PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 Released

Re:PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 ... by zulux on Thursday November 12, 2026 @10:29AM (#50468994)

Mega patches like this, in my opinion, should be treated as mandatory patches. If I were trying to get a significant security update into the field in the age of LLM drama, this is how I would do it.

[ Parent | on HN ]

Re:PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 ... by ltbarcly3 on Thursday November 12, 2026 @11:03AM (#50469603)

So you're in favor of applying security patches? Controversial opinion.

[ Parent | on HN ]

Re:PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 ... by fock on Thursday November 12, 2026 @11:26AM (#50469943)

then, what would you do if you were an adversary trying to push your xz-style vulnerability to every place known to man?

[ Parent | on HN ]

Re:PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 ... by levkk on Thursday November 12, 2026 @11:41AM (#50470172)

Most databases run offline and don't allow arbitrary SQL statements. SQL injections are generally eliminated by using the extended protocol.

So, yes, if you're running multi-tenant Postgres as a public service, you should upgrade. Everyone else is in no rush.

[ Parent | on HN ]

Re:PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 ... by perlgeek on Thursday November 12, 2026 @12:02PM (#50470486)

No rush, but don't wait too long either.

Yes, the application above it should prevent SQL injection, but if it's imperfect, you don't want an attacker to turn SQL injection into RCE.

[ Parent | on HN ]

Re:PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 ... by mistrial9 on Thursday November 12, 2026 @02:05PM (#50472494)

Debian Trixie just included quite a lot, when asking only for specific updates. I think your wish has been granted

[ Parent | on HN ]