# Release 17.4

## Release date:

2025-02-20

This release contains a few fixes from 17.3. For information about new features in major release 17, see release-17.

## Migration to Version 17.4

A dump/restore is not required for those running 17.X.

However, if you are upgrading from a version earlier than 17.1, see release-17-1.

## Changes

- Improve behavior of libpq's quoting functions (Andres Freund, Tom Lane) § § §

  The changes made for CVE-2025-1094 had one serious oversight: `PQescapeLiteral()` and `PQescapeIdentifier()` failed to honor their string length parameter, instead always reading to the input string's trailing null. This resulted in including unwanted text in the output, if the caller intended to truncate the string via the length parameter. With very bad luck it could cause a crash due to reading off the end of memory.

  In addition, modify all these quoting functions so that when invalid encoding is detected, an invalid sequence is substituted for just the first byte of the presumed character, not all of it. This reduces the risk of problems if a calling application performs additional processing on the quoted string.

- Fix small memory leak in pg_createsubscriber (Ranier Vilela) §

- Fix meson build system to correctly detect availability of the `bsd_auth.h` system header (Nazir Bilal Yavuz) §

## Release 17.3

## Release date:

2025-02-13

This release contains a variety of fixes from 17.2. For information about new features in major release 17, see release-17.

## Migration to Version 17.3

A dump/restore is not required for those running 17.X.

However, if you are upgrading from a version earlier than 17.1, see release-17-1.

## Changes

- Harden `PQescapeString` and allied functions against invalidly-encoded input strings (Andres Freund, Noah Misch) § § § § § §

  Data-quoting functions supplied by libpq now fully check the encoding validity of their input. If invalid characters are detected, they report an error if possible. For the ones that lack an error return convention, the output string is adjusted to ensure that the server will report invalid encoding and no intervening processing will be fooled by bytes that might happen to match single quote, backslash, etc.

  The purpose of this change is to guard against SQL-injection attacks that are possible if one of these functions is used to quote crafted input. There is no hazard when the resulting string is sent directly to a PostgreSQL server (which would check its encoding anyway), but there is a risk when it is passed through psql or other client-side code. Historically such code has not carefully vetted encoding, and in many cases it's not clear what it should do if it did detect such a problem.

  This fix is effective only if the data-quoting function, the server, and any intermediate processing agree on the character encoding that's being used. Applications that insert untrusted input into SQL commands should take special care to ensure that that's true.

  Applications and drivers that quote untrusted input without using these libpq functions may be at risk of similar problems. They should first confirm the data is valid in the encoding expected by the server.

  The PostgreSQL Project thanks Stephen Fewer for reporting this problem. (CVE-2025-1094)

- Restore auto-truncation of database and user names appearing in connection requests (Nathan Bossart) §

  This reverts a v17 change that proved to cause trouble for some users. Over-length names should be truncated in an encoding-aware fashion, but for now just return to the former behavior of blind truncation at `NAMEDATALEN-1` bytes.

- Exclude parallel workers from connection privilege checks and limits (Tom Lane) §

  Do not check `datallowconn`, `rolcanlogin`, and `ACL_CONNECT` privileges when starting a parallel worker, instead assuming that it's enough for the leader process to have passed similar checks originally. This avoids, for example, unexpected failures of parallelized queries when the leader is running as a role that lacks login privilege. In the same vein, enforce `ReservedConnections`, `datconnlimit`, and `rolconnlimit` limits only against regular backends, and count only regular backends while checking if the limits were already reached. Those limits are meant to prevent excessive consumption of process slots for regular backends --- but parallel workers and other special processes have their own pools of process slots with their own limit checks.

- Drop Lock suffix from LWLock wait event names (Bertrand Drouvot) §

  Refactoring unintentionally caused the pg_stat_activity view to show lock-related wait event names with a Lock suffix, which among other things broke joining it to pg_wait_events.

- Fix possible failure to return all matching tuples for a btree index scan with a ScalarArrayOp (`= ANY`) condition (Peter Geoghegan) §

- Fix possible re-use of stale results in window aggregates (David Rowley) §

  A window aggregate with a run condition optimization and a pass-by-reference result type might incorrectly return the result from the previous partition instead of performing a fresh calculation.

- Keep `TransactionXmin` in sync with `MyProc->xmin` (Heikki Linnakangas) §

  This oversight could permit a process to try to access data that had already been vacuumed away. One known consequence is transient could not access status of transaction errors.

- Fix race condition that could cause failure to add a newly-inserted catalog entry to a catalog cache list (Heikki Linnakangas) §

  This could result, for example, in failure to use a newly-created function within an existing session.

- Prevent possible catalog corruption when a system catalog is vacuumed concurrently with an update (Noah Misch) § §

- Fix data corruption when relation truncation fails (Thomas Munro) § § §

  The filesystem calls needed to perform relation truncation could fail, leaving inconsistent state on disk (for example, effectively reviving deleted data). We can't really prevent that, but we can recover by dint of making such failures into PANICs, so that consistency is restored by replaying from WAL up to just before the attempted truncation. This isn't a hugely desirable behavior, but such failures are rare enough that it seems an acceptable solution.

- Prevent checkpoints from starting during relation truncation (Robert Haas) §

  This avoids a race condition wherein the modified file might not get fsync'd before completing the checkpoint, creating a risk of data corruption if the operating system crashes soon after.

- Avoid possibly losing an update of pg_database.datfrozenxid when `VACUUM` runs concurrently with a `REASSIGN OWNED` that changes that database's owner (Kirill Reshke) §

- Fix incorrect tg_updatedcols values passed to `AFTER UPDATE` triggers (Tom Lane) §

  In some cases the tg_updatedcols bitmap could describe the set of columns updated by an earlier command in the same transaction, fooling the trigger into doing the wrong thing.

  Also, prevent memory bloat caused by making too many copies of the tg_updatedcols bitmap.

- Fix detach of a partition that has its own foreign-key constraint referencing a partitioned table (Amul Sul) §

  In common cases, foreign keys are defined on a partitioned table's top level; but if instead one is defined on a partition and references a partitioned table, and the referencing partition is detached, the relevant pg_constraint entries were updated incorrectly. This led to errors like could not find ON INSERT check triggers of foreign key constraint.

- Fix `pg_get_constraintdef`'s support for `NOT NULL` constraints on domains (Álvaro Herrera) §

- Fix mis-processing of `to_timestamp`'s `FF`n`` format codes (Tom Lane) §

  An integer format code immediately preceding `FF`n`` would consume all available digits, leaving none for `FF`n``.

- When deparsing a `PASSING` clause in a SQL/JSON query function, ensure that variable names are double-quoted when necessary (Dean Rasheed) §

- When deparsing an `XMLTABLE()` expression, ensure that XML namespace names are double-quoted when necessary (Dean Rasheed) §

- Include the `ldapscheme` option in `pg_hba_file_rules()` output (Laurenz Albe) § §

- Fix planning of pre-sorted `UNION` operations for cases where the input column datatypes don't all match (David Rowley) §

  This error could lead to sorting data with the wrong sort operator, with consequences ranging from no visible problem to core dumps.

- Don't merge `UNION` operations if their column collations aren't consistent (Tom Lane) §

  Previously we ignored collations when deciding if it's safe to merge `UNION` steps into a single N-way `UNION` operation. This was arguably valid before the introduction of nondeterministic collations, but it's not anymore, since the collation in use can affect the definition of uniqueness.

- Prevent wrong varnullingrels planner errors after pulling up a subquery that's underneath an outer join (Tom Lane) § §

- Ignore nulling-relation marker bits when looking up statistics (Richard Guo) §

  This oversight could lead to failure to use relevant statistics about expressions, or to corrupt MVNDistinct entry errors.

- Fix missed expression processing for partition pruning steps (Tom Lane) §

  This oversight could lead to unrecognized node type errors, and perhaps other problems, in queries accessing partitioned tables.

- Give the slotsync worker process its own process slot (Tom Lane, Hou Zhijie) §

  This was overlooked in the addition of the slotsync worker, with the result that its process slot effectively came out of the pool meant for regular backend processes. This could result in failure to launch the worker, or to subsequent failures of connection requests that should have succeeded according to the configured settings, if the number of regular backend processes approached `max_connections`.

- Allow dshash tables to grow past 1GB (Matthias van de Meent) §

  This avoids errors like invalid DSA memory alloc request size. The case can occur for example in transactions that process several million tables.

- Avoid possible integer overflow in `bringetbitmap()` (James Hunter, Evgeniy Gorbanyov) §

  Since the result is only used for statistical purposes, the effects of this error were mostly cosmetic.

- Correct miscalculation of SLRU bank numbers (Yura Sokolov) §

  This error led to using a smaller number of banks than intended, causing more contention but no functional misbehavior.

- Ensure that an already-set process latch doesn't prevent the postmaster from noticing socket events (Thomas Munro) §

  An extremely heavy workload of backends launching workers and workers exiting could prevent the postmaster from responding to incoming client connections in a timely fashion.

- Prevent streaming standby servers from looping infinitely when reading a WAL record that crosses pages (Kyotaro Horiguchi, Alexander Kukushkin) §

  This would happen when the record's continuation is on a page that needs to be read from a different WAL source.

- Fix unintended promotion of FATAL errors to PANIC during early process startup (Noah Misch) §

  This fixes some unlikely cases that would result in PANIC: proc_exit() called in child process.

- Fix cases where an operator family member operator or support procedure could become a dangling reference (Tom Lane) § §

  In some cases a data type could be dropped while references to its OID still remain in pg_amop or pg_amproc. While that caused no immediate issues, an attempt to drop the owning operator family would fail, and pg_dump would produce bogus output when dumping the operator family. This fix causes creation and modification of operator families/classes to add needed dependency entries so that dropping a data type will also drop any dependent operator family elements. That does not help vulnerable pre-existing operator families, though, so a band-aid has also been added to `DROP OPERATOR FAMILY` to prevent failure when dropping a family that has dangling members.

- Fix multiple memory leaks in logical decoding output (Vignesh C, Masahiko Sawada, Boyu Yang) § § §

- Fix small memory leak when updating the `application_name` or `cluster_name` settings (Tofig Aliev) §

- Avoid crash when a background process tries to check a new value of `synchronized_standby_slots` (Álvaro Herrera) §

- Avoid integer overflow while testing `wal_skip_threshold` condition (Tom Lane) §

  A transaction that created a very large relation could mistakenly decide to ensure durability by copying the relation into WAL instead of fsync'ing it, thereby negating the point of `wal_skip_threshold`. (This only matters when `wal_level` is set to `minimal`, else a WAL copy is required anyway.)

- Fix unsafe order of operations during cache lookups (Noah Misch) §

  The only known consequence was a usually-harmless you don't own a lock of type ExclusiveLock warning during `GRANT TABLESPACE`.

- Avoid potential use-after-free in parallel vacuum (Vallimaharajan G, John Naylor) §

  This bug seems to have no consequences in standard builds, but it's theoretically a hazard.

- Fix possible failed to resolve name failures when using JIT on older ARM platforms (Thomas Munro) §

  This could occur as a consequence of inconsistency about the default setting of `-moutline-atomics` between gcc and clang. At least Debian and Ubuntu are known to ship gcc and clang compilers that target armv8-a but differ on the use of outline atomics by default.

- Fix assertion failure in `WITH RECURSIVE ... UNION` queries (David Rowley) §

- Avoid assertion failure in rule deparsing if a set operation leaf query contains set operations (Man Zeng, Tom Lane) §

- Avoid edge-case assertion failure in parallel query startup (Tom Lane) §

- Fix assertion failure at shutdown when writing out the statistics file (Michael Paquier) §

- Avoid valgrind complaints about string hashing code (John Naylor) §

- In `NULLIF()`, avoid passing a read-write expanded object pointer to the data type's equality function (Tom Lane) §

  The equality function could modify or delete the object if it's given a read-write pointer, which would be bad if we decide to return it as the `NULLIF()` result. There is probably no problem with any built-in equality function, but it's easy to demonstrate a failure with one coded in PL/pgSQL.

- Ensure that expression preprocessing is applied to a default null value in `INSERT` (Tom Lane) §

  If the target column is of a domain type, the planner must insert a coerce-to-domain step not just a null constant, and this expression missed going through some required processing steps. There is no known consequence with domains based on core data types, but in theory an error could occur with domains based on extension types.

- Avoid data loss when starting a bulk write on a relation fork that already contains data (Matthias van de Meent) §

  Any pre-existing data was overwritten with zeroes. This is not an issue for core PostgreSQL, which never does that. Some extensions would like to, however.

- Avoid crash if a server process tried to iterate over a shared radix tree that it didn't create (Masahiko Sawada) §

  There is no code in core PostgreSQL that does this, but an extension might wish to.

- Repair memory leaks in PL/Python (Mat Arye, Tom Lane) §

  Repeated use of `PLyPlan.execute` or `plpy.cursor` resulted in memory leakage for the duration of the calling PL/Python function.

- Fix PL/Tcl to compile with Tcl 9 (Peter Eisentraut) §

- In the ecpg preprocessor, fix possible misprocessing of cursors that reference out-of-scope variables (Tom Lane) §

- In ecpg, fix compile-time warnings about unsupported use of `COPY ... FROM STDIN` (Ryo Kanbayashi) §

  Previously, the intended warning was not issued due to a typo.

- Fix psql to safely handle file path names that are encoded in SJIS (Tom Lane) §

  Some two-byte characters in SJIS have a second byte that is equal to ASCII backslash (`\`). These characters were corrupted by path name normalization, preventing access to files whose names include such characters.

- Add psql tab completion for `COPY (MERGE INTO)` (Jian He) §

- Fix use of wrong version of `pqsignal()` in pgbench and psql (Fujii Masao, Tom Lane) §

  This error could lead to misbehavior when using the `-T` option in pgbench or the `\watch` command in psql, due to interrupted system calls not being resumed as expected.

- Fix misexecution of some nested `\if` constructs in pgbench (Michail Nikolaev) §

  An `\if` command appearing within a false (not-being-executed) `\if` branch was incorrectly treated the same as `\elif`.

- In pgbench, fix possible misdisplay of progress messages during table initialization (Yushi Ogiwara, Tatsuo Ishii, Fujii Masao) § §

- Make pg_controldata more robust against corrupted `pg_control` files (Ilyasov Ian, Anton Voloshin) §

  Since pg_controldata will attempt to print the contents of `pg_control` even if the CRC check fails, it must take care not to misbehave for invalid field values. This patch fixes some issues triggered by invalid timestamps and apparently-negative WAL segment sizes.

- Fix possible crash in pg_dump with identity sequences attached to tables that are extension members (Tom Lane) §

- Fix memory leak in pg_restore with zstd-compressed data (Tom Lane) §

  The leak was per-decompression-operation, so would be most noticeable with a dump containing many tables or large objects.

- Fix pg_basebackup to correctly handle `pg_wal.tar` files exceeding 2GB on Windows (Davinder Singh, Thomas Munro) § §

- Use SQL-standard function bodies in the declarations of `contrib/earthdistance`'s SQL-language functions (Tom Lane, Ronan Dunklau) §

  This change allows their references to `contrib/cube` to be resolved during extension creation, reducing the risk of search-path-based failures and possible attacks.

  In particular, this restores their usability in contexts like generated columns, for which PostgreSQL v17 restricts the search path on security grounds. We have received reports of databases failing to be upgraded to v17 because of that. This patch has been included in v16 to provide a workaround: updating the `earthdistance` extension to this version beforehand should allow an upgrade to succeed.

- Detect version mismatch between `contrib/pageinspect`'s SQL declarations and the underlying shared library (Tomas Vondra) §

  Previously, such a mismatch could result in a crash while calling `brin_page_items()`. Instead throw an error recommending updating the extension.

- When trying to cancel a remote query in `contrib/postgres_fdw`, re-issue the cancel request a few times if it didn't seem to do anything (Tom Lane) §

  This fixes a race condition where we might try to cancel a just-sent query before the remote server has started to process it, so that the initial cancel request is ignored.

- Update configuration probes that determine the compiler switches needed to access ARM CRC instructions (Tom Lane) §

  On ARM platforms where the baseline CPU target lacks CRC instructions, we need to supply a `-march` switch to persuade the compiler to compile such instructions. Recent versions of gcc reject the value we were trying, leading to silently falling back to software CRC.

- Fix meson build system to support old OpenSSL libraries on Windows (Darek Slusarczyk) §

  Add support for the legacy library names `ssleay32` and `libeay32`.

- In Windows builds using meson, ensure all libcommon and libpgport functions are exported (Vladlen Popolitov, Heikki Linnakangas) § §

  This fixes unresolved external symbol build errors for extensions.

- Fix meson configuration process to correctly detect OSSP's `uuid.h` header file under MSVC (Andrew Dunstan) §

- When building with meson, install `pgevent` in `pkglibdir` not `bindir` (Peter Eisentraut) §

  This matches the behavior of the make-based build system and the old MSVC build system.

- When building with meson, install `sepgsql.sql` under `share/contrib/` not `share/extension/` (Peter Eisentraut) §

  This matches what the make-based build system does.

- Update time zone data files to tzdata release 2025a for DST law changes in Paraguay, plus historical corrections for the Philippines (Tom Lane) §

## Release 17.2

## Release date:

2024-11-21

This release contains a few fixes from 17.1. For information about new features in major release 17, see release-17.

## Migration to Version 17.2

A dump/restore is not required for those running 17.X.

However, if you are upgrading from a version earlier than 17.1, see release-17-1.

## Changes

- Repair ABI break for extensions that work with struct ResultRelInfo (Tom Lane) §

  Last week's minor releases unintentionally broke binary compatibility with timescaledb and several other extensions. Restore the affected structure to its previous size, so that such extensions need not be rebuilt.

- Restore functionality of `ALTER {ROLE|DATABASE} SET role` (Tom Lane, Noah Misch) §

  The fix for CVE-2024-10978 accidentally caused settings for `role` to not be applied if they come from non-interactive sources, including previous `ALTER {ROLE|DATABASE}` commands and the `PGOPTIONS` environment variable.

- Fix cases where a logical replication slot's restart_lsn could go backwards (Masahiko Sawada) §

  Previously, restarting logical replication could sometimes cause the slot's restart point to be recomputed as an older value than had previously been advertised in pg_replication_slots. This is bad, since for example WAL files might have been removed on the basis of the later restart_lsn value, in which case replication would fail to restart.

- Avoid deleting still-needed WAL files during pg_rewind (Polina Bungina, Alexander Kukushkin) §

  Previously, in unlucky cases, it was possible for pg_rewind to remove important WAL files from the rewound demoted primary. In particular this happens if those files have been marked for archival (i.e., their `.ready` files were created) but not yet archived. Then the newly promoted node no longer has such files because of them having been recycled, but likely they are needed for recovery in the demoted node. If pg_rewind removes them, recovery is not possible anymore.

- Fix race conditions associated with dropping shared statistics entries (Kyotaro Horiguchi, Michael Paquier) §

  These bugs could lead to loss of statistics data, assertion failures, or can only drop stats once errors.

- Count index scans in `contrib/bloom` indexes in the statistics views, such as the pg_stat_user_indexes.idx_scan counter (Masahiro Ikeda) §

- Fix crash when checking to see if an index's opclass options have changed (Alexander Korotkov) §

  Some forms of `ALTER TABLE` would fail if the table has an index with non-default operator class options.

- Avoid assertion failure caused by disconnected NFA sub-graphs in regular expression parsing (Tom Lane) §

  This bug does not appear to have any visible consequences in non-assert builds.

## Release 17.1

## Release date:

2024-11-14

This release contains a variety of fixes from 17.0. For information about new features in major release 17, see release-17.

## Migration to Version 17.1

A dump/restore is not required for those running 17.X.

However, if you have ever detached a partition from a partitioned table that has a foreign-key reference to another partitioned table, and not dropped the former partition, then you may have catalog and/or data corruption to repair, as detailed in the fifth changelog entry below.

Also, in the uncommon case that a database's `LC_CTYPE` setting is `C` while its `LC_COLLATE` setting is some other locale, indexes on textual columns should be reindexed, as described in the sixth changelog entry below.

## Changes

- Ensure cached plans are marked as dependent on the calling role when RLS applies to a non-top-level table reference (Nathan Bossart) §

  If a CTE, subquery, sublink, security invoker view, or coercion projection in a query references a table with row-level security policies, we neglected to mark the resulting plan as potentially dependent on which role is executing it. This could lead to later query executions in the same session using the wrong plan, and then returning or hiding rows that should have been hidden or returned instead.

  The PostgreSQL Project thanks Wolfgang Walther for reporting this problem. (CVE-2024-10976)

- Make libpq discard error messages received during SSL or GSS protocol negotiation (Jacob Champion) §

  An error message received before encryption negotiation is completed might have been injected by a man-in-the-middle, rather than being real server output. Reporting it opens the door to various security hazards; for example, the message might spoof a query result that a careless user could mistake for correct output. The best answer seems to be to discard such data and rely only on libpq's own report of the connection failure.

  The PostgreSQL Project thanks Jacob Champion for reporting this problem. (CVE-2024-10977)

- Fix unintended interactions between `SET SESSION AUTHORIZATION` and `SET ROLE` (Tom Lane) § §

  The SQL standard mandates that `SET SESSION AUTHORIZATION` have a side-effect of doing `SET ROLE NONE`. Our implementation of that was flawed, creating more interaction between the two settings than intended. Notably, rolling back a transaction that had done `SET SESSION AUTHORIZATION` would revert `ROLE` to `NONE` even if that had not been the previous state, so that the effective user ID might now be different from what it had been before the transaction. Transiently setting `session_authorization` in a function `SET` clause had a similar effect. A related bug was that if a parallel worker inspected `current_setting('role')`, it saw `none` even when it should see something else.

  The PostgreSQL Project thanks Tom Lane for reporting this problem. (CVE-2024-10978)

- Prevent trusted PL/Perl code from changing environment variables (Andrew Dunstan, Noah Misch) § § §

  The ability to manipulate process environment variables such as `PATH` gives an attacker opportunities to execute arbitrary code. Therefore, trusted PLs must not offer the ability to do that. To fix `plperl`, replace `%ENV` with a tied hash that rejects any modification attempt with a warning. Untrusted `plperlu` retains the ability to change the environment.

  The PostgreSQL Project thanks Coby Abrams for reporting this problem. (CVE-2024-10979)

- Fix updates of catalog state for foreign-key constraints when attaching or detaching table partitions (Jehan-Guillaume de Rorthais, Tender Wang, Álvaro Herrera) § §

  If the referenced table is partitioned, then different catalog entries are needed for a referencing table that is stand-alone versus one that is a partition. `ATTACH/DETACH PARTITION` commands failed to perform this conversion correctly. In particular, after `DETACH` the now stand-alone table would be missing foreign-key enforcement triggers, which could result in the table later containing rows that fail the foreign-key constraint. A subsequent re-`ATTACH` could fail with surprising errors, too.

  The way to fix this is to do `ALTER TABLE DROP CONSTRAINT` on the now stand-alone table for each faulty constraint, and then re-add the constraint. If re-adding the constraint fails, then some erroneous data has crept in. You will need to manually re-establish consistency between the referencing and referenced tables, then re-add the constraint.

  This query can be used to identify broken constraints and construct the commands needed to recreate them:

      SELECT conrelid::pg_catalog.regclass AS "constrained table",
             conname AS constraint,
             confrelid::pg_catalog.regclass AS "references",
             pg_catalog.format('ALTER TABLE %s DROP CONSTRAINT %I;',
                               conrelid::pg_catalog.regclass, conname) AS "drop",
             pg_catalog.format('ALTER TABLE %s ADD CONSTRAINT %I %s;',
                               conrelid::pg_catalog.regclass, conname,
                               pg_catalog.pg_get_constraintdef(oid)) AS "add"
      FROM pg_catalog.pg_constraint c
      WHERE contype = 'f' AND conparentid = 0 AND
         (SELECT count(*) FROM pg_catalog.pg_constraint c2
          WHERE c2.conparentid = c.oid) <>
         (SELECT count(*) FROM pg_catalog.pg_inherits i
          WHERE (i.inhparent = c.conrelid OR i.inhparent = c.confrelid) AND
            EXISTS (SELECT 1 FROM pg_catalog.pg_partitioned_table
                    WHERE partrelid = i.inhparent));

  Since it is possible that one or more of the `ADD CONSTRAINT` steps will fail, you should save the query's output in a file and then attempt to perform each step.

- Fix test for `C` locale when `LC_COLLATE` is different from `LC_CTYPE` (Jeff Davis) §

  When using `libc` as the default collation provider, the test to see if `C` locale is in use for collation accidentally checked `LC_CTYPE` not `LC_COLLATE`. This has no impact in the typical case where those settings are the same, nor if both are not `C` (nor its alias `POSIX`). However, if `LC_CTYPE` is `C` while `LC_COLLATE` is some other locale, wrong query answers could ensue, and corruption of indexes on strings was possible. Users of databases with such settings should reindex affected indexes after installing this update. The converse case with `LC_COLLATE` being `C` while `LC_CTYPE` is some other locale would cause performance degradation, but no actual errors.

- Don't use partitionwise joins or grouping if the query's collation for the key column doesn't match the partition key's collation (Jian He, Webbo Han) § §

  Such plans could produce incorrect results.

- Avoid planner failure after converting an `IS NULL` test on a `NOT NULL` column to constant `FALSE` (Richard Guo) §

  This bug typically led to errors such as variable not found in subplan target lists.

- Avoid possible planner crash while inlining a SQL function whose arguments contain certain array-related constructs (Tom Lane, Nathan Bossart) §

- Fix possible wrong answers or wrong varnullingrels planner errors for `MERGE ... WHEN NOT MATCHED BY SOURCE` actions (Dean Rasheed) § §

- Fix possible could not find pathkey item to sort error when the output of a `UNION ALL` member query needs to be sorted, and the sort column is an expression (Andrei Lepikhov, Tom Lane) §

- Fix edge case in B-tree ScalarArrayOp index scans (Peter Geoghegan) §

  When a scrollable cursor with a plan of this kind was backed up to its starting point and then run forward again, wrong answers were possible.

- Fix assertion failure or confusing error message for `COPY (`query`) TO ...`, when the `query` is rewritten by a `DO INSTEAD NOTIFY` rule (Tender Wang, Tom Lane) §

- Fix validation of `COPY`'s `FORCE_NOT_NULL` and `FORCE_NULL` options (Joel Jacobson) §

  Some incorrect usages are now rejected as they should be.

- Fix server crash when a `json_objectagg()` call contains a volatile function (Amit Langote) §

- Fix detection of skewed data during parallel hash join (Thomas Munro) §

  After repartitioning the inner side of a hash join because one partition has accumulated too many tuples, we check to see if all the partition's tuples went into the same child partition, which suggests that they all have the same hash value and further repartitioning cannot improve matters. This check malfunctioned in some cases, allowing repeated futile repartitioning which would eventually end in a resource-exhaustion error.

- Avoid crash when `ALTER DATABASE SET` is used to set a server parameter that requires search-path-based lookup, such as `default_text_search_config` (Jeff Davis) §

- Avoid repeated lookups of opclasses and collations while creating a new index on a partitioned table (Tom Lane) §

  This was problematic mainly because some of the lookups would be done with a restricted `search_path`, leading to unexpected failures if the `CREATE INDEX` command referenced objects outside `pg_catalog`.

  This fix also prevents comments on the parent partitioned index from being copied to child indexes.

- Add missing dependency from a partitioned table to a non-built-in access method specified in `CREATE TABLE ... USING` (Michael Paquier) §

  Dropping the access method should be blocked when a table exists that depends on it, but it was not, allowing subsequent odd behavior. Note that this fix only prevents problems for partitioned tables created after this update.

- Disallow locale names containing non-ASCII characters (Thomas Munro) §

  This is only an issue on Windows, as such locale names are not used elsewhere. They are problematic because it's quite unclear what encoding such names are represented in (since the locale itself defines the encoding to use). In recent PostgreSQL releases, an abort in the Windows runtime library could occur because of confusion about that.

  Anyone who encounters the new error message should either create a new duplicated locale with an ASCII-only name using Windows Locale Builder, or consider using BCP 47-compliant locale names like `tr-TR`.

- Fix race condition in committing a serializable transaction (Heikki Linnakangas) §

  Mis-processing of a recently committed transaction could lead to an assertion failure or a could not access status of transaction error.

- Fix race condition in `COMMIT PREPARED` that resulted in orphaned 2PC files (wuchengwen) §

  A concurrent `PREPARE TRANSACTION` could cause `COMMIT PREPARED` to not remove the on-disk two-phase state file for the completed transaction. There was no immediate ill effect, but a subsequent crash-and-recovery could fail with could not access status of transaction, requiring manual removal of the orphaned file to restore service.

- Avoid invalid memory accesses after skipping an invalid toast index during `VACUUM FULL` (Tender Wang) §

  A list tracking yet-to-be-rebuilt indexes was not properly updated in this code path, risking assertion failures or crashes later on.

- Fix ways in which an in place catalog update could be lost (Noah Misch) § § § § § § §

  Normal row updates write a new version of the row to preserve rollback-ability of the transaction. However, certain system catalog updates are intentionally non-transactional and are done with an in-place update of the row. These patches fix race conditions that could cause the effects of an in-place update to be lost. As an example, it was possible to forget having set pg_class.relhasindex to true, preventing updates of the new index and thus causing index corruption.

- Reset catalog caches at end of recovery (Noah Misch) §

  This prevents scenarios wherein an in-place catalog update could be lost due to using stale data from a catalog cache.

- Avoid using parallel query while holding off interrupts (Francesco Degrassi, Noah Misch, Tom Lane) § §

  This situation cannot arise normally, but it can be reached with test scenarios such as using a SQL-language function as B-tree support (which would be far too slow for production usage). If it did occur it would result in an indefinite wait.

- Ignore not-yet-defined Portals in the pg_cursors view (Tom Lane) §

  It is possible for user-defined code that inspects this view to be called while a new cursor is being set up, and if that happens a null pointer dereference would ensue. Avoid the problem by defining the view to exclude incompletely-set-up cursors.

- Avoid unexpected table_index_fetch_tuple call during logical decoding error while decoding a transaction involving insertion of a column default value (Takeshi Ideriha, Hou Zhijie) § §

- Reduce memory consumption of logical decoding (Masahiko Sawada) §

  Use a smaller default block size to store tuple data received during logical replication. This reduces memory wastage, which has been reported to be severe while processing long-running transactions, even leading to out-of-memory failures.

- Fix behavior of stable functions called from a `CALL` statement's argument list, when the `CALL` is within a PL/pgSQL `EXCEPTION` block (Tom Lane) §

  As with a similar fix in our previous quarterly releases, this case allowed such functions to be passed the wrong snapshot, causing them to see stale values of rows modified since the start of the outer transaction.

- Parse libpq's `keepalives` connection option in the same way as other integer-valued options (Yuto Sasaki) §

  The coding used here rejected trailing whitespace in the option value, unlike other cases. This turns out to be problematic in ecpg's usage, for example.

- In ecpglib, fix out-of-bounds read when parsing incorrect datetime input (Bruce Momjian, Pavel Nekrasov) §

  It was possible to try to read the location just before the start of a constant array. Real-world consequences seem minimal, though.

- Fix psql's describe commands to again work with pre-9.4 servers (Tom Lane) §

  Commands involving display of an ACL (permissions) column failed with very old PostgreSQL servers, due to use of a function not present in those versions.

- Avoid hanging if an interval less than 1ms is specified in psql's `\watch` command (Andrey Borodin, Michael Paquier) §

  Instead, treat this the same as an interval of zero (no wait between executions).

- Fix failure to find replication password in `~/.pgpass` (Tom Lane) §

  pg_basebackup and pg_receivewal failed to match an entry in `~/.pgpass` that had `replication` in the database name field, if no `-d` or `--dbname` switch was supplied. This resulted in an unexpected prompt for password.

- In pg_combinebackup, throw an error if an incremental backup file is present in a directory that is supposed to contain a full backup (Robert Haas) §

- In pg_combinebackup, don't construct filenames containing double slashes (Robert Haas) §

  This caused no functional problems, but the duplicate slashes were visible in error messages, which could create confusion.

- Avoid trying to reindex temporary tables and indexes in vacuumdb and in parallel reindexdb (VaibhaveS, Michael Paquier, Fujii Masao, Nathan Bossart) § § §

  Reindexing other sessions' temporary tables cannot work, but the check to skip them was missing in some code paths, leading to unwanted failures.

- Fix incorrect LLVM-generated code on ARM64 platforms (Thomas Munro, Anthonin Bonnefoy) §

  When using JIT compilation on ARM platforms, the generated code could not support relocation distances exceeding 32 bits, allowing unlucky placement of generated code to cause server crashes on large-memory systems.

- Fix a few places that assumed that process start time (represented as a `time_t`) will fit into a `long` value (Max Johnson, Nathan Bossart) §

  On platforms where `long` is 32 bits (notably Windows), this coding would fail after Y2038. Most of the failures appear only cosmetic, but notably `pg_ctl start` would hang.

- Update time zone data files to tzdata release 2024b (Tom Lane) § §

  This tzdata release changes the old System-V-compatibility zone names to duplicate the corresponding geographic zones; for example `PST8PDT` is now an alias for `America/Los_Angeles`. The main visible consequence is that for timestamps before the introduction of standardized time zones, the zone is considered to represent local mean solar time for the named location. For example, in `PST8PDT`, `timestamptz` input such as `1801-01-01 00:00` would previously have been rendered as `1801-01-01 00:00:00-08`, but now it is rendered as `1801-01-01 00:00:00-07:52:58`.

  Also, historical corrections for Mexico, Mongolia, and Portugal. Notably, `Asia/Choibalsan` is now an alias for `Asia/Ulaanbaatar` rather than being a separate zone, mainly because the differences between those zones were found to be based on untrustworthy data.

## Release 17

## Release date:

2024-09-26

## Overview

PostgreSQL 17 contains many new features and enhancements, including:

- New memory management system for `VACUUM`, which reduces memory consumption and can improve overall vacuuming performance.

- New SQL/JSON capabilities, including constructors, identity functions, and the `JSON_TABLE()` function, which converts JSON data into a table representation.

- Various query performance improvements, including for sequential reads using streaming I/O, write throughput under high concurrency, and searches over multiple values in a btree index.

- Logical replication enhancements, including:

  - Failover control

  - pg_createsubscriber, a utility that creates logical replicas from physical standbys

  - pg_upgrade now preserves logical replication slots on publishers and full subscription state on subscribers. This will allow upgrades to future major versions to continue logical replication without requiring copy to resynchronize.

- New client-side connection option, `sslnegotiation=direct`, that performs a direct TLS handshake to avoid a round-trip negotiation.

- pg_basebackup now supports incremental backup.

- `COPY` adds a new option, `ON_ERROR ignore`, that allows a copy operation to continue in the event of an error.

The above items and other new features of PostgreSQL 17 are explained in more detail in the sections below.

## Migration to Version 17

A dump/restore using app-pg-dumpall or use of pgupgrade or logical replication is required for those wishing to migrate data from any previous release. See upgrading for general information on migrating to new major releases.

Version 17 contains a number of changes that may affect compatibility with previous releases. Observe the following incompatibilities:

- Change functions to use a safe guc-search-path during maintenance operations (Jeff Davis) § §

  This prevents maintenance operations (`ANALYZE`, `CLUSTER`, `CREATE INDEX`, `CREATE MATERIALIZED VIEW`, `REFRESH MATERIALIZED VIEW`, `REINDEX`, or `VACUUM`) from performing unsafe access. Functions used by expression indexes and materialized views that need to reference non-default schemas must specify a search path during function creation.

- Restrict `ago` to only appear at the end in `interval` values (Joseph Koshakow) § §

  Also, prevent empty interval units from appearing multiple times.

- Remove server variable old_snapshot_threshold (Thomas Munro) §

  This variable allowed vacuum to remove rows that potentially could be still visible to running transactions, causing "snapshot too old" errors later if accessed. This feature might be re-added to PostgreSQL later if an improved implementation is found.

- Change `SET SESSION AUTHORIZATION` handling of the initial session user's superuser status (Joseph Koshakow) §

  The new behavior is based on the session user's superuser status at the time the `SET SESSION AUTHORIZATION` command is issued, rather than their superuser status at connection time.

- Remove feature which simulated per-database users (Nathan Bossart) §

  The feature, `db_user_namespace`, was rarely used.

- Remove adminpack contrib extension (Daniel Gustafsson) §

  This was used by now end-of-life pgAdmin III.

- Remove guc-wal-sync-method value `fsync_writethrough` on `Windows` (Thomas Munro) §

  This value was the same as `fsync` on `Windows`.

- Change file boundary handling of two WAL file name functions (Kyotaro Horiguchi, Andres Freund, Bruce Momjian) §

  The functions `pg_walfile_name()` and `pg_walfile_name_offset()` used to report the previous LSN segment number when the LSN was on a file segment boundary; it now returns the current LSN segment.

- Remove server variable `trace_recovery_messages` since it is no longer needed (Bharath Rupireddy) §

- Remove information schema column element_types.domain_default (Peter Eisentraut) §

- Change pgrowlocks lock mode output labels (Bruce Momjian) §

- Remove buffers_backend and buffers_backend_fsync from pg_stat_bgwriter (Bharath Rupireddy) §

  These fields are considered redundant to similar columns in pg_stat_io.

- Rename I/O block read/write timing statistics columns of pgstatstatements (Nazir Bilal Yavuz) §

  This renames blk_read_time to shared_blk_read_time, and blk_write_time to shared_blk_write_time.

- Change pg_attribute.attstattarget and pg_statistic_ext.stxstattarget to represent the default statistics target as `NULL` (Peter Eisentraut) § §

- Rename pg_collation.colliculocale to colllocale and pg_database.daticulocale to datlocale (Jeff Davis) §

- Rename pg_stat_progress_vacuum column max_dead_tuples to max_dead_tuple_bytes, rename num_dead_tuples to num_dead_item_ids, and add dead_tuple_bytes (Masahiko Sawada) § §

- Rename SLRU columns in system view pg_stat_slru (Alvaro Herrera) §

  The column names accepted by `pg_stat_reset_slru()` are also changed.

## Changes

Below you will find a detailed account of the changes between PostgreSQL 17 and the previous major release.

### Server

#### Optimizer

- Allow the optimizer to improve CTE plans by considering the statistics and sort order of columns referenced in earlier row output clauses (Jian Guo, Richard Guo, Tom Lane) § §

- Improve optimization of `IS NOT NULL` and `IS NULL` query restrictions (David Rowley, Richard Guo, Andy Fan) § §

  Remove `IS NOT NULL` restrictions from queries on `NOT NULL` columns and eliminate scans on `NOT NULL` columns if `IS NULL` is specified.

- Allow partition pruning on boolean columns on `IS [NOT] UNKNOWN` conditionals (David Rowley) §

- Improve optimization of range values when using containment operators <@ and @> (Kim Johan Andersson, Jian He) §

- Allow correlated `IN` subqueries to be transformed into joins (Andy Fan, Tom Lane) §

- Improve optimization of the `LIMIT` clause on partitioned tables, inheritance parents, and `UNION ALL` queries (Andy Fan, David Rowley) §

- Allow query nodes to be run in parallel in more cases (Tom Lane) §

- Allow `GROUP BY` columns to be internally ordered to match `ORDER BY` (Andrei Lepikhov, Teodor Sigaev) §

  This can be disabled using server variable guc-enable-groupby-reordering.

- Allow `UNION` (without `ALL`) to use MergeAppend (David Rowley) §

- Fix MergeAppend plans to more accurately compute the number of rows that need to be sorted (Alexander Kuzmenkov) §

- Allow GiST and SP-GiST indexes to be part of incremental sorts (Miroslav Bendik) §

  This is particularly useful for `ORDER BY` clauses where the first column has a GiST and SP-GiST index, and other columns do not.

- Add columns to pg_stats to report range-type histogram information (Egor Rogov, Soumyadeep Chakraborty) §

#### Indexes

- Allow btree indexes to more efficiently find a set of values, such as those supplied by `IN` clauses using constants (Peter Geoghegan, Matthias van de Meent) §

- Allow BRIN indexes to be created using parallel workers (Tomas Vondra, Matthias van de Meent) §

#### General Performance

- Allow vacuum to more efficiently remove and freeze tuples (Melanie Plageman, Heikki Linnakangas) §

  WAL traffic caused by vacuum is also more compact.

- Allow vacuum to more efficiently store tuple references (Masahiko Sawada, John Naylor) § § § §

  Additionally, vacuum is no longer silently limited to one gigabyte of memory when guc-maintenance-work-mem or guc-autovacuum-work-mem are higher.

- Optimize vacuuming of relations with no indexes (Melanie Plageman) §

- Increase default guc-vacuum-buffer-usage-limit to 2MB (Thomas Munro) §

- Improve performance when checking roles with many memberships (Nathan Bossart) §

- Improve performance of heavily-contended WAL writes (Bharath Rupireddy) §

- Improve performance when transferring large blocks of data to a client (Melih Mutlu) §

- Allow the grouping of file system reads with the new system variable guc-io-combine-limit (Thomas Munro, Andres Freund, Melanie Plageman, Nazir Bilal Yavuz) § § §

#### Monitoring

- Create system view pg_stat_checkpointer (Bharath Rupireddy, Anton A. Melnikov, Alexander Korotkov) § § §

  Relevant columns have been removed from pg_stat_bgwriter and added to this new system view.

- Improve control over resetting statistics (Atsushi Torikoshi, Bharath Rupireddy) § § §

  Allow `pg_stat_reset_shared()` (with no arguments) and pg_stat_reset_shared(`NULL`) to reset all shared statistics. Allow pg_stat_reset_shared('slru') and `pg_stat_reset_slru()` (with no arguments) to reset SLRU statistics, which was already possible with pg_stat_reset_slru(NULL).

- Add log messages related to WAL recovery from backups (Andres Freund) §

- Add guc-log-connections log line for `trust` connections (Jacob Champion) §

- Add log message to report walsender acquisition and release of replication slots (Bharath Rupireddy) §

  This is enabled by the server variable guc-log-replication-commands.

- Add system view pg_wait_events that reports wait event types (Bertrand Drouvot) §

  This is useful for adding descriptions to wait events reported in pg_stat_activity.

- Add wait events for checkpoint delays (Thomas Munro) §

- Allow vacuum to report the progress of index processing (Sami Imseih) §

  This appears in system view pg_stat_progress_vacuum columns indexes_total and indexes_processed.

#### Privileges

- Allow granting the right to perform maintenance operations (Nathan Bossart) §

  The permission can be granted on a per-table basis using the `MAINTAIN` privilege and on a per-role basis via the `pg_maintain` predefined role. Permitted operations are `VACUUM`, `ANALYZE`, `REINDEX`, `REFRESH MATERIALIZED VIEW`, `CLUSTER`, and `LOCK TABLE`.

- Allow roles with `pg_monitor` membership to execute `pg_current_logfile()` (Pavlo Golub, Nathan Bossart) §

#### Server Configuration

- Add system variable guc-allow-alter-system to disallow `ALTER SYSTEM` (Jelte Fennema-Nio, Gabriele Bartolini) §

- Allow `ALTER SYSTEM` to set unrecognized custom server variables (Tom Lane) §

  This is also possible with `GRANT ON PARAMETER`.

- Add server variable guc-transaction-timeout to restrict the duration of transactions (Andrey Borodin, Japin Li, Junwang Zhao, Alexander Korotkov) § § §

- Add a builtin platform-independent collation provider (Jeff Davis) § § § §

  This supports `C` and `C.UTF-8` collations.

- Add server variable guc-huge-pages-status to report the use of huge pages by Postgres (Justin Pryzby) §

  This is useful when guc-huge-pages is set to `try`.

- Add server variable to disable event triggers (Daniel Gustafsson) §

  The setting, guc-event-triggers, allows for the temporary disabling of event triggers for debugging.

- Allow the SLRU cache sizes to be configured (Andrey Borodin, Dilip Kumar, Alvaro Herrera) §

  The new server variables are guc-commit-timestamp-buffers, guc-multixact-member-buffers, guc-multixact-offset-buffers, guc-notify-buffers, guc-serializable-buffers, guc-subtransaction-buffers, and guc-transaction-buffers. guc-commit-timestamp-buffers, guc-transaction-buffers, and guc-subtransaction-buffers scale up automatically with guc-shared-buffers.

#### Streaming Replication and Recovery

- Add support for incremental file system backup (Robert Haas, Jakub Wartak, Tomas Vondra) § §

  Incremental backups can be created using pg_basebackup's new `--incremental` option. The new application pg_combinebackup allows manipulation of base and incremental file system backups.

- Allow the creation of WAL summarization files (Robert Haas, Nathan Bossart, Hubert Depesz Lubaczewski) § § § §

  These files record the block numbers that have changed within an LSN range and are useful for incremental file system backups. This is controlled by the server variables guc-summarize-wal and guc-wal-summary-keep-time, and introspected with `pg_available_wal_summaries()`, `pg_wal_summary_contents()`, and `pg_get_wal_summarizer_state()`.

- Add the system identifier to file system backup manifest files (Amul Sul) §

  This helps detect invalid WAL usage.

- Allow connection string value `dbname` to be written when pg_basebackup writes connection information to `postgresql.auto.conf` (Vignesh C, Hayato Kuroda) §

- Add column pg_replication_slots.invalidation_reason to report the reason for invalid slots (Shveta Malik, Bharath Rupireddy) § §

- Add column pg_replication_slots.inactive_since to report slot inactivity duration (Bharath Rupireddy) § § §

- Add function `pg_sync_replication_slots()` to synchronize logical replication slots (Hou Zhijie, Shveta Malik, Ajin Cherian, Peter Eisentraut) § §

- Add the `failover` property to the replication protocol (Hou Zhijie, Shveta Malik) §

#### Logical Replication

- Add application pg_createsubscriber to create a logical replica from a physical standby server (Euler Taveira) §

- Have pg_upgrade migrate valid logical slots and subscriptions (Hayato Kuroda, Hou Zhijie, Vignesh C, Julien Rouhaud, Shlok Kyal) § §

  This allows logical replication to continue quickly after the upgrade. This only works for old PostgreSQL clusters that are version 17 or later.

- Enable the failover of logical slots (Hou Zhijie, Shveta Malik, Ajin Cherian) §

  This is controlled by an optional fifth argument to `pg_create_logical_replication_slot()`.

- Add server variable guc-sync-replication-slots to enable failover logical slot synchronization (Shveta Malik, Hou Zhijie, Peter Smith) § §

- Add logical replication failover control to `CREATE/ALTER SUBSCRIPTION` (Shveta Malik, Hou Zhijie, Ajin Cherian) § §

- Allow the application of logical replication changes to use hash indexes on the subscriber (Hayato Kuroda) §

  Previously only btree indexes could be used for this purpose.

- Improve logical decoding performance in cases where there are many subtransactions (Masahiko Sawada) §

- Restart apply workers if subscription owner's superuser privileges are revoked (Vignesh C) §

  This forces reauthentication.

- Add `flush` option to `pg_logical_emit_message()` (Michael Paquier) §

  This makes the message durable.

- Allow specification of physical standbys that must be synchronized before they are visible to subscribers (Hou Zhijie, Shveta Malik) § §

  The new server variable is guc-synchronized-standby-slots.

- Add worker type column to pg_stat_subscription (Peter Smith) §

### Utility Commands

- Add new `COPY` option `ON_ERROR ignore` to discard error rows (Damir Belyalov, Atsushi Torikoshi, Alex Shulgin, Jian He, Yugo Nagata) § § § §

  The default behavior is `ON_ERROR stop`.

- Add new `COPY` option `LOG_VERBOSITY` which reports `COPY FROM` ignored error rows (Bharath Rupireddy) §

- Allow `COPY FROM` to report the number of skipped rows during processing (Atsushi Torikoshi) §

  This appears in system view column pg_stat_progress_copy.tuples_skipped.

- In `COPY FROM`, allow easy specification that all columns should be forced null or not null (Zhang Mingli) §

- Allow partitioned tables to have identity columns (Ashutosh Bapat) §

- Allow exclusion constraints on partitioned tables (Paul A. Jungwirth) §

  As long as exclusion constraints compare partition key columns for equality, other columns can use exclusion constraint-specific comparisons.

- Add clearer `ALTER TABLE` method to set a column to the default statistics target (Peter Eisentraut) §

  The new syntax is `ALTER TABLE ... SET STATISTICS DEFAULT`; using `SET STATISTICS -1` is still supported.

- Allow `ALTER TABLE` to change a column's generation expression (Amul Sul) §

  The syntax is `ALTER TABLE ... ALTER COLUMN ... SET EXPRESSION`.

- Allow specification of table access methods on partitioned tables (Justin Pryzby, Soumyadeep Chakraborty, Michael Paquier) § §

- Add `DEFAULT` setting for `ALTER TABLE .. SET ACCESS METHOD` (Michael Paquier) §

- Add support for event triggers that fire at connection time (Konstantin Knizhnik, Mikhail Gribkov) §

- Add event trigger support for `REINDEX` (Garrett Thornburg, Jian He) §

- Allow parenthesized syntax for `CLUSTER` options if a table name is not specified (Nathan Bossart) §

#### `EXPLAIN`

- Allow `EXPLAIN` to report optimizer memory usage (Ashutosh Bapat) §

  The option is called `MEMORY`.

- Add `EXPLAIN` option `SERIALIZE` to report the cost of converting data for network transmission (Stepan Rutz, Matthias van de Meent) §

- Add local I/O block read/write timing statistics to `EXPLAIN`'s `BUFFERS` output (Nazir Bilal Yavuz) §

- Improve `EXPLAIN`'s display of SubPlan nodes and output parameters (Tom Lane, Dean Rasheed) §

- Add JIT `deform_counter` details to `EXPLAIN` (Dmitry Dolgov) §

### Data Types

- Allow the `interval` data type to support `+/-infinity` values (Joseph Koshakow, Jian He, Ashutosh Bapat) §

- Allow the use of an `ENUM` added via `ALTER TYPE` if the type was created in the same transaction (Tom Lane) §

  This was previously disallowed.

### MERGE

- Allow `MERGE` to modify updatable views (Dean Rasheed) §

- Add `WHEN NOT MATCHED BY SOURCE` to `MERGE` (Dean Rasheed) §

  `WHEN NOT MATCHED` on target rows was already supported.

- Allow `MERGE` to use the `RETURNING` clause (Dean Rasheed) §

  The new `RETURNING` function `merge_action()` reports on the DML that generated the row.

### Functions

- Add function `JSON_TABLE()` to convert `JSON` data to a table representation (Nikita Glukhov, Teodor Sigaev, Oleg Bartunov, Alexander Korotkov, Andrew Dunstan, Amit Langote, Jian He) § §

  This function can be used in the `FROM` clause of `SELECT` queries as a tuple source.

- Add SQL/JSON constructor functions `JSON()`, `JSON_SCALAR()`, and `JSON_SERIALIZE()` (Nikita Glukhov, Teodor Sigaev, Oleg Bartunov, Alexander Korotkov, Andrew Dunstan, Amit Langote) §

- Add SQL/JSON query functions `JSON_EXISTS()`, `JSON_QUERY()`, and `JSON_VALUE()` (Nikita Glukhov, Teodor Sigaev, Oleg Bartunov, Alexander Korotkov, Andrew Dunstan, Amit Langote, Peter Eisentraut, Jian He) § § § § §

- Add jsonpath methods to convert `JSON` values to other `JSON` data types (Jeevan Chalke) §

  The jsonpath methods are `.bigint()`, `.boolean()`, `.date()`, `.decimal([precision [, scale]])`, `.integer()`, `.number()`, `.string()`, `.time()`, `.time_tz()`, `.timestamp()`, and `.timestamp_tz()`.

- Add `to_timestamp()` time zone format specifiers (Tom Lane) §

  `TZ` accepts time zone abbreviations or numeric offsets, while `OF` accepts only numeric offsets.

- Allow the session time zone to be specified by `AT LOCAL` (Vik Fearing) §

  This is useful when converting adding and removing time zones from time stamps values, rather than specifying the literal session time zone.

- Add functions `uuid_extract_timestamp()` and `uuid_extract_version()` to return UUID information (Andrey Borodin) §

- Add functions to generate random numbers in a specified range (Dean Rasheed) §

  The functions are `random(min, max)` and they take values of type `integer`, `bigint`, and `numeric`.

- Add functions to convert integers to binary and octal strings (Eric Radman, Nathan Bossart) §

  The functions are `to_bin()` and `to_oct()`.

- Add Unicode informational functions (Jeff Davis) §

  Function `unicode_version()` returns the Unicode version, `icu_unicode_version()` returns the ICU version, and `unicode_assigned()` returns if the characters are assigned Unicode codepoints.

- Add function `xmltext()` to convert text to a single `XML` text node (Jim Jones) §

- Add function `to_regtypemod()` to return the type modifier of a type specification (David Wheeler, Erik Wienhold) §

- Add `pg_basetype()` function to return a domain's base type (Steve Chavez) §

- Add function `pg_column_toast_chunk_id()` to return a value's TOAST identifier (Yugo Nagata) §

  This returns `NULL` if the value is not stored in TOAST.

### PL/pgSQL

- Allow plpgsql `%TYPE` and `%ROWTYPE` specifications to represent arrays of non-array types (Quan Zongliang, Pavel Stehule) §

- Allow plpgsql `%TYPE` specification to reference composite column (Tom Lane) §

### libpq

- Add libpq function to change role passwords (Joe Conway) §

  The new function, `PQchangePassword()`, hashes the new password before sending it to the server.

- Add libpq functions to close portals and prepared statements (Jelte Fennema-Nio) §

  The functions are `PQclosePrepared()`, `PQclosePortal()`, `PQsendClosePrepared()`, and `PQsendClosePortal()`.

- Add libpq API which allows for blocking and non-blocking cancel requests, with encryption if already in use (Jelte Fennema-Nio) §

  Previously only blocking, unencrypted cancel requests were supported.

- Add libpq function `PQsocketPoll()` to allow polling of network sockets (Tristan Partin, Tom Lane) § §

- Add libpq function `PQsendPipelineSync()` to send a pipeline synchronization point (Anton Kirilov) §

  This is similar to `PQpipelineSync()` but it does not flush to the server unless the size threshold of the output buffer is reached.

- Add libpq function `PQsetChunkedRowsMode()` to allow retrieval of results in chunks (Daniel Vérité) §

- Allow TLS connections without requiring a network round-trip negotiation (Greg Stark, Heikki Linnakangas, Peter Eisentraut, Michael Paquier, Daniel Gustafsson) § § § § § § § §

  This is enabled with the client-side option `sslnegotiation=direct`, requires ALPN, and only works on PostgreSQL 17 and later servers.

### app-psql

- Improve psql display of default and empty privileges (Erik Wienhold, Laurenz Albe) §

  Command `\dp` now displays `(none)` for empty privileges; default still displays as empty.

- Have backslash commands honor `\pset null` (Erik Wienhold, Laurenz Albe) §

  Previously `\pset null` was ignored.

- Allow psql's `\watch` to stop after a minimum number of rows returned (Greg Sabino Mullane) §

  The parameter is `min_rows`.

- Allow psql connection attempts to be canceled with control-C (Tristan Partin) §

- Allow psql to honor `FETCH_COUNT` for non-`SELECT` queries (Daniel Vérité) §

- Improve psql tab completion (Dagfinn Ilmari Mannsåker, Gilles Darold, Christoph Heiss, Steve Chavez, Vignesh C, Pavel Borisov, Jian He) § § § § § § § §

### Server Applications

- Add application pg_walsummary to dump WAL summary files (Robert Haas) §

- Allow pg_dump's large objects to be restorable in batches (Tom Lane) §

  This allows the restoration of many large objects to avoid transaction limits and to be restored in parallel.

- Add pg_dump option `--exclude-extension` (Ayush Vatsa) §

- Allow pg_dump, pg_dumpall, and pg_restore to specify include/exclude objects in a file (Pavel Stehule, Daniel Gustafsson) §

  The option is called `--filter`.

- Add the `--sync-method` parameter to several client applications (Justin Pryzby, Nathan Bossart) §

  The applications are initdb, pg_basebackup, pg_checksums, pg_dump, pg_rewind, and pg_upgrade.

- Add pg_restore option `--transaction-size` to allow object restores in transaction batches (Tom Lane) §

  This allows the performance benefits of transaction batches without the problems of excessively large transaction blocks.

- Change pgbench debug mode option from `-d` to `--debug` (Greg Sabino Mullane) §

  Option `-d` is now used for the database name, and the new `--dbname` option can be used as well.

- Add pgbench option `--exit-on-abort` to exit after any client aborts (Yugo Nagata) §

- Add pgbench command `\syncpipeline` to allow sending of sync messages (Anthonin Bonnefoy) §

- Allow pg_archivecleanup to remove backup history files (Atsushi Torikoshi) §

  The option is `--clean-backup-history`.

- Add some long options to pg_archivecleanup (Atsushi Torikoshi) §

  The long options are `--debug`, `--dry-run`, and `--strip-extension`.

- Allow pg_basebackup and pg_receivewal to use dbname in their connection specification (Jelte Fennema-Nio) §

  This is useful for connection poolers that are sensitive to the database name.

- Add pg_upgrade option `--copy-file-range` (Thomas Munro) §

  This is supported on `Linux` and `FreeBSD`.

- Allow reindexdb `--index` to process indexes from different tables in parallel (Maxim Orlov, Svetlana Derevyanko, Alexander Korotkov) §

- Allow reindexdb, vacuumdb, and clusterdb to process objects in all databases matching a pattern (Nathan Bossart) § § §

  The new option `--all` controls this behavior.

### Source Code

- Remove support for OpenSSL 1.0.1 (Michael Paquier) §

- Allow tests to pass in OpenSSL FIPS mode (Peter Eisentraut) § §

- Use CPU AVX-512 instructions for bit counting (Paul Amonson, Nathan Bossart, Ants Aasma) § §

- Require LLVM version 10 or later (Thomas Munro) §

- Use native CRC instructions on 64-bit LoongArch CPUs (Xudong Yang) §

- Remove `AIX` support (Heikki Linnakangas) §

- Remove the Microsoft Visual Studio-specific PostgreSQL build option (Michael Paquier) §

  Meson is now the only available method for Visual Studio builds.

- Remove configure option `--disable-thread-safety` (Thomas Munro, Heikki Linnakangas) § §

  We now assume all supported platforms have sufficient thread support.

- Remove configure option `--with-CC` (Heikki Linnakangas) §

  Setting the `CC` environment variable is now the only supported method for specifying the compiler.

- User-defined data type receive functions will no longer receive their data null-terminated (David Rowley) §

- Add incremental `JSON` parser for use with huge `JSON` documents (Andrew Dunstan) §

- Convert top-level `README` file to Markdown (Nathan Bossart) §

- Remove no longer needed top-level `INSTALL` file (Tom Lane) §

- Remove make's `distprep` option (Peter Eisentraut) §

- Add make support for Android shared libraries (Peter Eisentraut) §

- Add backend support for injection points (Michael Paquier) § § § §

  This is used for server debugging and they must be enabled at server compile time.

- Add dynamic shared memory registry (Nathan Bossart) §

  This allows shared libraries which are not initialized at startup to coordinate dynamic shared memory access.

- Fix `emit_log_hook` to use the same time value as other log records for the same query (Kambam Vinay, Michael Paquier) §

- Improve documentation for using `jsonpath` for predicate checks (David Wheeler) §

### Additional Modules

- Allow joins with non-join qualifications to be pushed down to foreign servers and custom scans (Richard Guo, Etsuro Fujita) §

  Foreign data wrappers and custom scans will need to be modified to handle these cases.

- Allow pushdown of `EXISTS` and `IN` subqueries to postgres-fdw foreign servers (Alexander Pyhalov) §

- Increase the default foreign data wrapper tuple cost (David Rowley, Umair Shahid) § §

  This value is used by the optimizer.

- Allow dblink database operations to be interrupted (Noah Misch) §

- Allow the creation of hash indexes on ltree columns (Tommy Pavlicek) §

  This also enables hash join and hash aggregation on ltree columns.

- Allow unaccent character translation rules to contain whitespace and quotes (Michael Paquier) §

  The syntax for the `unaccent.rules` file has changed.

- Allow amcheck to check for unique constraint violations using new option `--checkunique` (Anastasia Lubennikova, Pavel Borisov, Maxim Orlov) §

- Allow citext tests to pass in OpenSSL FIPS mode (Peter Eisentraut) §

- Allow pgcrypto tests to pass in OpenSSL FIPS mode (Peter Eisentraut) §

- Remove some unused SPI macros (Bharath Rupireddy) §

- Allow `ALTER OPERATOR` to set more optimization attributes (Tommy Pavlicek) §

  This is useful for extensions.

- Allow extensions to define custom wait events (Masahiro Ikeda) § § § §

  Custom wait events have been added to postgres-fdw and dblink.

- Add pgbuffercache function `pg_buffercache_evict()` to allow shared buffer eviction (Palak Chaturvedi, Thomas Munro) §

  This is useful for testing.

#### pg_stat_statements

- Replace `CALL` parameters in pg_stat_statements with placeholders (Sami Imseih) §

- Replace savepoint names stored in pg_stat_statements with placeholders (Greg Sabino Mullane) §

  This greatly reduces the number of entries needed to record `SAVEPOINT`, `RELEASE SAVEPOINT`, and `ROLLBACK TO SAVEPOINT` commands.

- Replace the two-phase commit GIDs stored in pg_stat_statements with placeholders (Michael Paquier) §

  This greatly reduces the number of entries needed to record `PREPARE TRANSACTION`, `COMMIT PREPARED`, and `ROLLBACK PREPARED`.

- Track `DEALLOCATE` in pg_stat_statements (Dagfinn Ilmari Mannsåker, Michael Paquier) §

  `DEALLOCATE` names are stored in pg_stat_statements as placeholders.

- Add local I/O block read/write timing statistics columns of pg_stat_statements (Nazir Bilal Yavuz) § §

  The new columns are local_blk_read_time and local_blk_write_time.

- Add JIT deform_counter details to pg_stat_statements (Dmitry Dolgov) §

- Add optional fourth argument (`minmax_only`) to `pg_stat_statements_reset()` to allow for the resetting of only min/max statistics (Andrei Zubkov) §

  This argument defaults to `false`.

- Add pg_stat_statements columns stats_since and minmax_stats_since to track entry creation time and last min/max reset time (Andrei Zubkov) §

## Acknowledgments

The following individuals (in alphabetical order) have contributed to this release as patch authors, committers, reviewers, testers, or reporters of issues.

- Abhijit Menon-Sen
- Adnan Dautovic
- Aidar Imamov
- Ajin Cherian
- Akash Shankaran
- Akshat Jaimini
- Alaa Attya
- Aleksander Alekseev
- Aleksej Orlov
- Alena Rybakina
- Alex Hsieh
- Alex Malek
- Alex Shulgin
- Alex Work
- Alexander Korotkov
- Alexander Kozhemyakin
- Alexander Kuzmenkov
- Alexander Lakhin
- Alexander Pyhalov
- Alexey Palazhchenko
- Alfons Kemper
- Álvaro Herrera
- Amadeo Gallardo
- Amit Kapila
- Amit Langote
- Amul Sul
- Anastasia Lubennikova
- Anatoly Zaretsky
- Andreas Karlsson
- Andreas Ulbrich
- Andrei Lepikhov
- Andrei Zubkov
- Andres Freund
- Andrew Alsup
- Andrew Atkinson
- Andrew Bille
- Andrew Dunstan
- Andrew Kane
- Andrey Borodin
- Andrey Rachitskiy
- Andrey Sokolov
- Andy Fan
- Anthonin Bonnefoy
- Anthony Hsu
- Anton Kirilov
- Anton Melnikov
- Anton Voloshin
- Antonin Houska
- Ants Aasma
- Antti Lampinen
- Aramaki Zyake
- Artem Anisimov
- Artur Zakirov
- Ashutosh Bapat
- Ashutosh Sharma
- Atsushi Torikoshi
- Attila Gulyás
- Ayush Tiwari
- Ayush Vatsa
- Bartosz Chrol
- Benoît Ryder
- Bernd Helmle
- Bertrand Drouvot
- Bharath Rupireddy
- Bo Andreson
- Boshomi Phenix
- Bowen Shi
- Boyu Yang
- Bruce Momjian
- Cameron Vogt
- Cary Huang
- Cédric Villemain
- Changhong Fei
- Chantal Keller
- Chapman Flack
- Chengxi Sun
- Chris Travers
- Christian Maurer
- Christian Stork
- Christoph Berg
- Christoph Heiss
- Christophe Courtois
- Christopher Kline
- Claudio Freire
- Colin Caine
- Corey Huinker
- Curt Kolovson
- Dag Lem
- Dagfinn Ilmari Mannsåker
- Damir Belyalov
- Daniel Fredouille
- Daniel Gustafsson
- Daniel Shelepanov
- Daniel Vérité
- Daniel Westermann
- Darren Rush
- Dave Cramer
- Dave Page
- David Christensen
- David Cook
- David G. Johnston
- David Geier
- David Hillman
- David Perez
- David Rowley
- David Steele
- David Wheeler
- David Zhang
- Dean Rasheed
- Denis Erokhin
- Denis Laxalde
- Devrim Gündüz
- Dilip Kumar
- Dimitrios Apostolou
- Dmitry Dolgov
- Dmitry Koval
- Dmitry Vasiliev
- Dominique Devienne
- Dong Wook Lee
- Donghang Lin
- Dongming Liu
- Drew Callahan
- Drew Kimball
- Dzmitry Jachnik
- Egor Chindyaskin
- Egor Rogov
- Ekaterina Kiryanova
- Elena Indrupskaya
- Elizabeth Christensen
- Emre Hasegeli
- Eric Cyr
- Eric Mutta
- Eric Radman
- Eric Ridge
- Erik Rijkers
- Erik Wienhold
- Erki Eessaar
- Ethan Mertz
- Etsuro Fujita
- Eugen Konkov
- Euler Taveira
- Evan Macbeth
- Evgeny Morozov
- Fabien Coelho
- Fabrízio de Royes Mello
- Farias de Oliveira
- Feliphe Pozzer
- Fire Emerald
- Flavien Guedez
- Floris Van Nee
- Francesco Degrassi
- Frank Streitzig
- Gabriele Bartolini
- Garrett Thornburg
- Gavin Flower
- Gavin Panella
- Gilles Darold
- Gilles Parc
- Grant Gryczan
- Greg Nancarrow
- Greg Sabino Mullane
- Greg Stark
- Gurjeet Singh
- Haiying Tang
- Hajime Matsunaga
- Hal Takahara
- Hanefi Onaldi
- Hannu Krosing
- Hans Buschmann
- Hao Wu
- Hao Zhang
- Hayato Kuroda
- Heikki Linnakangas
- Hemanth Sandrana
- Himanshu Upadhyaya
- Hironobu Suzuki
- Holger Reise
- Hongxu Ma
- Hongyu Song
- Horst Reiterer
- Hubert Lubaczewski
- Hywel Carver
- Ian Barwick
- Ian Ilyasov
- Ilya Nenashev
- Isaac Morland
- Israel Barth Rubio
- Ivan Kartyshov
- Ivan Kolombet
- Ivan Lazarev
- Ivan Panchenko
- Ivan Trofimov
- Jacob Champion
- Jacob Speidel
- Jacques Combrink
- Jaime Casanova
- Jakub Wartak
- James Coleman
- James Pang
- Jani Rahkola
- Japin Li
- Jeevan Chalke
- Jeff Davis
- Jeff Janes
- Jelte Fennema-Nio
- Jeremy Schneider
- Jian Guo
- Jian He
- Jim Jones
- Jim Keener
- Jim Nasby
- Jingtang Zhang
- Jingxian Li
- Jingzhou Fu
- Joe Conway
- Joel Jacobson
- John Ekins
- John Hsu
- John Morris
- John Naylor
- John Russell
- Jonathan Katz
- Jordi Gutiérrez
- Joseph Koshakow
- Josh Kupershmidt
- Joshua D. Drake
- Joshua Uyehara
- Jubilee Young
- Julien Rouhaud
- Junwang Zhao
- Justin Pryzby
- Kaido Vaikla
- Kambam Vinay
- Karen Talarico
- Karina Litskevich
- Karl O. Pinc
- Kashif Zeeshan
- Kim Johan Andersson
- Kirill Reshke
- Kirk Parker
- Kirk Wolak
- Kisoon Kwon
- Koen De Groote
- Kohei KaiGai
- Kong Man
- Konstantin Knizhnik
- Kouhei Sutou
- Krishnakumar R
- Kuntal Ghosh
- Kurt Roeckx
- Kyotaro Horiguchi
- Lang Liu
- Lars Kanis
- Laurenz Albe
- Lauri Laanmets
- Legs Mansion
- Lukas Fittl
- Magnus Hagander
- Mahendrakar Srinivasarao
- Maiquel Grassi
- Manos Emmanouilidis
- Marcel Hofstetter
- Marcos Pegoraro
- Marian Krucina
- Marina Polyakova
- Mark Dilger
- Mark Guertin
- Mark Sloan
- Markus Winand
- Marlene Reiterer
- Martín Marqués
- Martin Nash
- Martin Schlossarek
- Masahiko Sawada
- Masahiro Ikeda
- Masaki Kuwamura
- Masao Fujii
- Mason Sharp
- Matheus Alcantara
- Mats Kindahl
- Matthias Kuhn
- Matthias van de Meent
- Maxim Boguk
- Maxim Orlov
- Maxim Yablokov
- Maxime Boyer
- Melanie Plageman
- Melih Mutlu
- Merlin Moncure
- Micah Gate
- Michael Banck
- Michael Bondarenko
- Michael Paquier
- Michael Wang
- Michael Zhilin
- Michail Nikolaev
- Michal Bartak
- Michal Kleczek
- Mikhail Gribkov
- Mingli Zhang
- Miroslav Bendik
- Mitsuru Hinata
- Moaaz Assali
- Muralikrishna Bandaru
- Nathan Bossart
- Nazir Bilal Yavuz
- Neil Tiffin
- Ngigi Waithaka
- Nikhil Benesch
- Nikhil Raj
- Nikita Glukhov
- Nikita Kalinin
- Nikita Malakhov
- Nikolay Samokhvalov
- Nikolay Shaplov
- Nisha Moond
- Nishant Sharma
- Nitin Jadhav
- Noah Misch
- Noriyoshi Shinoda
- Ole Peder Brandtzæg
- Oleg Bartunov
- Oleg Sibiryakov
- Oleg Tselebrovskiy
- Olleg Samoylov
- Onder Kalaci
- Ondrej Navratil
- Pablo Kharo
- Palak Chaturvedi
- Pantelis Theodosiou
- Paul Amonson
- Paul Jungwirth
- Pavel Borisov
- Pavel Kulakov
- Pavel Luzanov
- Pavel Stehule
- Pavlo Golub
- Pedro Gallegos
- Pete Storer
- Peter Eisentraut
- Peter Geoghegan
- Peter Smith
- Philip Warner
- Philipp Salvisberg
- Pierre Ducroquet
- Pierre Fortin
- Przemyslaw Sztoch
- Quynh Tran
- Raghuveer Devulapalli
- Ranier Vilela
- Reid Thompson
- Rian McGuire
- Richard Guo
- Richard Vesely
- Ridvan Korkmaz
- Robert Haas
- Robert Scott
- Robert Treat
- Roberto Mello
- Robins Tharakan
- Roman Lozko
- Ronan Dunklau
- Rui Zhao
- Ryo Matsumura
- Ryoga Yoshida
- Sameer Kumar
- Sami Imseih
- Samuel Dussault
- Sanjay Minni
- Satoru Koizumi
- Sebastian Skalacki
- Sergei Glukhov
- Sergei Kornilov
- Sergey Prokhorenko
- Sergey Sargsyan
- Sergey Shinderuk
- Shaozhong Shi
- Shaun Thomas
- Shay Rojansky
- Shihao Zhong
- Shinya Kato
- Shlok Kyal
- Shruthi Gowda
- Shubham Khanna
- Shulin Zhou
- Shveta Malik
- Simon Riggs
- Soumyadeep Chakraborty
- Sravan Velagandula
- Stan Hu
- Stepan Neretin
- Stepan Rutz
- Stéphane Schildknecht
- Stephane Tachoires
- Stephen Frost
- Steve Atkins
- Steve Chavez
- Suraj Khamkar
- Suraj Kharage
- Svante Richter
- Svetlana Derevyanko
- Sylvain Frandaz
- Takayuki Tsunakawa
- Tatsuo Ishii
- Tatsuro Yamada
- Tender Wang
- Teodor Sigaev
- Thom Brown
- Thomas Munro
- Tim Carey-Smith
- Tim Needham
- Tim Palmer
- Tobias Bussmann
- Tom Lane
- Tomas Vondra
- Tommy Pavlicek
- Tomonari Katsumata
- Tristan Partin
- Tristen Raab
- Tung Nguyen
- Umair Shahid
- Uwe Binder
- Valerie Woolard
- Vallimaharajan G
- Vasya Boytsov
- Victor Wagner
- Victor Yegorov
- Victoria Shepard
- Vidushi Gupta
- Vignesh C
- Vik Fearing
- Viktor Leis
- Vinayak Pokale
- Vitaly Burovoy
- Vojtech Benes
- Wei Sun
- Wei Wang
- Wenjiang Zhang
- Will Mortensen
- Willi Mann
- Wolfgang Walther
- Xiang Liu
- Xiaoran Wang
- Xing Guo
- Xudong Yang
- Yahor Yuzefovich
- Yajun Hu
- Yaroslav Saburov
- Yong Li
- Yongtao Huang
- Yugo Nagata
- Yuhang Qiu
- Yuki Seino
- Yura Sokolov
- Yurii Rashkovskii
- Yuuki Fujii
- Yuya Watari
- Yves Colin
- Zhihong Yu
- Zhijie Hou
- Zongliang Quan
- Zubeyr Eryilmaz
- Zuming Jiang