Skip to content

Commit 035833c

Browse files
randoneeringrandoneering
committed
fix: address review findings - SQL safety, scoping, test coverage
Inline findings (must-fix): * .github/workflows/cve-data-sync.yml - drop uv, pip, and the outer install. Add a job-level `permissions: contents: read` so the drift check never holds write scope. Set `persist-credentials: false` on actions/checkout so the default token does not leak into later steps (the generator never makes authenticated requests). * data/cves.json - drop CVE-2025-12818. CVSS 5.9 is below the documented >= 7.0 inclusion rule. Regenerator output stays in sync on its own. * pgFirstAid.sql / view_pgFirstAid.sql / view_pgFirstAid_managed.sql - delete the two orphan comment fragments left behind by the ponytail-marker removal in 8a73c19 (one after each cve/bug preamble). * tools/generate_cve_sql.py - replace Python's `!r` escaping (which produces backslash-escaped strings that PG's standard string literals don't recognize) with a `_sql_quote` helper that doubles apostrophes. Drop the right-padding format specs `{cvss:>4}` and `{summary!r:>3}` that produced inconsistent alignment across columns. `render_bug_rows` now validates the major prefix on the issue_id before calling `_version_num`, so a malformed `PG<notanumber>-...` fails loudly instead of silently emitting a row with the wrong server_version_num range. * tools/README.md - trim the directory listing to only items that exist on this branch (generator + tests + drift-check workflow; no scraper entries on this branch). Drop the dangling "the scrapers below" reference. * view_pgFirstAid.sql - wrap the `pgfirstaid_pg_stat_statements_checks` function body in `begin ... exception when object_not_in_prerequisite_state then return; end;`, matching the existing pattern in pgFirstAid.sql and view_pgFirstAid_managed.sql. Catches the installed-but-not-loadable case the extension-existence check doesn't cover. Nitpicks: * .github/workflows/cve-data-sync.yml - same as F1; uv removed entirely (generator is stdlib-only). * testing/pgTAP/06_info_tests.sql - replace the tautological `count(*) >= 0` checks with shape checks: "no row violates the expected (severity, object_name prefix) for the check_name". Vacuously true on a fully-patched version; actually meaningful on a vulnerable one. Plan count preserved at 24. * tools/generate_cve_sql.py - same as F4; major validation done. * tools/README.md - same as F5; command examples now use plain `python tools/generate_cve_sql.py` matching the workflow. * tools/tests/test_generate_cve_sql.py - relax the regex in `test_major_order_is_numeric` to tolerate optional whitespace, so the test no longer depends on the exact alignment/no-alignment of `_render_cve_row`. Replace the empty `FileRegenerationTests` stub with a real `RegenerateOneTests` class that writes a SQL file to a tmpdir, invokes `regenerate_one`, and asserts the on-disk content. Verified: 14/14 generator unit tests, 24/24 pgTAP assertions (06_info_tests on PG 17.11, no rows case), 21/21 integration tests unchanged. Generator idempotent (`--check` exits 0 on regenerated files).
1 parent 8a73c19 commit 035833c

9 files changed

Lines changed: 331 additions & 204 deletions

File tree

‎.github/workflows/cve-data-sync.yml‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
name: cve-data-sync
22

3+
# CI drift check: confirms the SQL files match what `tools/generate_cve_sql.py`
4+
# would emit from data/cves.json + data/known_bugs.json. Runs on push and PR
5+
# touching the relevant files. The generator is stdlib-only (no third-party
6+
# dependencies, no uv), so the workflow installs plain CPython and runs it.
7+
38
on:
49
push:
510
branches: [main]
@@ -23,18 +28,18 @@ jobs:
2328
drift-check:
2429
name: SQL files match data/*.json
2530
runs-on: ubuntu-latest
31+
# Read-only: the generator never writes from this job, it just diffs.
32+
permissions:
33+
contents: read
2634
steps:
27-
- uses: actions/checkout@v4
28-
- uses: actions/setup-python@v5
35+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
36+
with:
37+
# Don't persist the default GitHub token for downstream steps; the
38+
# generator never makes authenticated requests.
39+
persist-credentials: false
40+
- uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
2941
with:
3042
python-version: "3.11"
31-
cache: pip
32-
cache-dependency-path: pyproject.toml
33-
- name: Install uv (project uses uv)
34-
run: |
35-
curl -LsSf https://astral.sh/uv/install.sh | sh
36-
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
3743
- name: Run generator in --check mode
3844
run: |
39-
uv sync --quiet
40-
uv run python tools/generate_cve_sql.py --check
45+
python tools/generate_cve_sql.py --check

‎data/cves.json‎

Lines changed: 39 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -26,63 +26,87 @@
2626
"cvss": 7.5,
2727
"summary": "Extension script @substitutions@ within quoting allows SQL injection",
2828
"doc_link": "https://www.postgresql.org/support/security/CVE-2023-39417/",
29-
"fixed_in": {"15": 4, "16": 1}
29+
"fixed_in": {
30+
"15": 4,
31+
"16": 1
32+
}
3033
},
3134
{
3235
"cve_id": "CVE-2023-5869",
3336
"cvss": 8.8,
3437
"summary": "pg_dump integer overflow (32-bit builds) can execute arbitrary code at restore",
3538
"doc_link": "https://www.postgresql.org/support/security/CVE-2023-5869/",
36-
"fixed_in": {"15": 5, "16": 1}
39+
"fixed_in": {
40+
"15": 5,
41+
"16": 1
42+
}
3743
},
3844
{
3945
"cve_id": "CVE-2024-0985",
4046
"cvss": 8.0,
4147
"summary": "Non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL",
4248
"doc_link": "https://www.postgresql.org/support/security/CVE-2024-0985/",
43-
"fixed_in": {"15": 6, "16": 2}
49+
"fixed_in": {
50+
"15": 6,
51+
"16": 2
52+
}
4453
},
4554
{
4655
"cve_id": "CVE-2024-7348",
4756
"cvss": 8.8,
4857
"summary": "pg_dump --restore uses an invalid type OID, allowing arbitrary SQL execution from a crafted dump",
4958
"doc_link": "https://www.postgresql.org/support/security/CVE-2024-7348/",
50-
"fixed_in": {"15": 8, "16": 4}
59+
"fixed_in": {
60+
"15": 8,
61+
"16": 4
62+
}
5163
},
5264
{
5365
"cve_id": "CVE-2024-10979",
5466
"cvss": 8.8,
5567
"summary": "PL/Perl environment variable changes execute arbitrary code",
5668
"doc_link": "https://www.postgresql.org/support/security/CVE-2024-10979/",
57-
"fixed_in": {"15": 9, "16": 5, "17": 1}
58-
},
59-
{
60-
"cve_id": "CVE-2025-12818",
61-
"cvss": 5.9,
62-
"summary": "libpq undersizes allocations via integer wraparound (DoS, potential code execution)",
63-
"doc_link": "https://www.postgresql.org/support/security/CVE-2025-12818/",
64-
"fixed_in": {"15": 15, "16": 11, "17": 7, "18": 1}
69+
"fixed_in": {
70+
"15": 9,
71+
"16": 5,
72+
"17": 1
73+
}
6574
},
6675
{
6776
"cve_id": "CVE-2026-6471",
6877
"cvss": 7.2,
6978
"summary": "Logical decoding can dlopen arbitrary file via choice of decoder plugin (REPLICATION privilege required)",
7079
"doc_link": "https://www.postgresql.org/support/security/CVE-2026-6471/",
71-
"fixed_in": {"15": 19, "16": 15, "17": 11, "18": 5}
80+
"fixed_in": {
81+
"15": 19,
82+
"16": 15,
83+
"17": 11,
84+
"18": 5
85+
}
7286
},
7387
{
7488
"cve_id": "CVE-2026-16239",
7589
"cvss": 8.8,
7690
"summary": "Type confusion in cursor CLOSE + DECLARE executes arbitrary code via portal/cursor re-creation with different types",
7791
"doc_link": "https://www.postgresql.org/support/security/CVE-2026-16239/",
78-
"fixed_in": {"15": 19, "16": 15, "17": 11, "18": 5}
92+
"fixed_in": {
93+
"15": 19,
94+
"16": 15,
95+
"17": 11,
96+
"18": 5
97+
}
7998
},
8099
{
81100
"cve_id": "CVE-2026-19385",
82101
"cvss": 8.8,
83102
"summary": "pg_dump heap buffer overflow executes arbitrary code",
84103
"doc_link": "https://www.postgresql.org/support/security/CVE-2026-19385/",
85-
"fixed_in": {"15": 19, "16": 15, "17": 11, "18": 5}
104+
"fixed_in": {
105+
"15": 19,
106+
"16": 15,
107+
"17": 11,
108+
"18": 5
109+
}
86110
}
87111
]
88112
}

‎pgFirstAid.sql‎

Lines changed: 32 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1890,38 +1890,33 @@ end;
18901890
-- HIGH: Known CVEs affecting the running PostgreSQL version. Curated from
18911891
-- https://www.postgresql.org/support/security/: affected_min and fixed_in
18921892
-- are server_version_num integers (e.g. 150004 for 15.4). Covers PG 15-18.
1893-
-- CVEs into the supported-versions index.
18941893
insert into health_results
18951894
with cve_data(cve_id, cvss, summary, affected_min, fixed_in, doc_link) as (
18961895
values
18971896
-- GENERATED cves BEGIN (do not edit; regenerate via tools/generate_cve_sql.py)
1898-
('CVE-2023-39417', 7.5, 'Extension script @substitutions@ within quoting allows SQL injection',150000, 150004, 'https://www.postgresql.org/support/security/CVE-2023-39417/'),
1899-
('CVE-2023-39417', 7.5, 'Extension script @substitutions@ within quoting allows SQL injection',160000, 160001, 'https://www.postgresql.org/support/security/CVE-2023-39417/'),
1900-
('CVE-2023-5869', 8.8, 'pg_dump integer overflow (32-bit builds) can execute arbitrary code at restore',150000, 150005, 'https://www.postgresql.org/support/security/CVE-2023-5869/'),
1901-
('CVE-2023-5869', 8.8, 'pg_dump integer overflow (32-bit builds) can execute arbitrary code at restore',160000, 160001, 'https://www.postgresql.org/support/security/CVE-2023-5869/'),
1902-
('CVE-2024-0985', 8.0, 'Non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL',150000, 150006, 'https://www.postgresql.org/support/security/CVE-2024-0985/'),
1903-
('CVE-2024-0985', 8.0, 'Non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL',160000, 160002, 'https://www.postgresql.org/support/security/CVE-2024-0985/'),
1904-
('CVE-2024-7348', 8.8, 'pg_dump --restore uses an invalid type OID, allowing arbitrary SQL execution from a crafted dump',150000, 150008, 'https://www.postgresql.org/support/security/CVE-2024-7348/'),
1905-
('CVE-2024-7348', 8.8, 'pg_dump --restore uses an invalid type OID, allowing arbitrary SQL execution from a crafted dump',160000, 160004, 'https://www.postgresql.org/support/security/CVE-2024-7348/'),
1906-
('CVE-2024-10979', 8.8, 'PL/Perl environment variable changes execute arbitrary code',150000, 150009, 'https://www.postgresql.org/support/security/CVE-2024-10979/'),
1907-
('CVE-2024-10979', 8.8, 'PL/Perl environment variable changes execute arbitrary code',160000, 160005, 'https://www.postgresql.org/support/security/CVE-2024-10979/'),
1908-
('CVE-2024-10979', 8.8, 'PL/Perl environment variable changes execute arbitrary code',170000, 170001, 'https://www.postgresql.org/support/security/CVE-2024-10979/'),
1909-
('CVE-2025-12818', 5.9, 'libpq undersizes allocations via integer wraparound (DoS, potential code execution)',150000, 150015, 'https://www.postgresql.org/support/security/CVE-2025-12818/'),
1910-
('CVE-2025-12818', 5.9, 'libpq undersizes allocations via integer wraparound (DoS, potential code execution)',160000, 160011, 'https://www.postgresql.org/support/security/CVE-2025-12818/'),
1911-
('CVE-2025-12818', 5.9, 'libpq undersizes allocations via integer wraparound (DoS, potential code execution)',170000, 170007, 'https://www.postgresql.org/support/security/CVE-2025-12818/'),
1912-
('CVE-2025-12818', 5.9, 'libpq undersizes allocations via integer wraparound (DoS, potential code execution)',180000, 180001, 'https://www.postgresql.org/support/security/CVE-2025-12818/'),
1913-
('CVE-2026-6471', 7.2, 'Logical decoding can dlopen arbitrary file via choice of decoder plugin (REPLICATION privilege required)',150000, 150019, 'https://www.postgresql.org/support/security/CVE-2026-6471/'),
1914-
('CVE-2026-6471', 7.2, 'Logical decoding can dlopen arbitrary file via choice of decoder plugin (REPLICATION privilege required)',160000, 160015, 'https://www.postgresql.org/support/security/CVE-2026-6471/'),
1915-
('CVE-2026-6471', 7.2, 'Logical decoding can dlopen arbitrary file via choice of decoder plugin (REPLICATION privilege required)',170000, 170011, 'https://www.postgresql.org/support/security/CVE-2026-6471/'),
1916-
('CVE-2026-6471', 7.2, 'Logical decoding can dlopen arbitrary file via choice of decoder plugin (REPLICATION privilege required)',180000, 180005, 'https://www.postgresql.org/support/security/CVE-2026-6471/'),
1917-
('CVE-2026-16239', 8.8, 'Type confusion in cursor CLOSE + DECLARE executes arbitrary code via portal/cursor re-creation with different types',150000, 150019, 'https://www.postgresql.org/support/security/CVE-2026-16239/'),
1918-
('CVE-2026-16239', 8.8, 'Type confusion in cursor CLOSE + DECLARE executes arbitrary code via portal/cursor re-creation with different types',160000, 160015, 'https://www.postgresql.org/support/security/CVE-2026-16239/'),
1919-
('CVE-2026-16239', 8.8, 'Type confusion in cursor CLOSE + DECLARE executes arbitrary code via portal/cursor re-creation with different types',170000, 170011, 'https://www.postgresql.org/support/security/CVE-2026-16239/'),
1920-
('CVE-2026-16239', 8.8, 'Type confusion in cursor CLOSE + DECLARE executes arbitrary code via portal/cursor re-creation with different types',180000, 180005, 'https://www.postgresql.org/support/security/CVE-2026-16239/'),
1921-
('CVE-2026-19385', 8.8, 'pg_dump heap buffer overflow executes arbitrary code',150000, 150019, 'https://www.postgresql.org/support/security/CVE-2026-19385/'),
1922-
('CVE-2026-19385', 8.8, 'pg_dump heap buffer overflow executes arbitrary code',160000, 160015, 'https://www.postgresql.org/support/security/CVE-2026-19385/'),
1923-
('CVE-2026-19385', 8.8, 'pg_dump heap buffer overflow executes arbitrary code',170000, 170011, 'https://www.postgresql.org/support/security/CVE-2026-19385/'),
1924-
('CVE-2026-19385', 8.8, 'pg_dump heap buffer overflow executes arbitrary code',180000, 180005, 'https://www.postgresql.org/support/security/CVE-2026-19385/')
1897+
('CVE-2023-39417', 7.5, 'Extension script @substitutions@ within quoting allows SQL injection', 150000, 150004, 'https://www.postgresql.org/support/security/CVE-2023-39417/'),
1898+
('CVE-2023-39417', 7.5, 'Extension script @substitutions@ within quoting allows SQL injection', 160000, 160001, 'https://www.postgresql.org/support/security/CVE-2023-39417/'),
1899+
('CVE-2023-5869', 8.8, 'pg_dump integer overflow (32-bit builds) can execute arbitrary code at restore', 150000, 150005, 'https://www.postgresql.org/support/security/CVE-2023-5869/'),
1900+
('CVE-2023-5869', 8.8, 'pg_dump integer overflow (32-bit builds) can execute arbitrary code at restore', 160000, 160001, 'https://www.postgresql.org/support/security/CVE-2023-5869/'),
1901+
('CVE-2024-0985', 8.0, 'Non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL', 150000, 150006, 'https://www.postgresql.org/support/security/CVE-2024-0985/'),
1902+
('CVE-2024-0985', 8.0, 'Non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL', 160000, 160002, 'https://www.postgresql.org/support/security/CVE-2024-0985/'),
1903+
('CVE-2024-7348', 8.8, 'pg_dump --restore uses an invalid type OID, allowing arbitrary SQL execution from a crafted dump', 150000, 150008, 'https://www.postgresql.org/support/security/CVE-2024-7348/'),
1904+
('CVE-2024-7348', 8.8, 'pg_dump --restore uses an invalid type OID, allowing arbitrary SQL execution from a crafted dump', 160000, 160004, 'https://www.postgresql.org/support/security/CVE-2024-7348/'),
1905+
('CVE-2024-10979', 8.8, 'PL/Perl environment variable changes execute arbitrary code', 150000, 150009, 'https://www.postgresql.org/support/security/CVE-2024-10979/'),
1906+
('CVE-2024-10979', 8.8, 'PL/Perl environment variable changes execute arbitrary code', 160000, 160005, 'https://www.postgresql.org/support/security/CVE-2024-10979/'),
1907+
('CVE-2024-10979', 8.8, 'PL/Perl environment variable changes execute arbitrary code', 170000, 170001, 'https://www.postgresql.org/support/security/CVE-2024-10979/'),
1908+
('CVE-2026-6471', 7.2, 'Logical decoding can dlopen arbitrary file via choice of decoder plugin (REPLICATION privilege required)', 150000, 150019, 'https://www.postgresql.org/support/security/CVE-2026-6471/'),
1909+
('CVE-2026-6471', 7.2, 'Logical decoding can dlopen arbitrary file via choice of decoder plugin (REPLICATION privilege required)', 160000, 160015, 'https://www.postgresql.org/support/security/CVE-2026-6471/'),
1910+
('CVE-2026-6471', 7.2, 'Logical decoding can dlopen arbitrary file via choice of decoder plugin (REPLICATION privilege required)', 170000, 170011, 'https://www.postgresql.org/support/security/CVE-2026-6471/'),
1911+
('CVE-2026-6471', 7.2, 'Logical decoding can dlopen arbitrary file via choice of decoder plugin (REPLICATION privilege required)', 180000, 180005, 'https://www.postgresql.org/support/security/CVE-2026-6471/'),
1912+
('CVE-2026-16239', 8.8, 'Type confusion in cursor CLOSE + DECLARE executes arbitrary code via portal/cursor re-creation with different types', 150000, 150019, 'https://www.postgresql.org/support/security/CVE-2026-16239/'),
1913+
('CVE-2026-16239', 8.8, 'Type confusion in cursor CLOSE + DECLARE executes arbitrary code via portal/cursor re-creation with different types', 160000, 160015, 'https://www.postgresql.org/support/security/CVE-2026-16239/'),
1914+
('CVE-2026-16239', 8.8, 'Type confusion in cursor CLOSE + DECLARE executes arbitrary code via portal/cursor re-creation with different types', 170000, 170011, 'https://www.postgresql.org/support/security/CVE-2026-16239/'),
1915+
('CVE-2026-16239', 8.8, 'Type confusion in cursor CLOSE + DECLARE executes arbitrary code via portal/cursor re-creation with different types', 180000, 180005, 'https://www.postgresql.org/support/security/CVE-2026-16239/'),
1916+
('CVE-2026-19385', 8.8, 'pg_dump heap buffer overflow executes arbitrary code', 150000, 150019, 'https://www.postgresql.org/support/security/CVE-2026-19385/'),
1917+
('CVE-2026-19385', 8.8, 'pg_dump heap buffer overflow executes arbitrary code', 160000, 160015, 'https://www.postgresql.org/support/security/CVE-2026-19385/'),
1918+
('CVE-2026-19385', 8.8, 'pg_dump heap buffer overflow executes arbitrary code', 170000, 170011, 'https://www.postgresql.org/support/security/CVE-2026-19385/'),
1919+
('CVE-2026-19385', 8.8, 'pg_dump heap buffer overflow executes arbitrary code', 180000, 180005, 'https://www.postgresql.org/support/security/CVE-2026-19385/')
19251920
-- GENERATED cves END
19261921
),
19271922
running_version as (
@@ -1947,20 +1942,19 @@ where r.version_num >= c.affected_min
19471942
-- MEDIUM: Notable known bugs affecting the running PostgreSQL version. Curated
19481943
-- from https://www.postgresql.org/docs/release/: non-CVE fixes users hit in
19491944
-- production. affected_min/fixed_in are server_version_num integers.
1950-
-- operator-reported bug proves it deserves a permanent seat.
19511945
insert into health_results
19521946
with issue_data(issue_id, summary, affected_min, fixed_in, doc_link) as (
19531947
values
19541948
-- GENERATED bugs BEGIN (do not edit; regenerate via tools/generate_cve_sql.py)
1955-
('PG15-INSERT-CONFLICT-VISIBLE-01', 'INSERT ... ON CONFLICT can fail to enforce unique-constraint visibility checks in some MVCC edge cases',150000, 150001, 'https://www.postgresql.org/docs/release/15.1/'),
1956-
('PG15-BTREE-PAGE-LEAK-02', 'B-tree page deletion can leak pages on workloads with heavy concurrent UPDATEs',150000, 150002, 'https://www.postgresql.org/docs/release/15.2/'),
1957-
('PG15-LOGREP-SUBSCRIBER-CRASH-03', 'Logical replication subscriber can crash mid-transaction on large in-progress changes',150000, 150005, 'https://www.postgresql.org/docs/release/15.5/'),
1958-
('PG16-BTREE-CORRUPT-04', 'B-tree index page splits could corrupt the tree on high-concurrency inserts',160000, 160002, 'https://www.postgresql.org/docs/release/16.2/'),
1959-
('PG16-LOGICAL-DECODING-SUBXACT-05', 'Logical decoding can miss subtransaction changes for aborted DDL',160000, 160003, 'https://www.postgresql.org/docs/release/16.3/'),
1960-
('PG16-VACUUM-MEMORY-LEAK-06', 'Vacuum memory accounting leaks over many iterations of aggressive autovacuum',160000, 160005, 'https://www.postgresql.org/docs/release/16.5/'),
1961-
('PG17-COPY-PARTITION-ROUTING-07', 'COPY FROM routing into partitioned tables can drop rows under concurrent partition attach',170000, 170001, 'https://www.postgresql.org/docs/release/17.1/'),
1962-
('PG17-PG-CREATESUBSCRIBER-08', 'pg_createsubscriber can leave slots uninitialized, breaking logical failover on first switchover',170000, 170004, 'https://www.postgresql.org/docs/release/17.4/'),
1963-
('PG18-MERGE-UPSERT-VIEW-09', 'MERGE ... WHEN NOT MATCHED against an inheritance child can produce duplicate rows under concurrent INSERT',180000, 180001, 'https://www.postgresql.org/docs/release/18.1/')
1949+
('PG15-INSERT-CONFLICT-VISIBLE-01', 'INSERT ... ON CONFLICT can fail to enforce unique-constraint visibility checks in some MVCC edge cases', 150000, 150001, 'https://www.postgresql.org/docs/release/15.1/'),
1950+
('PG15-BTREE-PAGE-LEAK-02', 'B-tree page deletion can leak pages on workloads with heavy concurrent UPDATEs', 150000, 150002, 'https://www.postgresql.org/docs/release/15.2/'),
1951+
('PG15-LOGREP-SUBSCRIBER-CRASH-03', 'Logical replication subscriber can crash mid-transaction on large in-progress changes', 150000, 150005, 'https://www.postgresql.org/docs/release/15.5/'),
1952+
('PG16-BTREE-CORRUPT-04', 'B-tree index page splits could corrupt the tree on high-concurrency inserts', 160000, 160002, 'https://www.postgresql.org/docs/release/16.2/'),
1953+
('PG16-LOGICAL-DECODING-SUBXACT-05', 'Logical decoding can miss subtransaction changes for aborted DDL', 160000, 160003, 'https://www.postgresql.org/docs/release/16.3/'),
1954+
('PG16-VACUUM-MEMORY-LEAK-06', 'Vacuum memory accounting leaks over many iterations of aggressive autovacuum', 160000, 160005, 'https://www.postgresql.org/docs/release/16.5/'),
1955+
('PG17-COPY-PARTITION-ROUTING-07', 'COPY FROM routing into partitioned tables can drop rows under concurrent partition attach', 170000, 170001, 'https://www.postgresql.org/docs/release/17.1/'),
1956+
('PG17-PG-CREATESUBSCRIBER-08', 'pg_createsubscriber can leave slots uninitialized, breaking logical failover on first switchover', 170000, 170004, 'https://www.postgresql.org/docs/release/17.4/'),
1957+
('PG18-MERGE-UPSERT-VIEW-09', 'MERGE ... WHEN NOT MATCHED against an inheritance child can produce duplicate rows under concurrent INSERT', 180000, 180001, 'https://www.postgresql.org/docs/release/18.1/')
19641958
-- GENERATED bugs END
19651959
),
19661960
running_version as (

0 commit comments

Comments
 (0)