head	1.5;
access;
symbols
	pkgsrc-2026Q2:1.3.0.4
	pkgsrc-2026Q2-base:1.3
	pkgsrc-2026Q1:1.3.0.2
	pkgsrc-2026Q1-base:1.3
	pkgsrc-2025Q4:1.1.0.2
	pkgsrc-2025Q4-base:1.1;
locks; strict;
comment	@# @;


1.5
date	2026.08.14.11.42.04;	author adam;	state Exp;
branches;
next	1.4;
commitid	90Oqfwo53xTsbBRG;

1.4
date	2026.07.16.19.01.47;	author wiz;	state Exp;
branches;
next	1.3;
commitid	FQnRlmCjzrRuxUNG;

1.3
date	2026.02.13.10.52.26;	author adam;	state Exp;
branches;
next	1.2;
commitid	w0TCHUvGOLf6LcuG;

1.2
date	2026.01.07.08.46.20;	author wiz;	state Exp;
branches;
next	1.1;
commitid	1wQ3ICD8eebefrpG;

1.1
date	2025.10.06.13.30.23;	author adam;	state Exp;
branches;
next	;
commitid	LuTSXVGAcgrvOvdG;


desc
@@


1.5
log
@postgresql: updated to 18.6, 17.11, 16.15, 15.19, 14.24

PostgreSQL 18.6, 17.11, 16.15, 15.19, 14.24

Security Issues

The following security vulnerabilities are closed across in this update release. You can find more details about the vulnerabilities and their affected versions in the links below:

CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (CVSS v3.1: 8.1)
CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (CVSS v3.1: 3.8)
CVE-2026-6470: Fails to check type USAGE privilege (CVSS v3.1: 4.3)
CVE-2026-6471: Logical decoding can dlopen arbitrary file (CVSS v3.1: 7.2)
CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (CVSS v3.1: 8.8)
CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (CVSS v3.1: 6.5)
CVE-2026-14664: Regexp heap buffer overflow executes arbitrary code (CVSS v3.1: 8.8)
CVE-2026-14666: Row security caching disregards role modifications (CVSS v3.1: 4.2)
CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (CVSS v3.1: 8.1)
CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (CVSS v3.1: 8.8)
CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (CVSS v3.1: 8.8)
CVE-2026-14671: refint plan cache type confusion executes arbitrary code (CVSS v3.1: 8.8)
CVE-2026-14672: Observable response discrepancy with non-default scram_iterations provides user existence oracle (CVSS v3.1: 5.3)
CVE-2026-14673: amcheck does not clear untrusted search path (CVSS v3.1: 3.8)
CVE-2026-14676: pg_stat_statements heap buffer overflow executes arbitrary code (CVSS v3.1: 8.8)
CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (CVSS v3.1: 8.8)
CVE-2026-14678: pg_trgm picksplit reads past end of buffer (CVSS v3.1: 4.3)
CVE-2026-14679: Stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (CVSS v3.1: 8.2)
CVE-2026-14680: Type confusion via "internal" arguments (CVSS v3.1: 8.8)
CVE-2026-14681: Improper enforcement of GSSAPI encryption when coupled with SSL (CVSS v3.1: 4.2)
CVE-2026-15741: Expression deparse allows SQL injection via EXTRACT argument (CVSS v3.1: 8.8)
CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (CVSS v3.1: 8.8)
CVE-2026-16238: Type confusion in pg_restore_attribute_stats() executes arbitrary code (CVSS v3.1: 8.8)
CVE-2026-16239: Type confusion in cursor CLOSE + DECLARE executes arbitrary code (CVSS v3.1: 8.8)
CVE-2026-16241: ECPG integer underflow can crash the client (CVSS v3.1: 3.8)
CVE-2026-18024: ascii() function reads past end of buffer (CVSS v3.1: 4.3)
CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (CVSS v3.1: 8.8)
CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (CVSS v3.1: 8.8)

Bug Fixes and Improvements
@
text
@# $NetBSD: Makefile,v 1.4 2026/07/16 19:01:47 wiz Exp $

PKGNAME=	${DISTNAME:S/-/18-plperl-/}
COMMENT=	PL/Perl procedural language for the PostgreSQL backend

DEPENDS+=	postgresql18-server>=${PKGVERSION_NOREV}:../../databases/postgresql18-server

.include "../../databases/postgresql18/Makefile.common"

USE_TOOLS+=		perl
PERL5_CONFIGURE=	no
CONFIGURE_ARGS+=	--with-perl
BUILD_MAKE_FLAGS=	PGXS=1

BUILD_DIRS=		src/pl/plperl
MAKE_FILE=		GNUmakefile

# There is some dependency ordering problem in the Makefile,
# so force the headers to be generated first.
BUILD_TARGET=		perlchunks.h plperl_opmask.h all

.include "../../databases/postgresql18-client/buildlink3.mk"
.include "../../lang/perl5/module.mk"
.include "../../mk/bsd.pkg.mk"
@


1.4
log
@*: recursive bump for perl5 5.44.0
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.3 2026/02/13 10:52:26 adam Exp $
a3 1
PKGREVISION=	1
@


1.3
log
@postgresql1[4-8]*: updated to 18.2, 17.8, 16.12, 15.16, and 14.21

PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21

Security Issues

CVE-2026-2003: PostgreSQL oidvector discloses a few bytes of memory

CVSS v3.1 Base Score: 4.3

Supported, Vulnerable Versions: 14 - 18.

Improper validation of type oidvector in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

The PostgreSQL project thanks Altan Birler for reporting this problem.

CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

CVSS v3.1 Base Score: 8.8

Supported, Vulnerable Versions: 14 - 18.

Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

The PostgreSQL project thanks Daniel Firer, as part of zeroday.cloud, for reporting this problem.

CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code

CVSS v3.1 Base Score: 8.8

Supported, Vulnerable Versions: 14 - 18.

Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

The PostgreSQL project thanks Team Xint Code, as part of zeroday.cloud, for reporting this problem.

CVE-2026-2006: PostgreSQL missing validation of multibyte character length executes arbitrary code

CVSS v3.1 Base Score: 8.8

Supported, Vulnerable Versions: 14 - 18.

Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

The PostgreSQL project thanks Paul Gerste and Moritz Sanft, as part of zeroday.cloud, for reporting this problem.

CVE-2026-2007: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory

CVSS v3.1 Base Score: 8.2

Supported, Vulnerable Versions: 18.

Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string. The attacker has limited control over the byte patterns to be written, but we have not ruled out the viability of attacks that lead to privilege escalation. PostgreSQL 18.1 and 18.0 are affected.

The PostgreSQL project thanks Heikki Linnakangas for reporting this problem.

Bug Fixes and Improvements

This update fixes over 65 bugs that were reported in the last several months. The issues listed below affect PostgreSQL 18. Some of these issues may also affect other supported versions of PostgreSQL.

Fix inconsistent case-insensitive text matching in the ltree extension. If you use an index on an ltree column, in some cases you may need perform a reindex. See the "Updating" section for additional instructions.
Executing ALTER TABLE ... ADD CONSTRAINT to add a NOT NULL constraint on a column that already is marked as NOT NULL now requires the constraint name to match the existing constraint name.
Fix trigger behavior when MERGE is executed from a WITH query to include rows affected by the MERGE.
Several query planner fixes.
Fix for text substring search for non-deterministic collations.
Several fixes for NOTIFY error handling and reporting.
Use the correct ordering function in GIN index parallel builds.
Fix incorrect handling of incremental backups with tables larger than 1GB.
Fail recovery if WAL does not exist back to the redo point indicated by the checkpoint record.
Fix for ALTER PUBLICATION to ensure event triggers contain all set options.
Several fixes around replication slot initialization.
Don't advance replication slot after a logical replication parallel worker apply failure to prevent transaction loss on the subscriber.
Fix error reporting for SQL/JSON path type mismatches.
Fix JIT compilation function inlining when using LLVM 17 or later.
Add new server parameter file_extend_method to control use of posix_fallocate().
Fix psql tab completion for the VACUUM command options.
Fix pg_dump to handle concurrent sequence drops gracefully and to fail if the calling user explicitly lacks privileges to read the sequence.
Several fixes for amcheck around btree inspection.
Avoid crash in pg_stat_statements when an IN list contains both constants and non-constant expressions.
This release also updates time zone data files to tzdata release 2025c, which only has a historical data change for pre-1976 timestamps in Baja California.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.2 2026/01/07 08:46:20 wiz Exp $
d4 1
@


1.2
log
@*: recursive bump for icu 78.1
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.1 2025/10/06 13:30:23 adam Exp $
a3 1
PKGREVISION=	1
@


1.1
log
@postgresql18: added version 18.0

PostgreSQL 18 improves performance for workloads of all sizes through a new I/O
subsystem that has demonstrated up to 3× performance improvements when reading
from storage, and also increases the number of queries that can use indexes.
This release makes major-version upgrades less disruptive, accelerating upgrade
times and reducing the time required to reach expected performance after an
upgrade completes. Developers also benefit from PostgreSQL 18 features,
including virtual generated columns that compute values at query time, and the
database-friendly uuidv7() function that provides better indexing and read
performance for UUIDs. PostgreSQL 18 makes it easier to integrate with
single-sign on (SSO) systems with support for OAuth 2.0 authentication.
@
text
@d1 1
a1 1
# $NetBSD$
d4 1
@