head	1.12;
access;
symbols
	pkgsrc-2026Q1:1.12.0.2
	pkgsrc-2026Q1-base:1.12
	pkgsrc-2025Q4:1.10.0.4
	pkgsrc-2025Q4-base:1.10
	pkgsrc-2025Q3:1.10.0.2
	pkgsrc-2025Q3-base:1.10
	pkgsrc-2025Q2:1.8.0.2
	pkgsrc-2025Q2-base:1.8
	pkgsrc-2025Q1:1.5.0.4
	pkgsrc-2025Q1-base:1.5
	pkgsrc-2024Q4:1.5.0.2
	pkgsrc-2024Q4-base:1.5;
locks; strict;
comment	@# @;


1.12
date	2026.02.13.10.52.25;	author adam;	state Exp;
branches;
next	1.11;
commitid	w0TCHUvGOLf6LcuG;

1.11
date	2026.01.07.08.46.19;	author wiz;	state Exp;
branches;
next	1.10;
commitid	1wQ3ICD8eebefrpG;

1.10
date	2025.08.15.08.37.43;	author adam;	state Exp;
branches;
next	1.9;
commitid	rrB54QWS4v4yRN6G;

1.9
date	2025.07.04.08.45.08;	author wiz;	state Exp;
branches;
next	1.8;
commitid	vfjLVB0DFyTBfp1G;

1.8
date	2025.05.09.13.46.35;	author adam;	state Exp;
branches;
next	1.7;
commitid	v3jE4Hpi6jkIIeUF;

1.7
date	2025.04.17.21.50.10;	author wiz;	state Exp;
branches;
next	1.6;
commitid	xcIXAVA292fk6sRF;

1.6
date	2025.04.02.12.27.43;	author prlw1;	state Exp;
branches;
next	1.5;
commitid	M68jpBUtoIOpttPF;

1.5
date	2024.11.25.20.13.26;	author adam;	state Exp;
branches;
next	1.4;
commitid	vo2XULdddDGha4zF;

1.4
date	2024.11.16.12.03.34;	author wiz;	state Exp;
branches;
next	1.3;
commitid	EcLctWHJOZ20KRxF;

1.3
date	2024.11.16.10.13.52;	author adam;	state Exp;
branches;
next	1.2;
commitid	yMyTfQxO92xq8RxF;

1.2
date	2024.11.14.22.19.10;	author wiz;	state Exp;
branches;
next	1.1;
commitid	JmuDYqwL4erbdFxF;

1.1
date	2024.11.08.13.43.38;	author adam;	state Exp;
branches;
next	;
commitid	5LiFBvjEWBTDyQwF;


desc
@@


1.12
log
@postgresql1[4-8]*: updated to 18.2, 17.8, 16.12, 15.16, and 14.21

PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21

Security Issues

CVE-2026-2003: PostgreSQL oidvector discloses a few bytes of memory

CVSS v3.1 Base Score: 4.3

Supported, Vulnerable Versions: 14 - 18.

Improper validation of type oidvector in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

The PostgreSQL project thanks Altan Birler for reporting this problem.

CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

CVSS v3.1 Base Score: 8.8

Supported, Vulnerable Versions: 14 - 18.

Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

The PostgreSQL project thanks Daniel Firer, as part of zeroday.cloud, for reporting this problem.

CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code

CVSS v3.1 Base Score: 8.8

Supported, Vulnerable Versions: 14 - 18.

Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

The PostgreSQL project thanks Team Xint Code, as part of zeroday.cloud, for reporting this problem.

CVE-2026-2006: PostgreSQL missing validation of multibyte character length executes arbitrary code

CVSS v3.1 Base Score: 8.8

Supported, Vulnerable Versions: 14 - 18.

Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

The PostgreSQL project thanks Paul Gerste and Moritz Sanft, as part of zeroday.cloud, for reporting this problem.

CVE-2026-2007: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory

CVSS v3.1 Base Score: 8.2

Supported, Vulnerable Versions: 18.

Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string. The attacker has limited control over the byte patterns to be written, but we have not ruled out the viability of attacks that lead to privilege escalation. PostgreSQL 18.1 and 18.0 are affected.

The PostgreSQL project thanks Heikki Linnakangas for reporting this problem.

Bug Fixes and Improvements

This update fixes over 65 bugs that were reported in the last several months. The issues listed below affect PostgreSQL 18. Some of these issues may also affect other supported versions of PostgreSQL.

Fix inconsistent case-insensitive text matching in the ltree extension. If you use an index on an ltree column, in some cases you may need perform a reindex. See the "Updating" section for additional instructions.
Executing ALTER TABLE ... ADD CONSTRAINT to add a NOT NULL constraint on a column that already is marked as NOT NULL now requires the constraint name to match the existing constraint name.
Fix trigger behavior when MERGE is executed from a WITH query to include rows affected by the MERGE.
Several query planner fixes.
Fix for text substring search for non-deterministic collations.
Several fixes for NOTIFY error handling and reporting.
Use the correct ordering function in GIN index parallel builds.
Fix incorrect handling of incremental backups with tables larger than 1GB.
Fail recovery if WAL does not exist back to the redo point indicated by the checkpoint record.
Fix for ALTER PUBLICATION to ensure event triggers contain all set options.
Several fixes around replication slot initialization.
Don't advance replication slot after a logical replication parallel worker apply failure to prevent transaction loss on the subscriber.
Fix error reporting for SQL/JSON path type mismatches.
Fix JIT compilation function inlining when using LLVM 17 or later.
Add new server parameter file_extend_method to control use of posix_fallocate().
Fix psql tab completion for the VACUUM command options.
Fix pg_dump to handle concurrent sequence drops gracefully and to fail if the calling user explicitly lacks privileges to read the sequence.
Several fixes for amcheck around btree inspection.
Avoid crash in pg_stat_statements when an IN list contains both constants and non-constant expressions.
This release also updates time zone data files to tzdata release 2025c, which only has a historical data change for pre-1976 timestamps in Baja California.
@
text
@# $NetBSD: Makefile,v 1.11 2026/01/07 08:46:19 wiz Exp $

PKGNAME=	${DISTNAME:S/-/17-plperl-/}
COMMENT=	PL/Perl procedural language for the PostgreSQL backend

DEPENDS+=	postgresql17-server>=${PKGVERSION_NOREV}:../../databases/postgresql17-server

.include "../../databases/postgresql17/Makefile.common"

USE_TOOLS+=		perl
PERL5_CONFIGURE=	no
CONFIGURE_ARGS+=	--with-perl
BUILD_MAKE_FLAGS=	PGXS=1

BUILD_DIRS=		src/pl/plperl
MAKE_FILE=		GNUmakefile

# There is some dependency ordering problem in the Makefile,
# so force the headers to be generated first.
BUILD_TARGET=		perlchunks.h plperl_opmask.h all

.include "../../databases/postgresql17-client/buildlink3.mk"
.include "../../lang/perl5/module.mk"
.include "../../mk/bsd.pkg.mk"
@


1.11
log
@*: recursive bump for icu 78.1
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.10 2025/08/15 08:37:43 adam Exp $
a3 1
PKGREVISION=	1
@


1.10
log
@postgresql1[3-7]: updated to 17.6, 16.10, 15.14, 14.19, 13.22

PostgreSQL 17.6, 16.10, 15.14, 14.19, 13.22

Security Issues

CVE-2025-8713: PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table
CVE-2025-8714: PostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql client
CVE-2025-8715: PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server

Bug Fixes and Improvements

This update fixes over 55 bugs that were reported in the last several months. The issues listed below affect PostgreSQL 17. Some of these issues may also affect other supported versions of PostgreSQL.

Fix for BRIN indexes using the numeric_minmax_multi_ops operator class that could cause them to become bloated and inefficient. Please see the "Updating" section for instructions on how to fix these indexes.
Several fixes for logical replication, including fixes for memory allocation failure, duplicate transaction replay, infinite wait, unexpected shutdown, and a standby unable to shutdown.
Fix premature removal of old WAL during a checkpoint, which could impact recovery when using replication slots.
Revert a change that could reject XML documents over 10MB in size.
Fix how nested character classes (e.g. [[:alpha:]%_]) are handled in SIMILAR TO expressions.
Restore the ability for PL/pgSQL expressions to use parallel execution.
Avoid a rare scenario where a B-tree index could modify the wrong entry.
Several fixes for MERGE, including incorrect query results with concurrency and when targeting a table that is a parent in an inheritance hierarchy.
Fix LZ4 decompression failure that could occur on data that is not very compressible.
Prevent an infinite loop in checkpoints on systems with very large shared_buffers settings.
Fix issues with GSSAPI authentication when using Active Directory accounts with many group memberships. This release also fixes timing-dependent connection failures when using SSL or GSSAPI encryption in non-blocking mode.
Fix a crash in libpq function PQcancelCreate().
Fix several resource leaks.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.9 2025/07/04 08:45:08 wiz Exp $
d4 1
@


1.9
log
@*: bump for perl 5.42.0
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.8 2025/05/09 13:46:35 adam Exp $
a3 1
PKGREVISION=	1
@


1.8
log
@postgresql: updated to 17.5, 16.9, 15.13, 14.18, 13.21

PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21

CVE-2025-4207: PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation

Bug Fixes and Improvements

This update fixes over 60 bugs that were reported in the last several months. The issues listed below affect PostgreSQL 17. Some of these issues may also affect other supported versions of PostgreSQL.

Handle self-referential foreign keys on partitioned tables correctly. Creating or attaching partitions failed to make the required catalog entries for a foreign-key constraint if the table referenced by the constraint was the same partitioned table. This resulted in failure to enforce the constraint fully. To fix this, please see the instructions in the "Updating" section.
Fix for potential data loss issue when using BRIN bloom indexes (e.g. using the date_bloom_ops operator class).
Fix MERGE into a partitioned table with DO NOTHING actions.
Prevent failure in INSERT commands when the table has a GENERATED column of a domain type and the domain's constraints disallow NULL values.
Fix ALTER TABLE .. ADD COLUMN to correctly handle the case of a domain type that has its own default value and the DEFAULT for the column is not set.
Fix issues when performing casts within the keys of JSON constructor expressions.
Fix XMLSERIALIZE() so that the INDENT option is correctly dumped out when it's present in views or rules. This was noticeable on restores.
Several query planner fixes, including avoiding a premature evaluation of arguments in an aggregate function that has both FILTER and either ORDER BY or DISTINCT clauses that could lead to unnecessary failures.
Fix for potentially returning incorrect results when a bitmap scan without output columns is executed while vacuum is also running on the same table.
Fix performance issues in GIN index search startup when there are many search keys, for example, jsonbcol ?| array[...] with tens of thousands of array elements.
Ensure that I/O statistics of active WAL senders are reported within at most one second.
Fix race condition in handling of synchronous_standby_names immediately after startup, where a backend might fail to wait for a synchronous commit.
Avoid infinite loop if scram_iterations is set to INT_MAX.
Several fixes for logical replication, including handling of vacuum around deleted rows that are still required for logical decoding.
Prevent potential data loss when schema modification operations (DDL) that don't take a strong lock affect tables that are being logically replicated.
Prevent issues in logical replication that could allow duplicate data to be applied due to apply worker error handling.
Improve how reindexdb handles scheduling parallel reindex operations to achieve the expected amount of parallelism.

This release also updates time zone data files to tzdata release 2025b for DST law changes in Chile, plus historical corrections for Iran. Additionally, there is a new time zone America/Coyhaique for Chile's Aysén Region, to account for it changing to UTC-03 year-round, which diverges from America/Santiago.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.7 2025/04/17 21:50:10 wiz Exp $
d4 1
@


1.7
log
@*: recursive bump for icu 77 and libxml2 2.14
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.6 2025/04/02 12:27:43 prlw1 Exp $
a3 1
PKGREVISION=	2
@


1.6
log
@Render postgresql17 CONFLICTS as harmless as those of postgresql16
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.5 2024/11/25 20:13:26 adam Exp $
d4 1
a4 1
PKGREVISION=	1
@


1.5
log
@postgresql1*: updated to 17.2, 16.6, 15.10, 14.15, 13.18, 12.22

PostgreSQL 17.2, 16.6, 15.10, 14.15, 13.18, and 12.22

The issues listed below affect PostgreSQL 17. Some of these issues may also affect other supported versions of PostgreSQL.

Restore functionality of ALTER ROLE .. SET ROLE and ALTER DATABASE .. SET ROLE. The fix for CVE-2024-10978 accidentally caused settings for role to not be applied if they came from non-interactive sources, including previous ALTER {ROLE|DATABASE} commands and the PGOPTIONS environment variable.
Restore compatibility for the timescaledb and other PostgreSQL extensions built using PostgreSQL prior to the 2024-11-14 release (17.0, 16.4, 15.8, 14.13, 13.16, 12.20, and earlier). This fix restores struct ResultRelInfo to its previous size, so that affected extensions don't need to be rebuilt.
Fix cases where a logical replication slot's restart_lsn could go backwards.
Avoid deleting still-needed WAL files during pg_rewind.
Fix race conditions associated with dropping shared statistics entries, which could lead to loss of statistics data.
Fix crash with ALTER TABLE when checking to see if an index's opclass options have changed if the table has an index with a non-default operator class.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.4 2024/11/16 12:03:34 wiz Exp $
d4 1
@


1.4
log
@*: recursive bump for perl 5.40
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.3 2024/11/16 10:13:52 adam Exp $
a3 1
PKGREVISION=	1
@


1.3
log
@postgresql: updated to 17.1, 16.5, 15.9, 14.14, 13.17

PostgreSQL 12 is now end-of-life.

Security Issues
* CVE-2024-10976: PostgreSQL row security below e.g. subqueries disregards user ID changes
* CVE-2024-10977: PostgreSQL libpq retains an error message from man-in-the-middle
* CVE-2024-10978: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID
* CVE-2024-10979: PostgreSQL PL/Perl environment variable changes execute arbitrary code

Bug Fixes and Improvements

This update fixes over 35 bugs that were reported in the last several months. The issues listed below affect PostgreSQL 17. Some of these issues may also affect other supported versions of PostgreSQL.

Fix when attaching or detaching table partitions with foreign key constraints. After upgrade, users impacted by this issue will need to perform manual steps to finish fixing it. Please see the "Upgrading" section and the release notes for more information.
Fix when using libc as the default collation provider when LC_CTYPE is C while LC_COLLATE is a different locale. This could lead to incorrect query results. If you have these settings in your database, please reindex any affected indexes after updating to this release. This issue impacted 17.0 only.
Several query planner fixes, including disallowing joining partitions (partitionwise join) if the collations of the partitions don't match.
Fix possible wrong answers or wrong varnullingrels planner errors for MERGE ... WHEN NOT MATCHED BY SOURCE actions.
Fix validation of the COPY FORCE_NOT_NULL and FORCE_NULL.
Fix server crash when a json_objectagg() call contains a volatile function.
Ensure there's a registered dependency between a partitioned table and a non-built-in access method specified in CREATE TABLE ... USING. This fix only prevents problems for partitioned tables created after this update.
Fix race condition in committing a serializable transaction.
Fix race condition in COMMIT PREPARED that could require manual file removal after a crash-and-recovery.
Fix for pg_cursors view to prevent errors by excluding cursors that aren't completely set up.
Reduce logical decoding memory consumption.
Fix to prevent stable functions from receiving stale row values when they're called from a CALL statement's argument list and the CALL is within a PL/pgSQL EXCEPTION block.
Fix for JIT crashes on ARM (aarch64) systems.
The psql \watch now treats values that are less than 1ms to be 0 (no wait between executions).
Fix failure to use credentials for a replication user in the password file (pgpass)
pg_combinebackup now throws an error if an incremental backup file is present in a directory that should contain a full backup.
Fix to avoid reindexing temporary tables and indexes in vacuumdb and parallel reindexdb
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.2 2024/11/14 22:19:10 wiz Exp $
d4 1
@


1.2
log
@*: recursive bump for icu 76 shlib major version bump
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.1 2024/11/08 13:43:38 adam Exp $
a3 1
PKGREVISION=	1
@


1.1
log
@postgresql17: added version 17.0

PostgreSQL 17 builds on decades of open source development, improving its
performance and scalability while adapting to emergent data access and storage
patterns. This release of PostgreSQL adds significant overall performance
gains, including an overhauled memory management implementation for vacuum,
optimizations to storage access and improvements for high concurrency
workloads, speedups in bulk loading and exports, and query execution
improvements for indexes. PostgreSQL 17 has features that benefit brand new
workloads and critical systems alike, such as additions to the developer
experience with the SQL/JSON JSON_TABLE command, and enhancements to logical
replication that simplify management of high availability workloads and major
version upgrades.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.6 2024/08/09 21:55:49 adam Exp $
d4 1
@