Disable btree index de-duplication support for the bpchar data type (Shihao Zhong, Peter Geoghegan) §

Index de-duplication is unsafe for bpchar because its notion of equality is weaker than bitwise equality. In particular, because bpchar equality ignores trailing spaces, values of different lengths can compare equal. De-duplication then allows index-only scans to return subtly wrong results.

This patch disables de-duplication for new index entries, but does nothing about possible corruption of existing entries. Therefore, users who have btree indexes on bpchar columns should REINDEX them after installing this update.

Note that this problem only applies to columns declared as bpchar, that is, lacking any length constraint. The more common usage of CHAR(n) is not at risk, even though it shares the same underlying code, because the length constraint forces otherwise-equal strings to have the same length and thus to be bitwise equal.

Ensure that VACUUM cleans up all dead tuples in a GIN index (Peter Geoghegan) § §

When a single VACUUM operation requires multiple index scans (because it is removing more tuples than it can hold in memory at once), it was possible to miss removing some index entries that should be removed. An additional bug involving a race with leaf page splits had the same effect. These bugs would eventually lead to a corrupt index with entries pointing at unrelated table rows. REINDEX is recommended if you suspect this has happened.

Fix GIN posting tree page deletion after an incomplete page split (Peter Geoghegan) §

The deletion step could incorrectly disconnect sibling pages, causing subsequent index searches to miss rows. REINDEX is recommended if you suspect this has happened.

Fix failure to update mutable pg_index fields for TOAST-table indexes (Bharath Rupireddy) §

REINDEX CONCURRENTLY can change these fields, but the relation cache was not expecting that, allowing index updates to be missed. The end result could be errors about “missing chunk number” due to missing index entries. Fortunately, these only represent index corruption; the TOAST table itself is fine, so a REINDEX will suffice to recover.

Fix assorted planner bugs triggered by lateral references (Richard Guo) § § § § §

These mistakes could lead to incorrect query plans causing wrong answers, or to internal planner errors such as “failed to build any N-way joins”.

Fix placement of PlaceHolderVars as nestloop parameters (Richard Guo) §

In rare cases, planning could fail with “failed to assign all NestLoopParams to plan nodes”, “plan should not reference subplan's variable”, or “variable not found in subplan target list” errors.

Avoid planner failure for sort keys that are PlaceHolderVars (Richard Guo) § §

Depending on the plan shape selected, such cases could produce wrong results, or could fail with “variable not found in subplan target lists”.

Handle SubLinks correctly when expanding a whole-row join alias reference (Richard Guo) §

This oversight led to errors like “cannot handle unplanned sub-select” or “unrecognized node type”.

Don't assume that DISTINCT ON ensures uniqueness of a subquery's output rows when the subquery's targetlist contains any set-returning functions (Richard Guo) §

This doesn't follow, because the set-returning functions may be evaluated after the de-duplication step.

Fix incorrect behavior of MIN()/MAX() index scans when query specifies FETCH ... WITH TIES (Chaitanya Choudhary) §

The WITH TIES option was accidentally copied into the sub-SELECT generated to perform the index scan, possibly triggering “more than one row returned by a subquery used as an expression” errors.

Use the correct collation when unique-ifying a semijoin's righthand side (Andrey Rachitskiy) §

This is an issue only if the join's comparison clause uses a non-deterministic collation, since all deterministic collations agree on string equality. But if it does, it was possible to produce incorrect results with too many rows.

Acquire a predicate lock on conflicting rows during INSERT ... ON CONFLICT (Zsolt Parragi, Andrey Borodin) § §

Failure to do this resulted in incorrect behavior in serializable mode, allowing concurrent updates that should have failed with a serialization error.

Fix incorrect multi-column RANGE partition pruning (David Rowley) §

When performing partition pruning with a RANGE partitioned table where pruning quals are only present for a leading prefix of the partition key, it was possible for partition pruning to prune away some partitions that shouldn't be pruned (leading to missing some rows that should be found) and/or include some partitions that were not needed.

Fix incorrect pruning of DEFAULT partitions in range-partitioned tables that use MINVALUE or MAXVALUE bounds (Ewan Young) §

In some cases the code would incorrectly conclude that the DEFAULT partition needn't be scanned, causing failure to find some rows that should match the query.

Fix problems with queries applying multiple sort keys to a single column (David Rowley, Ayush Tiwari) § §

Some queries could crash the backend, while in other cases the additional sort specifications were ignored. Ordinarily such additional sort specifications are redundant anyway, since the first one would fully determine the result ordering. However, this is not necessarily so with non-deterministic collations, or with queries using different ORDER BY operators.

Avoid possible re-use of stale hash tables when a hashed SubPlan is referenced in multiple places (Rahul Yadav) § §

Ensure that Memoize plan nodes use the correct input collation (Shihao Zhong) §

This matters only when using non-deterministic collations.

Fix wrong results from Memoize plans when a Param is a subexpression of a cache key (Richard Guo) § §

Fix loss of parallel worker statistics for Memoize plan nodes underneath a Gather (Tatsuya Kawata) §

Only the statistics since the last rescan of the Gather were reported by EXPLAIN ANALYZE.

Don't create a shell type if a function definition specifies an unknown return type name with array or type modifier syntax (Heikki Linnakangas) §

Such cases are surely errors, since you should create the type before doing anything advanced with it.

Fix snapshot export and import to work properly on a snapshot taken during recovery (Peter Geoghegan, Bertrand Drouvot) §

The data layout is different in such a snapshot, but the export/import logic didn't know that, so that the imported snapshot behaved incorrectly. This led not only to wrong answers within the importing transaction, but possibly to persistent data corruption due to it setting hint bits incorrectly.

This bug is known to be triggered by parallel pg_dump, when run on a standby server. In that context it could corrupt both the dump output and the standby server's data.

Fix atomicity problem in transaction snapshot import (Chee Wooson) §

There was a window in which onlookers might not see the source transaction as still running, possibly allowing wrong decisions by VACUUM for example.

Fix GIN index searches for plain scalar strings in strict jsonpath queries (Rui Zhao) §

A jsonb_ops index scan for a jsonpath such as strict $ == "scalar" failed to find table entries that were simply "scalar".

Fix errors in extraction of GIN index scan conditions from jsonpath queries (Tom Lane) §

An AND operator underneath a NOT operator could be misimplemented. Also a method applied to a literal constant, for example "42".double(), was not handled correctly. These mistakes did not cause visible errors, but the GIN index search would miss some or all of the rows that should match.

Fix edge-case error in SP-GiST quad-tree <@ searches (John Naylor) §

Due to roundoff error, the search might sometimes not descend into a quadrant that it needs to search, leading to incomplete query results.

Fix edge-case failures in SP-GiST quad-tree indexes (Ayush Tiwari) §

Roundoff errors could allow searches and insertions to fail with “getQuadrant: impossible case” errors.

Accept empty tsquery values in binary input (Ayush Tiwari) §

An empty tsquery value is allowed elsewhere, but tsqueryrecv() failed.

Disallow zero-length lexemes and out-of-range phrase distance values in binary input of tsquery values (Tom Lane) §

These cases were already rejected during text input, but tsqueryrecv() omitted making equivalent checks. That allowed accepting values that would fail subsequent dump/reload.

Consistently enforce maximum lengths in tsvector and tsquery (Tom Lane) §

Some places thought the maximum lexeme length was MAXSTRLEN (2047), while others thought it was MAXSTRLEN-1. Fortunately, the looser bound is correct, so make them all use MAXSTRLEN. Likewise, some places were stricter than others about the total data length limit, MAXSTRPOS. These fixes avoid situations where a validly-constructed value would fail dump/reload.

Fix right() with a length argument of INT_MIN (-2147483648) (Ewan Young) §

Due to integer overflow, the function returned the whole string when it should return an empty string.

Fix pg_blocking_pids() to account correctly for relation extension locks (Bertrand Drouvot) §

Fix 32-vs-64-bit confusion in pg_indexam_progress_phasename() (Markos Fountoulakis) §

This function accidentally worked on common hardware, but could misbehave on 32-bit or big-endian platforms.

Detect integer overflow in to_char() with V format (Andrey Rachitskiy) §

If the data value is an integer, and multiplying it by the power of ten implied by the V format causes integer overflow, to_char() silently emitted incorrect digits. Throw an integer overflow error instead.

Avoid integer overflow while calculating BRIN minmax_multi distances for tid values (Tomas Vondra) §

Very large tid values could result in negative distances, which would end in making the index inefficient, though not actually corrupt.

Avoid overflow while calculating BRIN minmax_multi distances for numeric values, and handle NaNs properly (Kirill Reshke, Tomas Vondra) §

These oversights could result in errors being thrown (preventing index summarization), or in inefficient indexes.

Avoid overflow when computing differences for numeric ranges (Kirill Reshke) §

In this context we want to return plus or minus infinity rather than throwing an overflow error.

Support out-of-order FLAG lines in Hunspell affix files (Ewan Young) §

Hunspell affix files usually put the FLAG line first, and our implementation silently depended on that. If it came after some lines whose meaning depends on the FLAG setting, the result would be crashes or failures to match compound words. Fix the logic so that the FLAG line can be anywhere.

Fix assorted errors in rule deparsing (Henson Choi) § § § §

Always print AS before a target-relation alias in UPDATE, DELETE, or MERGE, to avoid ambiguity if that alias is set. Also ensure that xml IS DOCUMENT constructs and subquery left-hand arguments are adequately parenthesized. Also fix deparsing of AT TIME ZONE and similar constructs in a view's FROM clause; these need to be wrapped in a no-op CAST. These errors could prevent dump restoration due to a syntax error in a view, or cause reloaded views to be parsed as something different from before.

Fix parser failure when a multi-row INSERT ... VALUES has a sub-SELECT in a target column subscript (Amit Langote) §

This led to “unexpected non-SELECT command in SubLink”.

Fix missed preprocessing of WHERE clauses in COPY FROM (Nathan Bossart) §

This oversight led to “cache lookup failed for function 0” errors with negated operators, and probably in other cases as well.

Fix race conditions with DROP TABLESPACE (Ayush Tiwari) §

A DROP executed concurrently with commands that attempt to add new objects to the tablespace could end with inconsistent catalog contents.

Cleanly reject operations on unlogged tables during recovery (Jim Jones) § §

An unlogged table will have no data on a standby, so reading it must fail. Most operations give an appropriate error for this, but COPY ... TO failed with an internal “could not open file” error, as did currtid2().

Revert previous changes to free space map persistence (Alexander Korotkov) §

Commits c06d1a4ba et al. (included in the May 2026 releases) turned out to cause more trouble than they fixed.

Avoid backend hang during temporary table cleanup at exit, if the default transaction mode is SERIALIZABLE READ ONLY DEFERRABLE (Andrey Rachitskiy) §

Cleanup would block until concurrent serializable transactions complete, which could be indefinitely if some of them are prepared transactions.

Avoid crash when describing a FETCH statement whose cursor is gone (Dirkjan Bussink) §

If a vacuum delay sleep is requested while holding locks, don't sleep (Kevin Rocker, Andrey Borodin, Mostafa) §

Also, move several existing delay calls to points where it's actually safe to sleep.

Avoid freeing the plan for a foreign-key enforcement query if the plan is still in use (Lucas Jeffrey, Trakshan Mishra, Amit Langote) §

It was possible to reach this behavior in contrived cases, such as a self-referencing ON DELETE CASCADE foreign key on tables with triggers that perform DML.

Fix WAL-logging of multi-level page deletion in btree indexes (Peter Geoghegan) §

The WAL log could contain stale values for a to-be-deleted page's sibling links, resulting in complaints on standby servers if wal_consistency_checking is enabled. Barring a crash, the damage would shortly be repaired by completion of the deletion action, so that this error was usually only cosmetic.

Ensure that state files for pending prepared transactions are written out atomically during a checkpoint (Shihao Zhong) §

Previously it was possible for a crash to leave an invalid state file behind, causing subsequent database startup to fail.

Do not start a checkpoint in the middle of aborting a prepared transaction (Shihao Zhong) §

A crash would allow the transaction to be committed afterwards, leading to inconsistent state.

Do not start a checkpoint in the middle of creating a multixact (Shihao Zhong) §

This avoids possible data loss after a subsequent crash.

Fix possible loss of tuples updated by later-aborted subtransactions (Shihao Zhong, Michael Paquier) §

A table rewrite (for example, CLUSTER or VACUUM FULL) could discard such tuples as invalid.

Do not lose tuple's tid when storing it into a tuple table slot (Virender Singla, Greg Burd) §

Some code paths neglected to copy the tid field, which could lead to data corruption or wrong query answers in unusual cases.

Avoid race condition in marking a partitioned index valid (Andrey Borodin, Kirill Reshke) §

This could, for example, cause parallel pg_restore to fail due to trying to recreate foreign key constraints too soon.

Fix checks for an aborted updating transaction in multixids (Chee Wooson) §

Known consequences of this coding error include unexpected “new multixact has more than one updating member” errors, as well as incorrect failures to update a row.

A hash index scan that starts during a bucket split could miss some index entries (Peter Geoghegan, Amit Kapila) §

Fix incorrect position tracking in TID Range Scans (Ewan Young, David Rowley) §

Sequences involving fetching backwards and then forwards again could fail to scan all the way to the end of the range.

Avoid reading a potentially-torn copy of the pg_control file for base backups (David Steele) § § §

A concurrent write to the file could result in including inconsistent data in the backup.

Prevent making incorrect copies of non-relation files in base backups (David Steele) §

Files that routinely get replaced by atomic renames, such as postgresql.auto.conf, could be truncated or zero-padded in a backup made concurrently with such a replacement.

Ensure that base backups report checksum failures affecting single pages (Zsolt Parragi) §

Due to a logic error, checksum failures were counted in pg_stat_database only when more than one page in the same file was corrupt.

Verify the syntax of the output_plugin_libraries parameter when a value is assigned (Jacob Champion, Hayato Kuroda) §

Previously, a syntactically-incorrect value could be put into postgresql.conf, causing logical replication to fail.

Avoid incorrect update of backend status flags during replication slot invalidation (Vlad Lesin) §

An invalidation done by an auxiliary process such as the checkpointer could clobber the status field of an unrelated backend. The consequences of this are difficult to predict, but one possibility is that hot standby feedback could be effectively disabled.

In logical replication, handle subtransaction aborts better (Bingshuai Li, Hayato Kuroda, Zhijie Hou) §

If a subtransaction that made a catalog update aborts, logical decoding mistakenly still believed that the update was effective, potentially causing incorrect decoding output.

Avoid race condition when building an initial decoding snapshot (Antonin Houska, Rui Zhao) §

There was a small risk of data corruption from using a snapshot that includes transactions that have committed but not yet set their CLOG status.

Avoid null-pointer crash with missing replication option values in pgoutput logical replication sender (Zhijie Hou) §

Fix small memory leak in pgoutput with streamed prepared transactions (Ayush Tiwari) §

Fix duplicate creation of temporary replication slot when a WAL receiver follows a timeline switch (ChangAo Chen) §

This mistake led to a “could not create replication slot” error followed by a restart of the WAL receiver, which would then recover, so there was no permanent damage.

Fix incorrect LSNs in WAL decoding error messages (Rahul Yadav) §

These error messages reported the LSN of a WAL record that wasn't the one they were actually complaining about.

Fix potential use-after-free cases in WAL sender (Ayush Tiwari) §

Avoid use-after-free in jsonb_set_lax() (John Naylor) §

Fix null-pointer dereferences that could occur when a schema is concurrently dropped (Baji Shaik) §

Fix possible null-pointer dereference when building extended statistics on expressions (Shihao Zhong, Michael Paquier) §

This error was reachable only with unexpected (but legal) behavior of a custom typanalyze function.

Fix possibly-stale values of pg_locks.waitstart (Shihao Zhong) §

Harden pgstats code against partially-completed local pgstats entries (Michael Paquier) §

Fix cleanup of reused pgstats entries (Michael Paquier) §

This error led to leakage of pgstats entries, which could result in errors at backend exit or database shutdown.

Fix memory leaks caused by not releasing all data associated with a WAL reader (Tomás Senart) §

In many cases this oversight did little harm because the containing memory context would soon be reset or deleted. However there are cases where it could cause long-lived memory bloat, notably in the checkpointer process.

Avoid memory bloat while computing ndistinct extended statistics across many columns (Ilia Evdokimov) §

Fix buffer pin leak after a failed hash index bucket split cleanup (Peter Geoghegan) §

This coding error resulted in nothing worse than warnings about resource leakage.

Ensure all relations opened for AFTER triggers are closed again (Hayato Kuroda, David Rowley) §

This oversight triggered “resource was not closed” warnings, but nothing more serious than that.

Fix PL/pgSQL's handling of anycompatiblemultirange arguments and results (Jeevan Chalke) §

This type had not been added to PL/pgSQL's knowledge of polymorphic types, resulting in errors when trying to create or use a function declared with it.

Harden PL/Perl and associated contrib modules against “tied” Perl hashes and arrays (Tom Lane) § §

Rely on av_count() to decide the length of a Perl array, rather than looking for a null pointer; and contrarily be more wary about unexpected null value pointers from array and hash fetches. These cases are only known to arise in connection with “tied” objects.

Ensure that psql counts all the COPY FROM STDIN commands appearing in a multi-query command string (Zsolt Parragi) §

After the fix for CVE-2026-6464, psql would reject multiple COPY FROM STDIN commands appearing in a single string, because it was not expecting more than one COPY operation to occur.

Make psql cope better with out-of-memory conditions during backslash command processing (Fujii Masao) § §

Fix some small memory leaks in psql (Fujii Masao) §

Make pg_dump dump column statistics targets for indexes backing constraints (Zsolt Parragi) §

Formerly pg_dump would emit ALTER INDEX ... SET STATISTICS commands when needed for plain indexes, but not for indexes created via EXCLUDE constraints on expressions.

In pg_dump's tar-format output, don't put invalid \restrict/\unrestrict commands into the restore.sql tar member (Pavel Kopylov) §

Fix possible index corruption in contrib/pg_trgm GiST indexes (Nate Clark) §

Combination of index entries could lose the flag identifying their format, so that subsequent index searches could miss matching rows.

This fix does not repair existing indexes. Users should REINDEX existing gist_trgm_ops indexes after updating.

Fix error check in timer setup on Windows (Sehrope Sarkuni) §

Failure to create a thread to manage timeouts was not detected, leading to silent failure of subsequent timeout requests.

Use a non-locking initial test in TAS_SPIN on AArch64 (Nathan Bossart) §

This code change has been shown to improve performance on many-core AArch64 machines while not hurting performance on smaller ones; moreover, it avoids a performance regression with newer Linux kernels.

Update time zone data files to tzdata release 2026f (Tom Lane) § § §

Canada's Northwest Territories are on year-round UTC-06 (effectively, permanent DST) beginning in November 2026. This affects only America/Inuvik as the rest of the territory is covered by America/Edmonton, for which the equivalent change was released in 2026c. Similarly, Manitoba (America/Winnipeg) moves to year-round UTC-05. For now assume their TZ abbreviations will be CST and EST respectively.

Cuba did not fall back on 2026-11-01; they will stay on DST this winter (but apparently plan to revert to normal next year).

The backward-compatibility zone names EST5EDT, CST6CDT, MST7MDT, and PST8PDT now have simpler behavior for old time stamps. They use the indicated UTC offsets and TZ abbreviations indefinitely far back, rather than allowing aspects of the associated city-named zone's historical behavior to leak through. This conforms better to POSIX.

Historical corrections for Brazil, Colombia, Iran, and Ireland.

On Windows, initdb will now recognize the new time zone names that Microsoft has devised for the updated Canadian zones.