Upgrading from 15.3 to 15.8 gives you 1.2 years worth of fixes (268 of them)

List of changes:

• ⇑ Upgrade to 15.4 released on 2023-08-10 - docs

  • Disallow substituting a schema or owner name into an extension script if the name contains a quote, backslash, or dollar sign (Noah Misch)

    This restriction guards against SQL-injection hazards for trusted extensions.

    The PostgreSQL Project thanks Micah Gate, Valerie Woolard, Tim Carey-Smith, and Christoph Berg for reporting this problem. (CVE-2023-39417)

  • Fix MERGE to enforce row security policies properly (Dean Rasheed)

    When MERGE performs an UPDATE action, it should enforce any UPDATE or SELECT RLS policies defined on the target table, to be consistent with the way that a plain UPDATE with a WHERE clause works. Instead it was enforcing INSERT RLS policies for both INSERT and UPDATE actions.

    In addition, when MERGE performs a DO NOTHING action, it applied the target table's DELETE RLS policies to existing rows, even though those rows are not being deleted. While it's not a security problem, this could result in unwanted errors.

    The PostgreSQL Project thanks Dean Rasheed for reporting this problem. (CVE-2023-39418)

  • Fix confusion between empty (no rows) ranges and all-NULL ranges in BRIN indexes, as well as incorrect merging of all-NULL summaries (Tomas Vondra)

    Each of these oversights could result in forgetting that a BRIN index range contains any NULL values, potentially allowing subsequent queries that should return NULL values to miss doing so.

    This fix will not in itself correct faulty BRIN entries. It's recommended to REINDEX any BRIN indexes that may be used to search for nulls.

  • Avoid leaving a corrupted database behind when DROP DATABASE is interrupted (Andres Freund)

    If DROP DATABASE was interrupted after it had already begun taking irreversible steps, the target database remained accessible (because the removal of its pg_database row would roll back), but it would have corrupt contents. Fix by marking the database as inaccessible before we begin to perform irreversible operations. A failure after that will leave the database still partially present, but nothing can be done with it except to issue another DROP DATABASE.

  • Ensure that partitioned indexes are correctly marked as valid or not at creation (Michael Paquier)

    If a new partitioned index matches an existing but invalid index on one of the partitions, the partitioned index could end up being marked valid prematurely. This could lead to misbehavior or assertion failures in subsequent queries on the partitioned table.

  • Ignore invalid child indexes when matching partitioned indexes to child indexes during ALTER TABLE ATTACH PARTITION (Michael Paquier)

    Such an index will now be ignored, and a new child index created instead.

  • Fix possible failure when marking a partitioned index valid after all of its partitions have been attached (Michael Paquier)

    The update of the index's pg_index entry could use stale data for other columns. One reported symptom is an “attempted to update invisible tuple” error.

  • Fix ALTER EXTENSION SET SCHEMA to complain if the extension contains any objects outside the extension's schema (Michael Paquier, Heikki Linnakangas)

    Erroring out if the extension contains objects in multiple schemas was always intended; but the check was mis-coded so that it would fail to detect some cases, leading to surprising behavior.

  • Fix tracking of tables' access method dependencies (Michael Paquier)

    ALTER TABLE ... SET ACCESS METHOD failed to update relevant pg_depend entries when changing a table's access method. When using non-built-in access methods, this creates a risk that an access method could be dropped even though tables still depend on it. This fix corrects the logic in ALTER TABLE, but it will not adjust any already-missing pg_depend entries.

  • Don't use partial unique indexes for uniqueness proofs in the planner (David Rowley)

    This could give rise to incorrect plans, since the presumed uniqueness of rows read from a table might not hold if the index in question isn't used to scan the table.

  • Don't Memoize lateral joins with volatile join conditions (Richard Guo)

    Applying Memoize to a sub-plan that contains volatile filter conditions is likely to lead to wrong answers. The check to avoid doing this missed some cases that can arise when using LATERAL.

  • Avoid producing incorrect plans for foreign joins with pseudoconstant join clauses (Etsuro Fujita)

    The planner currently lacks support for attaching pseudoconstant join clauses to a pushed-down remote join, so disable generation of remote joins in such cases. (A better solution will require ABI-breaking changes of planner data structures, so it will have to wait for a future major release.)

  • Correctly handle sub-SELECTs in RLS policy expressions and security-barrier views when expanding rule actions (Tom Lane)

  • Fix race conditions in conflict detection for SERIALIZABLE isolation mode (Thomas Munro)

    Conflicts could be missed when using bitmap heap scans, when using GIN indexes, and when examining an initially-empty btree index. All these cases could lead to serializability failures due to improperly allowing conflicting transactions to commit.

  • Fix misbehavior of EvalPlanQual checks with inherited or partitioned target tables (Tom Lane)

    This oversight could lead to update or delete actions in READ COMMITTED isolation mode getting performed when they should have been skipped because of a conflicting concurrent update.

  • Fix hash join with an inner-side hash key that contains Params coming from an outer nested loop (Tom Lane)

    When rescanning the join after the values of such Params have changed, we must rebuild the hash table, but neglected to do so. This could result in missing join output rows.

  • Fix intermittent failures when trying to update a field of a composite column (Tom Lane)

    If the overall value of the composite column is wide enough to require out-of-line toasting, then an unluckily-timed cache flush could cause errors or server crashes.

  • Prevent query-lifespan memory leaks in some UPDATE queries with triggers (Tomas Vondra)

  • Prevent query-lifespan memory leaks when an Incremental Sort plan node is rescanned (James Coleman, Laurenz Albe, Tom Lane)

  • Accept fractional seconds in the input to jsonpath's datetime() method (Tom Lane)

  • Prevent stack-overflow crashes with very complex text search patterns (Tom Lane)

  • Allow tokens up to 10240 bytes long in pg_hba.conf and pg_ident.conf (Tom Lane)

    The previous limit of 256 bytes has been found insufficient for some use-cases.

  • Ensure that all existing placeholders are checked for matches when an extension declares its GUC prefix to be reserved (Karina Litskevich, Ekaterina Sokolova)

    Faulty loop logic could cause some entries to be skipped.

  • Fix mishandling of C++ out-of-memory conditions (Heikki Linnakangas)

    If JIT is in use, running out of memory in a C++ new call would lead to a PostgreSQL FATAL error, instead of the expected C++ exception.

  • Fix rare null-pointer crash in plancache.c (Tom Lane)

  • Avoid leaking a stats entry for a subscription when it is dropped (Masahiko Sawada)

  • Avoid losing track of possibly-useful shared memory segments when a page free results in coalescing ranges of free space (Dongming Liu)

    Ensure that the segment is moved into the appropriate “bin” for its new amount of free space, so that it will be found by subsequent searches.

  • Allow VACUUM to continue after detecting certain types of b-tree index corruption (Peter Geoghegan)

    If an invalid sibling-page link is detected, log the issue and press on, rather than throwing an error as before. Nothing short of REINDEX will fix the broken index, but preventing VACUUM from completing until that is done risks making matters far worse.

  • Ensure that WrapLimitsVacuumLock is released after VACUUM detects invalid data in pg_database.datfrozenxid or pg_database.datminmxid (Andres Freund)

    Failure to release this lock could lead to a deadlock later, although the lock would be cleaned up if the session exits or encounters some other error.

  • Avoid double replay of prepared transactions during crash recovery (suyu.cmj, Michael Paquier)

    After a crash partway through a checkpoint with some two-phase transaction state data already flushed to disk by this checkpoint, crash recovery could attempt to replay the prepared transaction(s) twice, leading to a fatal error such as “lock is already held” in the startup process.

  • Ensure that a newly created, but still empty table is fsync'ed at the next checkpoint (Heikki Linnakangas)

    Without this, if there is an operating system crash causing the empty file to disappear, subsequent operations on the table might fail with “could not open file” errors.

  • Ensure that creation of the init fork of an unlogged index is WAL-logged (Heikki Linnakangas)

    While an unlogged index's main data fork is not WAL-logged, its init fork should be, to ensure that we have a consistent state to restore the index to after a crash. This step was missed if the init fork contains no data, which is a case not used by any standard index AM; but perhaps some extension behaves that way.

  • Silence bogus “missing contrecord” errors (Thomas Munro)

    Treat this case as plain end-of-WAL to avoid logging inaccurate complaints from pg_waldump and walsender.

  • Fix overly strict assertion in jsonpath code (David Rowley)

    This assertion failed if a query applied the .type() operator to a like_regex result. There was no bug in non-assert builds.

  • Avoid assertion failure when processing an empty statement via the extended query protocol in an already-aborted transaction (Tom Lane)

  • Avoid assertion failure when the stats_fetch_consistency setting is changed intra-transaction (Kyotaro Horiguchi)

  • Fix contrib/fuzzystrmatch's Soundex difference() function to handle empty input sanely (Alexander Lakhin, Tom Lane)

    An input string containing no alphabetic characters resulted in unpredictable output.

  • Tighten whitespace checks in contrib/hstore input (Evan Jones)

    In some cases, characters would be falsely recognized as whitespace and hence discarded.

  • Disallow oversize input arrays with contrib/intarray's gist__int_ops index opclass (Ankit Kumar Pandey, Alexander Lakhin)

    Previously this code would report a NOTICE but press on anyway, creating an invalid index entry that presents a risk of crashes when the index is read.

  • Avoid useless double decompression of GiST index entries in contrib/intarray (Konstantin Knizhnik, Matthias van de Meent, Tom Lane)

  • Fix contrib/pageinspect's gist_page_items() function to work when there are included index columns (Alexander Lakhin, Michael Paquier)

    Previously, if the index has included columns, gist_page_items() would fail to display those values on index leaf pages, or crash outright on non-leaf pages.

  • In psql, ignore the PSQL_WATCH_PAGER environment variable when stdin/stdout are not a terminal (Tom Lane)

    This corresponds to the treatment of PSQL_PAGER in commands besides \watch.

  • Fix pg_dump to correctly handle new-style SQL-language functions whose bodies require parse-time dependencies on unique indexes (Tom Lane)

    Such cases can arise from GROUP BY and ON CONFLICT clauses, for example. The function must then be postponed until after the unique index in the dump output, but pg_dump did not do that and instead printed a warning about “could not resolve dependency loop”.

  • Improve pg_dump's display of details about dependency-loop problems (Tom Lane)

  • Avoid crash in pgbench with an empty pipeline and prepared mode (Álvaro Herrera)

  • Ensure that pg_index.indisreplident is kept up-to-date in relation cache entries (Shruthi Gowda)

    This value could be stale in some cases. There is no core code that relies on the relation cache's copy, so this is only a latent bug as far as Postgres itself is concerned; but there may be extensions for which it is a live bug.

  • Fix make_etags script to work with non-Exuberant ctags (Masahiko Sawada)

• ⇑ Upgrade to 15.5 released on 2023-11-09 - docs

  • Fix handling of unknown-type arguments in DISTINCT "any" aggregate functions (Tom Lane)

    This error led to a text-type value being interpreted as an unknown-type value (that is, a zero-terminated string) at runtime. This could result in disclosure of server memory following the text value.

    The PostgreSQL Project thanks Jingzhou Fu for reporting this problem. (CVE-2023-5868)

  • Detect integer overflow while computing new array dimensions (Tom Lane)

    When assigning new elements to array subscripts that are outside the current array bounds, an undetected integer overflow could occur in edge cases. Memory stomps that are potentially exploitable for arbitrary code execution are possible, and so is disclosure of server memory.

    The PostgreSQL Project thanks Pedro Gallegos for reporting this problem. (CVE-2023-5869)

  • Prevent the pg_signal_backend role from signalling background workers and autovacuum processes (Noah Misch, Jelte Fennema-Nio)

    The documentation says that pg_signal_backend cannot issue signals to superuser-owned processes. It was able to signal these background processes, though, because they advertise a role OID of zero. Treat that as indicating superuser ownership. The security implications of cancelling one of these process types are fairly small so far as the core code goes (we'll just start another one), but extensions might add background workers that are more vulnerable.

    Also ensure that the is_superuser parameter is set correctly in such processes. No specific security consequences are known for that oversight, but it might be significant for some extensions.

    The PostgreSQL Project thanks Hemanth Sandrana and Mahendrakar Srinivasarao for reporting this problem. (CVE-2023-5870)

  • Fix misbehavior during recursive page split in GiST index build (Heikki Linnakangas)

    Fix a case where the location of a page downlink was incorrectly tracked, and introduce some logic to allow recovering from such situations rather than silently doing the wrong thing. This error could result in incorrect answers from subsequent index searches. It may be advisable to reindex all GiST indexes after installing this update.

  • Prevent de-duplication of btree index entries for interval columns (Noah Misch)

    There are interval values that are distinguishable but compare equal, for example 24:00:00 and 1 day. This breaks assumptions made by btree de-duplication, so interval columns need to be excluded from de-duplication. This oversight can cause incorrect results from index-only scans. Moreover, after updating amcheck will report an error for almost all such indexes. Users should reindex any btree indexes on interval columns.

  • Process date values more sanely in BRIN datetime_minmax_multi_ops indexes (Tomas Vondra)

    The distance calculation for dates was backward, causing poor decisions about which entries to merge. The index still produces correct results, but is much less efficient than it should be. Reindexing BRIN minmax_multi indexes on date columns is advisable.

  • Process large timestamp and timestamptz values more sanely in BRIN datetime_minmax_multi_ops indexes (Tomas Vondra)

    Infinities were mistakenly treated as having distance zero rather than a large distance from other values, causing poor decisions about which entries to merge. Also, finite-but-very-large values (near the endpoints of the representable timestamp range) could result in internal overflows, again causing poor decisions. The index still produces correct results, but is much less efficient than it should be. Reindexing BRIN minmax_multi indexes on timestamp and timestamptz columns is advisable if the column contains, or has contained, infinities or large finite values.

  • Avoid calculation overflows in BRIN interval_minmax_multi_ops indexes with extreme interval values (Tomas Vondra)

    This bug might have caused unexpected failures while trying to insert large interval values into such an index.

  • Fix partition step generation and runtime partition pruning for hash-partitioned tables with multiple partition keys (David Rowley)

    Some cases involving an IS NULL condition on one of the partition keys could result in a crash.

  • Fix inconsistent rechecking of concurrently-updated rows during MERGE (Dean Rasheed)

    In READ COMMITTED mode, an update that finds that its target row was just updated by a concurrent transaction will recheck the query's WHERE conditions on the updated row. MERGE failed to ensure that the proper rows of other joined tables were used during this recheck, possibly resulting in incorrect decisions about whether the newly-updated row should be updated again by MERGE.

  • Correctly identify the target table in an inherited UPDATE/DELETE/MERGE even when the parent table is excluded by constraints (Amit Langote, Tom Lane)

    If the initially-named table is excluded by constraints, but not all its inheritance descendants are, the first non-excluded descendant was identified as the primary target table. This would lead to firing statement-level triggers associated with that table, rather than the initially-named table as should happen. In v16, the same oversight could also lead to “invalid perminfoindex 0 in RTE with relid NNNN” errors.

  • Fix edge case in btree mark/restore processing of ScalarArrayOpExpr clauses (Peter Geoghegan)

    When restoring an indexscan to a previously marked position, the code could miss required setup steps if the scan had advanced exactly to the end of the matches for a ScalarArrayOpExpr (that is, an indexcol = ANY(ARRAY[])) clause. This could result in missing some rows that should have been fetched.

  • Fix intra-query memory leak in Memoize execution (Orlov Aleksej, David Rowley)

  • Fix intra-query memory leak when a set-returning function repeatedly returns zero rows (Tom Lane)

  • Don't crash if cursor_to_xmlschema() is applied to a non-data-returning Portal (Boyu Yang)

  • Throw the intended error if pgrowlocks() is applied to a partitioned table (David Rowley)

    Previously, a not-on-point complaint “only heap AM is supported” would be raised.

  • Handle invalid indexes more cleanly in assorted SQL functions (Noah Misch)

    Report an error if pgstatindex(), pgstatginindex(), pgstathashindex(), or pgstattuple() is applied to an invalid index. If brin_desummarize_range(), brin_summarize_new_values(), brin_summarize_range(), or gin_clean_pending_list() is applied to an invalid index, do nothing except to report a debug-level message. Formerly these functions attempted to process the index, and might fail in strange ways depending on what the failed CREATE INDEX had left behind.

  • Fix pg_stat_reset_single_table_counters() to do the right thing for a shared catalog (Masahiro Ikeda)

    Previously the reset would be ineffective.

  • Avoid premature memory allocation failure with long inputs to to_tsvector() (Tom Lane)

  • Fix over-allocation of the constructed tsvector in tsvectorrecv() (Denis Erokhin)

    If the incoming vector includes position data, the binary receive function left wasted space (roughly equal to the size of the position data) in the finished tsvector. In extreme cases this could lead to “maximum total lexeme length exceeded” failures for vectors that were under the length limit when emitted. In any case it could lead to wasted space on-disk.

  • Fix incorrect coding in gtsvector_picksplit() (Alexander Lakhin)

    This could lead to poor page-split decisions in GiST indexes on tsvector columns.

  • Improve checks for corrupt PGLZ compressed data (Flavien Guedez)

  • In COPY FROM, fail cleanly when an unsupported encoding conversion is needed (Tom Lane)

    Recent refactoring accidentally removed the intended error check for this, such that it ended in “cache lookup failed for function 0” instead of a useful error message.

  • Avoid crash in EXPLAIN if a parameter marked to be displayed by EXPLAIN has a NULL boot-time value (Xing Guo, Aleksander Alekseev, Tom Lane)

    No built-in parameter fits this description, but an extension could define such a parameter.

  • Ensure we have a snapshot while dropping ON COMMIT DROP temp tables (Tom Lane)

    This prevents possible misbehavior if any catalog entries for the temp tables have fields wide enough to require toasting (such as a very complex CHECK condition).

  • Avoid improper response to shutdown signals in child processes just forked by system() (Nathan Bossart)

    This fix avoids a race condition in which a child process that has been forked off by system(), but hasn't yet exec'd the intended child program, might receive and act on a signal intended for the parent server process. That would lead to duplicate cleanup actions being performed, which will not end well.

  • Cope with torn reads of pg_control in frontend programs (Thomas Munro)

    On some file systems, reading pg_control may not be an atomic action when the server concurrently writes that file. This is detectable via a bad CRC. Retry a few times to see if the file becomes valid before we report error.

  • Avoid torn reads of pg_control in relevant SQL functions (Thomas Munro)

    Acquire the appropriate lock before reading pg_control, to ensure we get a consistent view of that file.

  • Avoid integer overflow when computing size of backend activity string array (Jakub Wartak)

    On 64-bit machines we will allow values of track_activity_query_size large enough to cause 32-bit overflow when multiplied by the allowed number of connections. The code actually allocating the per-backend local array was careless about this though, and allocated the array incorrectly.

  • Fix briefly showing inconsistent progress statistics for ANALYZE on inherited tables (Heikki Linnakangas)

    The block-level counters should be reset to zero at the same time we update the current-relation field.

  • Fix the background writer to report any WAL writes it makes to the statistics counters (Nazir Bilal Yavuz)

  • Fix confusion about forced-flush behavior in pgstat_report_wal() (Ryoga Yoshida, Michael Paquier)

    This could result in some statistics about WAL I/O being forgotten in a shutdown.

  • Track the dependencies of cached CALL statements, and re-plan them when needed (Tom Lane)

    DDL commands, such as replacement of a function that has been inlined into a CALL argument, can create the need to re-plan a CALL that has been cached by PL/pgSQL. That was not happening, leading to misbehavior or strange errors such as “cache lookup failed”.

  • Avoid a possible pfree-a-NULL-pointer crash after an error in OpenSSL connection setup (Sergey Shinderuk)

  • Track nesting depth correctly when inspecting RECORD-type Vars from outer query levels (Richard Guo)

    This oversight could lead to assertion failures, core dumps, or “bogus varno” errors.

  • Track hash function and negator function dependencies of ScalarArrayOpExpr plan nodes (David Rowley)

    In most cases this oversight was harmless, since these functions would be unlikely to disappear while the node's original operator remains present.

  • Fix error-handling bug in RECORD type cache management (Thomas Munro)

    An out-of-memory error occurring at just the wrong point could leave behind inconsistent state that would lead to an infinite loop.

  • Fix assertion failure when logical decoding is retried in the same session after an error (Hou Zhijie)

  • Treat out-of-memory failures as fatal while reading WAL (Michael Paquier)

    Previously this would be treated as a bogus-data condition, leading to the conclusion that we'd reached the end of WAL, which is incorrect and could lead to inconsistent WAL replay.

  • Fix possible recovery failure due to trying to allocate memory based on a bogus WAL record length field (Thomas Munro, Michael Paquier)

  • Fix race condition in database dropping that could lead to the autovacuum launcher getting stuck (Andres Freund, Will Mortensen, Jacob Speidel)

    The race could lead to a statistics entry for the removed database remaining present, confusing the launcher's selection of which database to process.

  • Fix datatype size confusion in logical tape management (Ranier Vilela)

    Integer overflow was possible on platforms where long is wider than int, although it would take a multiple-terabyte temporary file to cause a problem.

  • Avoid unintended close of syslogger process's stdin (Heikki Linnakangas)

  • Avoid doing plan cache revalidation of utility statements that do not receive interesting processing during parse analysis (Tom Lane)

    Aside from saving a few cycles, this prevents failure after a cache invalidation for statements that must not set a snapshot, such as SET TRANSACTION ISOLATION LEVEL.

  • Keep by-reference attmissingval values in a long-lived context while they are being used (Andrew Dunstan)

    This avoids possible use of dangling pointers when a tuple slot outlives the tuple descriptor with which its value was constructed.

  • Recalculate the effective value of search_path after ALTER ROLE (Jeff Davis)

    This ensures that after renaming a role, the meaning of the special string $user is re-determined.

  • Fix “could not duplicate handle” error occurring on Windows when min_dynamic_shared_memory is set above zero (Thomas Munro)

  • Fix order of operations in GenericXLogFinish (Jeff Davis)

    This code violated the conditions required for crash safety by writing WAL before marking changed buffers dirty. No core code uses this function, but extensions do (contrib/bloom does, for example).

  • Remove incorrect assertion in PL/Python exception handling (Alexander Lakhin)

  • Fix assertion failure in pg_dump when it's asked to dump the pg_catalog schema (Peter Eisentraut)

  • Fix pg_restore so that selective restores will include both table-level and column-level ACLs for selected tables (Euler Taveira, Tom Lane)

    Formerly, only the table-level ACL would get restored if both types were present.

  • Add logic to pg_upgrade to check for use of abstime, reltime, and tinterval data types (Álvaro Herrera)

    These obsolete data types were removed in PostgreSQL version 12, so check to make sure they aren't present in an older database before claiming it can be upgraded.

  • Avoid generating invalid temporary slot names in pg_basebackup (Jelte Fennema)

    This has only been seen to occur when the server connection runs through pgbouncer.

  • Avoid false “too many client connections” errors in pgbench on Windows (Noah Misch)

  • In contrib/amcheck, do not report interrupted page deletion as corruption (Noah Misch)

    This fix prevents false-positive reports of “the first child of leftmost target page is not leftmost of its level”, “block NNNN is not leftmost” or “left link/right link pair in index XXXX not in agreement”. They appeared if amcheck ran after an unfinished btree index page deletion and before VACUUM had cleaned things up.

  • Fix failure of contrib/btree_gin indexes on interval columns, when an indexscan using the < or <= operator is performed (Dean Rasheed)

    Such an indexscan failed to return all the entries it should.

  • Add support for LLVM 16 and 17 (Thomas Munro, Dmitry Dolgov)

  • Suppress assorted build-time warnings on recent macOS (Tom Lane)

    Xcode 15 (released with macOS Sonoma) changed the linker's behavior in a way that causes many duplicate-library warnings while building PostgreSQL. These were harmless, but they're annoying so avoid citing the same libraries twice. Also remove use of the -multiply_defined suppress linker switch, which apparently has been a no-op for a long time, and is now actively complained of.

  • When building contrib/unaccent's rules file, fall back to using python if --with-python was not given and make variable PYTHON was not set (Japin Li)

  • Remove PHOT (Phoenix Islands Time) from the default timezone abbreviations list (Tom Lane)

    Presence of this abbreviation in the default list can cause failures on recent Debian and Ubuntu releases, as they no longer install the underlying tzdb entry by default. Since this is a made-up abbreviation for a zone with a total human population of about two dozen, it seems unlikely that anyone will miss it. If someone does, they can put it back via a custom abbreviations file.

• ⇑ Upgrade to 15.6 released on 2024-02-08 - docs

  • Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (Heikki Linnakangas)

    One step of a concurrent refresh command was run under weak security restrictions. If a materialized view's owner could persuade a superuser or other high-privileged user to perform a concurrent refresh on that view, the view's owner could control code executed with the privileges of the user running REFRESH. Fix things so that all user-determined code is run as the view's owner, as expected.

    The only known exploit for this error does not work in PostgreSQL 16.0 and later, so it may be that v16 is not vulnerable in practice.

    The PostgreSQL Project thanks Pedro Gallegos for reporting this problem. (CVE-2024-0985)

  • Fix memory leak when performing JIT inlining (Andres Freund, Daniel Gustafsson)

    There have been multiple reports of backend processes suffering out-of-memory conditions after sufficiently many JIT compilations. This fix should resolve that.

  • When dequeueing from an LWLock, avoid needing to search the list of waiting processes (Andres Freund)

    This fixes O(N^2) behavior when the list of waiters is long. In some use-cases this results in substantial throughput improvements.

  • Avoid generating incorrect partitioned-join plans (Richard Guo)

    Some uncommon situations involving lateral references could create incorrect plans. Affected queries could produce wrong answers, or odd failures such as “variable not found in subplan target list”, or executor crashes.

  • Fix incorrect wrapping of subquery output expressions in PlaceHolderVars (Tom Lane)

    This fixes incorrect results when a subquery is underneath an outer join and has an output column that laterally references something outside the outer join's scope. The output column might not appear as NULL when it should do so due to the action of the outer join.

  • Fix misprocessing of window function run conditions (Richard Guo)

    This oversight could lead to “WindowFunc not found in subplan target lists” errors.

  • Skip inappropriate actions when MERGE causes a cross-partition update (Dean Rasheed)

    When executing a MERGE UPDATE action on a partitioned table, if the UPDATE is turned into a DELETE and INSERT due to changing a partition key column, skip firing AFTER UPDATE ROW triggers, as well as other post-update actions such as RLS checks. These actions would typically fail, which is why a regular UPDATE doesn't do them in such cases; MERGE shouldn't either.

  • Cope with BEFORE ROW DELETE triggers in cross-partition MERGE updates (Dean Rasheed)

    If such a trigger attempted to prevent the update by returning NULL, MERGE would suffer an error or assertion failure.

  • Prevent access to a no-longer-pinned buffer in BEFORE ROW UPDATE triggers (Alexander Lakhin, Tom Lane)

    If the tuple being updated had just been updated and moved to another page by another session, there was a narrow window where we would attempt to fetch data from the new tuple version without any pin on its buffer. In principle this could result in garbage data appearing in non-updated columns of the proposed new tuple. The odds of problems in practice seem rather low, however.

  • Avoid requesting an oversize shared-memory area in parallel hash join (Thomas Munro, Andrei Lepikhov, Alexander Korotkov)

    The limiting value was too large, allowing “invalid DSA memory alloc request size” errors to occur with sufficiently large expected hash table sizes.

  • Avoid assertion failures in heap_update() and heap_delete() when a tuple to be updated by a foreign-key enforcement trigger fails the extra visibility crosscheck (Alexander Lakhin)

    This error had no impact in non-assert builds.

  • Fix possible failure during ALTER TABLE ADD COLUMN on a complex inheritance tree (Tender Wang)

    If a grandchild table would inherit the new column via multiple intermediate parents, the command failed with “tuple already updated by self”.

  • Fix problems with duplicate token names in ALTER TEXT SEARCH CONFIGURATION ... MAPPING commands (Tender Wang, Michael Paquier)

  • Properly lock the associated table during DROP STATISTICS (Tomas Vondra)

    Failure to acquire the lock could result in “tuple concurrently deleted” errors if the DROP executes concurrently with ANALYZE.

  • Fix function volatility checking for GENERATED and DEFAULT expressions (Tom Lane)

    These places could fail to detect insertion of a volatile function default-argument expression, or decide that a polymorphic function is volatile although it is actually immutable on the datatype of interest. This could lead to improperly rejecting or accepting a GENERATED clause, or to mistakenly applying the constant-default-value optimization in ALTER TABLE ADD COLUMN.

  • Detect that a new catalog cache entry became stale while detoasting its fields (Tom Lane)

    We expand any out-of-line fields in a catalog tuple before inserting it into the catalog caches. That involves database access which might cause invalidation of catalog cache entries — but the new entry isn't in the cache yet, so we would miss noticing that it should get invalidated. The result is a race condition in which an already-stale cache entry could get made, and then persist indefinitely. This would lead to hard-to-predict misbehavior. Fix by rechecking the tuple's visibility after detoasting.

  • Fix edge-case integer overflow detection bug on some platforms (Dean Rasheed)

    Computing 0 - INT64_MIN should result in an overflow error, and did on most platforms. However, platforms with neither integer overflow builtins nor 128-bit integers would fail to spot the overflow, instead returning INT64_MIN.

  • Detect Julian-date overflow when adding or subtracting an interval to/from a timestamp (Tom Lane)

    Some cases that should cause an out-of-range error produced an incorrect result instead.

  • Add more checks for overflow in interval_mul() and interval_div() (Dean Rasheed)

    Some cases that should cause an out-of-range error produced an incorrect result instead.

  • Ensure cached statistics are discarded after a change to stats_fetch_consistency (Shinya Kato)

    In some code paths, it was possible for stale statistics to be returned.

  • Make the pg_file_settings view check validity of unapplied values for settings with backend or superuser-backend context (Tom Lane)

    Invalid values were not noted in the view as intended. This escaped detection because there are very few settings in these groups.

  • Match collation too when matching an existing index to a new partitioned index (Peter Eisentraut)

    Previously we could accept an index that has a different collation from the corresponding element of the partition key, possibly leading to misbehavior.

  • Avoid failure if a child index is dropped concurrently with REINDEX INDEX on a partitioned index (Fei Changhong)

  • Fix insufficient locking when cleaning up an incomplete split of a GIN index's internal page (Fei Changhong, Heikki Linnakangas)

    The code tried to do this with shared rather than exclusive lock on the buffer. This could lead to index corruption if two processes attempted the cleanup concurrently.

  • Avoid premature release of buffer pin in GIN index insertion (Tom Lane)

    If an index root page split occurs concurrently with our own insertion, the code could fail with “buffer NNNN is not owned by resource owner”.

  • Avoid failure with partitioned SP-GiST indexes (Tom Lane)

    Trying to use an index of this kind could lead to “No such file or directory” errors.

  • Fix ownership change reporting for large objects (Tom Lane)

    A no-op ALTER LARGE OBJECT OWNER command (that is, one selecting the existing owner) passed the wrong class ID to the PostAlterHook, probably confusing any extension using that hook.

  • Fix reporting of I/O timing data in EXPLAIN (BUFFERS) (Michael Paquier)

    The numbers labeled as “shared/local” actually refer only to shared buffers, so change that label to “shared”.

  • Ensure durability of CREATE DATABASE (Noah Misch)

    If an operating system crash occurred during or shortly after CREATE DATABASE, recovery could fail, or subsequent connections to the new database could fail. If a base backup was taken in that window, similar problems could be observed when trying to use the backup. The symptom would be that the database directory, PG_VERSION file, or pg_filenode.map file was missing or empty.

  • Add more LOG messages when starting and ending recovery from a backup (Andres Freund)

    This change provides additional information in the postmaster log that may be useful for diagnosing recovery problems.

  • Prevent standby servers from incorrectly processing dead index tuples during subtransactions (Fei Changhong)

    The startedInRecovery flag was not correctly set for a subtransaction. This affects only processing of dead index tuples. It could allow a query in a subtransaction to ignore index entries that it should return (if they are already dead on the primary server, but not dead to the standby transaction), or to prematurely mark index entries as dead that are not yet dead on the primary. It is not clear that the latter case has any serious consequences, but it's not the intended behavior.

  • Fix integer overflow hazard in checking whether a record will fit into the WAL decoding buffer (Thomas Munro)

    This bug appears to be only latent except when running a 32-bit PostgreSQL build on a 64-bit platform.

  • Fix deadlock between a logical replication apply worker, its tablesync worker, and a session process trying to alter the subscription (Shlok Kyal)

    One edge of the deadlock loop did not involve a lock wait, so the deadlock went undetected and would persist until manual intervention.

  • Ensure that column default values are correctly transmitted by the pgoutput logical replication plugin (Nikhil Benesch)

    ALTER TABLE ADD COLUMN with a constant default value for the new column avoids rewriting existing tuples, instead expecting that reading code will insert the correct default into a tuple that lacks that column. If replication was subsequently initiated on the table, pgoutput would transmit NULL instead of the correct default for such a column, causing incorrect replication on the subscriber.

  • Fix failure of logical replication's initial sync for a table with no columns (Vignesh C)

    This case generated an improperly-formatted COPY command.

  • Prevent examining system catalogs with the wrong snapshot during logical decoding (Fei Changhong)

    If decoding begins partway through a transaction that modifies system catalogs, the decoder may not recognize that, causing it to fail to treat that transaction as in-progress for catalog lookups. This fix deals with the case that a top-level transaction is already marked as containing catalog changes, but its subtransaction(s) are not.

  • Return the correct status code when a new client disconnects without responding to the server's password challenge (Liu Lang, Tom Lane)

    In some cases we'd treat this as a loggable error, which was not the intention and tends to create log spam, since common clients like psql frequently do this. It may also confuse extensions that use ClientAuthentication_hook.

  • Fix incompatibility with OpenSSL 3.2 (Tristan Partin, Bo Andreson)

    Use the BIO “app_data” field for our private storage, instead of assuming it's okay to use the “data” field. This mistake didn't cause problems before, but with 3.2 it leads to crashes and complaints about double frees.

  • Be more wary about OpenSSL not setting errno on error (Tom Lane)

    If errno isn't set, assume the cause of the reported failure is read EOF. This fixes rare cases of strange error reports like “could not accept SSL connection: Success”.

  • Fix file descriptor leakage when a foreign data wrapper's ForeignAsyncRequest function fails (Heikki Linnakangas)

  • Report ENOMEM errors from file-related system calls as ERRCODE_OUT_OF_MEMORY, not ERRCODE_INTERNAL_ERROR (Alexander Kuzmenkov)

  • In PL/pgSQL, support SQL commands that are CREATE FUNCTION/CREATE PROCEDURE with SQL-standard bodies (Tom Lane)

    Previously, such cases failed with parsing errors due to the semicolon(s) appearing in the function body.

  • Fix libpq's handling of errors in pipelines (Álvaro Herrera)

    The pipeline state could get out of sync if an error is returned for reasons other than a query problem (for example, if the connection is lost). Potentially this would lead to a busy-loop in the calling application.

  • Make libpq's PQsendFlushRequest() function flush the client output buffer under the same rules as other PQsend functions (Jelte Fennema-Nio)

    In pipeline mode, it may still be necessary to call PQflush() as well; but this change removes some inconsistency.

  • Avoid race condition when libpq initializes OpenSSL support concurrently in two different threads (Willi Mann, Michael Paquier)

  • Fix timing-dependent failure in GSSAPI data transmission (Tom Lane)

    When using GSSAPI encryption in non-blocking mode, libpq sometimes failed with “GSSAPI caller failed to retransmit all data needing to be retried”.

  • In pg_dump, don't dump RLS policies or security labels for extension member objects (Tom Lane, Jacob Champion)

    Previously, commands would be included in the dump to set these properties, which is really incorrect since they should be considered as internal affairs of the extension. Moreover, the restoring user might not have adequate privilege to set them, and indeed the dumping user might not have enough privilege to dump them (since dumping RLS policies requires acquiring lock on their table).

  • In pg_dump, don't dump an extended statistics object if its underlying table isn't being dumped (Rian McGuire, Tom Lane)

    This conforms to the behavior for other dependent objects such as indexes.

  • Make it an error for a pgbench script to end with an open pipeline (Anthonin Bonnefoy)

    Previously, pgbench would behave oddly if a \startpipeline command lacked a matching \endpipeline. This seems like a scripting mistake rather than a case that pgbench needs to handle nicely, so throw an error.

  • In contrib/bloom, fix overly tight assertion about false_positive_rate (Alexander Lakhin)

  • Fix crash in contrib/intarray if an array with an element equal to INT_MAX is inserted into a gist__int_ops index (Alexander Lakhin, Tom Lane)

  • Report a better error when contrib/pageinspect's hash_bitmap_info() function is applied to a partitioned hash index (Alexander Lakhin, Michael Paquier)

  • Report a better error when contrib/pgstattuple's pgstathashindex() function is applied to a partitioned hash index (Alexander Lakhin)

  • On Windows, suppress autorun options when launching subprocesses in pg_ctl and pg_regress (Kyotaro Horiguchi)

    When launching a child process via cmd.exe, pass the /D flag to prevent executing any autorun commands specified in the registry. This avoids possibly-surprising side effects.

  • Move is_valid_ascii() from mb/pg_wchar.h to utils/ascii.h (Jubilee Young)

    This change avoids the need to include <simd.h> in pg_wchar.h, which was causing problems for some third-party code.

  • Fix compilation failures with libxml2 version 2.12.0 and later (Tom Lane)

  • Fix compilation failure of WAL_DEBUG code on Windows (Bharath Rupireddy)

  • Suppress compiler warnings from Python's header files (Peter Eisentraut, Tom Lane)

    Our preferred compiler options provoke warnings about constructs appearing in recent versions of Python's header files. When using gcc, we can suppress these warnings with a pragma.

  • Avoid deprecation warning when compiling with LLVM 18 (Thomas Munro)

  • Update time zone data files to tzdata release 2024a for DST law changes in Greenland, Kazakhstan, and Palestine, plus corrections for the Antarctic stations Casey and Vostok. Also historical corrections for Vietnam, Toronto, and Miquelon.

• ⇑ Upgrade to 15.7 released on 2024-05-09 - docs

  • Restrict visibility of pg_stats_ext and pg_stats_ext_exprs entries to the table owner (Nathan Bossart)

    These views failed to hide statistics for expressions that involve columns the accessing user does not have permission to read. View columns such as most_common_vals might expose security-relevant data. The potential interactions here are not fully clear, so in the interest of erring on the side of safety, make rows in these views visible only to the owner of the associated table.

    The PostgreSQL Project thanks Lukas Fittl for reporting this problem. (CVE-2024-4317)

    By itself, this fix will only fix the behavior in newly initdb'd database clusters. If you wish to apply this change in an existing cluster, you will need to do the following:

    1. Find the SQL script fix-CVE-2024-4317.sql in the share directory of the PostgreSQL installation (typically located someplace like /usr/share/postgresql/). Be sure to use the script appropriate to your PostgreSQL major version. If you do not see this file, either your version is not vulnerable (only v14–v16 are affected) or your minor version is too old to have the fix.

    2. In each database of the cluster, run the fix-CVE-2024-4317.sql script as superuser. In psql this would look like

       \i /usr/share/postgresql/fix-CVE-2024-4317.sql
       

       (adjust the file path as appropriate). Any error probably indicates that you've used the wrong script version. It will not hurt to run the script more than once.

    3. Do not forget to include the template0 and template1 databases, or the vulnerability will still exist in databases you create later. To fix template0, you'll need to temporarily make it accept connections. Do that with

       ALTER DATABASE template0 WITH ALLOW_CONNECTIONS true;
       

       and then after fixing template0, undo it with

       ALTER DATABASE template0 WITH ALLOW_CONNECTIONS false;
       

  • Fix INSERT from multiple VALUES rows into a target column that is a domain over an array or composite type (Tom Lane)

    Such cases would either fail with surprising complaints about mismatched datatypes, or insert unexpected coercions that could lead to odd results.

  • Require SELECT privilege on the target table for MERGE with a DO NOTHING clause (Álvaro Herrera)

    SELECT privilege would be required in all practical cases anyway, but require it even if the query reads no columns of the target table. This avoids an edge case in which MERGE would require no privileges whatever, which seems undesirable even when it's a do-nothing command.

  • Fix handling of self-modified tuples in MERGE (Dean Rasheed)

    Throw an error if a target row joins to more than one source row, as required by the SQL standard. (The previous coding could silently ignore this condition if a concurrent update was involved.) Also, throw a non-misleading error if a target row is already updated by a later command in the current transaction, thanks to a BEFORE trigger or a volatile function used in the query.

  • Fix incorrect pruning of NULL partition when a table is partitioned on a boolean column and the query has a boolean IS NOT clause (David Rowley)

    A NULL value satisfies a clause such as boolcol IS NOT FALSE, so pruning away a partition containing NULLs yielded incorrect answers.

  • Make ALTER FOREIGN TABLE SET SCHEMA move any owned sequences into the new schema (Tom Lane)

    Moving a regular table to a new schema causes any sequences owned by the table to be moved to that schema too (along with indexes and constraints). This was overlooked for foreign tables, however.

  • Make ALTER TABLE ... ADD COLUMN create identity/serial sequences with the same persistence as their owning tables (Peter Eisentraut)

    CREATE UNLOGGED TABLE will make any owned sequences be unlogged too. ALTER TABLE missed that consideration, so that an added identity column would have a logged sequence, which seems pointless.

  • Improve ALTER TABLE ... ALTER COLUMN TYPE's error message when there is a dependent function or publication (Tom Lane)

  • In CREATE DATABASE, recognize strategy keywords case-insensitively for consistency with other options (Tomas Vondra)

  • Fix EXPLAIN's counting of heap pages accessed by a bitmap heap scan (Melanie Plageman)

    Previously, heap pages that contain no visible tuples were not counted; but it seems more consistent to count all pages returned by the bitmap index scan.

  • Fix EXPLAIN's output for subplans in MERGE (Dean Rasheed)

    EXPLAIN would sometimes fail to properly display subplan Params referencing variables in other parts of the plan tree.

  • Avoid deadlock during removal of orphaned temporary tables (Mikhail Zhilin)

    If the session that creates a temporary table crashes without removing the table, autovacuum will eventually try to remove the orphaned table. However, an incoming session that's been assigned the same temporary namespace will do that too. If a temporary table has a dependency (such as an owned sequence) then a deadlock could result between these two cleanup attempts.

  • Avoid race condition while examining per-relation frozen-XID values (Noah Misch)

    VACUUM's computation of per-database frozen-XID values from per-relation values could get confused by a concurrent update of those values by another VACUUM.

  • Fix buffer usage reporting for parallel vacuuming (Anthonin Bonnefoy)

    Buffer accesses performed by parallel workers were not getting counted in the statistics reported in VERBOSE mode.

  • Disallow converting a table to a view within an outer SQL command that is using that table (Tom Lane)

    This avoids possible crashes.

  • Ensure that join conditions generated from equivalence classes are applied at the correct plan level (Tom Lane)

    In versions before PostgreSQL 16, it was possible for generated conditions to be evaluated below outer joins when they should be evaluated above (after) the outer join, leading to incorrect query results. All versions have a similar hazard when considering joins to UNION ALL trees that have constant outputs for the join column in some SELECT arms.

  • Prevent potentially-incorrect optimization of some window functions (David Rowley)

    Disable “run condition” optimization of ntile() and count() with non-constant arguments. This avoids possible misbehavior with sub-selects, typically leading to errors like “WindowFunc not found in subplan target lists”.

  • Avoid unnecessary use of moving-aggregate mode with a non-moving window frame (Vallimaharajan G)

    When a plain aggregate is used as a window function, and the window frame start is specified as UNBOUNDED PRECEDING, the frame's head cannot move so we do not need to use the special (and more expensive) moving-aggregate mode. This optimization was intended all along, but due to a coding error it never triggered.

  • Avoid use of already-freed data while planning partition-wise joins under GEQO (Tom Lane)

    This would typically end in a crash or unexpected error message.

  • Avoid freeing still-in-use data in Memoize (Tender Wang, Andrei Lepikhov)

    In production builds this error frequently didn't cause any problems, as the freed data would most likely not get overwritten before it was used.

  • Fix incorrectly-reported statistics kind codes in “requested statistics kind X is not yet built” error messages (David Rowley)

  • Be more careful with RECORD-returning functions in FROM (Tom Lane)

    The output columns of such a function call must be defined by an AS clause that specifies the column names and data types. If the actual function output value doesn't match that, an error is supposed to be thrown at runtime. However, some code paths would examine the actual value prematurely, and potentially issue strange errors or suffer assertion failures if it doesn't match expectations.

  • Fix confusion about the return rowtype of SQL-language procedures (Tom Lane)

    A procedure implemented in SQL language that returns a single composite-type column would cause an assertion failure or core dump.

  • Add protective stack depth checks to some recursive functions (Egor Chindyaskin)

  • Fix mis-rounding and overflow hazards in date_bin() (Moaaz Assali)

    In the case where the source timestamp is before the origin timestamp and their difference is already an exact multiple of the stride, the code incorrectly subtracted the stride anyway. Also, detect some integer-overflow cases that would have produced incorrect results.

  • Detect integer overflow when adding or subtracting an interval to/from a timestamp (Joseph Koshakow)

    Some cases that should cause an out-of-range error produced an incorrect result instead.

  • Avoid race condition in pg_get_expr() (Tom Lane)

    If the relation referenced by the argument is dropped concurrently, the function's intention is to return NULL, but sometimes it failed instead.

  • Fix detection of old transaction IDs in XID status functions (Karina Litskevich)

    Transaction IDs more than 2³¹ transactions in the past could be misidentified as recent, leading to misbehavior of pg_xact_status() or txid_status().

  • Ensure that a table's freespace map won't return a page that's past the end of the table (Ronan Dunklau)

    Because the freespace map isn't WAL-logged, this was possible in edge cases involving an OS crash, a replica promote, or a PITR restore. The result would be a “could not read block” error.

  • Fix file descriptor leakage when an error is thrown while waiting in WaitEventSetWait (Etsuro Fujita)

  • Avoid corrupting exception stack if an FDW implements async append but doesn't configure any wait conditions for the Append plan node to wait for (Alexander Pyhalov)

  • Throw an error if an index is accessed while it is being reindexed (Tom Lane)

    Previously this was just an assertion check, but promote it into a regular runtime error. This will provide a more on-point error message when reindexing a user-defined index expression that attempts to access its own table.

  • Ensure that index-only scans on name columns return a fully-padded value (David Rowley)

    The value physically stored in the index is truncated, and previously a pointer to that value was returned to callers. This provoked complaints when testing under valgrind. In theory it could result in crashes, though none have been reported.

  • Fix race condition in deciding whether a table sync operation is needed in logical replication (Vignesh C)

    An invalidation event arriving while a subscriber identifies which tables need to be synced would be forgotten about, so that any tables newly in need of syncing might not get processed in a timely fashion.

  • Fix crash with DSM allocations larger than 4GB (Heikki Linnakangas)

  • Disconnect if a new server session's client socket cannot be put into non-blocking mode (Heikki Linnakangas)

    It was once theoretically possible for us to operate with a socket that's in blocking mode; but that hasn't worked fully in a long time, so fail at connection start rather than misbehave later.

  • Fix inadequate error reporting with OpenSSL 3.0.0 and later (Heikki Linnakangas, Tom Lane)

    System-reported errors passed through by OpenSSL were reported with a numeric error code rather than anything readable.

  • Avoid concurrent calls to bindtextdomain() in libpq and ecpglib (Tom Lane)

    Although GNU gettext's implementation seems to be fine with concurrent calls, the version available on Windows is not.

  • Fix crash in ecpg's preprocessor if the program tries to redefine a macro that was defined on the preprocessor command line (Tom Lane)

  • In ecpg, avoid issuing false “unsupported feature will be passed to server” warnings (Tom Lane)

  • Ensure that the string result of ecpg's intoasc() function is correctly zero-terminated (Oleg Tselebrovskiy)

  • In psql, avoid leaking a query result after the query is cancelled (Tom Lane)

    This happened only when cancelling a non-last query in a query string made with \; separators.

  • Fix pg_dumpall so that role comments, if present, will be dumped regardless of the setting of --no-role-passwords (Daniel Gustafsson, Álvaro Herrera)

  • Skip files named .DS_Store in pg_basebackup, pg_checksums, and pg_rewind (Daniel Gustafsson)

    This avoids problems on macOS, where the Finder may create such files.

  • Fix PL/pgSQL's parsing of single-line comments (---style comments) following expressions (Erik Wienhold, Tom Lane)

    This mistake caused parse errors if such a comment followed a WHEN expression in a PL/pgSQL CASE statement.

  • In contrib/amcheck, don't report false match failures due to short- versus long-header values (Andrey Borodin, Michael Zhilin)

    A variable-length datum in a heap tuple or index tuple could have either a short or a long header, depending on compression parameters that applied when it was made. Treat these cases as equivalent rather than complaining if there's a difference.

  • Fix bugs in BRIN output functions (Tomas Vondra)

    These output functions are only used for displaying index entries in contrib/pageinspect, so the errors are of limited practical concern.

  • In contrib/postgres_fdw, avoid emitting requests to sort by a constant (David Rowley)

    This could occur in cases involving UNION ALL with constant-emitting subqueries. Sorting by a constant is useless of course, but it also risks being misinterpreted by the remote server, leading to “ORDER BY position N is not in select list” errors.

  • Make contrib/postgres_fdw set the remote session's time zone to GMT not UTC (Tom Lane)

    This should have the same results for practical purposes. However, GMT is recognized by hard-wired code in the server, while UTC is looked up in the timezone database. So the old code could fail in the unlikely event that the remote server's timezone database is missing entries.

  • In contrib/xml2, avoid use of library functions that have been deprecated in recent versions of libxml2 (Dmitry Koval)

  • Fix incompatibility with LLVM 18 (Thomas Munro, Dmitry Dolgov)

  • Allow make check to work with the musl C library (Thomas Munro, Bruce Momjian, Tom Lane)

• ⇑ Upgrade to 15.8 released on 2024-08-08 - docs

  • Prevent unauthorized code execution during pg_dump (Masahiko Sawada)

    An attacker able to create and drop non-temporary objects could inject SQL code that would be executed by a concurrent pg_dump session with the privileges of the role running pg_dump (which is often a superuser). The attack involves replacing a sequence or similar object with a view or foreign table that will execute malicious code. To prevent this, introduce a new server parameter restrict_nonsystem_relation_kind that can disable expansion of non-builtin views as well as access to foreign tables, and teach pg_dump to set it when available. Note that the attack is prevented only if both pg_dump and the server it is dumping from are new enough to have this fix.

    The PostgreSQL Project thanks Noah Misch for reporting this problem. (CVE-2024-7348)

  • Prevent infinite loop in VACUUM (Melanie Plageman)

    After a disconnected standby server with an old running transaction reconnected to the primary, it was possible for VACUUM on the primary to get confused about which tuples are removable, resulting in an infinite loop.

  • Fix failure after attaching a table as a partition, if the table had previously had inheritance children (Álvaro Herrera)

  • Fix ALTER TABLE DETACH PARTITION for cases involving inconsistent index-based constraints (Álvaro Herrera, Tender Wang)

    When a partitioned table has an index that is not associated with a constraint, but a partition has an equivalent index that is, then detaching the partition would misbehave, leaving the ex-partition's constraint with an incorrect coninhcount value. This would cause trouble during any further manipulations of that constraint.

  • Fix partition pruning setup during ALTER TABLE DETACH PARTITION CONCURRENTLY (Álvaro Herrera)

    The executor assumed that no partition could be detached between planning and execution of a query on a partitioned table. This is no longer true since the introduction of DETACH PARTITION's CONCURRENTLY option, making it possible for query execution to fail transiently when that is used.

  • Correctly update a partitioned table's pg_class.reltuples field to zero after its last child partition is dropped (Noah Misch)

    The first ANALYZE on such a partitioned table must update relhassubclass as well, and that caused the reltuples update to be lost.

  • Fix handling of polymorphic output arguments for procedures (Tom Lane)

    The SQL CALL statement did not resolve the correct data types for such arguments, leading to errors such as “cannot display a value of type anyelement”, or even outright crashes. (But CALL in PL/pgSQL worked correctly.)

  • Fix behavior of stable functions called from a CALL statement's argument list (Tom Lane)

    If the CALL is within an atomic context (e.g. there's an outer transaction block), such functions were passed the wrong snapshot, causing them to see stale values of rows modified since the start of the outer transaction.

  • Detect integer overflow in money calculations (Joseph Koshakow)

    None of the arithmetic functions for the money type checked for overflow before, so they would silently give wrong answers for overflowing cases.

  • Fix over-aggressive clamping of the scale argument in round(numeric) and trunc(numeric) (Dean Rasheed)

    These functions clamped their scale argument to +/-2000, but there are valid use-cases for it to be larger; the functions returned incorrect results in such cases. Instead clamp to the actual allowed range of type numeric.

  • Fix result for pg_size_pretty() when applied to the smallest possible bigint value (Joseph Koshakow)

  • Prevent pg_sequence_last_value() from failing on unlogged sequences on standby servers and on temporary sequences of other sessions (Nathan Bossart)

    Make it return NULL in these cases instead of throwing an error.

  • Fix parsing of ignored operators in websearch_to_tsquery() (Tom Lane)

    Per the manual, punctuation in the input of websearch_to_tsquery() is ignored except for the special cases of dashes and quotes. However, parentheses and a few other characters appearing immediately before an or could cause or to be treated as a data word, rather than as an OR operator as expected.

  • Detect another integer overflow case while computing new array dimensions (Joseph Koshakow)

    Reject applying array dimensions [-2147483648:2147483647] to an empty array. This is closely related to CVE-2023-5869, but appears harmless since the array still ends up empty.

  • Detect another case of a new catalog cache entry becoming stale while detoasting its fields (Noah Misch)

    An in-place update occurring while we expand out-of-line fields in a catalog tuple could be missed, leading to a catalog cache entry that lacks the in-place change but is not known to be stale. This is only possible in the pg_database catalog, so the effects are narrow, but misbehavior is possible.

  • Correctly check updatability of view columns targeted by INSERT ... DEFAULT (Tom Lane)

    If such a column is non-updatable, we should give an error reporting that. But the check was missed and then later code would report an unhelpful error such as “attribute number N not found in view targetlist”.

  • Avoid reporting an unhelpful internal error for incorrect recursive queries (Tom Lane)

    Rearrange the order of error checks so that we throw an on-point error when a WITH RECURSIVE query does not have a self-reference within the second arm of the UNION, but does have one self-reference in some other place such as ORDER BY.

  • Lock owned sequences during ALTER TABLE SET LOGGED|UNLOGGED (Noah Misch)

    These commands change the persistence of a table's owned sequences along with the table, but they failed to acquire lock on the sequences while doing so. This could result in losing the effects of concurrent nextval() calls.

  • Don't throw an error if a queued AFTER trigger no longer exists (Tom Lane)

    It's possible for a transaction to execute an operation that queues a deferred AFTER trigger for later execution, and then to drop the trigger before that happens. Formerly this led to weird errors such as “could not find trigger NNNN”. It seems better to silently do nothing if the trigger no longer exists at the time when it would have been executed.

  • Fix failure to remove pg_init_privs entries for column-level privileges when their table is dropped (Tom Lane)

    If an extension grants some column-level privileges on a table it creates, relevant catalog entries would remain behind after the extension is dropped. This was harmless until/unless the table's OID was re-used for another relation, when it could interfere with what pg_dump dumps for that relation.

  • Fix selection of an arbiter index for ON CONFLICT when the desired index has expressions or predicates (Tom Lane)

    If a query using ON CONFLICT accesses the target table through an updatable view, it could fail with “there is no unique or exclusion constraint matching the ON CONFLICT specification”, even though a matching index does exist.

  • Refuse to modify a temporary table of another session with ALTER TABLE (Tom Lane)

    Permissions checks normally would prevent this case from arising, but it is possible to reach it by altering a parent table whose child is another session's temporary table. Throw an error if we discover that such a child table belongs to another session.

  • Fix handling of extended statistics on expressions in CREATE TABLE LIKE STATISTICS (Tom Lane)

    The CREATE command failed to adjust column references in statistics expressions to the possibly-different column numbering of the new table. This resulted in invalid statistics objects that would cause problems later. A typical scenario where renumbering columns is needed is when the source table contains some dropped columns.

  • Fix failure to recalculate sub-queries generated from MIN() or MAX() aggregates (Tom Lane)

    In some cases the aggregate result computed at one row of the outer query could be re-used for later rows when it should not be. This has only been seen to happen when the outer query uses DISTINCT that is implemented with hash aggregation, but other cases may exist.

  • Avoid crashing when a JIT-inlined backend function throws an error (Tom Lane)

    The error state can include pointers into the dynamically loaded module holding the JIT-compiled code (for error location strings). In some code paths the module could get unloaded before the error report is processed, leading to SIGSEGV when the location strings are accessed.

  • Cope with behavioral changes in libxml2 version 2.13.x (Erik Wienhold, Tom Lane)

    Notably, we now suppress “chunk is not well balanced” errors from libxml2, unless that is the only reported error. This is to make error reports consistent between 2.13.x and earlier libxml2 versions. In earlier versions, that message was almost always redundant or outright incorrect, so 2.13.x substantially reduced the number of cases in which it's reported.

  • Fix handling of subtransactions of prepared transactions when starting a hot standby server (Heikki Linnakangas)

    When starting a standby's replay at a shutdown checkpoint WAL record, transactions that had been prepared but not yet committed on the primary are correctly understood as being still in progress. But subtransactions of a prepared transaction (created by savepoints or PL/pgSQL exception blocks) were not accounted for and would be treated as aborted. That led to inconsistency if the prepared transaction was later committed.

  • Prevent incorrect initialization of logical replication slots (Masahiko Sawada)

    In some cases a replication slot's start point within the WAL stream could be set to a point within a transaction, leading to assertion failures or incorrect decoding results.

  • Avoid “can only drop stats once” error during replication slot creation and drop (Floris Van Nee)

  • Fix resource leakage in logical replication WAL sender (Hou Zhijie)

    The walsender process leaked memory when publishing changes to a partitioned table whose partitions have row types physically different from the partitioned table's.

  • Avoid memory leakage after servicing a notify or sinval interrupt (Tom Lane)

    The processing functions for these events could switch the current memory context to TopMemoryContext, resulting in session-lifespan leakage of any data allocated before the incorrect setting gets replaced. There were observable leaks associated with (at least) encoding conversion of incoming queries and parameters attached to Bind messages.

  • Prevent leakage of reference counts for the shared memory block used for statistics (Anthonin Bonnefoy)

    A new backend process attaching to the statistics shared memory incremented its reference count, but failed to decrement the count when exiting. After 2³² sessions had been created, the reference count would overflow to zero, causing failures in all subsequent backend process starts.

  • Prevent deadlocks and assertion failures during truncation of the multixact SLRU log (Heikki Linnakangas)

    A process trying to delete SLRU segments could deadlock with the checkpointer process.

  • Avoid possibly missing end-of-input events on Windows sockets (Thomas Munro)

    Windows reports an FD_CLOSE event only once after the remote end of the connection disconnects. With unlucky timing, we could miss that report and wait indefinitely, or at least until a timeout elapsed, expecting more input.

  • Fix buffer overread in JSON parse error reports for incomplete byte sequences (Jacob Champion)

    It was possible to walk off the end of the input buffer by a few bytes when the last bytes comprise an incomplete multi-byte character. While usually harmless, in principle this could cause a crash.

  • Disable creation of stateful TLS session tickets by OpenSSL (Daniel Gustafsson)

    This avoids possible failures with clients that think receipt of a session ticket means that TLS session resumption is supported.

  • When replanning a PL/pgSQL “simple expression”, check it's still simple (Tom Lane)

    Certain fairly-artificial cases, such as dropping a referenced function and recreating it as an aggregate, could lead to surprising failures such as “unexpected plan node type”.

  • Fix incompatibility between PL/Perl and Perl 5.40 (Andrew Dunstan)

  • Fix recursive RECORD-returning PL/Python functions (Tom Lane)

    If we recurse to a new call of the same function that passes a different column definition list (AS clause), it would fail because the inner call would overwrite the outer call's idea of what rowtype to return.

  • Don't corrupt PL/Python's TD dictionary during a recursive trigger call (Tom Lane)

    If a PL/Python-language trigger caused another one to be invoked, the TD dictionary created for the inner one would overwrite the outer one's TD dictionary.

  • Fix PL/Tcl's reporting of invalid list syntax in the result of a function returning tuple (Erik Wienhold, Tom Lane)

    Such a case could result in a crash, or in emission of misleading context information that actually refers to the previous Tcl error.

  • Avoid non-thread-safe usage of strerror() in libpq (Peter Eisentraut)

    Certain error messages returned by OpenSSL could become garbled in multi-threaded applications.

  • Avoid memory leak within pg_dump during a binary upgrade (Daniel Gustafsson)

  • Ensure that pg_restore -l reports dependent TOC entries correctly (Tom Lane)

    If -l was specified together with selective-restore options such as -n or -N, dependent TOC entries such as comments would be omitted from the listing, even when an actual restore would have selected them.

  • Avoid “cursor can only scan forward” error in contrib/postgres_fdw (Etsuro Fujita)

    This error could occur if the remote server is v15 or later and a foreign table is mapped to a non-trivial remote view.

  • In contrib/postgres_fdw, do not send FETCH FIRST WITH TIES clauses to the remote server (Japin Li)

    The remote server might not implement this clause, or might interpret it differently than we would locally, so don't risk attempting remote execution.

  • Avoid clashing with system-provided <regex.h> headers (Thomas Munro)

    This fixes a compilation failure on macOS version 15 and up.

  • Fix otherwise-harmless assertion failure in Memoize cost estimation (David Rowley)

  • Fix otherwise-harmless assertion failures in REINDEX CONCURRENTLY applied to an SP-GiST index (Tom Lane)

• source repo
• author info
• meta-info