Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_du…
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client ope…
Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cu…
Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via confl…
Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running…
Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to f…
SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression …
Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via cr…
Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the databas…
Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, vi…
Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emer…
Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write o…
Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pa…
Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 an…
Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY …
Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4…
Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account runn…
Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and O…
Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count…
Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on t…
Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is th…
Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via…
Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security polic…
Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows…
Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lack…
Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes tha…
databases/postgresql??-*: Update to latest versions
Update to 18.6, 17.11, 16.15, 15.19 and 14.24.
This release fixes 28 security vulnerabilities and over 110 bugs
reported over the last several months.
Welcome postgresql19 to the ports tree with 19-beta3.
Note: PostgreSQL 18.5 was skipped due to a regression; the fix
version is 18.6.
PostgreSQL 14 will stop receiving fixes on 2026-11-12.
Changes: https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/
Security: 05d311bc-9991-11f1-bc50-6cc21735f730
databases/postgresql??-*: Upgrade to latest version
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 18.4, 17.10, 16.14, 15.18,
and 14.23. This release fixes 11 security vulnerabilities and over 60
bugs reported over the last several months.
Release notes: https://www.postgresql.org/docs/release/
PostgreSQL 14 EOL Notice
PostgreSQL 14 will stop receiving fixes on November 12, 2026. If you are
running PostgreSQL 14 in a production environment, we suggest that you
make plans to upgrade to a newer, supported version of PostgreSQL.
Please see our versioning policy for more information.
Security: 7185ecc9-4fb7-11f1-bc50-6cc21735f730
CVE-2026-6472, CVE-2026-6473, CVE-2026-6474,
CVE-2026-6475, CVE-2026-6476, CVE-2026-6477,
CVE-2026-6478, CVE-2026-6479, CVE-2026-6575,
CVE-2026-6637, CVE-2026-6638.
databases/postgresql??-*: Update to latest version
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 18.3, 17.9, 16.13, 15.17,
and 14.22. This is an out-of-cycle release that fixes several
regressions reported after the last update release.
Release notes: https://www.postgresql.org/about/news/postgresql-183-179-1613-1517-and-1422-released-3246/
https://wiki.postgresql.org/wiki/2026-02_Regression_Fixes
databases/postgresql*-*: Update to latest version
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 18.2, 17.8, 16.12, 15.16,
and 14.21. This release fixes 5 security vulnerabilities and over 65
bugs reported over the last several months.
Release notes:
https://www.postgresql.org/about/news/postgresql-182-178-1612-1516-and-1421-released-3235/
https://www.postgresql.org/docs/release/
Security:
CVE-2026-2003: PostgreSQL oidvector discloses a few bytes of memory
CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code
CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code
CVE-2026-2006: PostgreSQL missing validation of multibyte character length executes arbitrary code
CVE-2026-2007: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory
Remove postgresql13* since it is now EoL.
databases/postgresql??-*: Update to latest versions
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 18.1, 17.7, 16.11, 15.15,
14.20, and 13.23. This release fixes 2 security vulnerabilities and over
50 bugs reported over the last several months.
This is the final release of PostgreSQL 13. PostgreSQL 13 is now
end-of-life and will no longer receive security and bug fixes.
Release notes: https://www.postgresql.org/about/news/postgresql-181-177-1611-1515-1420-and-1323-released-3171/
databases/postgresql{13,14,15,16,17,18}-*: Multiple fixes
- Strip shared library and binary executable
- Fix stage-qa
- Bump PORTREVISION for package change
postgresql{13,14,15,16,17,18}-server:
- Clean up Makefile: Remove unnecessary ";\"
- Sort PLIST: share/locale comes before DATADIR (share/postgresql)
postgresql{17,18}-plperl:
- Remove duplicate USES=perl5
- Add missing USE_PERL5=run
from postgresql{17,18}-plperl build log:
====> Running Q/A tests (stage-qa)
Error: /usr/local/lib/postgresql/bool_plperl.so is linked to /usr/local/lib/perl5/5.40/mach/CORE/libperl.so.5.40 from lang/perl5.40 but it is not declared as a dependency
PR: 290587
Approved by: girgen
databases/postgresql??-*: Update to latest versions
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.6, 16.10, 15.14, 14.19,
and 13.22, as well as the third beta release of PostgreSQL 18. This
release fixes 3 security vulnerabilities and over 55 bugs reported over
the last several months.
If you previously created a BRIN index using the
numeric_minmax_multi_ops operator class, please see the "Updating"
section for additional instructions after upgrading your instance.
For the full list of changes, please review the release notes.
Build client with ZSTD default [1].
Support promote and logrotate commans in RC-script. [2]
PR: 287225 [1], 288836 [2]
Security: fc048b51-7909-11f0-90a2-6cc21735f730
Release notes: https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
databases/postgresql1?-contrib: Fix plist issue for openssl=off
When OPENSSL=off, pgcrypto was not built but existed unconditionally in
the plist.
Noted by: Andrea Venturoli
databases/postgresql??-*: Update to latest version
PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 Released!
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.5, 16.9, 15.13, 14.18,
and 13.21. This release fixes 1 security vulnerability and over 60 bugs
reported over the last several months.
Security: 78b8e808-2c45-11f0-9a65-6cc21735f730
Release notes: https://www.postgresql.org/about/news/postgresql-175-169-1513-1418-and-1321-released-3072/
databases/postgresql??-*: Upgrade to latest versions
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.4, 16.8, 15.12, 14.17,
and 13.20.
The issues listed below affect PostgreSQL 17. Some of these issues may
also affect other supported versions of PostgreSQL.
Improve behavior of quoting functions in libpq. The fix for
CVE-2025-1094 caused the quoting functions to not honor their string
length parameters and, in some cases, cause crashes. This problem could
be noticeable from a PostgreSQL client library, based on how it is
integrated with libpq.
Fix small memory leak in pg_createsubscriber.
Also fix a problem in the FreeBSD port, where the rc script wouldn't
return properly, messing up orchestration tools like ansible. [1]
PR: 272502 [1]
Release notes: https://www.postgresql.org/docs/release/
databases/postgresql??-*: Update to latest versions
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.3, 16.7, 15.11, 14.16,
and 13.19. This release fixes 1 security vulnerability and over 70 bugs
reported over the last several months.
For the full list of changes, please review the release notes.
This commit also removes the broken support for Heimdal and fixes the
build when using MIT Kerberos. [1]
PR: 220325 suggested by Cullum Smith and many others. [1]
Release notes: https://www.postgresql.org/docs/release/
Security: fadf3b41-ea19-11ef-a540-6cc21735f730
databases/postgresql1{3,4,5,6,7}-client: Recommend py-psycopg over py-psycopg2
Upstream Python package maintainers recommend using the psycopg 3.x over
psycopg2 for new projects since the latter is in maintenance mode only.
Approved by: girgen (pgsql)
Differential Revision: https://reviews.freebsd.org/D48493
databases/postgresql??-*: Update to latest version
The issues listed below affect PostgreSQL 17. Some of these issues may
also affect other supported versions of PostgreSQL.
- Restore functionality of ALTER ROLE .. SET ROLE and ALTER DATABASE ..
SET ROLE. The fix for CVE-2024-10978 accidentally caused settings for
role to not be applied if they came from non-interactive sources,
including previous ALTER {ROLE|DATABASE} commands and the PGOPTIONS
environment variable.
- Restore compatibility for the timescaledb and other PostgreSQL
extensions built using PostgreSQL prior to the 2024-11-14 release
(17.0, 16.4, 15.8, 14.13, 13.16, 12.20, and earlier). This fix restores
struct ResultRelInfo to its previous size, so that affected extensions
don't need to be rebuilt.
- Fix cases where a logical replication slot's restart_lsn could go backwards.
- Avoid deleting still-needed WAL files during pg_rewind.
- Fix race conditions associated with dropping shared statistics
entries, which could lead to loss of statistics data.
- Fix crash with ALTER TABLE when checking to see if an index's opclass
options have changed if the table has an index with a non-default
operator class.
Security: 12e3feab-a29f-11ef-af48-6cc21735f730
databases/postgresql??-*: Update to latest versions
PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 Released!
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.1, 16.5, 15.9, 14.14,
13.17, and 12.21. This release fixes 4 security vulnerabilities and over
35 bugs reported over the last several months.
Also add XML back as an active default option due to popular demand. [1]
Clean up the ports a bit.
PR: 269115 [1]
Release notes: https://www.postgresql.org/docs/release/
Security: a03636f4-a29f-11ef-af48-6cc21735f730
Security: 12e3feab-a29f-11ef-af48-6cc21735f730
Security: a61ef21b-a29e-11ef-af48-6cc21735f730
Security: 3831292b-a29d-11ef-af48-6cc21735f730
databases/postgresql??-*: Update to latest minor versions
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 16.4, 15.8, 14.13, 13.16,
and 12.20. This release fixes 1 security vulnerability and over 55 bugs
reported over the last several months.
PR: 279671 - make the rc script service jails aware
PR: 279536 - remove LLVM max version restriction
PR: 278887 - SETENV -> SETENVI for -contrib ports
Release notes: https://www.postgresql.org/docs/release/
postgresql??-*: Build with a clean environment
The fix in 572f236169264, PR 276478, suggest a change SETENV->SETENVI.
Implement this for the PostgreSQL builds. This should fix builds
problems for some when building using portmaster.
PR: 278889
Reported by: O. Hartmann
databases/postgresql??-*: Update to latest versions
PostgreSQL 16.3, 15.7, 14.12, 13.15, and 12.19 Released!
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 16.3, 15.7, 14.12, 13.15,
and 12.19. This release fixes one security vulnerability and over 55
bugs reported over the last several months.
Please note that the fix in this release for CVE-2024-4317 only fixes
fresh PostgreSQL installations, namely those that are created with the
initdb utility after this fix is applied. If you have a current
PostgreSQL installation and are concerned about this issue, please
follow the additional updating instructions provided in the
CVE-2024-4317 description or the release notes for the remediation. [1]
The script is installed as /usr/local/share/postgresql/fix-CVE-2024-4317.sql
PostgreSQL 12 will stop receiving fixes on November 14, 2024. If you are
running PostgreSQL 12 in a production environment, we suggest that you
make plans to upgrade to a newer, supported version of PostgreSQL.
Please see our versioning policy for more information.
[1]: https://www.postgresql.org/support/security/CVE-2024-4317/
Security: d53c30c1-0d7b-11ef-ba02-6cc21735f730
PR: 277428 (remove unneded patch)
PR: 260494 (remove deprecated INTDATE option)
PR: 265860 (correct path for contrib README file in pkg-message)
databases/postgresql??-*: Update to latest version
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 16.2, 15.6, 14.11, 13.14,
and 12.18. This release fixes one security vulnerability and over 65
bugs reported over the last several months.
If you use GIN indexes, you may need to reindex after updating to this
release. Please see the release notes for more information.
URL: https://www.postgresql.org/about/news/postgresql-162-156-1411-1314-and-1218-released-2807/
Release notes: https://www.postgresql.org/docs/release/
Security: 19e6dd1b-c6a5-11ee-9cd0-6cc21735f730
databases/postgresql??-server: honour login class set in /etc/passwd
If postgresql_login_class is not set, honour the setting in /etc/passwd.
The previous commit ignored the passwd setting and set the login class
to "default" if it was left unset.
PR: 275851
*/*: Sunset 12.4-RELEASE/12-STABLE from ports tree
- Remove all references to defunct ARCH arm
- Remove all references to defunct ARCH sparc64
- Remove x11-drivers/xf86-video-sunffb which requires defunct sparc64
ARCH
- Remove sysutils/afbinit requires defunct sparc64 ARCH
- Remove all references to bktr driver
- Remove all references to defunct FreeBSD_12
- Remove all references to OSVERSION/OSREL corresponding to 12
- Remove conditionals in Mk/Uses/cabal.mk
- Remove sparc reference from Mk/Uses/qt-dist.mk
- Remove BROKEN_sparc64/NOT_FOR_ARCH=sparc64
- Remove BROKEN_FreeBSD_12* from:
- Remove OpenSSL patches from:
- Remove conditional flags for OSVERSION >= 1300000 to fixed flags.
Also move conditional flags for non sparc64/arm ARCH to fixed flags.
Reviewed by: brooks, jbeich, rene, salvadore
Differential Revision: https://reviews.freebsd.org/D42068
databases/postgresql??-*: update to latest version
PostgreSQL 16.1, 15.5, 14.10, 13.13, 12.17, and 11.22 Released!
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 16.1, 15.5, 14.10, 13.13,
12.17, and 11.22 This release fixes three security vulnerabilities and
over 55 bugs reported over the last several months.
Release notes: https://www.postgresql.org/about/news/postgresql-161-155-1410-1313-1217-and-1122-released-2749/
Security: CVE-2023-5868, CVE-2023-5869, CVE-2023-5870
Security: 31f45d06-7f0e-11ee-94b4-6cc21735f730
Security: 0f445859-7f0e-11ee-94b4-6cc21735f730
Security: bbb18fcb-7f0d-11ee-94b4-6cc21735f730
databases/postgresql16-*: Update to 16.0
The PostgreSQL Global Development Group today announced the release of
PostgreSQL 16, the latest version of the world's most advanced open
source database.
PostgreSQL 16 raises its performance, with notable improvements to query
parallelism, bulk data loading, and logical replication. There are many
features in this release for developers and administrators alike,
including more SQL/JSON syntax, new monitoring stats for your workloads,
and greater flexibility in defining access control rules for management
of policies across large fleets.
Read about more improvements in the release notes, for example about
Performance Improvements, Logical replication, Developer Experience,
Access Control & Security and Monitoring.
Release notes: https://www.postgresql.org/about/news/postgresql-16-released-2715/
databases/postgresql??-*: Update to latest versions.
PostgreSQL 15.4, 14.9, 13.12, 12.16, 11.21, and PostgreSQL 16 Beta 3
Released.
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 15.4, 14.9, 13.12, 12.16,
and 11.21, as well as the third beta release of PostgreSQL 16. This
release fixes two security vulnerabilities and over 40 bugs reported
over the last several months.
If you use BRIN indexes to look up NULL values, you will need to reindex
them after upgrading to this release. On PostgreSQL 12 and above, you
can use REINDEX CONCURRENTLY to avoid blocking writes to the affected
index and table, for example:
REINDEX INDEX CONCURRENTLY your_index_name;
Also, remove the patch for postgresql.conf.sample suggesting to turn off
update_process_title [1], since it is no longer a problem.
Release notes: https://www.postgresql.org/about/news/postgresql-154-149-1312-1216-1121-and-postgresql-16-beta-3-released-2689/
[1]: https://commitfest.postgresql.org/19/1715/
databases/postgresql15-server: fix build with clang 16 (as system compiler)
databases/postgresql??-server: use the default LLVM
Always use the version of LLVM that is default for the ports tree,
if PostgreSQL builds with it. This simplifies the build process.
For i386, revert to using clang -msse2 instead of pulling in gcc. CPUs
older than Pentium5 do not support SSE2 and the binary will not run
there. We are not expected to support ancient hardware forever, so I've
added a comment recommending users of ancient CPUs to build from ports
using gcc.
During an exp-run for llvm 16 (see bug 271047), it turned out that
databases/postgresql15-server failed to build with clang 16 as the base
system compiler:
In file included from llvmjit.c:38:
../../../../src/include/jit/llvmjit_emit.h:112:23: warning: call to undeclared function 'LLVMBuildStructGEP'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
LLVMValueRef v_ptr = LLVMBuildStructGEP(b, v, idx, "");
^
../../../../src/include/jit/llvmjit_emit.h:112:15: error: incompatible integer to pointer conversion initializing 'LLVMValueRef' (aka 'struct LLVMOpaqueValue *') with an expression of type 'int' [-Wint-conversion]
LLVMValueRef v_ptr = LLVMBuildStructGEP(b, v, idx, "");
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../../../../src/include/jit/llvmjit_emit.h:114:9: warning: call to undeclared function 'LLVMBuildLoad'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
return LLVMBuildLoad(b, v_ptr, name);
^
../../../../src/include/jit/llvmjit_emit.h:114:9: error: incompatible integer to pointer conversion returning 'int' from a function with result type 'LLVMValueRef' (aka 'struct LLVMOpaqueValue *') [-Wint-conversion]
return LLVMBuildLoad(b, v_ptr, name);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
and many more similar errors. The same applies to the slave ports
postgresql11-server, postgresql12-server, postgresql13-server, and
postgresql14-server.
This is because PostgreSQL's llvmjit support is not yet ready for LLVM
16's API changes. In LLVM 15 functions like LLVMBuildStructGEP were
already declared deprecated, but in LLVM 16 these have been removed (and
replaced with LLVMBuildStructGEP2, etc).
Until PostgreSQL updates their llvmjit for the changed APIs, I would
like to reintroduce the LLVM version restriction that was removed in
<https://cgit.freebsd.org/ports/commit/?id=1e19f00e5e46>, but slightly
adjusted: there is no more need to check for LLVM ports below 10.
Another thing that is required is to pass a CLANG variable to the
configure script, pointing to the same version that is used for the LLVM
bindings. Otherwise, the .bc files will get compiled by the base system
compiler, and this can lead to a ThinLTO link error, if the base system
compiler is a newer version of llvm.
PR: 271498
Suggested by: dim@