) in 17.6
Every release in between
securityTighten security checks in planner estimation functions (Dean Rasheed) The fix for CVE-2017-7484, plus followup fixes, intended to prevent leaky functions from being applied to statistics data for columns that the calling user does not have permission to read. Two gaps in that protection have been…
securityPrevent pg_dump scripts from being used to attack the user running the restore (Nathan Bossart) Since dump/restore operations typically involve running SQL commands as superuser, the target database installation must trust the source server. However, it does not follow that the operating system…
securityConvert newlines to spaces in names included in comments in pg_dump output (Noah Misch) Object names containing newlines offered the ability to inject arbitrary SQL commands into the output script. (Without the preceding fix, injection of psql meta-commands would also be possible this way.)…
fixFix incorrect distance calculation in BRIN numeric_minmax_multi_ops support function (Peter Eisentraut, Tom Lane) The results were sometimes wrong on 64-bit platforms, and wildly wrong on 32-bit platforms. This did not produce obvious failures because the logic is only used to choose how to merge…
fixAvoid regression in the size of XML input that we will accept (Michael Paquier, Erik Wienhold) Our workaround for a bug in early 2.13.x releases of libxml2 made use of a code path that rejects text chunks exceeding 10MB, whereas the previous coding did not. Those early releases are presumably…
fixFix MERGE problems with concurrent updates (Dean Rasheed) If a MERGE inside a CTE attempts an update or delete on a table with BEFORE ROW triggers, and a concurrent UPDATE or DELETE changes the target row, the MERGE command would fail (crashing in the case of an update action, and potentially…
fixFix MERGE into a plain-inheritance parent table (Dean Rasheed) Insertions into such a target table could crash or produce incorrect query results due to failing to handle WITH CHECK OPTION and RETURNING actions.
featureAllow tables with statement-level triggers to become partitions or inheritance children (Etsuro Fujita) We do not allow partitions or inheritance child tables to have row-level triggers with transition tables, because an operation on the whole inheritance tree would need to maintain a separate…
featureAllow resetting unknown custom parameters with reserved prefixes (Nathan Bossart) Previously, if a parameter setting had been stored using ALTER DATABASE/ROLE/SYSTEM, the stored setting could not be removed if the parameter was unknown but had a reserved prefix. This case could arise if an…
fixFix a potential deadlock during ALTER SUBSCRIPTION ... DROP PUBLICATION (Ajin Cherian) Ensure that server processes acquire catalog locks in a consistent order during replication origin drops.
featureShorten the race condition window for creating indexes with conflicting names (Tom Lane) When choosing an auto-generated name for an index, avoid conflicting with not-yet-committed pg_class rows as well as fully-valid ones. This avoids possibly choosing the same name as some concurrent CREATE…
fixFix processing of character classes within SIMILAR TO regular expressions (Laurenz Albe) The code that translates SIMILAR TO pattern matching expressions to POSIX-style regular expressions did not consider that square brackets can be nested. For example, in a pattern like [[:alpha:]%_], the code…
featureWhen deparsing queries, always add parentheses around the expression in FETCH FIRST expression ROWS WITH TIES clauses (Heikki Linnakangas) This avoids some cases where the deparsed result wasn't syntactically valid.
fixAvoid infinite wait in logical decoding when reading a partially-written WAL record (Vignesh C) If the server crashes after writing the first part of a WAL record that would span multiple pages, subsequent logical decoding of the WAL stream would wait for data to arrive on the next WAL page. That…
breakingFix inconsistent spelling of LWLock names for MultiXactOffsetSLRU and MultiXactMemberSLRU (Bertrand Drouvot) This resulted in different wait-event names being displayed in pg_wait_events and pg_stat_activity, potentially breaking monitoring queries that join those views.
fixFix inconsistent quoting of role names in ACL strings (Tom Lane) The previous quoting rule was locale-sensitive, which could lead to portability problems when transferring aclitem values across installations. (pg_dump does not do that, but other tools might.) To ensure consistency, always quote…
fixFix potentially-incorrect decompression of LZ4-compressed archive data (Mikhail Gribkov) This error seems to manifest only with not-very-compressible input data, which may explain why it escaped detection.
fixAvoid re-distributing cache invalidation messages from other transactions during logical replication (vignesh C) Our previous round of minor releases included a bug fix to ensure that replication receiver processes would respond to cross-process cache invalidation messages, preventing them from…
breakingAvoid premature removal of old WAL during checkpoints (Vitaly Davydov) If a replication slot's restart point is advanced while a checkpoint is in progress, no-longer-needed WAL segments could get removed too soon, leading to recovery failure if the database crashes immediately afterwards. Fix by…
fixNever move a replication slot's confirmed-flush position backwards (Shveta Malik) In some cases a replication client could acknowledge an LSN that's past what it has stored persistently, and then perhaps send an older LSN after a restart. We consider this not-a-bug so long as the client did not…
featurePrevent excessive delays before launching new logical replication workers (Tom Lane) In some cases the logical replication launcher could sleep considerably longer than the configured wal_retrieve_retry_interval before launching a new worker.
fixFix use-after-free during logical replication of INSERT ... ON CONFLICT (Ethan Mertz, Michael Paquier) This could result in incorrect progress reporting, or with very bad luck it could result in a crash of the WAL sender process.
featureAllow waiting for a transaction on a standby server to be interrupted (Kevin K Biju) Creation of a replication slot on a standby server may require waiting for some active transaction(s) to finish on the primary and then be replayed on the standby. Since that could be an indefinite wait, it's…
fixFix per-relation memory leakage in autovacuum (Tom Lane)
fixFix session-lifespan memory leaks in XMLSERIALIZE(... INDENT) (Dmitry Kovalenko, Tom Lane)
fixFix possible crash after out-of-memory when allocating large chunks with the “bump” allocator (Tom Lane)
fixFix some places that might try to fetch toasted fields of system catalogs without any snapshot (Nathan Bossart) This could result in an assertion failure or “cannot fetch toast data without an active snapshot” error.
breakingRemove faulty assertion that a command tag must have been determined by the end of PortalRunMulti() (Álvaro Herrera) This failed in edge cases such as an empty prepared statement.
fixFix assertion failure in XMLTABLE parsing (Richard Guo)
fixRestore the ability to run PL/pgSQL expressions in parallel (Dipesh Dhameliya) PL/pgSQL's notion of an “expression” is very broad, encompassing any SQL SELECT query that returns a single column and no more than one row. So there are cases, for example evaluation of an aggregate function, where the…
fixFix edge-case resource leaks in PL/Python error reporting (Tom Lane) An out-of-memory failure while reporting an error from Python could result in failure to drop reference counts on Python objects, leading to session-lifespan memory leakage.
fixFix libpq's PQcancelCreate() function for the case where the server's address was specified using hostaddr (Sergei Kornilov) libpq would crash if the resulting cancel object was actually used.
fixFix libpq's PQport() function to never return NULL unless the passed connection is NULL (Daniele Varrazzo) This is the documented behavior, but recent libpq versions would return NULL in some cases where the user had not provided a port specification. Revert to our historical behavior of returning…
fixFix timing-dependent failures in SSL and GSSAPI data transmission (Tom Lane) When using SSL or GSSAPI encryption in non-blocking mode, libpq sometimes failed with “SSL error: bad length” or “GSSAPI caller failed to retransmit all data needing to be retried”.
fixFix duplicate transaction replay when initializing a subscription with pg_createsubscriber (Shlok Kyal) It was possible for the last transaction processed during subscriber recovery to be sent again once normal replication begins.
featureIn pg_upgrade, check for inconsistent inherited not-null constraints (Ali Akbar) PostgreSQL versions before 18 allow an inherited column not-null constraint to be dropped. However, this results in a schema that cannot be restored, leading to failure in pg_upgrade. Detect such cases during…
featureAvoid possible leak of the open connection during contrib/dblink connection establishment (Tom Lane) In the rare scenario where we hit out-of-memory while inserting the new connection object into dblink's hashtable, the open connection would be leaked until end of session, leaving an idle session…
featurePrevent assertion failure in contrib/pg_prewarm (Masahiro Ikeda) Applying pg_prewarm() to a relation lacking storage (such as a view) caused an assertion failure, although there was no ill effect in non-assert builds. Add an error check to reject that case.
featureEnsure that directories listed in configure's --with-includes and --with-libraries options are searched before system-supplied directories (Tom Lane) A common reason for using these options is to allow a user-built version of some library to override the system-supplied version. However, that…
deprecatedAvoid deprecation warnings when building with libxml2 2.14 and later (Michael Paquier)
+31 more items in the release notessecurityAvoid one-byte buffer overread when examining invalidly-encoded strings that are claimed to be in GB18030 encoding (Noah Misch, Andres Freund) While unlikely, a SIGSEGV crash could occur if an incomplete multibyte character appeared at the end of memory. This was possible both in the server and in…
otherHandle self-referential foreign keys on partitioned tables correctly (Álvaro Herrera) Creating or attaching partitions failed to make the required catalog entries for a foreign-key constraint, if the table referenced by the constraint was the same partitioned table. This resulted in failure to…
featureAvoid data loss when merging compressed BRIN summaries in brin_bloom_union() (Tomas Vondra) The code failed to account for decompression results not being identical to the input objects, which would result in failure to add some of the data to the merged summary, leading to missed rows in index…
fixFix unexpected “attribute has wrong type” errors in UPDATE, DELETE, and MERGE queries that use whole-row table references to views or functions in FROM (Tom Lane)
fixFix MERGE into a partitioned table with DO NOTHING actions (Tender Wang) Some cases failed with “unknown action in MERGE WHEN clause” errors.
otherPrevent failure in INSERT commands when the table has a GENERATED column of a domain data type and the domain's constraints disallow null values (Jian He) Constraint failure was reported even if the generation expression produced a perfectly okay result.
otherCorrectly process references to outer CTE names that appear within a WITH clause attached to an INSERT/UPDATE/DELETE/MERGE command that's inside WITH (Tom Lane) The parser failed to detect disallowed recursion cases, nor did it account for such references when sorting CTEs into a usable order.
fixFix misprocessing of casts within the keys of JSON constructor expressions (Amit Langote)
otherDon't try to parallelize array_agg() when the argument is of an anonymous record type (Richard Guo, Tom Lane) The protocol for communicating with parallel workers doesn't support identifying the concrete record type that a worker is returning.
fixFix ARRAY(subquery) and ARRAY[expression, ...] constructs to produce sane results when the input is of type int2vector or oidvector (Tom Lane) This patch restores the behavior that existed before PostgreSQL 9.5: the result is of type int2vector[] or oidvector[].
fixFix possible erroneous reports of invalid affixes while parsing Ispell dictionaries (Jacob Brazeal)
fixFix ALTER TABLE ADD COLUMN to correctly handle the case of a domain type that has a default (Jian He, Tom Lane, Tender Wang) If a domain type has a default, adding a column of that type (without any explicit DEFAULT clause) failed to install the domain's default value in existing rows, instead…
featureAdd missing deparsing of the INDENT option of XMLSERIALIZE() (Jim Jones) Previously, views or rules using XMLSERIALIZE(... INDENT) were dumped without the INDENT clause, causing incorrect results after restore.
fixFix erroneous deductions from column NOT NULL constraints in the presence of outer joins (Richard Guo) In some cases the planner would discard an IS NOT NULL query condition, even though the condition applies after an outer join and thus is not redundant.
fixFix planner's failure to identify more than one hashable ScalarArrayOpExpr subexpression within a top-level expression (David Geier) This resulted in unnecessarily-inefficient execution of any additional subexpressions that could have been processed with a hash table (that is, IN, NOT IN, or = ANY…
fixFix incorrect table size estimate with low fill factor (Tomas Vondra) When the planner estimates the number of rows in a never-yet-analyzed table, it uses the table's fillfactor setting in the estimation, but it neglected to clamp the result to at least one row per page. A low fillfactor could…
fixFix performance issues in GIN index search startup when there are many search keys (Tom Lane, Vinod Sridharan) An indexable clause with many keys (for example, jsonbcol ?| array[...] with tens of thousands of array elements) took O(N2) time to start up, and was uncancelable for that interval too.
fixDetect missing support procedures in a BRIN index operator class, and report an error instead of crashing (Álvaro Herrera)
fixFix race condition in handling of synchronous_standby_names immediately after startup (Melnikov Maksim, Michael Paquier) For a short period after system startup, backends might fail to wait for synchronous commit even though synchronous_standby_names is enabled.
fixAvoid possible crashes due to double transformation of json_array()'s subquery (Tom Lane)
fixFix pg_strtof() to not crash with null endptr (Alexander Lakhin, Tom Lane)
fixFix crash after out-of-memory in certain GUC assignments (Daniel Gustafsson)
fixAvoid crash when a Snowball stemmer encounters an out-of-memory condition (Maksim Korotkov)
fixFix over-enthusiastic freeing of SpecialJoinInfo structs during planning (Richard Guo) This led to crashes during planning if partitionwise joining is enabled.
featurePrevent over-advancement of catalog xmin in “fast forward” mode of logical decoding (Zhijie Hou) This mistake could allow deleted catalog entries to be vacuumed away even though they were still potentially needed by the WAL-reading process.
featurePrevent incorrect reset of replication origin when an apply worker encounters an error but the error is caught and does not result in worker exit (Hayato Kuroda) This mistake could allow duplicate data to be applied.
fixFix crash in logical replication if the subscriber's partitioned table has a BRIN index (Tom Lane)
fixFix wrong checkpoint details in error message about incorrect recovery timeline choice (David Steele) If the requested recovery timeline is not reachable, the reported checkpoint and timeline should be the values read from the backup_label, if there is one. This message previously reported values…
fixFix order of operations in smgropen() (Andres Freund) Ensure that the SMgrRelation object is fully initialized before calling the smgr_open callback, so that it can be cleaned up properly if the callback fails.
breakingRemove incorrect assertion in pgstat_report_stat() (Michael Paquier)
fixFix overly-strict assertion in gistFindCorrectParent() (Heikki Linnakangas)
fixFix rare assertion failure in standby servers when the primary is restarted (Heikki Linnakangas)
fixIn pg_amcheck and pg_upgrade, use the correct function to free allocations made by libpq (Michael Paquier, Ranier Vilela) These oversights could result in crashes in certain Windows build configurations, such as a debug build of libpq used by a non-debug build of the calling application.
fixFix reindexdb's scheduling of parallel reindex operations (Alexander Korotkov) The original coding failed to achieve the expected amount of parallelism.
fixAvoid crashing with corrupt input data in contrib/pageinspect's heap_page_items() (Dmitry Kovalenko)
featurePrevent assertion failure in contrib/pg_freespacemap's pg_freespacemap() (Tender Wang) Applying pg_freespacemap() to a relation lacking storage (such as a view) caused an assertion failure, although there was no ill effect in non-assert builds. Add an error check to reject that case.
fixFix build failure when an old version of libpq_fe.h is present in system include directories (Tom Lane)
fixFix build failure on macOS 15.4 (Tom Lane, Peter Eisentraut) This macOS update broke our configuration probe for strchrnul().
fixFix valgrind labeling of per-buffer data of read streams (Thomas Munro) This affects no core code in released versions of PostgreSQL, but an extension using the per-buffer data feature might have encountered spurious failures when being tested under valgrind.
featureUpdate time zone data files to tzdata release 2025b for DST law changes in Chile, plus historical corrections for Iran (Tom Lane) There is a new time zone America/Coyhaique for Chile's Aysén Region, to account for it changing to UTC-03 year-round and thus diverging from America/Santiago.
+21 more items in the release notes