PostgreSQL 13.1, 12.5, 11.10, 10.15, 9.6.20, and 9.5.24
Security Issues
* CVE-2020-25695: Multiple features escape "security restricted operation" sandbox
* CVE-2020-25694: Reconnection can downgrade connection security settings
* CVE-2020-25696: psql's \gset allows overwriting specially treated variables
Bug Fixes and Improvements
This update also fixes over 65 bugs that were reported in the last several months. Some of these issues only affect version 13, but may also apply to other supported versions.
Some of these fixes include:
Fix a breakage in the replication protocol by ensuring that two "command completion" events are expected for START_REPLICATION.
Ensure fsync is called on the SLRU caches that PostgreSQL maintains. This prevents potential data loss due to an operating system crash.
Fix ALTER ROLE usage for users with the BYPASSRLS permission.
ALTER TABLE ONLY ... DROP EXPRESSION is disallowed on partitioned tables when there are child tables.
Ensure that ALTER TABLE ONLY ... ENABLE/DISABLE TRIGGER does not apply to child tables.
Fix for ALTER TABLE ... SET NOT NULL on partitioned tables to avoid a potential deadlock in parallel pg_restore.
Fix handling of expressions in CREATE TABLE LIKE with inheritance.
DROP INDEX CONCURRENTLY is disallowed on partitioned tables.
Allow LOCK TABLE to succeed on a self-referential view instead of throwing an error.
Several fixes around statistics collection and progress reporting for REINDEX CONCURRENTLY.
Ensure that GENERATED columns are updated when any columns they depend on are updated via a rule or an updatable view.
Support hash partitioning with text array columns as partition keys.
Allow the jsonpath .datetime() method to accept ISO 8601-format timestamps.
During a "smart" shutdown, ensure background processes are not terminated until all foreground client sessions are completed, fixing an issue that broke the processing of parallel queries.
Several fixes for the query planner and optimizer.
Ensure that data is de-toasted before being inserted into a BRIN index. This could manifest itself with errors like "missing chunk number 0 for toast value NNN". If you have seen a similar error in an existing BRIN index, you should be able to correct it by using REINDEX on the index.
Fix the output of EXPLAIN to have the correct XML tag nesting for incremental sort plans.
Several fixes for memory leaks, including ones involving RLS policies, using CALL with PL/pgSQL, SIGHUP processing a configuration parameter that cannot be applied without a restart, and an edge-case for index lookup for a partition.
libpq can now support arbitrary-length lines in the .pgpass file.
On Windows, psql now reads the output of a backtick command in text mode, not binary mode, so it can now properly handle newlines.
Fix how pg_dump, pg_restore, clusterdb, reindexdb, and vacuumdb use complex connection-string parameters.
When the \connect command of psql reuses connection parameters, ensure that all non-overridden parameters from a previous connection string are also re-used.
Ensure that pg_dump collects per-column information about extension configuration tables, avoiding crashes when specifying --inserts.
Ensure that parallel pg_restore processes foreign keys referencing partitioned tables in the correct order.
Several fixes for contrib/pgcrypto, including a memory leak fix.
40241177fe