postgresql-18 (18.6-3.pgdg22.04+1) jammy-pgdg; urgency=medium

  * Rebuild for jammy-pgdg.
  * Changes applied:
    + Use clang/llvm 15 for jit support.
    + Remove tzdata-legacy from build and test dependencies.

 -- PostgreSQL on Debian and Ubuntu <pgsql-pkg-debian@lists.postgresql.org>  Sat, 15 Aug 2026 21:42:00 +0200

postgresql-18 (18.6-3) unstable; urgency=medium

  * Fix package names used in the Breaks and drop old Breaks against
    dbconfig-common before 2.0.22.

 -- Christoph Berg <myon@debian.org>  Sat, 15 Aug 2026 21:42:00 +0200

postgresql-18 (18.6-2) unstable; urgency=medium

  * Add Breaks on the packages affected by the output_plugin_libraries change:
    pg-rewrite, pg-squeeze, postgres-decoderbufs, wal2json.
    Also add timescaledb (different reason, TBD).

 -- Christoph Berg <myon@debian.org>  Fri, 14 Aug 2026 22:45:43 +0200

postgresql-18 (18.6-1) unstable; urgency=medium

  * New upstream version 18.6. (18.5 was never released.)

    + Restrict logical decoding output plugins to the set specified by
      a new server parameter `output_plugin_libraries` (Jacob
      Champion)

      Previously, a replication user could select any loadable library
      for logical decoding, allowing exploits of various sorts. To
      allow locking this down without breaking setups that worked
      before, introduce a whitelist of allowed output plugins.

      By default, only the output plugins shipped as part of
      PostgreSQL (`pgoutput` and `test_decoding`) are included in
      `output_plugin_libraries`. Installations that rely on other
      output plugins must add them after updating the server, for
      example

      output_plugin_libraries = 'pgoutput, test_decoding, my_trusted_decoder'

      Additionally, pg_upgrade --check will fail if the
      `output_plugin_libraries` parameter on the new cluster does not
      permit the plugins of logical replication slots on the old
      cluster, when migrating from versions 17 and later. Make
      necessary additions to the new cluster's setting before
      performing pg_upgrade.

      The PostgreSQL Project thanks Vladimir Tokarev and Yu Kunpeng
      for reporting this problem. (CVE-2026-6471)

    + Fix contrib/pgcrypto's PGP encryption to detect unsupported
      ciphers (Daniel Gustafsson)

      Previously, if OpenSSL rejected the requested cipher (for
      example, because it is running in FIPS mode, or the legacy
      provider hasn't been loaded), pgcrypto failed to notice the
      failure and simply XOR'd the non-encrypted block with the
      plaintext, rendering the "encryption" trivially breakable. This
      will typically occur with deprecated or non-FIPS cipher
      algorithms (cipher-algo=blowfish/bf, twofish, cast5, or 3des).

      By default, pgcrypto will now fail to decrypt any messages that
      were affected in this way. To allow retrieval of such data, a
      new option `ignore-cipher-failure` has been added to
      pgp_pub_decrypt() and pgp_sym_decrypt(). Setting
      `ignore-cipher-failure=1` will restore their previous behavior,
      allowing the faulty encryption wrapper to be stripped off:

      pgp_sym_decrypt(encrypted_column, any key, 'ignore-cipher-failure=1')

      Once the affected messages are identified and stripped of their
      wrappers, they can then be re-encrypted with a modern algorithm.
      It is important however that the behavior of OpenSSL be the same
      as it was when the faulty messages were created: if the set of
      unsupported algorithms is not the same, this approach will not
      work. See the documentation for `ignore-cipher-failure`.

      The PostgreSQL Project thanks Shishir Sharma for reporting this
      problem. (CVE-2026-14663)

    + Fix psql to skip in-line data following a scripted COPY ... FROM
      STDIN command, even if the COPY fails before sending
      `PGRES_COPY_IN` (Tom Lane)

      Previously, if a `COPY` command failed at startup (for instance,
      because the target table doesn't exist) psql would not realize
      that and would proceed to read the following in-line data as SQL
      commands. In the best case that's wrong and in the worst case
      it's a SQL-injection hazard. Teach psql to recognize
      syntactically-valid COPY ... FROM STDIN commands and to skip
      data on its own authority if the server doesn't respond with
      `PGRES_COPY_IN`.

      While this fix is unlikely to affect any production SQL scripts,
      test scripts might intentionally exercise failing COPY ... FROM
      STDIN commands. Those will need to gain a `\.` data terminator
      line after each such command.

      The PostgreSQL Project thanks Alexander Lakhin for reporting
      this problem. (CVE-2026-6464)

    + Cross-check the output row type of a portal running EXECUTE or
      FETCH (Robert Haas)

      EXECUTE and FETCH use two portals: an outer one for the
      statement itself, and an inner one running the query being
      executed on its behalf. It was previously possible to make the
      declared row types of the two portals diverge, leading to server
      memory disclosure and arbitrary code execution.

      The PostgreSQL Project thanks Ben Morris (in collaboration with
      Claude and Anthropic Research) and Peter Geoghegan for reporting
      this problem. (CVE-2026-16239)

    + Fix buffer overrun with long time zone abbreviation in to_char()
      (Tom Lane)

      This can easily crash the server, and exploits leading to
      arbitrary code execution have been reported.

      The PostgreSQL Project thanks Hcamael, Amjad Shahzad, Tan Zhen
      of AntAISecurityLab, Tomer Fichman, Zheng Yu, Amy Burnett
      (OpenAI Codex Security), Rick de Jager, Heewon Song, Sylvie
      Mayer, Aleksander Alekseev, and Hillai Ben Sasson for reporting
      this problem. (CVE-2026-14669)

    + Fix buffer overrun in regexp match/split functions (Masahiko
      Sawada)

      If passed invalidly-encoded data, these functions could write
      past the end of their conversion buffer.

      The PostgreSQL Project thanks Francesco Verardi for reporting
      this problem. (CVE-2026-14664)

    + Harden the ascii() function against invalid input (Michael
      Paquier)

      By supplying invalidly-encoded input, this function could be
      coaxed to read and return a few bytes of data that it shouldn't.
      In assert-enabled builds, its assertions could be triggered too.

      The PostgreSQL Project thanks Hcamael for reporting this
      problem. (CVE-2026-18024)

    + Fix multirange type handling in pg_restore_attribute_stats()
      (OpenAI Security Research Team)

      pg_restore_attribute_stats() treated multirange types just like
      their underlying range type. This works correctly for the bounds
      histogram, but it was wrong for all the other statistics kinds.

      The PostgreSQL Project thanks Amy Burnett (OpenAI Codex
      Security) for reporting this problem. (CVE-2026-16238)

    + Make scalarineqsel() check that a constant it expects to be of
      type tid actually is (Tom Lane)

      This expectation will hold for all the built-in operators that
      use this estimator, but a maliciously-constructed operator could
      violate it, leading to a crash or server memory disclosure.

      The PostgreSQL Project thanks Hcamael for reporting this
      problem. (CVE-2026-14668)

    + Harden tsvector and tsquery code against overly long values
      (both individual lexemes and total vector/query length) (Tom
      Lane)

      The documented limits were not enforced in all code paths.

      The PostgreSQL Project thanks Yuhang Wu, Zhenpeng Lin, Zheng Yu,
      and Hcamael for reporting these problems. (CVE-2026-14662)

    + Fix various places that mistakenly assumed they would not have
      to deal with more than `FUNC_MAX_ARGS` function arguments (Tom
      Lane)

      Notably, the server's actual limit on the number of arguments to
      an aggregate function is `FUNC_MAX_ARGS - 1`, but the parser
      failed to enforce that, creating hazards downstream.

      The PostgreSQL Project thanks Zheng Yu, ylwangtju, and Masahiko
      Sawada for reporting these problems. (CVE-2026-14679)

    + Reject calls from SQL to functions that take or return type
      internal (Tom Lane)

      The existing defenses against doing this have been shown to be
      insufficient, so add more explicit checks.

      The PostgreSQL Project thanks Amy Burnett (OpenAI Codex
      Security) for reporting this problem. (CVE-2026-14680)

    + Preserve the ownership of extended statistics objects when they
      are rebuilt by ALTER TABLE (Masahiko Sawada)

      Previously, the role running ALTER TABLE gained ownership of
      such objects, but that seems inappropriate.

      The PostgreSQL Project thanks Noah Misch for reporting this
      problem. (CVE-2026-6469)

    + When deparsing an EXTRACT() function call, quote the field name
      if needed (Nathan Bossart)

      The parser accepts any string literal as a field name in
      EXTRACT(), deferring validation to execution. If the call is
      stored and deparsed (for example during pg_dump), the string
      body was regurgitated verbatim, allowing SQL injection.

      The PostgreSQL Project thanks Ben Morris (in collaboration with
      Claude and Anthropic Research) for reporting this problem.
      (CVE-2026-15741)

    + Check for `USAGE` privilege on data types in places that
      formerly failed to check that (Nathan Bossart)

      CREATE TYPE AS RANGE did not check, nor did ALTER TABLE OF, nor
      did commands that create stored expressions. These omissions
      allowed roles without `USAGE` privilege to nonetheless create
      objects depending on the type, possibly blocking the type's
      owner from changing the type later.

      The PostgreSQL Project thanks Jingzhou Fu for reporting this
      problem. (CVE-2026-6470)

    + Invalidate role-dependent cached plans after role changes (Ilya
      Staroverov, Shinya Kato, Nathan Bossart)

      Role membership, role attribute, and database ownership changes
      may impact the expected behavior of row-level security policies,
      but previously we'd continue to use cached plans that were made
      according to the old state of affairs.

      The PostgreSQL Project thanks Ilya Staroverov and Shinya Kato
      for reporting this problem. (CVE-2026-14666)

    + Reject GSSEncRequest after direct SSL connection (Michael
      Paquier)

      After establishing a TLS-encrypted connection, the server would
      still accept a request for GSSAPI encryption. If that succeeded,
      the connection would proceed using TLS encryption, but it would
      look like a GSS connection to the pg_hba rules. Thus, a pg_hba
      policy intending to disallow TLS would not be enforced
      correctly.

      The PostgreSQL Project thanks p4p3r for reporting this problem.
      (CVE-2026-14681)

    + Make mock SCRAM authentication secrets more plausible (Nathan
      Bossart)

      If a SCRAM login is attempted against a role that doesn't exist
      or doesn't have a SCRAM secret, we generate a mock secret and
      carry out the authentication handshake anyway, to avoid
      revealing these facts to an attacker. But the mock secret was
      made with a fixed iteration count, which in itself can be an
      observable response discrepancy. Use the configuration setting
      `scram_iterations` instead, to make the mock secret look more
      like the installation's real secrets.

      The PostgreSQL Project thanks Radim Marek for reporting this
      problem. (CVE-2026-14672)

    + Fix out-of-bounds writes in ecpg applications caused by invalid
      bytea data received from the server (Michael Paquier)

      ecpg assumed without checking that any bytea value must begin
      with `\x`. A broken or malicious server might send a string
      shorter than 2 bytes, resulting in memory clobber in the
      application.

      The PostgreSQL Project thanks ylwangtju for reporting this
      problem. (CVE-2026-16241)

    + Do not do backquote expansion on the argument of psql's
      \unrestrict command (Nathan Bossart)

      This oversight in the fix for CVE-2025-8714 allows a malicious
      server to inject shell commands into plain-text dump output that
      will be run at restore time on the machine running psql, the
      exact scenario that CVE-2025-8714 intended to prevent.

      The PostgreSQL Project thanks Lucas Velgus, Filip Janus, and
      Daniel Bakker for reporting this problem. (CVE-2026-18408)

    + Remove pg_dump's assumption that pg_proc.protrftypes cannot have
      more than `FUNC_MAX_ARGS` entries (Tom Lane)

      Since there could be entries for both input and output
      arguments, it's feasible for this array's length to exceed
      `FUNC_MAX_ARGS` (which constrains only input arguments). Even if
      that were not so, pg_dump cannot assume that the server was
      built with the same value of `FUNC_MAX_ARGS` that it has. An
      overrun would lead to a memory clobber inside pg_dump.

      The PostgreSQL Project thanks Masahiko Sawada for reporting this
      problem. (CVE-2026-19385)

    + Harden PL/Perl against "tied" Perl arrays and hashes (Tom Lane)

      A tied object that doesn't behave like a regular one could lead
      to memory overwrite, or to constructing a corrupt result array
      (which would likely cause problems later).

      The PostgreSQL Project thanks Hcamael for reporting this
      problem. (CVE-2026-14670)

    + Fix integer overflows in memory-allocation calculations in
      PL/Perl and PL/Tcl (Heikki Linnakangas)

      This is the same type of problem as CVE-2026-6473, just in a
      different part of the code, and is fixed in the same way.

      The PostgreSQL Project thanks the Tulya Project (Team Dhiutsa,
      Bitecope Technologies Private Ltd) for reporting this problem.
      (CVE-2026-14677)

    + Ensure that contrib/amcheck functions restrict `search_path`
      before executing index expressions (Noah Misch)

      Because amcheck will run such index expressions as the owner of
      their tables, a caller could potentially hijack
      `search_path`-dependent functions to run arbitrary code as the
      table owner. By default this is not a vulnerability because only
      superusers are allowed to call amcheck functions; but if that
      privilege was granted out, it created a larger hazard than the
      documentation suggests.

      The PostgreSQL Project thanks Yuelin Wang and Jacob Brazeal for
      reporting this problem. (CVE-2026-14673)

    + Fix integer overflows in contrib/fuzzystrmatch's levenshtein()
      and levenshtein_less_equal() functions (Nathan Bossart)

      Passing large cost values to these functions could cause integer
      overflows, thereby producing nonsensical results, and even
      causing out-of-bounds writes in some cases.

      The PostgreSQL Project thanks Ben Morris (in collaboration with
      Claude and Anthropic Research) for reporting this problem.
      (CVE-2026-15742)

    + Fix buffer overrun in contrib/pg_stat_statements (Álvaro
      Herrera)

      Query normalization didn't accurately account for the amount of
      space the normalized string would require.

      The PostgreSQL Project thanks Sajeeb Lohani (with TrendAI Zero
      Day Initiative) and Yuelin Wang for reporting this problem.
      (CVE-2026-14676)

    + Fix datatype error in contrib/pg_trgm's GiST picksplit function
      (Heikki Linnakangas)

      This mistake resulted in reading past the end of the buffer,
      typically causing bad split decisions; but a crash could ensue
      if you're very unlucky.

      The PostgreSQL Project thanks Mehmet D. Ince for reporting this
      problem. (CVE-2026-14678)

    + Remove the plan cache in contrib/refint (Ayush Tiwari)

      This caching behavior has several serious bugs, notably that
      check_foreign_key() embeds the new key values in its
      cascade-UPDATE queries, so a cached plan reuses the
      originally-needed values rather than the key values that should
      be used. The simplest solution is to remove it.

      The PostgreSQL Project thanks Hcamael for reporting this
      problem. (CVE-2026-14671)

    + Ensure that parallel GIN index builds update the table's
      pg_class.reltuples value correctly (Jan Nidzwetzki, Tomas
      Vondra)

      A parallel worker could report an uninitialized value for the
      number of rows it processed, leading to a bogus value for
      reltuples, even Infinity or NaN. Such values could lead to
      subsequent autovacuum and autoanalyze operations never deciding
      that the table needs to be processed. If so, the situation will
      not self-heal. A manual ANALYZE command, or creation of another
      index, will be needed to reset reltuples to the correct value.
      If you have any tables with GIN indexes, it's recommended to
      check to see if their reltuples entries look sane. A query such
      as this may be helpful:

        SELECT DISTINCT t.oid::regclass, t.reltuples
        FROM pg_class t
          JOIN pg_index i ON t.oid = i.indrelid
          JOIN pg_class ic ON i.indexrelid = ic.oid
        WHERE t.relhasindex AND ic.relam = 2742;

  * Fix psql -c 'truncate/create table; copy from stdin'.

 -- Christoph Berg <myon@debian.org>  Tue, 11 Aug 2026 22:58:48 +0200

postgresql-18 (18.4-1) unstable; urgency=medium

  [ Christoph Berg ]
  * New upstream version 18.4.

    + Prevent unbounded recursion while processing startup packets
      (Michael Paquier)

      A malicious client could crash the connected backend by alternating
      rejected SSL and GSS encryption requests indefinitely.

      The PostgreSQL Project thanks Calif.io (in collaboration with Claude and
      Anthropic Research) for reporting this problem. (CVE-2026-6479)

    + Fix assorted integer overflows in memory-allocation calculations
      (Tom Lane, Nathan Bossart, Heikki Linnakangas)

      Various places were incautious about the possibility of integer overflow
      in calculations of how much memory to allocate.  Overflow would lead to
      allocating a too-small buffer which the caller would then write past the
      end of.  This would at least trigger server crashes, and probably could
      be exploited for arbitrary code execution.  In many but by no means all
      cases, the hazard exists only in 32-bit builds.

      The PostgreSQL Project thanks Xint Code, Bruce Dang, Sven Klemm, and
      Pavel Kohout for reporting these problems. (CVE-2026-6473)

    + Properly quote subscription names in pg_createsubscriber
      (Nathan Bossart)

      The given subscription name was inserted into SQL commands without
      quoting, so that SQL injection could be achieved in the (perhaps
      unlikely) case that the subscription name comes from an untrusted
      source.

      The PostgreSQL Project thanks Yu Kunpeng for reporting this problem.
      (CVE-2026-6476)

    + Properly quote object names in logical replication origin checks
      (Pavel Kohout)

      ALTER SUBSCRIPTION ... REFRESH PUBLICATION interpolated schema and
      relation names into SQL commands without quoting them, allowing
      execution of arbitrary SQL on the publisher.

      The PostgreSQL Project thanks Pavel Kohout for reporting this problem.
      (CVE-2026-6638)

    + Reject over-length options in ts_headline() (Michael Paquier)

      The StartSel, StopSel and FragmentDelimiter strings must not exceed 32Kb
      in length, but this was not checked for.  An over-length value would
      typically crash the server.

      The PostgreSQL Project thanks Xint Code for reporting this problem.
      (CVE-2026-6473)

    + Detect faulty input when restoring attribute MCV statistics
      (Michael Paquier)

      The statistics restore functions were insufficiently careful about
      validating most-common-value statistics, and would accept values that
      could crash the planner later on.

      The PostgreSQL Project thanks Jeroen Gui for reporting this problem.
      (CVE-2026-6575)

    + Guard against malicious time zone names in timeofday() and pg_strftime()
      (Tom Lane)

      A crafted time zone setting could pass % sequences to snprintf(),
      potentially causing crashes or disclosure of server memory.  Another
      path to similar results was to overflow the limited-size output buffer
      used by pg_strftime().

      The PostgreSQL Project thanks Xint Code for reporting this problem.
      (CVE-2026-6474)

    + When creating a multirange type, ensure the user has CREATE privilege on
      the schema specified for the multirange type (Jelte Fennema-Nio)

      The multirange type can be put into a different schema than its parent
      range type, but we neglected to apply the required privilege check when
      doing so.

      The PostgreSQL Project thanks Jelte Fennema-Nio for reporting this
      problem. (CVE-2026-6472)

    + Use timing-safe string comparisons in authentication code
      (Michael Paquier)

      Use timingsafe_bcmp() instead of memcpy() or strcmp() when checking
      passwords, hashes, etc.  It is not known whether the data dependency of
      those functions is usefully exploitable in any of these places, but in
      the interests of safety, replace them.

      The PostgreSQL Project thanks Joe Conway for reporting this problem.
      (CVE-2026-6478)

    + Mark PQfn() as unsafe, and avoid using it within libpq (Nathan Bossart)

      For a non-integral result type, PQfn() is not passed the size of the
      output buffer, so it cannot check that the data returned by the server
      will fit.  A malicious server could therefore overwrite client memory.
      This is unfixable without an API change, so mark the function as
      deprecated.  Internally to libpq, use a variant version that can apply
      the missing check.

      The PostgreSQL Project thanks Yu Kunpeng and Martin Heistermann for
      reporting this problem. (CVE-2026-6477)

    + Prevent path traversal in pg_basebackup and pg_rewind (Michael Paquier)

      These applications failed to validate output file paths read from their
      input, so that a malicious source could overwrite any file writable by
      these applications.  Constrain where data can be written by rejecting
      paths that are absolute or contain parent-directory references.

      The PostgreSQL Project thanks XlabAI Team of Tencent Xuanwu Lab and
      Valery Gubanov for reporting this problem. (CVE-2026-6475)

    + Guard against field overflow within contrib/intarray's query_int type
      and contrib/ltree's ltxtquery type (Tom Lane)

      Parsing of these query structures did not check for overflow of 16-bit
      fields, so that construction of an invalid query tree was possible.
      This can crash the server when executing the query.

      The PostgreSQL Project thanks Xint Code for reporting this problem.
      (CVE-2026-6473)

    + Guard against overly long values of contrib/ltree's lquery type
      (Michael Paquier)

      Values with more than 64K items caused internal overflows, potentially
      resulting in stack smashes or wrong answers.

      The PostgreSQL Project thanks Vergissmeinnicht, A1ex, and Jihe Wang for
      reporting this problem. (CVE-2026-6473)

    + Prevent SQL injection and buffer overruns in contrib/spi
      (Nathan Bossart)

      check_foreign_key() was insufficiently careful about quoting key values,
      and also used fixed-length buffers for constructing queries.  While this
      module is only meant as example code, it still shouldn't contain such
      dangerous errors.

      The PostgreSQL Project thanks Nikolay Samokhvalov for reporting this
      problem. (CVE-2026-6637)

  * Add zh_TW, zh_CN debconf translations. Thanks Yangfl! (Closes: #1124468)

  [ Michael Banck ]
  * Add patch that fixes TAP tests on hurd.

 -- Christoph Berg <myon@debian.org>  Mon, 11 May 2026 22:49:32 +0200

postgresql-18 (18.3-1) unstable; urgency=medium

  * New upstream version 18.3.

    + Fix failure after replaying a multixid truncation record from WAL that
      was generated by an older minor version (Heikki Linnakangas)

      Erroneous logic for coping with the way that previous versions handled
      multixid wraparound led to replay failure, with messages like "could not
      access status of transaction". A typical scenario in which this could
      occur is a standby server of the latest minor version consuming WAL from
      a primary server of an older version.

    + Avoid incorrect complaint of invalid encoding when substring() is
      applied to toasted data (Noah Misch)

      The fix for CVE-2026-2006 was too aggressive and could raise an error
      about an incomplete character in cases that are actually valid.

    + Fix oversight in the fix for CVE-2026-2007 (Zsolt Parragi)

      If the bounds array needed to be expanded, because the input contained
      more trigrams than the initial guess, generate_trgm_only didn't return
      the modified array pointer to its caller.  That would lead to incorrect
      output from strict_word_similarity() and related functions, or in rare
      cases a crash.  The faulty code is reached if the input string becomes
      longer when it's converted to lower case. The only known instances of
      that occur when an ICU locale is used with certain single-byte
      encodings.

    + Fix the volatility marking of json_strip_nulls() and jsonb_strip_nulls()
      (Andrew Dunstan)

      These functions have always been considered immutable, but refactoring
      in version 18 accidentally marked them stable instead. That prevents
      their use in index expressions and could cause unnecessary repeat
      evaluations in queries.  This fix corrects the marking in
      newly-initialized database clusters (including clusters that are
      pg_upgrade'd to 18.3 or later). However it will not help existing
      clusters made using 18.0 through 18.2.

      If this mistake affects your usage of these functions, the recommended
      fix for an existing cluster is a manual catalog update. As superuser,
      perform

      UPDATE pg_catalog.pg_proc SET provolatile = 'i' WHERE oid IN ('3261','3262');

      in each affected database.  Update template0 and template1 as well, so
      that databases made in future will have the fix.

 -- Christoph Berg <myon@debian.org>  Tue, 24 Feb 2026 12:48:56 +0100

postgresql-18 (18.2-1) unstable; urgency=medium

  * New upstream version 18.2.

    + Guard against unexpected dimensions of oidvector/int2vector (Tom Lane)

      These data types are expected to be 1-dimensional arrays containing no
      nulls, but there are cast pathways that permit violating those
      expectations.  Add checks to some functions that were depending on those
      expectations without verifying them, and could misbehave in consequence.

      The PostgreSQL Project thanks Altan Birler for reporting this problem.
      (CVE-2026-2003)

    + Harden selectivity estimators against being attached to operators that
      accept unexpected data types (Tom Lane)

      contrib/intarray contained a selectivity estimation function that could
      be abused for arbitrary code execution, because it did not check that
      its input was of the expected data type.  Third-party extensions should
      check for similar hazards and add defenses using the technique intarray
      now uses. Since such extension fixes will take time, we now require
      superuser privilege to attach a non-built-in selectivity estimator to an
      operator.

      The PostgreSQL Project thanks Daniel Firer, as part of zeroday.cloud,
      for reporting this problem. (CVE-2026-2004)

    + Fix buffer overrun in contrib/pgcrypto's PGP decryption functions
      (Michael Paquier)

      Decrypting a crafted message with an overlength session key caused a
      buffer overrun, with consequences as bad as arbitrary code execution.

      The PostgreSQL Project thanks Team Xint Code, as part of zeroday.cloud,
      for reporting this problem. (CVE-2026-2005)

    + Fix inadequate validation of multibyte character lengths
      (Thomas Munro, Noah Misch)

      Assorted bugs allowed an attacker able to issue crafted SQL to overrun
      string buffers, with consequences as bad as arbitrary code execution.
      After these fixes, applications may observe invalid byte sequence for
      encoding errors when string functions process invalid text that has been
      stored in the database.

      The PostgreSQL Project thanks Paul Gerste and Moritz Sanft, as part of
      zeroday.cloud, for reporting this problem. (CVE-2026-2006)

    + Harden contrib/pg_trgm against changes in string lowercasing behavior
      (Heikki Linnakangas)

      Fix potential buffer overruns arising from the fact that in some locales
      lower-casing a string can produce more characters (not bytes) than were
      in the original.  That behavior is new in version 18, and so is the bug.

      The PostgreSQL Project thanks Heikki Linnakangas for reporting this
      problem. (CVE-2026-2007)

  * Remove pg_numa_init and LLVM 21 patches, merged upstream.

 -- Christoph Berg <myon@debian.org>  Tue, 10 Feb 2026 11:26:19 +0100

postgresql-18 (18.1-2) unstable; urgency=medium

  * Fix build with LLVM 21.

 -- Christoph Berg <myon@debian.org>  Thu, 11 Dec 2025 17:37:16 +0100

postgresql-18 (18.1-1) unstable; urgency=medium

  * New upstream version 18.1.

    + Check for CREATE privileges on the schema in CREATE STATISTICS
      (Jelte Fennema-Nio)

      This omission allowed table owners to create statistics in any schema,
      potentially leading to unexpected naming conflicts.

      The PostgreSQL Project thanks Jelte Fennema-Nio for reporting this
      problem. (CVE-2025-12817)

    + Avoid integer overflow in allocation-size calculations within libpq
      (Jacob Champion)

      Several places in libpq were not sufficiently careful about computing
      the required size of a memory allocation.  Sufficiently large inputs
      could cause integer overflow, resulting in an undersized buffer, which
      would then lead to writing past the end of the buffer.

      The PostgreSQL Project thanks Aleksey Solovev of Positive Technologies
      for reporting this problem. (CVE-2025-12818)

  * Handle EPERM in pg_numa_init.
  * Test-Depend on postgresql-common-dev.

 -- Christoph Berg <myon@debian.org>  Tue, 11 Nov 2025 13:05:55 +0100

postgresql-18 (18.0-1) unstable; urgency=medium

  * PostgreSQL 18.0.
  * B-D on openssl.

 -- Christoph Berg <myon@debian.org>  Tue, 23 Sep 2025 21:46:05 +0200

postgresql-18 (18~rc1-3) unstable; urgency=medium

  * libpq.pc: Drop libcurl from Requires.private.

 -- Christoph Berg <myon@debian.org>  Tue, 23 Sep 2025 17:12:07 +0200

postgresql-18 (18~rc1-2) unstable; urgency=medium

  * Upload to unstable in preparation of 18.0 release.
  * B-D on postgresql-common-dev instead of -common.
  * Drop move-pages32 patch, upstream had a different fix already.

 -- Christoph Berg <myon@debian.org>  Mon, 22 Sep 2025 12:37:17 +0200

postgresql-18 (18~rc1-1) experimental; urgency=medium

  * New upstream version 18rc1.
  * libpq-oauth.lintian-overrides: Package is a plugin.

 -- Christoph Berg <myon@debian.org>  Wed, 13 Aug 2025 23:37:10 +0200

postgresql-18 (18~beta3-1) experimental; urgency=medium

  * New upstream version 18beta3.
  * Drop obsolete patches: focal-arm64-outline-atomics, jit-s390x.

 -- Christoph Berg <myon@debian.org>  Tue, 12 Aug 2025 12:08:31 +0200

postgresql-18 (18~beta2-1) experimental; urgency=medium

  * New upstream version 18beta2.
  * Drop hurd-iovec patch, implemented upstream.
  * debian/libpq5.symbols: Remove PQservice (introduced earlier in 18).

 -- Christoph Berg <myon@debian.org>  Fri, 18 Jul 2025 12:48:48 +0200

postgresql-18 (18~beta1+20250701-1) experimental; urgency=medium

  * New upstream snapshot.

 -- Christoph Berg <myon@debian.org>  Tue, 01 Jul 2025 11:36:41 +0200

postgresql-18 (18~beta1+20250624-1) experimental; urgency=medium

  * New upstream snapshot.
  * Restrict libpq-oauth and B-D: libnuma-dev to [linux-any].
  * Work around a Linux 32-bit bug in move_pages on 64-bit kernels.
  * Add Turkish debconf translation by Atila KOÇ, thanks! (Closes: #1107984)
  * Add Catalan debconf translation by Carles Pina i Estany, thanks!

 -- Christoph Berg <myon@debian.org>  Mon, 23 Jun 2025 14:37:14 +0200

postgresql-18 (18~beta1+20250612-1) experimental; urgency=medium

  * New upstream snapshot.
  * Add B-D on libnuma-dev.

 -- Christoph Berg <myon@debian.org>  Fri, 06 Jun 2025 14:29:17 +0200

postgresql-18 (18~beta1-1) experimental; urgency=medium

  * First beta version.

 -- Christoph Berg <myon@debian.org>  Tue, 06 May 2025 20:28:58 +0200

postgresql-18 (18~~devel.20250502-1) experimental; urgency=medium

  * Split libpq-oauth into a separate package so libpq5 does not have to
    depend on libcurl.

 -- Christoph Berg <myon@debian.org>  Fri, 02 May 2025 10:39:45 +0200

postgresql-18 (18~~devel.20250421-1) experimental; urgency=medium

  * New upstream snapshot.

 -- Christoph Berg <myon@debian.org>  Mon, 21 Apr 2025 21:07:47 +0200

postgresql-18 (18~~devel.20250405-1) experimental; urgency=medium

  * New upstream snapshot.
  * B-D on liburing-dev.

 -- Christoph Berg <myon@debian.org>  Wed, 02 Apr 2025 15:15:38 +0200

postgresql-18 (18~~devel.20250331-1) experimental; urgency=medium

  * New upstream snapshot.
  * Drop extension_destdir patch, implemented upstream as
    extension_control_path.
  * Disable JIT on loong64 and riscv64 again, still segfaulting.

 -- Christoph Berg <myon@debian.org>  Wed, 19 Mar 2025 15:47:26 +0100

postgresql-18 (18~~devel.20250318+g4078da6c478-1) experimental; urgency=medium

  * New major upstream version 18; packaging based on postgresql-17.
  * Move JIT to new postgresql-18-jit package. (Closes: #927182)
  * Enable JIT only on 64-bit architectures.

 -- Christoph Berg <myon@debian.org>  Tue, 18 Mar 2025 16:43:43 +0100
