Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_du…
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client ope…
Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cu…
Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via confl…
Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running…
Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to f…
SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression …
Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via cr…
Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the databas…
Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, vi…
Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emer…
Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write o…
Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pa…
Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 an…
Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY …
Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4…
Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account runn…
Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and O…
Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count…
Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on t…
Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is th…
Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via…
Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security polic…
Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows…
Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lack…
Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes tha…
databases/postgresql??-*: Update to latest versions
Update to 18.6, 17.11, 16.15, 15.19 and 14.24.
This release fixes 28 security vulnerabilities and over 110 bugs
reported over the last several months.
Welcome postgresql19 to the ports tree with 19-beta3.
Note: PostgreSQL 18.5 was skipped due to a regression; the fix
version is 18.6.
PostgreSQL 14 will stop receiving fixes on 2026-11-12.
Changes: https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/
Security: 05d311bc-9991-11f1-bc50-6cc21735f730
databases/postgresql??-*: Upgrade to latest version
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 18.4, 17.10, 16.14, 15.18,
and 14.23. This release fixes 11 security vulnerabilities and over 60
bugs reported over the last several months.
Release notes: https://www.postgresql.org/docs/release/
PostgreSQL 14 EOL Notice
PostgreSQL 14 will stop receiving fixes on November 12, 2026. If you are
running PostgreSQL 14 in a production environment, we suggest that you
make plans to upgrade to a newer, supported version of PostgreSQL.
Please see our versioning policy for more information.
Security: 7185ecc9-4fb7-11f1-bc50-6cc21735f730
CVE-2026-6472, CVE-2026-6473, CVE-2026-6474,
CVE-2026-6475, CVE-2026-6476, CVE-2026-6477,
CVE-2026-6478, CVE-2026-6479, CVE-2026-6575,
CVE-2026-6637, CVE-2026-6638.
databases/postgresql??-*: Update to latest version
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 18.3, 17.9, 16.13, 15.17,
and 14.22. This is an out-of-cycle release that fixes several
regressions reported after the last update release.
Release notes: https://www.postgresql.org/about/news/postgresql-183-179-1613-1517-and-1422-released-3246/
https://wiki.postgresql.org/wiki/2026-02_Regression_Fixes
databases/postgresql*-*: Update to latest version
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 18.2, 17.8, 16.12, 15.16,
and 14.21. This release fixes 5 security vulnerabilities and over 65
bugs reported over the last several months.
Release notes:
https://www.postgresql.org/about/news/postgresql-182-178-1612-1516-and-1421-released-3235/
https://www.postgresql.org/docs/release/
Security:
CVE-2026-2003: PostgreSQL oidvector discloses a few bytes of memory
CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code
CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code
CVE-2026-2006: PostgreSQL missing validation of multibyte character length executes arbitrary code
CVE-2026-2007: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory
Remove postgresql13* since it is now EoL.
databases/postgresql??-*: Update to latest versions
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 18.1, 17.7, 16.11, 15.15,
14.20, and 13.23. This release fixes 2 security vulnerabilities and over
50 bugs reported over the last several months.
This is the final release of PostgreSQL 13. PostgreSQL 13 is now
end-of-life and will no longer receive security and bug fixes.
Release notes: https://www.postgresql.org/about/news/postgresql-181-177-1611-1515-1420-and-1323-released-3171/
databases/postgresql{13,14,15,16,17,18}-*: Multiple fixes
- Strip shared library and binary executable
- Fix stage-qa
- Bump PORTREVISION for package change
postgresql{13,14,15,16,17,18}-server:
- Clean up Makefile: Remove unnecessary ";\"
- Sort PLIST: share/locale comes before DATADIR (share/postgresql)
postgresql{17,18}-plperl:
- Remove duplicate USES=perl5
- Add missing USE_PERL5=run
from postgresql{17,18}-plperl build log:
====> Running Q/A tests (stage-qa)
Error: /usr/local/lib/postgresql/bool_plperl.so is linked to /usr/local/lib/perl5/5.40/mach/CORE/libperl.so.5.40 from lang/perl5.40 but it is not declared as a dependency
PR: 290587
Approved by: girgen
databases/postgresql??-*: Update to latest versions
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.6, 16.10, 15.14, 14.19,
and 13.22, as well as the third beta release of PostgreSQL 18. This
release fixes 3 security vulnerabilities and over 55 bugs reported over
the last several months.
If you previously created a BRIN index using the
numeric_minmax_multi_ops operator class, please see the "Updating"
section for additional instructions after upgrading your instance.
For the full list of changes, please review the release notes.
Build client with ZSTD default [1].
Support promote and logrotate commans in RC-script. [2]
PR: 287225 [1], 288836 [2]
Security: fc048b51-7909-11f0-90a2-6cc21735f730
Release notes: https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
databases/postgresql1?-contrib: Fix plist issue for openssl=off
When OPENSSL=off, pgcrypto was not built but existed unconditionally in
the plist.
Noted by: Andrea Venturoli
databases/postgresql??-*: Update to latest version
PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 Released!
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.5, 16.9, 15.13, 14.18,
and 13.21. This release fixes 1 security vulnerability and over 60 bugs
reported over the last several months.
Security: 78b8e808-2c45-11f0-9a65-6cc21735f730
Release notes: https://www.postgresql.org/about/news/postgresql-175-169-1513-1418-and-1321-released-3072/
databases/postgresql??-*: Upgrade to latest versions
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.4, 16.8, 15.12, 14.17,
and 13.20.
The issues listed below affect PostgreSQL 17. Some of these issues may
also affect other supported versions of PostgreSQL.
Improve behavior of quoting functions in libpq. The fix for
CVE-2025-1094 caused the quoting functions to not honor their string
length parameters and, in some cases, cause crashes. This problem could
be noticeable from a PostgreSQL client library, based on how it is
integrated with libpq.
Fix small memory leak in pg_createsubscriber.
Also fix a problem in the FreeBSD port, where the rc script wouldn't
return properly, messing up orchestration tools like ansible. [1]
PR: 272502 [1]
Release notes: https://www.postgresql.org/docs/release/
databases/postgresql??-*: Update to latest versions
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.3, 16.7, 15.11, 14.16,
and 13.19. This release fixes 1 security vulnerability and over 70 bugs
reported over the last several months.
For the full list of changes, please review the release notes.
This commit also removes the broken support for Heimdal and fixes the
build when using MIT Kerberos. [1]
PR: 220325 suggested by Cullum Smith and many others. [1]
Release notes: https://www.postgresql.org/docs/release/
Security: fadf3b41-ea19-11ef-a540-6cc21735f730
databases/postgresql1{3,4,5,6,7}-client: Recommend py-psycopg over py-psycopg2
Upstream Python package maintainers recommend using the psycopg 3.x over
psycopg2 for new projects since the latter is in maintenance mode only.
Approved by: girgen (pgsql)
Differential Revision: https://reviews.freebsd.org/D48493
databases/postgresql??-*: Update to latest version
The issues listed below affect PostgreSQL 17. Some of these issues may
also affect other supported versions of PostgreSQL.
- Restore functionality of ALTER ROLE .. SET ROLE and ALTER DATABASE ..
SET ROLE. The fix for CVE-2024-10978 accidentally caused settings for
role to not be applied if they came from non-interactive sources,
including previous ALTER {ROLE|DATABASE} commands and the PGOPTIONS
environment variable.
- Restore compatibility for the timescaledb and other PostgreSQL
extensions built using PostgreSQL prior to the 2024-11-14 release
(17.0, 16.4, 15.8, 14.13, 13.16, 12.20, and earlier). This fix restores
struct ResultRelInfo to its previous size, so that affected extensions
don't need to be rebuilt.
- Fix cases where a logical replication slot's restart_lsn could go backwards.
- Avoid deleting still-needed WAL files during pg_rewind.
- Fix race conditions associated with dropping shared statistics
entries, which could lead to loss of statistics data.
- Fix crash with ALTER TABLE when checking to see if an index's opclass
options have changed if the table has an index with a non-default
operator class.
Security: 12e3feab-a29f-11ef-af48-6cc21735f730
databases/postgresql??-*: Update to latest versions
PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 Released!
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.1, 16.5, 15.9, 14.14,
13.17, and 12.21. This release fixes 4 security vulnerabilities and over
35 bugs reported over the last several months.
Also add XML back as an active default option due to popular demand. [1]
Clean up the ports a bit.
PR: 269115 [1]
Release notes: https://www.postgresql.org/docs/release/
Security: a03636f4-a29f-11ef-af48-6cc21735f730
Security: 12e3feab-a29f-11ef-af48-6cc21735f730
Security: a61ef21b-a29e-11ef-af48-6cc21735f730
Security: 3831292b-a29d-11ef-af48-6cc21735f730
databases/postgresql??-*: Update to latest minor versions
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 16.4, 15.8, 14.13, 13.16,
and 12.20. This release fixes 1 security vulnerability and over 55 bugs
reported over the last several months.
PR: 279671 - make the rc script service jails aware
PR: 279536 - remove LLVM max version restriction
PR: 278887 - SETENV -> SETENVI for -contrib ports
Release notes: https://www.postgresql.org/docs/release/
databases/postgresql??-*: Update to latest versions
PostgreSQL 16.3, 15.7, 14.12, 13.15, and 12.19 Released!
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 16.3, 15.7, 14.12, 13.15,
and 12.19. This release fixes one security vulnerability and over 55
bugs reported over the last several months.
Please note that the fix in this release for CVE-2024-4317 only fixes
fresh PostgreSQL installations, namely those that are created with the
initdb utility after this fix is applied. If you have a current
PostgreSQL installation and are concerned about this issue, please
follow the additional updating instructions provided in the
CVE-2024-4317 description or the release notes for the remediation. [1]
The script is installed as /usr/local/share/postgresql/fix-CVE-2024-4317.sql
PostgreSQL 12 will stop receiving fixes on November 14, 2024. If you are
running PostgreSQL 12 in a production environment, we suggest that you
make plans to upgrade to a newer, supported version of PostgreSQL.
Please see our versioning policy for more information.
[1]: https://www.postgresql.org/support/security/CVE-2024-4317/
Security: d53c30c1-0d7b-11ef-ba02-6cc21735f730
PR: 277428 (remove unneded patch)
PR: 260494 (remove deprecated INTDATE option)
PR: 265860 (correct path for contrib README file in pkg-message)
databases/postgresql??-*: Update to latest version
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 16.2, 15.6, 14.11, 13.14,
and 12.18. This release fixes one security vulnerability and over 65
bugs reported over the last several months.
If you use GIN indexes, you may need to reindex after updating to this
release. Please see the release notes for more information.
URL: https://www.postgresql.org/about/news/postgresql-162-156-1411-1314-and-1218-released-2807/
Release notes: https://www.postgresql.org/docs/release/
Security: 19e6dd1b-c6a5-11ee-9cd0-6cc21735f730
databases/postgresql??-server: honour login class set in /etc/passwd
If postgresql_login_class is not set, honour the setting in /etc/passwd.
The previous commit ignored the passwd setting and set the login class
to "default" if it was left unset.
PR: 275851
databases/postgresql??-*: update to latest version
PostgreSQL 16.1, 15.5, 14.10, 13.13, 12.17, and 11.22 Released!
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 16.1, 15.5, 14.10, 13.13,
12.17, and 11.22 This release fixes three security vulnerabilities and
over 55 bugs reported over the last several months.
Release notes: https://www.postgresql.org/about/news/postgresql-161-155-1410-1313-1217-and-1122-released-2749/
Security: CVE-2023-5868, CVE-2023-5869, CVE-2023-5870
Security: 31f45d06-7f0e-11ee-94b4-6cc21735f730
Security: 0f445859-7f0e-11ee-94b4-6cc21735f730
Security: bbb18fcb-7f0d-11ee-94b4-6cc21735f730
databases/postgresql??-*: Update to latest versions.
PostgreSQL 15.4, 14.9, 13.12, 12.16, 11.21, and PostgreSQL 16 Beta 3
Released.
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 15.4, 14.9, 13.12, 12.16,
and 11.21, as well as the third beta release of PostgreSQL 16. This
release fixes two security vulnerabilities and over 40 bugs reported
over the last several months.
If you use BRIN indexes to look up NULL values, you will need to reindex
them after upgrading to this release. On PostgreSQL 12 and above, you
can use REINDEX CONCURRENTLY to avoid blocking writes to the affected
index and table, for example:
REINDEX INDEX CONCURRENTLY your_index_name;
Also, remove the patch for postgresql.conf.sample suggesting to turn off
update_process_title [1], since it is no longer a problem.
Release notes: https://www.postgresql.org/about/news/postgresql-154-149-1312-1216-1121-and-postgresql-16-beta-3-released-2689/
[1]: https://commitfest.postgresql.org/19/1715/
databases/postgresql??-server: update to latest version
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 15.3, 14.8, 13.11, 12.15,
and 11.20. This release fixes two security vulnerabilities over 80 bugs
reported over the last several months.
CVE-2023-2454: CREATE SCHEMA ... schema_element defeats protective search_path changes.
This enabled an attacker having database-level CREATE privilege to
execute arbitrary code as the bootstrap superuser. Database owners have
that right by default, and explicit grants may extend it to other users.
CVE-2023-2455: Row security policies disregard user ID changes after inlining.
While CVE-2016-2193 fixed most interaction between row security and user
ID changes, it missed a scenario involving function inlining. This leads
to potentially incorrect policies being applied in cases where
role-specific policies are used and a given query is planned under one
role and then executed under other roles. This scenario can happen under
security definer functions or when a common user and query is planned
initially and then re-used across multiple SET ROLEs. Applying an
incorrect policy may permit a user to complete otherwise-forbidden reads
and modifications. This affects only databases that have used CREATE
POLICY to define a row security policy.
Security: fbb5a260-f00f-11ed-bbae-6cc21735f730
Security: 4b636f50-f011-11ed-bbae-6cc21735f730
Release-notes: https://www.postgresql.org/docs/release/
databases/postgresql??-*: upgrade to latest versions
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 15.2, 14.7, 13.10, 12.14,
and 11.19. This release closes one security vulnerability and fixes over
60 bugs reported over the last several months.
Release notes: https://www.postgresql.org/docs/release/
Security: CVE-2022-41862: Client memory disclosure when
connecting, with Kerberos, to modified server.
databases/postgresql*-server: require mountlate in rc.d scripts
PostgreSQL server may use late-mounted filesystems, so require these
in rc.d scripts. Real life example is when /tmp is late-mounted tmpfs
atop of ZFS, and if posgresql-server starts before mountlate, its
socket which resides on /tmp is hidden under tmpfs which is mounted
afterwards.
PR: 267500
Approved by: maintainer timeout (pgsql, 2 weeks)
databases/postgresq??-*: update to latest version
PostgreSQL 15.1, 14.6, 13.9, 12.13, 11.18, and 10.23 Released!
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 15.1, 14.6, 13.9, 12.13,
11.18, and 10.23. This release fixes 25 bugs reported over the last
several months.
This is the final release of PostgreSQL 10. PostgreSQL 10 will no longer
receive security and bug fixes. If you are running PostgreSQL 10 in a
production environment, we suggest that you make plans to upgrade.
Release notes: https://www.postgresql.org/docs/release/
databases/postgresql*-server: fix minor style bugs in maintenance script
Convert to ASCII and trim EOL whitespace. The scripts are now identical
across all PostgreSQL server versions we have in the ports.
Verified by: cksum(1)
Fix WWW in parent/child ports
Many of the WWW are overwritten later which means the wrong value
is used. This did not happen before where the children were either
a) just using the pkg-descr from the parents
b) or had their own separate pkg-descr with custom WWW
Use WWW?= in parents when the child's WWW is different.
Children that use the same WWW as the parent can just inherit it,
i.e., the child WWW can be removed.
Approved by: portmgr (implicit)
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
databases/postgresql??-*: Update to latest version
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 14.5, 13.8, 12.12, 11.17,
and 10.22, as well as the third beta release of PostgreSQL 15. This
release closes one security vulnerability and fixes over 40 bugs
reported over the last three months.
PostgreSQL 10 will stop receiving fixes on November 10, 2022. If you are
running PostgreSQL 10 in a production environment, we strongly advise
that you make plans to upgrade to a newer, supported version of
PostgreSQL so you can continue to receive bug and security fixes.
Security: CVE-2022-2625
Release notes: https://www.postgresql.org/about/news/postgresql-145-138-1212-1117-1022-and-15-beta-3-released-2496/
databases/postgresql14-server: update to 14.4
This release fixes an issue with all versions of PostgreSQL 14 that can
lead to silent corruption of indexes.
Since the release of PostgreSQL 14.0, there existed an issue with CREATE
INDEX CONCURRENTLY and REINDEX CONCURRENTLY that could cause silent data
corruption in indexes. This issue is fixed in the upcoming PostgreSQL
14.4 release.
If you ran either of these commands on any version of PostgreSQL 14
prior to 14.4, you may have experienced silent data corruption. You can
use the pg_amcheck command with the --heapallindexed flag to detect this
issue with B-tree indexes.
If you need an immediate remediation for this issue before the
PostgreSQL 14.4 release, you can run CREATE INDEX or REINDEX without
CONCURRENTLY. You can also run the reindexdb command and use the --jobs
flag for added parallelism, but do not use the --concurrently flag.
Once PostgreSQL 14.4 is released, you can safely use CREATE INDEX
CONCURRENTLY and REINDEX CONCURRENTLY to manage your indexes, as well as
the --concurrently flag on reindexdb.
URL: https://www.postgresql.org/message-id/165473835807.573551.1512237163040609764%40wrigleys.postgresql.org
postgresql??-server: fix regression in the rc script
The rc script was converted to use a SUB_LIST variable, but I failed to
introduce the variable correctly in the Makefile. [1]
The plist for postgresql15-server was incorrect. Fixed this as well.
PR: 264097 [1]
databases/postgresql??-*: add postgresql-15 to the ports tree
Introduce PostgreSQL-15 to the ports tree.
Make version 15 the master port, and add plist parameter for the
postgresql version.
Release notes: https://www.postgresql.org/docs/devel/release.html
databases/postgresql??-server: update to latest version
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 14.3, 13.7, 12.11, 11.16,
and 10.21. This release fixes over 50 bugs reported over the last three
months. This release closes one security vulnerability and fixes over 50
bugs reported over the last three months.
We encourage you to install this update at your earliest possible
convenience.
If you have any GiST indexes on columns using the ltree data type, you
will need to reindex them after upgrading.
For the full list of changes, please review the release notes.
It also fixes a security issue, CVE-2022-1552:
Autovacuum, REINDEX, and others omit "security restricted operation" sandbox.
Versions Affected: 10 - 14. The security team typically does not test
unsupported versions, but this problem is quite old.
Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER,
and pg_amcheck made incomplete efforts to operate safely when a
privileged user is maintaining another user's objects. Those commands
activated relevant protections too late or not at all. An attacker
having permission to create non-temp objects in at least one schema
could execute arbitrary SQL functions under a superuser identity.
While promptly updating PostgreSQL is the best remediation for most
users, a user unable to do that can work around the vulnerability by
disabling autovacuum, not manually running the above commands, and not
restoring from output of the pg_dump command. Performance may degrade
quickly under this workaround. VACUUM is safe, and all commands are fine
when a trusted user owns the target object.
Security: 157ce083-d145-11ec-ab9b-6cc21735f730
Release notes: https://www.postgresql.org/docs/release/
databases/postgresql14-server: Avoid using llvm14
When the base system compiler is clang 14, the postgresql ports attempt
to build against the devel/llvm14 port. This will fail with several
compile errors as there are a few incompatible changes in the LLVM 14 C
and C++ APIs. Until upstream postgresql adapts to these changes, limit
the PG_LLVM_VERSION to a maximum of 13.
PR: 261976
Approved by: maintainer timeout (2 weeks)
MFH: 2022Q1
databases/postgresql??-server: Upgrade to latest version
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 14.2, 13.6, 12.10, 11.15,
and 10.20. This release fixes over 55 bugs reported over the last three
months.
Announcement: https://www.postgresql.org/about/news/postgresql-142-136-1210-1115-and-1020-released-2402/
Release notes: https://www.postgresql.org/docs/release/