PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 Released (postgresql.org)

61 pointsby plaur7823 hours ago7 comments

ianberdin 4 minutes ago

Looking at all these security patches reminded me of when I was a kid and I thoroughly cleaned my apartment, wiped away every bit of dust in every single crevice, and then a couple of days later it was all back again. And I thought: am I really going to be doing this my whole life?

zulux 2 hours ago

Mega patches like this, in my opinion, should be treated as mandatory patches. If I were trying to get a significant security update into the field in the age of LLM drama, this is how I would do it.

ltbarcly3 an hour ago

So you're in favor of applying security patches? Controversial opinion.

fock an hour ago

then, what would you do if you were an adversary trying to push your xz-style vulnerability to every place known to man?

levkk 32 minutes ago

Most databases run offline and don't allow arbitrary SQL statements. SQL injections are generally eliminated by using the extended protocol.

So, yes, if you're running multi-tenant Postgres as a public service, you should upgrade. Everyone else is in no rush.

perlgeek 11 minutes ago

No rush, but don't wait too long either.

Yes, the application above it should prevent SQL injection, but if it's imperfect, you don't want an attacker to turn SQL injection into RCE.

simonw an hour ago

"This release fixes 52 security vulnerabilities and over 140 bugs reported over the last several months."