The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 16.4, 15.8, 14.13, 13.16, and 12.20, as well as the third beta release of PostgreSQL 17. This release fixes 1 security vulnerability and over 55 bugs reported over the last several months.
For the full list of changes, please review the release notes.
PostgreSQL 12 will stop receiving fixes on November 14, 2024. If you are running PostgreSQL 12 in a production environment, we suggest that you make plans to upgrade to a newer, supported version of PostgreSQL. Please see our versioning policy for more information.
CVSS v3.1 Base Score: 8.8
Supported, Vulnerable Versions: 12 - 16.
An attacker able to create and drop non-temporary objects could inject SQL code
that would be executed by a concurrent pg_dump
session with the privileges of the role running pg_dump (which is often a
superuser). The attack involves replacing a sequence or similar object with a
view or foreign table that will execute malicious code. To prevent this,
introduce a new server parameter restrict_nonsystem_relation_kind that can
disable expansion of non-builtin views as well as access to foreign tables, and
teach pg_dump to set it when available. Note that the attack is prevented only
if both pg_dump and the server it is dumping from are new enough to have this
fix.
The PostgreSQL project thanks Noah Misch for reporting this problem.
This update fixes over 55 bugs that were reported in the last several months. The issues listed below affect PostgreSQL 16. Some of these issues may also affect other supported versions of PostgreSQL.
VACUUM.ALTER TABLE DETACH ... PARTITION CONCURRENTLY.CALL statement.pg_sequence_last_value() now returns NULL instead of throwing an error when called on unlogged sequences on standby servers and on temporary sequences of other sessions.websearch_to_tsquery().INSERT ... DEFAULT.ALTER TABLE ... SET LOGGED|UNLOGGED.AFTER trigger no longer exists.INSERT ... ON CONFLICT when the desired index has expressions or predicates, for example, through an updatable view.ALTER TABLE.CREATE TABLE ... LIKE STATISTICS.MIN() or MAX() aggregates.FOR i IN 1_001..1_002).pg_restore -l reports dependent table of contents entries correctly.pg_stat_statements now passes a query ID for utility (non-SELECT/INSERT/UPDATE) statements that appears in SQL-language functions.postgres_fdw when mapping a foreign table to a nontrivial remote view.postgres_fdw no longer sends a FETCH FIRST WITH TIES clause to a remote server.All PostgreSQL update releases are cumulative. As with other minor releases,
users are not required to dump and reload their database or use pg_upgrade in
order to apply this update release; you may simply shutdown PostgreSQL and
update its binaries.
Users who have skipped one or more update releases may need to run additional post-update steps; please see the release notes from earlier versions for details.
For more details, please see the release notes.
This release marks the third beta release of PostgreSQL 17 and puts the community one step closer to general availability tentatively around the end of the third quarter.
In the spirit of the open source PostgreSQL community, we strongly encourage you to test the new features of PostgreSQL 17 on your systems to help us eliminate bugs or other issues that may exist. While we do not advise you to run PostgreSQL 17 Beta 3 in production environments, we encourage you to find ways to run your typical application workloads against this beta release.
Your testing and feedback will help the community ensure that the PostgreSQL 17 release upholds our standards of delivering a stable, reliable release of the world's most advanced open source relational database. Please read more about our beta testing process and how you can contribute:
https://www.postgresql.org/developer/beta/
To upgrade to PostgreSQL 17 Beta 3 from an earlier version of PostgreSQL,
you will need to use a strategy similar to upgrading between major versions of
PostgreSQL (e.g. pg_upgrade or pg_dump / pg_restore). For more
information, please visit the documentation section on
upgrading.
Fixes and changes in PostgreSQL 17 Beta 3 include:
standby_slot_names parameter to to synchronized_standby_slots.pg_combinebackup --clone.pg_createsubscriber to work for database names that contain a space.pg_createsubscriber now drops pre-existing subscriptions when run on a
target database.pg_upgrade.sslmode=prefer to error when a server sends
an error during the startup process.pg_basebackup incremental backup on a standby
server when it's executed immediately after the previous backup.pg_upgrade --transaction-size can cause the backend to use
an order of magnitude more RAM.Please see the release notes for a complete list of new and changed features, and PostgreSQL 17 open items for more details on fixes and changes.
The stability of each PostgreSQL release greatly depends on you, the community, to test the upcoming version with your workloads and testing tools in order to find bugs and regressions before the general availability of PostgreSQL 17. As this is a Beta, minor changes to database behaviors, feature details, and APIs are still possible. Your feedback and testing will help determine the final tweaks on the new features, so please test in the near future. The quality of user testing helps determine when we can make a final release.
A list of open issues is publicly available in the PostgreSQL wiki. You can report bugs using this form on the PostgreSQL website:
https://www.postgresql.org/account/submitbug/
If you have corrections or suggestions for this release announcement, please send them to the [email protected] public mailing list.