Repository navigation
fix: run patched PostgreSQL 17.12 and track PostgreSQL in Settings › Software - #15993
Merged
Merged
Conversation
…s › Software PostgreSQL's 2026-11-12 release fixes 52 security flaws, including CVE-2026-6460, which lets a role that can create objects run code as the server's OS user. The Docker database image moves from 17.11 to the 17.12 pgvector build, on both amd64 and arm64. A volume created on 17.11 opens on 17.12 with its data intact, because a minor release keeps the on-disk format. Settings › Software now has a PostgreSQL row. It shows the running server's version beside the latest patch release of its major line, from postgresql.org's release index. The row flags a server behind the latest patch and gives the update command for Homebrew or Docker. It warns a year before the line's end of life and marks a line past end of life as a security risk. A new major version cannot open an older data directory. A dependency refresh that moves the Docker image to a new major now fails dbImageDigestPin.test.js; that change must include a dump/restore path for existing volumes. docs/STORAGE.md describes how to apply patch and major updates.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PostgreSQL's 2026-11-12 security release (18.7 / 17.12 / 16.16 / 15.20 / 14.25) fixes 52 flaws. The most serious, CVE-2026-6460 (CVSS 8.8), lets a role that can create objects run code as the server's OS user.
pgvector/pgvector:pg17is re-pinned to the 17.12 index digest indocker-compose.yml, CI andscripts/lib/dbImage.js. Both arches reportPG_VERSION=17.12-1.pgdg12+1, and the digest equals the manifest body's SHA-256.postgresql.org/versions.json.npm run setup:db.PINNED_DB_MAJORfixes the Docker image's major.dbImageDigestPin.test.jsfails if a digest refresh moves the tag, so a major change must include a dump/restore path for existing volumes. The patch and major update procedures are indocs/STORAGE.mdunder "PostgreSQL version updates".Verification
<->distance query were intact, andcomposite_type_mismatch=error.current, "Supported until 2029-11-08".npm run pregatepasses. New tests:postgresRuntime.test.js, plus PostgreSQL row cases insoftwareInventory.test.js.The release's REINDEX advice covers pg_trgm GiST indexes, B-tree indexes on unbounded
bpcharcolumns, and TOAST tables rebuilt withREINDEX CONCURRENTLY. PortOS's schema has none of those indexes and never runsREINDEX.