Disable btree index de-duplication support for the bpchar data type (Shihao Zhong, Peter Geoghegan) §

Index de-duplication is unsafe for bpchar because its notion of equality is weaker than bitwise equality. In particular, because bpchar equality ignores trailing spaces, values of different lengths can compare equal. De-duplication then allows index-only scans to return subtly wrong results.

This patch disables de-duplication for new index entries, but does nothing about possible corruption of existing entries. Therefore, users who have btree indexes on bpchar columns should REINDEX them after installing this update.

Note that this problem only applies to columns declared as bpchar, that is, lacking any length constraint. The more common usage of CHAR(n) is not at risk, even though it shares the same underlying code, because the length constraint forces otherwise-equal strings to have the same length and thus to be bitwise equal.

Ensure that VACUUM cleans up all dead tuples in a GIN index (Peter Geoghegan) § §

When a single VACUUM operation requires multiple index scans (because it is removing more tuples than it can hold in memory at once), it was possible to miss removing some index entries that should be removed. An additional bug involving a race with leaf page splits had the same effect. These bugs would eventually lead to a corrupt index with entries pointing at unrelated table rows. REINDEX is recommended if you suspect this has happened.

Fix GIN posting tree page deletion after an incomplete page split (Peter Geoghegan) §

The deletion step could incorrectly disconnect sibling pages, causing subsequent index searches to miss rows. REINDEX is recommended if you suspect this has happened.

Fix failure to update mutable pg_index fields for TOAST-table indexes (Bharath Rupireddy) §

REINDEX CONCURRENTLY can change these fields, but the relation cache was not expecting that, allowing index updates to be missed. The end result could be errors about “missing chunk number” due to missing index entries. Fortunately, these only represent index corruption; the TOAST table itself is fine, so a REINDEX will suffice to recover.

Perform join removal by editing the query's parse tree, rather than trying to fix up the planner's derived data structures (Tom Lane, Richard Guo, Shihao Zhong, Ayush Tiwari) § § § § § § § § §

The original implementation of join removal in the planner has had numerous bugs over the years, including some that were never fixed. It was inherently fragile because changes in the planner's derived data structures often required adjustments in join removal, yet there was no easy way to keep that code in sync. Replace it with code that modifies the far-simpler parse tree representation and then loops around to re-generate all of the derived data. This is a significant change that normally we'd never consider back-patching, but the prospect of continuing bugs from the old implementation has driven us to take the risk of doing so.

Fix assorted planner bugs triggered by lateral references (Richard Guo) § § § § § § § § § § §

These mistakes could lead to incorrect query plans causing wrong answers, or to internal planner errors such as “failed to build any N-way joins”.

Ensure proper placement of qual clauses containing PlaceHolderVars by assigning a relation ID to antijoins made from SubLinks (Richard Guo) §

This avoids edge cases where such a qual could be pushed into the right-hand side of the antijoin, giving it the opposite of the desired semantics.

Fix placement of PlaceHolderVars as nestloop parameters (Richard Guo) § §

In rare cases, planning could fail with “failed to assign all NestLoopParams to plan nodes”, “plan should not reference subplan's variable”, or “variable not found in subplan target list” errors.

Avoid planner failure for sort keys that are PlaceHolderVars (Richard Guo) § §

Depending on the plan shape selected, such cases could could produce wrong results, or could fail with “variable not found in subplan target lists”.

Fix incorrect dropping of outer join clauses after re-associating outer joins (Richard Guo, Nitin Motiani) §

Avoid “unsupported join alias expression” failures when a whole-row Var references a join and appears below an outer join (Richard Guo) §

Handle SubLinks correctly when expanding a whole-row join alias reference (Richard Guo) §

This oversight led to errors like “cannot handle unplanned sub-select” or “unrecognized node type”.

Do not perform self-join elimination with inheritance trees (Tender Wang) §

In traditional table inheritance, a unique index on the parent table isn't sufficient to prove uniqueness across its children too, so that the proof required for SJE isn't possible. Moreover, the code was willing to merge parent_table with parent_table ONLY, which doesn't even represent the same set of rows.

In self-join elimination, check that clauses used to prove uniqueness actually match (Tender Wang) §

Previously, this code assumed that equality clauses with the same operands were equivalent; but in fact they could use different equality operators, or more likely different collations.

Don't assume that DISTINCT ON ensures uniqueness of a subquery's output rows when the subquery's targetlist contains any set-returning functions (Richard Guo) §

This doesn't follow, because the set-returning functions may be evaluated after the de-duplication step.

Fix incorrect constant-folding of a JSON constructor with a RETURNING clause inside a simple-form CASE with a constant test expression (Richard Guo) §

Fix test for pushing WHERE clauses down past a grouping step that has a different equivalence rule (Richard Guo) §

The previous release cycle's fix for this situation misbehaved for some clauses involving CASE expressions.

Fix incorrect behavior of MIN()/MAX() index scans when query specifies FETCH ... WITH TIES (Chaitanya Choudhary) §

The WITH TIES option was accidentally copied into the sub-SELECT generated to perform the index scan, possibly triggering “more than one row returned by a subquery used as an expression” errors.

Use the correct collation when unique-ifying a semijoin's righthand side (Andrey Rachitskiy) §

This is an issue only if the join's comparison clause uses a non-deterministic collation, since all deterministic collations agree on string equality. But if it does, it was possible to produce incorrect results with too many rows.

Fix handling of disabled plan node types below single-child Append nodes (Tender Wang) §

The Append node failed to copy its child's disabled_nodes count, allowing it to possibly be chosen over other alternatives that contain no disabled nodes.

Acquire a predicate lock on conflicting rows during INSERT ... ON CONFLICT (Zsolt Parragi, Andrey Borodin) § §

Failure to do this resulted in incorrect behavior in serializable mode, allowing concurrent updates that should have failed with a serialization error.

Fix integer overflow during parallel GIN index build (Ewan Young) §

Index keys were stored in an interim data structure whose size field was only 16 bits, so that keys larger than 65535 bytes were truncated, resulting in crashes or corrupted index entries.

Fix incorrect multi-column RANGE partition pruning (David Rowley) §

When performing partition pruning with a RANGE partitioned table where pruning quals are only present for a leading prefix of the partition key, it was possible for partition pruning to prune away some partitions that shouldn't be pruned (leading to missing some rows that should be found) and/or include some partitions that were not needed.

Fix incorrect pruning of DEFAULT partitions in range-partitioned tables that use MINVALUE or MAXVALUE bounds (Ewan Young) §

In some cases the code would incorrectly conclude that the DEFAULT partition needn't be scanned, causing failure to find some rows that should match the query.

Fix mishandling of run-time partition pruning during EPQ rechecks (David Rowley, Zsolt Parragi) § §

This error could result in silently skipping rows that should be updated, as well as possible use-after-free accesses.

Don't use SubPlan-containing expressions in plan-startup-time partition pruning (Richard Guo) §

This avoids “SubPlan found with no parent plan” errors in edge cases.

Fix problems with queries applying multiple sort keys to a single column (David Rowley, Ayush Tiwari) § §

Some queries could crash the backend, while in other cases the additional sort specifications were ignored. Ordinarily such additional sort specifications are redundant anyway, since the first one would fully determine the result ordering. However, this is not necessarily so with non-deterministic collations, or with queries using different ORDER BY operators.

Avoid possible re-use of stale hash tables when a hashed SubPlan is referenced in multiple places (Rahul Yadav) § §

Ensure that Memoize plan nodes use the correct input collation (Shihao Zhong) §

This matters only when using non-deterministic collations.

Fix wrong results from Memoize plans when a Param is a subexpression of a cache key (Richard Guo) § §

Fix loss of parallel worker statistics for Memoize plan nodes underneath a Gather (Tatsuya Kawata) §

Only the statistics since the last rescan of the Gather were reported by EXPLAIN ANALYZE.

Don't create a shell type if a function definition specifies an unknown return type name with array or type modifier syntax (Heikki Linnakangas) §

Such cases are surely errors, since you should create the type before doing anything advanced with it.

Fix snapshot export and import to work properly on a snapshot taken during recovery (Peter Geoghegan, Bertrand Drouvot) §

The data layout is different in such a snapshot, but the export/import logic didn't know that, so that the imported snapshot behaved incorrectly. This led not only to wrong answers within the importing transaction, but possibly to persistent data corruption due to it setting hint bits incorrectly.

This bug is known to be triggered by parallel pg_dump, when run on a standby server. In that context it could corrupt both the dump output and the standby server's data.

Fix atomicity problem in transaction snapshot import (Chee Wooson) §

There was a window in which onlookers might not see the source transaction as still running, possibly allowing wrong decisions by VACUUM for example.

Fix import of statistics for columns that are domains over range types, multirange types, or tsvector (Michael Paquier) §

The restore logic failed to look through the domain while checking applicability of statistics types that are for these data types.

Fix double parse transformation of PASSING arguments in JSON_TABLE (Ayush Tiwari, Amit Langote) §

This mistake caused unexpected failures such as “unexpected non-SELECT command in SubLink”.

Fix failure to assign collations to PASSING expressions in JSON_TABLE (Venu Kummari) §

This oversight could result in wrong answers or “could not determine which collation to use for string comparison” errors.

Fix usage of toasted text values in the PASSING arguments of JSON_TABLE and related functions (Chaitanya Choudhary, Shihao Zhong) §

The code failed to apply detoasting, resulting in incorrect output.

Fix NULL result persistence in JSON_VALUE() RETURNING json/jsonb (Srinath Reddy Sadipiralla) §

Once JSON_VALUE(... RETURNING ...) with a json or jsonb result value returned NULL, every later evaluation of the same expression in the same statement also returned NULL, whether it should or not.

Fix ON EMPTY/ERROR result persistence in JSON_VALUE and related constructs (Jian He, Andrey Rachitskiy) §

A NULL input could result in returning the value of the previous row's ON EMPTY / ON ERROR expression.

Fix handling of failures in DEFAULT expressions in SQL/JSON operations (Jian He) §

An error arising while executing a DEFAULT expression could be ignored, instead producing a NULL result.

Fix handling of domain coercion failures in SQL/JSON operations (Jian He) §

SQL/JSON query functions could throw an error, or report the wrong one, in cases where an ON ERROR or ON EMPTY clause specified some non-error behavior.

Fix GIN index searches for plain scalar strings in strict jsonpath queries (Rui Zhao) §

A jsonb_ops index scan for a jsonpath such as strict $ == "scalar" failed to find table entries that were simply "scalar".

Fix errors in extraction of GIN index scan conditions from jsonpath queries (Tom Lane) §

An AND operator underneath a NOT operator could be misimplemented. Also a method applied to a literal constant, for example "42".double(), was not handled correctly. These mistakes did not cause visible errors, but the GIN index search would miss some or all of the rows that should match.

Fix edge-case error in SP-GiST quad tree <@ searches (John Naylor) §

Due to roundoff error, the search might sometimes not descend into a quadrant that it needs to search, leading to incomplete query results.

Fix edge-case failures in SP-GiST quad-tree indexes (Ayush Tiwari) §

Roundoff errors could allow searches and insertions to fail with “getQuadrant: impossible case” errors.

Accept empty tsquery values in binary input (Ayush Tiwari) §

An empty tsquery value is allowed elsewhere, but tsqueryrecv() failed.

Disallow zero-length lexemes and out-of-range phrase distance values during binary input of tsquery values (Tom Lane) §

These cases were already rejected during text input, but tsqueryrecv() omitted making equivalent checks. That allowed accepting values that would fail subsequent dump/reload.

Treat operators-nested-too-deeply errors as soft errors in tsquery input and ltxtquery input (Tom Lane) §

Consistently enforce maximum lengths in tsvector and tsquery (Tom Lane) §

Some places thought the maximum lexeme length was MAXSTRLEN (2047), while others thought it was MAXSTRLEN-1. Fortunately, the looser bound is correct, so make them all use MAXSTRLEN. Likewise, some places were stricter than others about the total data length limit, MAXSTRPOS. These fixes avoid situations where a validly-constructed value would fail dump/reload.

Fix right() with a length argument of INT_MIN (-2147483648) (Ewan Young) §

Due to integer overflow, the function returned the whole string when it should return an empty string.

Fix pg_blocking_pids() to account correctly for relation extension locks (Bertrand Drouvot) §

Fix 32-vs-64-bit confusion in pg_indexam_progress_phasename() (Markos Fountoulakis) §

This function accidentally worked on common hardware, but could misbehave on 32-bit or big-endian platforms.

Detect integer overflow in to_char() with V format (Andrey Rachitskiy) §

If the data value is an integer, and multiplying it by the power of ten implied by the V format causes integer overflow, to_char() silently emitted incorrect digits. Throw an integer overflow error instead.

Avoid integer overflow while calculating BRIN minmax_multi distances for tid values (Tomas Vondra) §

Very large tid values could result in negative distances, which would end in making the index inefficient, though not actually corrupt.

Avoid overflow while calculating BRIN minmax_multi distances for numeric values, and handle NaNs properly (Kirill Reshke, Tomas Vondra) §

These oversights could result in errors being thrown (preventing index summarization), or in inefficient indexes.

Avoid overflow when computing differences for numeric ranges (Kirill Reshke) §

In this context we want to return plus or minus infinity rather than throwing an overflow error.

Support out-of-order FLAG lines in Hunspell affix files (Ewan Young) §

Hunspell affix files usually put the FLAG line first, and our implementation silently depended on that. If it came after some lines whose meaning depends on the FLAG setting, the result would be crashes or failures to match compound words. Fix the logic so that the FLAG line can be anywhere.

Fix OLD/NEW aliases that EXPLAIN prints in RETURNING SubPlans (Henson Choi) § §

In plans involving multiple aliases, the wrong one could be printed, resulting in confusing output.

Fix assorted errors in rule deparsing (Henson Choi) § § § §

Always print AS before a target-relation alias in UPDATE, DELETE, or MERGE, to avoid ambiguity if that alias is set. Also ensure that xml IS DOCUMENT constructs and subquery left-hand arguments are adequately parenthesized. Also fix deparsing of AT TIME ZONE and similar constructs in a view's FROM clause; these need to be wrapped in a no-op CAST. These errors could prevent dump restoration due to a syntax error in a view, or even cause views to be parsed as something unintended.

Fix parser failure when a multi-row INSERT ... VALUES has a sub-SELECT in a target column subscript (Amit Langote) §

This led to “unexpected non-SELECT command in SubLink”.

Fix missed preprocessing of WHERE clauses in COPY FROM (Nathan Bossart) §

This oversight led to “cache lookup failed for function 0” errors with negated operators, and probably in other cases as well.

Disallow NOT NULL NO INHERIT constraints on partitioned tables (David Rowley, Nitin Motiani) §

This was already rejected by plain CREATE TABLE, but cases such as CREATE TABLE LIKE missed making the check, potentially allowing a partition to contain null values when it should not.

Fix test for an existing NOT NULL constraint in ALTER TABLE ADD PRIMARY KEY (Fujii Masao, Manuel Reyes Bravo) §

Previously, dropping a NOT NULL column, adding a new column with the same name, and making it a primary key in a single ALTER TABLE command could fail with “primary key column ... is not marked NOT NULL”.

Fix concurrent delete handling in MERGE ... WHEN NOT MATCHED BY SOURCE (Tender Wang) §

When executing a WHEN NOT MATCHED BY SOURCE action in MERGE, if the tuple from the target table was concurrently deleted, the retry code would incorrectly execute a WHEN NOT MATCHED BY TARGET action for the row instead, giving incorrect results.

Fix race conditions with DROP TABLESPACE (Ayush Tiwari) §

A DROP executed concurrently with commands that attempt to add new objects to the tablespace could end with inconsistent catalog contents.

Cleanly reject operations on unlogged tables during recovery (Jim Jones) § §

An unlogged table will have no data on a standby, so reading it must fail. Most operations give an appropriate error for this, but COPY ... TO failed with an internal “could not open file” error, as did currtid2().

Fix inconsistent permissions checking for role membership changes (ChangAo Chen) §

This fixes cases where what should be a permissions failure was reported as an internal “no possible grantors” error.

Revert previous changes to free space map persistence (Alexander Korotkov) §

Commits c06d1a4ba et al. (included in the May 2026 releases) turned out to cause more trouble than they fixed.

Avoid backend hang during temporary table cleanup at exit, if the default transaction mode is SERIALIZABLE READ ONLY DEFERRABLE (Andrey Rachitskiy) §

Cleanup would block until concurrent serializable transactions complete, which could be indefinitely if some of them are prepared transactions.

Avoid crash when describing a FETCH statement whose cursor is gone (Dirkjan Bussink) §

Fix memory accounting for datum sorts on pass-by-reference data types (Mario Karuza) §

This error could lead to failure to enforce work_mem limits correctly, or to misleading output from EXPLAIN ANALYZE.

If a vacuum delay sleep is requested while holding locks, don't sleep (Kevin Rocker, Andrey Borodin, Mostafa) §

Also, move several existing delay calls to points where it's actually safe to sleep.

Fix parallel vacuum I/O timing reports (Bharath Rupireddy) §

VACUUM VERBOSE and autovacuum logs included parallel workers' blocks-read and blocks-dirtied counts, but not the time they spent doing that I/O.

Avoid freeing the plan for a foreign-key enforcement query if the plan is still in use (Lucas Jeffrey, Trakshan Mishra, Amit Langote) §

It was possible to reach this behavior in contrived cases, such as a self-referencing ON DELETE CASCADE foreign key on tables with triggers that perform DML.

Fix postmaster failing to exit when the startup subprocess crashes during crash restart (Zexin Li) §

The postmaster should give up and quit in this case, but it failed to do so, instead becoming stuck.

Be more wary about scanner failures when parsing a GUC file (Michael Paquier) §

Recheck oauth_validator_libraries during OAuth authentication (Zsolt Parragi) § §

This addition ensures that changes to oauth_validator_libraries are enforced immediately. Previously, if such a change made an existing oauth line in pg_hba.conf invalid, the new setting was not enforced until that situation was fixed.

Fix postmaster crash when oauth_validator_libraries is set to a string containing only whitespace (Grigorev Jurij, Zsolt Parragi) § § § §

Fix WAL-logging of multi-level page deletion in btree indexes (Peter Geoghegan) §

The WAL log could contain stale values for a to-be-deleted page's sibling links, resulting in complaints on standby servers if wal_consistency_checking is enabled. Barring a crash, the damage would shortly be repaired by completion of the deletion action, so that this error was usually only cosmetic.

Avoid overly-strong WAL consistency check on buffers that are only pinned not locked (Greg Burd, Thomas Munro) §

A buffer that is not locked could be concurrently changed by other processes, so that the image captured for consistency checking is not self-consistent, leading to “incorrect resource manager data checksum in record” failures on standbys.

Ensure that state files for pending prepared transactions are written out atomically during a checkpoint (Shihao Zhong) §

Previously it was possible for a crash to leave an invalid state file behind, causing subsequent database startup to fail.

Do not start a checkpoint in the middle of aborting a prepared transaction (Shihao Zhong) §

A crash would allow the transaction to be committed afterwards, leading to inconsistent state.

Do not start a checkpoint in the middle of creating a multixact (Shihao Zhong) §

This avoids possible data loss after a subsequent crash.

Fix possible loss of tuples updated by later-aborted subtransactions (Shihao Zhong, Michael Paquier) §

A table rewrite (for example, CLUSTER or VACUUM FULL) could discard such tuples as invalid.

Do not lose tuple's tid when storing it into a tuple table slot (Virender Singla, Greg Burd) §

Some code paths neglected to copy the tid field, which could lead to data corruption or wrong query answers in unusual cases.

Avoid race condition in marking a partitioned index valid (Andrey Borodin, Kirill Reshke) §

This could, for example, cause parallel pg_restore to fail due to trying to recreate foreign key constraints too soon.

Fix checks for an aborted updating transaction in multixids (Chee Wooson) §

Known consequences of this coding error include unexpected “new multixact has more than one updating member” errors, as well as incorrect failures to update a row.

A hash index scan that starts during a bucket split could miss some index entries (Peter Geoghegan, Amit Kapila) §

Fix incorrect position tracking in TID Range Scans (Ewan Young, David Rowley) §

Sequences involving fetching backwards and then forwards again could fail to scan all the way to the end of the range.

Avoid unnecessary buffer locking when recovery replays freeze-only and VM-only WAL records (Melanie Plageman) §

This prevents unnecessary replay delays and cancellations of standby queries.

Avoid reading a potentially-torn copy of the pg_control file for base backups (David Steele) § §

A concurrent write to the file could result in including inconsistent data in the backup.

Prevent making incorrect copies of non-relation files in base backups (David Steele) §

Files that routinely get replaced by atomic renames, such as postgresql.auto.conf, could be truncated or zero-padded in a backup made concurrently with such a replacement.

Ensure that base backups report checksum failures affecting single pages (Zsolt Parragi) §

Due to a logic error, checksum failures were counted in pg_stat_database only when more than one page in the same file was corrupt.

Fix stale visibility maps in incremental backups after heap truncation (Ke, Fujii Masao, Shihao Zhong) §

An incremental backup taken after VACUUM truncates a table can restore stale visibility map bits when both data checksums and wal_log_hints are disabled, leading to data corruption.

This fix does not correct existing WAL summaries, therefore incremental backups taken after updating can still be affected. It's recommended that users of incremental backups take a new full backup after updating and use it as the basis for subsequent incremental backups.

Reject incremental backups based on a backup from a divergent history (Sai Pranav, Fujii Masao) §

After a failover, an incremental backup could accept a prior backup whose WAL range extends beyond the point where the new primary left the old timeline. Combining these backups could retain pages from the abandoned history, producing a corrupt backup.

Ensure that incremental backup merges WAL summaries in LSN order (Ke, Fujii Masao) §

This error could result in stale data being included in a combined backup.

Fix erroneous edge-case decisions about when to include WAL summaries in incremental backups (Ayush Tiwari) §

This error could result in stale data being included in a combined backup.

Avoid resetting a replication subscription's two_phase state to pending if it is already enabled (Zhijie Hou) §

Executing ALTER SUBSCRIPTION ... SET (two_phase = true) twice resulted in confused state, potentially allowing data corruption on the subscriber.

Verify the syntax of the output_plugin_libraries parameter when a value is assigned (Jacob Champion, Hayato Kuroda) §

Previously, a syntactically-incorrect value could be put into postgresql.conf, causing logical replication to fail.

Reject REPLICA IDENTITY USING INDEX if a key column has an unvalidated NOT NULL constraint (Ante Kresic) §

A replica identity key must be not-null, but this code path would accept cases where that was not yet known to be true.

Fix logical replication with a lossy identity index (Paul A. Jungwirth, Zhijie Hou) §

Typically identity indexes are btrees, which deliver exact results. However, GiST indexes on multiranges can be used as identity indexes, and they deliver results that require rechecking. Logical replication failed to perform the recheck, so that updates and deletes could target the wrong row on the subscriber.

Avoid incorrect update of backend status flags during replication slot invalidation (Vlad Lesin) §

An invalidation done by an auxiliary process such as the checkpointer could clobber the status field of an unrelated backend. The consequences of this are difficult to predict, but one possibility is that hot standby feedback could be effectively disabled.

In logical replication, handle subtransaction aborts better (Bingshuai Li, Hayato Kuroda, Zhijie Hou) §

If a subtransaction that made a catalog update aborts, logical decoding mistakenly still believed that the update was effective, potentially causing incorrect decoding output.

Avoid race condition when building an initial decoding snapshot (Antonin Houska, Rui Zhao) §

There was a small risk of data corruption from using a snapshot that includes transactions that have committed but not yet set their CLOG status.

In logical decoding, avoid processing a stream abort event for a subtransaction that was never actually streamed (Andrey Rachitskiy) §

This error could lead to null pointer dereferences or other misbehavior.

Avoid null-pointer crash with missing replication option values in pgoutput logical replication sender (Zhijie Hou) §

Fix small memory leak in pgoutput with streamed prepared transactions (Ayush Tiwari) §

Fix lost wakeups in physical WAL senders (Alex Speller) §

This fix corrects some cases where a WAL sender process could sleep even though there is data waiting to be sent.

Fix duplicate creation of temporary replication slot when a WAL receiver follows a timeline switch (ChangAo Chen) §

This mistake led to a “could not create replication slot” error followed by a restart of the WAL receiver, which would then recover, so there was no permanent damage.

Fix race condition between logical replication subscriber and concurrent index DDL (Mikhail Nikalayeu, Vignesh C) §

Changing the state of a replication target relation's primary key or replica identity index could cause the replication apply logic to miss finding a matching row (but only once per such event).

Fix incorrect LSNs in WAL decoding error messages (Rahul Yadav) §

These error messages reported the LSN of a WAL record that wasn't the one they were actually complaining about.

Don't allow REPLICA IDENTITY FULL lookups to select invalid indexes (Mikhail Nikalayeu) §

Previously, logical replication could try to use an index left behind by a failed CREATE INDEX CONCURRENTLY, leading to wrong results since the index is likely incomplete.

Fix potential use-after-free cases in WAL sender (Ayush Tiwari) §

Avoid use-after-free in jsonb_set_lax() (John Naylor) §

Fix double-free when XMLSERIALIZE(... INDENT) output exceeds 1GB (Jim Jones) §

Fix null-pointer dereferences that could occur when a schema is concurrently dropped (Baji Shaik) §

Avoid null-pointer crash in logical subscription refresh when a relevant relation is concurrently dropped (Satyanarayana Narlapuram, Bharath Rupireddy) §

Fix possible null-pointer dereference when building extended statistics on expressions (Shihao Zhong, Michael Paquier)

This error was reachable only with unexpected (but legal) behavior of a custom typanalyze function.

Fix possibly-stale values of pg_locks.waitstart (Shihao Zhong) §

Harden pgstats code against partially-completed local pgstats entries (Michael Paquier) §

Fix cleanup of reused pgstats entries (Michael Paquier) §

This error led to leakage of pgstats entries, which could result in errors at backend exit or database shutdown.

Fix memory leaks caused by not releasing all data associated with a WAL reader (Tomás Senart) §

In many cases this oversight did little harm because the containing memory context would soon be reset or deleted. However there are cases where it could cause long-lived memory bloat, notably in the checkpointer process.

Avoid memory bloat while computing ndistinct extended statistics across many columns (Ilia Evdokimov) §

Fix buffer pin leak after a failed hash index bucket split cleanup (Peter Geoghegan) §

This coding error resulted in nothing worse than warnings about resource leakage.

Ensure all relations opened for AFTER triggers are closed again (Hayato Kuroda, David Rowley) §

This oversight triggered “resource was not closed” warnings, but nothing more serious than that.

Fix io_uring resource leakage across crash restarts (Lucas Draescher) §

Eventually, a restart would fail with “too many open files” or a similar error, at which point the postmaster would exit and the resources would be released. This is only an issue when using io_method=io_uring, which is not the default.

Fix PL/pgSQL's handling of anycompatiblemultirange arguments and results (Jeevan Chalke) §

This type had not been added to PL/pgSQL's knowledge of polymorphic types, resulting in errors when trying to create or use a function declared with it.

Harden PL/Perl and associated contrib modules against “tied” Perl hashes and arrays (Tom Lane) § §

Rely on av_count() to decide the length of a Perl array, rather than looking for a null pointer; and contrarily be more wary about unexpected null value pointers from array and hash fetches. These cases are only known to arise in connection with “tied” objects.

Avoid memory leakage in libpq with repeated GSS connections (Matt Carter, Tom Lane) §

Avoid incorrect behavior when getopt_long() rearranges a program's command line arguments (Sehrope Sarkuni) §

For example, vacuumdb postgres --jobs took postgres as the number of jobs instead of complaining that --jobs is missing its argument.

Fix psql's display of REPLICA IDENTITY NOTHING table properties (Shinya Kato) §

Ensure that psql counts all the COPY FROM STDIN commands appearing in a multi-query command string (Zsolt Parragi) §

Since the fix for CVE-2026-6464, psql would reject multiple COPY FROM STDIN commands appearing in a single string, because it was not expecting more than one COPY operation to occur.

Prevent psql from getting confused if the argument of \getresults is invalid (Fujii Masao) §

Make psql cope better with out-of-memory conditions during backslash command processing (Fujii Masao) § §

Fix some small memory leaks in psql (Fujii Masao) §

Fix pg_basebackup's incorrect progress reporting for incremental backups (Daria Lepikhova) §

In pg_combinebackup, reject out-of-range block numbers in incremental backup files (Peter Eisentraut) §

This omission meant that pg_combinebackup could crash on corrupted input.

Make pg_dump dump column statistics targets for indexes backing constraints (Zsolt Parragi) §

Formerly pg_dump would emit ALTER INDEX ... SET STATISTICS commands when needed for plain indexes, but not for indexes created via UNIQUE or PRIMARY KEY syntax.

In pg_dump's tar-format output, don't put invalid \restrict/\unrestrict commands into the restore.sql tar member (Pavel Kopylov) §

Make pg_walsummary's --quiet switch suppress limit block output (Koshi Shibagaki) §

Make reindexdb error out cleanly if an index-level REINDEX CONCURRENTLY is requested with multiple jobs (Kirill Reshke) §

Previously, this combination of options would lead to a server-side error, complaining that REINDEX CONCURRENTLY cannot run within a transaction block.

Fix contrib/file_fdw to not crash in ANALYZE when the table has column default clauses (Fujii Masao) §

Fix possible index corruption in contrib/pg_trgm GiST indexes (Nate Clark) §

Combination of index entries could lose the flag identifying their format, so that subsequent index searches could miss matching rows.

This fix does not repair existing indexes. Users should REINDEX existing gist_trgm_ops indexes after updating.

Fix error check in timer setup on Windows (Sehrope Sarkuni) §

Failure to create a thread to manage timeouts was not detected, leading to silent failure of subsequent timeout requests.

Use a non-locking initial test in TAS_SPIN on AArch64 (Nathan Bossart)

This code change has been shown to improve performance on many-core AArch64 machines while not hurting performance on smaller ones; moreover, it avoids a performance regression with newer Linux kernels.

Update time zone data files to tzdata release 2026f (Tom Lane) § § §

Canada's Northwest Territories will be on year-round UTC-06 (effectively, permanent DST) beginning in November 2026. This affects only America/Inuvik as the rest of the territory is covered by America/Edmonton, for which the equivalent change was released in 2026c. Similarly, Manitoba (America/Winnipeg) will move to year-round UTC-05. For now assume their TZ abbreviations will be CST and EST respectively.

Cuba did not fall back on 2026-11-01; they will stay on DST this winter (but apparently plan to revert to normal next year).

The backward-compatibility zone names EST5EDT, CST6CDT, MST7MDT, and PST8PDT now have simpler behavior for old time stamps. They use the indicated UTC offsets and TZ abbreviations indefinitely far back, rather than allowing aspects of the associated city-named zone's historical behavior to leak through. This conforms better to POSIX.

Historical corrections for Brazil, Colombia, Iran, and Ireland.

On Windows, initdb will now recognize the new time zone names that Microsoft has devised for the updated Canadian zones.