Upgrade to release 18.6. It does not require a dump/restore when
upgrading from another 18.x release. However, it brings numerous
security fixes and the first three security entries below describe
configuration adjustments and data cleanups that you may need to
make after updating:
- Restrict logical decoding output plugins to the set specified by
a new server parameter output_plugin_libraries (Jacob Champion)
The PostgreSQL Project thanks Shishir Sharma for reporting
this problem. (CVE-2026-14663)
- Fix psql to skip in-line data following a scripted COPY ... FROM
STDIN command, even if the COPY fails before sending
PGRES_COPY_IN (Tom Lane)
The PostgreSQL Project thanks Alexander Lakhin for
reporting this problem. (CVE-2026-6464)
- Cross-check the output row type of a portal running EXECUTE or
FETCH (Robert Haas)
The PostgreSQL Project thanks Ben Morris (in collaboration with
Claude and Anthropic Research) and Peter Geoghegan for reporting
this problem. (CVE-2026-16239)
- Fix buffer overrun in regexp match/split functions (Masahiko
Sawada)
The PostgreSQL Project thanks Francesco Verardi for reporting
this problem. (CVE-2026-14664)
- Fix various places that mistakenly assumed they would not have
to deal with more than FUNC_MAX_ARGS function arguments
(Tom Lane)
The PostgreSQL Project thanks Zheng Yu, ylwangtju, and Masahiko
Sawada for reporting these problems. (CVE-2026-14679)
For more details and the full changelog have a look at:
https://www.postgresql.org/docs/release/18.6/
Note: 18.5 was never released, due to a regression discovered
post-wrap.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
