postgresql: updated to 18.6, 17.11, 16.15, 15.19, 14.24
PostgreSQL 18.6, 17.11, 16.15, 15.19, 14.24
Security Issues
The following security vulnerabilities are closed across in this update release. You can find more details about the vulnerabilities and their affected versions in the links below:
CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (CVSS v3.1: 8.1)
CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (CVSS v3.1: 3.8)
CVE-2026-6470: Fails to check type USAGE privilege (CVSS v3.1: 4.3)
CVE-2026-6471: Logical decoding can dlopen arbitrary file (CVSS v3.1: 7.2)
CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (CVSS v3.1: 8.8)
CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (CVSS v3.1: 6.5)
CVE-2026-14664: Regexp heap buffer overflow executes arbitrary code (CVSS v3.1: 8.8)
CVE-2026-14666: Row security caching disregards role modifications (CVSS v3.1: 4.2)
CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (CVSS v3.1: 8.1)
CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (CVSS v3.1: 8.8)
CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (CVSS v3.1: 8.8)
[19 lines not shown]
[flang] Add warning when BOZ literal is too large for assignment (#210749)
Generate a warning when a BOZ literal assignment does not fit into the
left-hand side variable.
AI use disclaimer: Github CoPilot assisted with this PR. I manually
reviewed and tested the code.
Co-authored-by: John Otken john.otken at hpe.com
---------
Co-authored-by: John Otken <john.otken at hpe.com>
devel/jujutsu: update to version 0.44.0
This update stabilizes the support for fetching and pushing tags.
Tags can be tracked or untracked just like bookmarks. Tracked tags are
pushed by default.
There are many new features and bug fixes and some breaking changes.
For the complete list of changes see:
https://github.com/jj-vcs/jj/releases/tag/v0.44.0
devel/jujutsu: update to version 0.44.0
This update stabilizes the support for fetching and pushing tags.
Tags can be tracked or untracked just like bookmarks. Tracked tags are
pushed by default.
There are many new features and bug fixes and some breaking changes.
For the complete list of changes see:
https://github.com/jj-vcs/jj/releases/tag/v0.44.0
databases/kyotocabinet: fix missing prototype warnings
No upstream response in 14 days, let's get this locally, because
else we get all sort of warnings in downstream ports using kc.
PR: 296665
Approved by: sunpoet (maintainer timeout)
MFH: 2026Q3
(cherry picked from commit 76a04c511595baf51d75ec318be553ef827205ef)
databases/kyotocabinet: fix missing prototype warnings
No upstream response in 14 days, let's get this locally, because
else we get all sort of warnings in downstream ports using kc.
PR: 296665
Approved by: sunpoet (maintainer timeout)
MFH: 2026Q3
databases/kyotocabinet: fix missing prototype warnings
No upstream response in 14 days, let's get this locally, because
else we get all sort of warnings in downstream ports using kc.
PR: 296665
Approved by: sunpoet (maintainer timeout)
MFH: 2026Q3
Add John McCall as Swift conformance maintainer (#216041)
We've had a small number of PRs and issues come up that touch on Swift,
so this adds John as the point of contact for Swift related concerns as
they come up in Clang.
Update to samba-4.24.6
Changes: https://www.samba.org/samba/history/samba-4.24.6.html
Minor of libndr needs a minor bump because of the addition of symbol.
Tested and OK Ian McWilliam <kaosagnt AT gmail DOT com> (co-maintainer)
Update to samba-4.24.6
Changes: https://www.samba.org/samba/history/samba-4.24.6.html
Minor of libndr needs a minor bump because of the addition of symbol.
Tested and OK Ian McWilliam <kaosagnt AT gmail DOT com> (co-maintainer)
[ORC] Give the SPS controller interface a home in OrcShared (#216275)
The proxy specs in Orc/RTBridge/SPS fused the wire contract (an
operation's controller-interface symbol name and SPS signature) with the
controller-side machinery that calls it. This was dragging Orc Core APIs
(e.g. ExecutionSession) into the OrcTargetProcess library via
OrcRTBootstrap.cpp.
Fix this by introducing Orc/Shared/SPSCI, holding one descriptor per
operation:
struct MemWriteUInt8s {
static constexpr char Name[] = "orc_rt_ci_sps_mem_write_uint8s";
using SPSSig = void(SPSSequence<SPSMemoryAccessUInt8Write>);
};
The filenames mirror orc-rt/include/orc-rt/sps-ci/*SPSCI.h, so the two
sides of each contract pair up by name. ProxySpec now takes a descriptor
in place of a signature and a name pointer:
[12 lines not shown]
[AMDGPU] Skip pointer users with no uses when preloading kernel args (#216281)
A dead GEP has no users, so dereferencing user_begin() looking for a
load hits the end iterator and asserts
