Upgrading from 10.4 to 10.6 gives you 6.1 months worth of fixes (118 of them)

List of changes:

• ⇑ Upgrade to 10.5 released on 2018-08-09 - docs

  • Fix failure to reset libpq's state fully between connection attempts (Tom Lane)

    An unprivileged user of dblink or postgres_fdw could bypass the checks intended to prevent use of server-side credentials, such as a ~/.pgpass file owned by the operating-system user running the server. Servers allowing peer authentication on local connections are particularly vulnerable. Other attacks such as SQL injection into a postgres_fdw session are also possible. Attacking postgres_fdw in this way requires the ability to create a foreign server object with selected connection parameters, but any user with access to dblink could exploit the problem. In general, an attacker with the ability to select the connection parameters for a libpq-using application could cause mischief, though other plausible attack scenarios are harder to think of. Our thanks to Andrew Krasichkov for reporting this issue. (CVE-2018-10915)

  • Fix INSERT ... ON CONFLICT UPDATE through a view that isn't just SELECT * FROM ... (Dean Rasheed, Amit Langote)

    Erroneous expansion of an updatable view could lead to crashes or “attribute ... has the wrong type” errors, if the view's SELECT list doesn't match one-to-one with the underlying table's columns. Furthermore, this bug could be leveraged to allow updates of columns that an attacking user lacks UPDATE privilege for, if that user has INSERT and UPDATE privileges for some other column(s) of the table. Any user could also use it for disclosure of server memory. (CVE-2018-10925)

  • Ensure that updates to the relfrozenxid and relminmxid values for “nailed” system catalogs are processed in a timely fashion (Andres Freund)

    Overoptimistic caching rules could prevent these updates from being seen by other sessions, leading to spurious errors and/or data corruption. The problem was significantly worse for shared catalogs, such as pg_authid, because the stale cache data could persist into new sessions as well as existing ones.

  • Fix case where a freshly-promoted standby crashes before having completed its first post-recovery checkpoint (Michael Paquier, Kyotaro Horiguchi, Pavan Deolasee, Álvaro Herrera)

    This led to a situation where the server did not think it had reached a consistent database state during subsequent WAL replay, preventing restart.

  • Avoid emitting a bogus WAL record when recycling an all-zero btree page (Amit Kapila)

    This mistake has been seen to cause assertion failures, and potentially it could result in unnecessary query cancellations on hot standby servers.

  • During WAL replay, guard against corrupted record lengths exceeding 1GB (Michael Paquier)

    Treat such a case as corrupt data. Previously, the code would try to allocate space and get a hard error, making recovery impossible.

  • When ending recovery, delay writing the timeline history file as long as possible (Heikki Linnakangas)

    This avoids some situations where a failure during recovery cleanup (such as a problem with a two-phase state file) led to inconsistent timeline state on-disk.

  • Improve performance of WAL replay for transactions that drop many relations (Fujii Masao)

    This change reduces the number of times that shared buffers are scanned, so that it is of most benefit when that setting is large.

  • Improve performance of lock releasing in standby server WAL replay (Thomas Munro)

  • Make logical WAL senders report streaming state correctly (Simon Riggs, Sawada Masahiko)

    The code previously mis-detected whether or not it had caught up with the upstream server.

  • Ensure that a snapshot is provided when executing data type input functions in logical replication subscribers (Minh-Quan Tran, Álvaro Herrera)

    This omission led to failures in some cases, such as domains with constraints using SQL-language functions.

  • Fix bugs in snapshot handling during logical decoding, allowing wrong decoding results in rare cases (Arseny Sher, Álvaro Herrera)

  • Add subtransaction handling in logical-replication table synchronization workers (Amit Khandekar, Robert Haas)

    Previously, table synchronization could misbehave if any subtransactions were aborted after modifying a table being synchronized.

  • Ensure a table's cached index list is correctly rebuilt after an index creation fails partway through (Peter Geoghegan)

    Previously, the failed index's OID could remain in the list, causing problems later in the same session.

  • Fix mishandling of empty uncompressed posting list pages in GIN indexes (Sivasubramanian Ramasubramanian, Alexander Korotkov)

    This could result in an assertion failure after pg_upgrade of a pre-9.4 GIN index (9.4 and later will not create such pages).

  • Pad arrays of unnamed POSIX semaphores to reduce cache line sharing (Thomas Munro)

    This reduces contention on many-CPU systems, fixing a performance regression (compared to previous releases) on Linux and FreeBSD.

  • Ensure that a process doing a parallel index scan will respond to signals (Amit Kapila)

    Previously, parallel workers could get stuck waiting for a lock on an index page, and not notice requests to abort the query.

  • Ensure that VACUUM will respond to signals within btree page deletion loops (Andres Freund)

    Corrupted btree indexes could result in an infinite loop here, and that previously wasn't interruptible without forcing a crash.

  • Fix hash-join costing mistake introduced with inner_unique optimization (David Rowley)

    This could lead to bad plan choices in situations where that optimization was applicable.

  • Fix misoptimization of equivalence classes involving composite-type columns (Tom Lane)

    This resulted in failure to recognize that an index on a composite column could provide the sort order needed for a mergejoin on that column.

  • Fix planner to avoid “ORDER/GROUP BY expression not found in targetlist” errors in some queries with set-returning functions (Tom Lane)

  • Fix handling of partition keys whose data type uses a polymorphic btree operator class, such as arrays (Amit Langote, Álvaro Herrera)

  • Fix SQL-standard FETCH FIRST syntax to allow parameters ($n), as the standard expects (Andrew Gierth)

  • Remove undocumented restriction against duplicate partition key columns (Yugo Nagata)

  • Disallow temporary tables from being partitions of non-temporary tables (Amit Langote, Michael Paquier)

    While previously allowed, this case didn't work reliably.

  • Fix EXPLAIN's accounting for resource usage, particularly buffer accesses, in parallel workers (Amit Kapila, Robert Haas)

  • Fix SHOW ALL to show all settings to roles that are members of pg_read_all_settings, and also allow such roles to see source filename and line number in the pg_settings view (Laurenz Albe, Álvaro Herrera)

  • Fix failure to schema-qualify some object names in getObjectDescription and getObjectIdentity output (Kyotaro Horiguchi, Tom Lane)

    Names of collations, conversions, text search objects, publication relations, and extended statistics objects were not schema-qualified when they should be.

  • Fix CREATE AGGREGATE type checking so that parallelism support functions can be attached to variadic aggregates (Alexey Bashtanov)

  • Widen COPY FROM's current-line-number counter from 32 to 64 bits (David Rowley)

    This avoids two problems with input exceeding 4G lines: COPY FROM WITH HEADER would drop a line every 4G lines, not only the first line, and error reports could show a wrong line number.

  • Allow replication slots to be dropped in single-user mode (Álvaro Herrera)

    This use-case was accidentally broken in release 10.0.

  • Fix incorrect results from variance(int4) and related aggregates when run in parallel aggregation mode (David Rowley)

  • Process TEXT and CDATA nodes correctly in xmltable() column expressions (Markus Winand)

  • Cope with possible failure of OpenSSL's RAND_bytes() function (Dean Rasheed, Michael Paquier)

    Under rare circumstances, this oversight could result in “could not generate random cancel key” failures that could only be resolved by restarting the postmaster.

  • Fix libpq's handling of some cases where hostaddr is specified (Hari Babu, Tom Lane, Robert Haas)

    PQhost() gave misleading or incorrect results in some cases. Now, it uniformly returns the host name if specified, or the host address if only that is specified, or the default host name (typically /tmp or localhost) if both parameters are omitted.

    Also, the wrong value might be compared to the server name when verifying an SSL certificate.

    Also, the wrong value might be compared to the host name field in ~/.pgpass. Now, that field is compared to the host name if specified, or the host address if only that is specified, or localhost if both parameters are omitted.

    Also, an incorrect error message was reported for an unparseable hostaddr value.

    Also, when the host, hostaddr, or port parameters contain comma-separated lists, libpq is now more careful to treat empty elements of a list as selecting the default behavior.

  • Add a string freeing function to ecpg's pgtypes library, so that cross-module memory management problems can be avoided on Windows (Takayuki Tsunakawa)

    On Windows, crashes can ensue if the free call for a given chunk of memory is not made from the same DLL that malloc'ed the memory. The pgtypes library sometimes returns strings that it expects the caller to free, making it impossible to follow this rule. Add a PGTYPESchar_free() function that just wraps free, allowing applications to follow this rule.

  • Fix ecpg's support for long long variables on Windows, as well as other platforms that declare strtoll/strtoull nonstandardly or not at all (Dang Minh Huong, Tom Lane)

  • Fix misidentification of SQL statement type in PL/pgSQL, when a rule change causes a change in the semantics of a statement intra-session (Tom Lane)

    This error led to assertion failures, or in rare cases, failure to enforce the INTO STRICT option as expected.

  • Fix password prompting in client programs so that echo is properly disabled on Windows when stdin is not the terminal (Matthew Stickney)

  • Further fix mis-quoting of values for list-valued GUC variables in dumps (Tom Lane)

    The previous fix for quoting of search_path and other list-valued variables in pg_dump output turned out to misbehave for empty-string list elements, and it risked truncation of long file paths.

  • Fix pg_dump's failure to dump REPLICA IDENTITY properties for constraint indexes (Tom Lane)

    Manually created unique indexes were properly marked, but not those created by declaring UNIQUE or PRIMARY KEY constraints.

  • Make pg_upgrade check that the old server was shut down cleanly (Bruce Momjian)

    The previous check could be fooled by an immediate-mode shutdown.

  • Fix contrib/hstore_plperl to look through Perl scalar references, and to not crash if it doesn't find a hash reference where it expects one (Tom Lane)

  • Fix crash in contrib/ltree's lca() function when the input array is empty (Pierre Ducroquet)

  • Fix various error-handling code paths in which an incorrect error code might be reported (Michael Paquier, Tom Lane, Magnus Hagander)

  • Rearrange makefiles to ensure that programs link to freshly-built libraries (such as libpq.so) rather than ones that might exist in the system library directories (Tom Lane)

    This avoids problems when building on platforms that supply old copies of PostgreSQL libraries.

  • Update time zone data files to tzdata release 2018e for DST law changes in North Korea, plus historical corrections for Czechoslovakia.

    This update includes a redefinition of “daylight savings” in Ireland, as well as for some past years in Namibia and Czechoslovakia. In those jurisdictions, legally standard time is observed in summer, and daylight savings time in winter, so that the daylight savings offset is one hour behind standard time not one hour ahead. This does not affect either the actual UTC offset or the timezone abbreviations in use; the only known effect is that the is_dst column in the pg_timezone_names view will now be true in winter and false in summer in these cases.

• ⇑ Upgrade to 10.6 released on 2018-11-08 - docs

  • Ensure proper quoting of transition table names when pg_dump emits CREATE TRIGGER ... REFERENCING commands (Tom Lane)

    This oversight could be exploited by an unprivileged user to gain superuser privileges during the next dump/reload or pg_upgrade run. (CVE-2018-16850)

  • Fix corner-case failures in has_foo_privilege() family of functions (Tom Lane)

    Return NULL rather than throwing an error when an invalid object OID is provided. Some of these functions got that right already, but not all. has_column_privilege() was additionally capable of crashing on some platforms.

  • Fix pg_get_partition_constraintdef() to return NULL rather than fail when passed an invalid relation OID (Tom Lane)

  • Avoid O(N^2) slowdown in regular expression match/split functions on long strings (Andrew Gierth)

  • Fix parsing of standard multi-character operators that are immediately followed by a comment or + or - (Andrew Gierth)

    This oversight could lead to parse errors, or to incorrect assignment of precedence.

  • Avoid O(N^3) slowdown in lexer for long strings of + or - characters (Andrew Gierth)

  • Fix mis-execution of SubPlans when the outer query is being scanned backwards (Andrew Gierth)

  • Fix failure of UPDATE/DELETE ... WHERE CURRENT OF ... after rewinding the referenced cursor (Tom Lane)

    A cursor that scans multiple relations (particularly an inheritance tree) could produce wrong behavior if rewound to an earlier relation.

  • Fix EvalPlanQual to handle conditionally-executed InitPlans properly (Andrew Gierth, Tom Lane)

    This resulted in hard-to-reproduce crashes or wrong answers in concurrent updates, if they contained code such as an uncorrelated sub-SELECT inside a CASE construct.

  • Prevent creation of a partition in a trigger attached to its parent table (Amit Langote)

    Ideally we'd allow that, but for the moment it has to be blocked to avoid crashes.

  • Fix problems with applying ON COMMIT DELETE ROWS to a partitioned temporary table (Amit Langote)

  • Fix character-class checks to not fail on Windows for Unicode characters above U+FFFF (Tom Lane, Kenji Uno)

    This bug affected full-text-search operations, as well as contrib/ltree and contrib/pg_trgm.

  • Disallow pushing sub-SELECTs containing window functions, LIMIT, or OFFSET to parallel workers (Amit Kapila)

    Such cases could result in inconsistent behavior due to different workers getting different answers, as a result of indeterminacy due to row-ordering variations.

  • Ensure that sequences owned by a foreign table are processed by ALTER OWNER on the table (Peter Eisentraut)

    The ownership change should propagate to such sequences as well, but this was missed for foreign tables.

  • Ensure that the server will process already-received NOTIFY and SIGTERM interrupts before waiting for client input (Jeff Janes, Tom Lane)

  • Fix over-allocation of space for array_out()'s result string (Keiichi Hirobe)

  • Avoid query-lifetime memory leak in XMLTABLE (Andrew Gierth)

  • Fix memory leak in repeated SP-GiST index scans (Tom Lane)

    This is only known to amount to anything significant in cases where an exclusion constraint using SP-GiST receives many new index entries in a single command.

  • Ensure that ApplyLogicalMappingFile() closes the mapping file when done with it (Tomas Vondra)

    Previously, the file descriptor was leaked, eventually resulting in failures during logical decoding.

  • Fix logical decoding to handle cases where a mapped catalog table is repeatedly rewritten, e.g. by VACUUM FULL (Andres Freund)

  • Prevent starting the server with wal_level set to too low a value to support an existing replication slot (Andres Freund)

  • Avoid crash if a utility command causes infinite recursion (Tom Lane)

  • When initializing a hot standby, cope with duplicate XIDs caused by two-phase transactions on the master (Michael Paquier, Konstantin Knizhnik)

  • Fix event triggers to handle nested ALTER TABLE commands (Michael Paquier, Álvaro Herrera)

  • Propagate parent process's transaction and statement start timestamps to parallel workers (Konstantin Knizhnik)

    This prevents misbehavior of functions such as transaction_timestamp() when executed in a worker.

  • Fix transfer of expanded datums to parallel workers so that alignment is preserved, preventing crashes on alignment-picky platforms (Tom Lane, Amit Kapila)

  • Fix WAL file recycling logic to work correctly on standby servers (Michael Paquier)

    Depending on the setting of archive_mode, a standby might fail to remove some WAL files that could be removed.

  • Fix handling of commit-timestamp tracking during recovery (Masahiko Sawada, Michael Paquier)

    If commit timestamp tracking has been turned on or off, recovery might fail due to trying to fetch the commit timestamp for a transaction that did not record it.

  • Randomize the random() seed in bootstrap and standalone backends, and in initdb (Noah Misch)

    The main practical effect of this change is that it avoids a scenario where initdb might mistakenly conclude that POSIX shared memory is not available, due to name collisions caused by always using the same random seed.

  • Fix possible shared-memory corruption in DSA logic (Thomas Munro)

  • Allow DSM allocation to be interrupted (Chris Travers)

  • Avoid failure in a parallel worker when loading an extension that tries to access system caches within its init function (Thomas Munro)

    We don't consider that to be good extension coding practice, but it mostly worked before parallel query, so continue to support it for now.

  • Properly handle turning full_page_writes on dynamically (Kyotaro Horiguchi)

  • Fix possible crash due to double free() during SP-GiST rescan (Andrew Gierth)

  • Prevent mis-linking of src/port and src/common functions on ELF-based BSD platforms, as well as HP-UX and Solaris (Andrew Gierth, Tom Lane)

    Shared libraries loaded into a backend's address space could use the backend's versions of these functions, rather than their own copies as intended. Since the behavior of the two sets of functions isn't quite the same, this led to failures.

  • Avoid possible buffer overrun when replaying GIN page recompression from WAL (Alexander Korotkov, Sivasubramanian Ramasubramanian)

  • Avoid overrun of a hash index's metapage when BLCKSZ is smaller than default (Dilip Kumar)

  • Fix missed page checksum updates in hash indexes (Amit Kapila)

  • Fix missed fsync of a replication slot's directory (Konstantin Knizhnik, Michael Paquier)

  • Fix unexpected timeouts when using wal_sender_timeout on a slow server (Noah Misch)

  • Ensure that hot standby processes use the correct WAL consistency point (Alexander Kukushkin, Michael Paquier)

    This prevents possible misbehavior just after a standby server has reached a consistent database state during WAL replay.

  • Ensure background workers are stopped properly when the postmaster receives a fast-shutdown request before completing database startup (Alexander Kukushkin)

  • Update the free space map during WAL replay of page all-visible/frozen flag changes (Álvaro Herrera)

    Previously we were not careful about this, reasoning that the FSM is not critical data anyway. However, if it's sufficiently out of date, that can result in significant performance degradation after a standby has been promoted to primary. The FSM will eventually be healed by updates, but we'd like it to be good sooner, so work harder at maintaining it during WAL replay.

  • Avoid premature release of parallel-query resources when query end or tuple count limit is reached (Amit Kapila)

    It's only okay to shut down the executor at this point if the caller cannot demand backwards scan afterwards.

  • Don't run atexit callbacks when servicing SIGQUIT (Heikki Linnakangas)

  • Don't record foreign-server user mappings as members of extensions (Tom Lane)

    If CREATE USER MAPPING is executed in an extension script, an extension dependency was created for the user mapping, which is unexpected. Roles can't be extension members, so user mappings shouldn't be either.

  • Make syslogger more robust against failures in opening CSV log files (Tom Lane)

  • When libpq is given multiple target host names, do the DNS lookups one at a time, not all at once (Tom Lane)

    This prevents unnecessary failures or slow connections when a connection is successfully made to one of the earlier servers in the list.

  • Fix libpq's handling of connection timeouts so that they are properly applied per host name or IP address (Tom Lane)

    Previously, some code paths failed to restart the timer when switching to a new target host, possibly resulting in premature timeout.

  • Fix psql, as well as documentation examples, to call PQconsumeInput() before each PQnotifies() call (Tom Lane)

    This fixes cases in which psql would not report receipt of a NOTIFY message until after the next command.

  • Fix pg_dump's --no-publications option to also ignore publication tables (Gilles Darold)

  • In pg_dump, exclude identity sequences when their parent table is excluded from the dump (David Rowley)

  • Fix possible inconsistency in pg_dump's sorting of dissimilar object names (Jacob Champion)

  • Ensure that pg_restore will schema-qualify the table name when emitting DISABLE/ENABLE TRIGGER commands (Tom Lane)

    This avoids failures due to the new policy of running restores with restrictive search path.

  • Fix pg_upgrade to handle event triggers in extensions correctly (Haribabu Kommi)

    pg_upgrade failed to preserve an event trigger's extension-membership status.

  • Fix pg_upgrade's cluster state check to work correctly on a standby server (Bruce Momjian)

  • Enforce type cube's dimension limit in all contrib/cube functions (Andrey Borodin)

    Previously, some cube-related functions could construct values that would be rejected by cube_in(), leading to dump/reload failures.

  • In contrib/pg_stat_statements, disallow the pg_read_all_stats role from executing pg_stat_statements_reset() (Haribabu Kommi)

    pg_read_all_stats is only meant to grant permission to read statistics, not to change them, so this grant was incorrect.

    To cause this change to take effect, run ALTER EXTENSION pg_stat_statements UPDATE in each database where pg_stat_statements has been installed.

  • In contrib/postgres_fdw, don't try to ship a variable-free ORDER BY clause to the remote server (Andrew Gierth)

  • Fix contrib/unaccent's unaccent() function to use the unaccent text search dictionary that is in the same schema as the function (Tom Lane)

    Previously it tried to look up the dictionary using the search path, which could fail if the search path has a restrictive value.

  • Fix build problems on macOS 10.14 (Mojave) (Tom Lane)

    Adjust configure to add an -isysroot switch to CPPFLAGS; without this, PL/Perl and PL/Tcl fail to configure or build on macOS 10.14. The specific sysroot used can be overridden at configure time or build time by setting the PG_SYSROOT variable in the arguments of configure or make.

    It is now recommended that Perl-related extensions write $(perl_includespec) rather than -I$(perl_archlibexp)/CORE in their compiler flags. The latter continues to work on most platforms, but not recent macOS.

    Also, it should no longer be necessary to specify --with-tclconfig manually to get PL/Tcl to build on recent macOS releases.

  • Fix MSVC build and regression-test scripts to work on recent Perl versions (Andrew Dunstan)

    Perl no longer includes the current directory in its search path by default; work around that.

  • On Windows, allow the regression tests to be run by an Administrator account (Andrew Dunstan)

    To do this safely, pg_regress now gives up any such privileges at startup.

  • Allow btree comparison functions to return INT_MIN (Tom Lane)

    Up to now, we've forbidden datatype-specific comparison functions from returning INT_MIN, which allows callers to invert the sort order just by negating the comparison result. However, this was never safe for comparison functions that directly return the result of memcmp(), strcmp(), etc, as POSIX doesn't place any such restriction on those functions. At least some recent versions of memcmp() can return INT_MIN, causing incorrect sort ordering. Hence, we've removed this restriction. Callers must now use the INVERT_COMPARE_RESULT() macro if they wish to invert the sort order.

  • Fix recursion hazard in shared-invalidation message processing (Tom Lane)

    This error could, for example, result in failure to access a system catalog or index that had just been processed by VACUUM FULL.

    This change adds a new result code for LockAcquire, which might possibly affect external callers of that function, though only very unusual usage patterns would have an issue with it. The API of LockAcquireExtended is also changed.

  • Save and restore SPI's global variables during SPI_connect() and SPI_finish() (Chapman Flack, Tom Lane)

    This prevents possible interference when one SPI-using function calls another.

  • Avoid using potentially-under-aligned page buffers (Tom Lane)

    Invent new union types PGAlignedBlock and PGAlignedXLogBlock, and use these in place of plain char arrays, ensuring that the compiler can't place the buffer at a misaligned start address. This fixes potential core dumps on alignment-picky platforms, and may improve performance even on platforms that allow misalignment.

  • Make src/port/snprintf.c follow the C99 standard's definition of snprintf()'s result value (Tom Lane)

    On platforms where this code is used (mostly Windows), its pre-C99 behavior could lead to failure to detect buffer overrun, if the calling code assumed C99 semantics.

  • When building on i386 with the clang compiler, require -msse2 to be used (Andres Freund)

    This avoids problems with missed floating point overflow checks.

  • Fix configure's detection of the result type of strerror_r() (Tom Lane)

    The previous coding got the wrong answer when building with icc on Linux (and perhaps in other cases), leading to libpq not returning useful error messages for system-reported errors.

  • Update time zone data files to tzdata release 2018g for DST law changes in Chile, Fiji, Morocco, and Russia (Volgograd), plus historical corrections for China, Hawaii, Japan, Macau, and North Korea.

• source repo
• author info
• meta-info