File postgresql11.changes of Package postgresql11

Overview Repositories Revisions Requests Users Attributes Meta

File postgresql11.changes of Package postgresql11 (Revision c9dc9eed261fd3790e3022c96875c189)

Currently displaying revision c9dc9eed261fd3790e3022c96875c189 , Show latest

-------------------------------------------------------------------
Thu Nov  9 12:03:30 UTC 2023 - Reinhard Max <max@suse.com>

- Update to 11.22:
  * bsc#1216962, CVE-2023-5868: Fix handling of unknown-type
    arguments in DISTINCT "any" aggregate functions. This error led
    to a text-type value being interpreted as an unknown-type value
    (that is, a zero-terminated string) at runtime. This could
    result in disclosure of server memory following the text value.
  * bsc#1216961, CVE-2023-5869: Detect integer overflow while
    computing new array dimensions. When assigning new elements to
    array subscripts that are outside the current array bounds, an
    undetected integer overflow could occur in edge cases. Memory
    stomps that are potentially exploitable for arbitrary code
    execution are possible, and so is disclosure of server memory.
  * bsc#1216960, CVE-2023-5870: Prevent the pg_signal_backend role
    from signalling background workers and autovacuum processes.
    The documentation says that pg_signal_backend cannot issue
    signals to superuser-owned processes. It was able to signal
    these background  processes, though, because they advertise a
    role OID of zero. Treat that as indicating superuser ownership.
    The security implications of cancelling one of these process
    types are fairly small so far as the core code goes (we'll just
    start another one), but extensions might add background workers
    that are more vulnerable.
    Also ensure that the is_superuser parameter is set correctly in
    such processes. No specific security consequences are known for
    that oversight, but it might be significant for some extensions.
  * Add support for LLVM 16 and 17
  * https://www.postgresql.org/about/news/2749
  * https://www.postgresql.org/docs/11/release-11-22.html

-------------------------------------------------------------------
Tue Oct 31 10:57:13 UTC 2023 - Reinhard Max <max@suse.com>

- boo#1216734: Revert the last change and make the devel package
  independend of all other subpackages except for the libs.

-------------------------------------------------------------------
Tue Oct 10 12:49:02 UTC 2023 - Reinhard Max <max@suse.com>

- boo#1216022: Call install-alternatives from the devel subpackage
  as well, otherwise the symlink for ecpg might be missing.

-------------------------------------------------------------------
Mon Sep 18 15:24:14 UTC 2023 - Dominique Leuenberger <dimstar@opensuse.org>

- Also buildignore the postgresql*-implementation symbols: this is
  needed in order to bootstrap when no postgresql version currently
  has valid symbols provided. Once the packages are built, OBS
  could translate this to the pgname-* packages and accept the
  ignores; during bootstrap though, there is nothing providing the
  symbol and the existing buildignores do not suffice.

-------------------------------------------------------------------
Thu Aug 10 14:16:25 UTC 2023 - Reinhard Max <max@suse.com>

- Update to 11.21:
  * bsc#1214059, CVE-2023-39417: Disallow substituting a schema or
    owner name into an extension script if the name contains a
    quote, backslash, or dollar sign.
  * https://www.postgresql.org/docs/11/release-11-21.html

-------------------------------------------------------------------
Fri May 26 11:48:38 UTC 2023 - Reinhard Max <max@suse.com>

- Restore the independence of mini builds from the main build after
  the -mini name change from April 4, 2023.
- Adjust icu handling to prepare for PostgreSQL 16.

-------------------------------------------------------------------
Mon May 15 14:23:32 UTC 2023 - Reinhard Max <max@suse.com>

- Overhaul postgresql-README.SUSE and move it from the binary
  package to the noarch wrapper package.
- Change the unix domain socket location from /var/run to /run.

-------------------------------------------------------------------
Thu May 11 13:20:32 UTC 2023 - Reinhard Max <max@suse.com>

- Update to 11.20:
  * bsc#1211228, CVE-2023-2454:
    Prevent CREATE SCHEMA from defeating changes in search_path
  * bsc#1211229, CVE-2023-2455: Enforce row-level security
    policies correctly after inlining a set-returning function
  * https://www.postgresql.org/about/news/2637/
  * https://www.postgresql.org/docs/11/release-11-20.html

-------------------------------------------------------------------
Tue Apr 18 09:05:09 UTC 2023 - Reinhard Max <max@suse.com>

- bsc#1210303: Stop using the obsolete internal %_restart_on_update
  macro and drop support for sysv init to simplify the scriptlets.

-------------------------------------------------------------------
Thu Feb  9 12:03:40 UTC 2023 - Reinhard Max <max@suse.com>

- Update to 11.19:
  * https://www.postgresql.org/about/news/2592/
  * https://www.postgresql.org/docs/15/release-15-2.html
- Bump latest_supported_llvm_ver to 15.

-------------------------------------------------------------------
Thu Nov 10 16:30:04 UTC 2022 - Reinhard Max <max@suse.com>

- bsc#1205300: Update to 11.18:
  * https://www.postgresql.org/about/news/2543/
  * https://www.postgresql.org/docs/11/release-11-18.html
- Sync spec file with postgresql15.

-------------------------------------------------------------------
Thu Sep 22 21:26:36 UTC 2022 - Aaron Puchert <aaronpuchert@alice-dsl.net>

- Create mechanism to specify the latest supported LLVM version.
  Automatically pin to that version if the distribution has a newer
  unsupported default version.

-------------------------------------------------------------------
Tue Sep 13 12:39:03 UTC 2022 - Reinhard Max <max@suse.com>

- Sync spec file with postgresql15.

-------------------------------------------------------------------
Mon Sep 12 07:52:42 UTC 2022 - Andreas Schwab <schwab@suse.de>

- Disable LLVM JIT on riscv64

-------------------------------------------------------------------
Fri Aug 12 10:59:32 UTC 2022 - Reinhard Max <max@suse.com>

- Update to 11.17:
  * bsc#1202368, CVE-2022-2625: Extension scripts replace objects
    not belonging to the extension.
  * https://www.postgresql.org/docs/release/11.17/

-------------------------------------------------------------------
Thu May 12 14:36:20 UTC 2022 - Reinhard Max <max@suse.com>

- Upgrade to 11.16:
  * bsc#1199475, CVE-2022-1552: Confine additional operations
    within "security restricted operation" sandboxes.
  * https://www.postgresql.org/docs/11/release-11-16.html

-------------------------------------------------------------------
Wed Apr 13 12:17:48 UTC 2022 - Reinhard Max <max@suse.com>

- bsc#1198166: Pin to llvm13 until the next patchlevel update.

-------------------------------------------------------------------
Tue Feb  8 15:29:51 UTC 2022 - Reinhard Max <max@suse.com>

- bsc#1195680: Upgrade to 11.15:
  * https://www.postgresql.org/docs/11/release-11-15.html
  * Reindexing might be needed after applying this upgrade, so
    please read the release notes carefully.
- boo#1190740: Add constraints file with 12GB of memory for s390x
  as a workaround

-------------------------------------------------------------------
Thu Nov 25 11:02:15 UTC 2021 - Reinhard Max <max@suse.com>

- Add a llvmjit-devel subpackage to pull in the right versions
  of clang and llvm for building extensions. 
- Fix some mistakes in the interdependencies between the
  implementation packages and their noarch counterpart.
- Update the BuildIgnore section.

-------------------------------------------------------------------
Thu Nov 11 14:41:40 UTC 2021 - Reinhard Max <max@suse.com>

- bsc#1192516: Upgrade to version 11.14:
  * Make the server reject extraneous data after an SSL or GSS
    encryption handshake (CVE-2021-23214).
  * Make libpq reject extraneous data after an SSL or GSS
    encryption handshake (CVE-2021-23222).
  * https://www.postgresql.org/docs/11/release-11-14.html

-------------------------------------------------------------------
Tue Oct  5 11:28:57 UTC 2021 - Reinhard Max <max@suse.com>

- Let genlists skip non-existing binaries to avoid lots of version
  conditionals in the file lists.
- Remove postgresql-testsuite-int8.sql.patch, because its purpose
  is unclear. This affects only the test subpackage.

-------------------------------------------------------------------
Tue Aug 31 11:14:53 UTC 2021 - Reinhard Max <max@suse.com>

- bsc#1185952: fix build with llvm12 on s390x.
  0001-jit-Workaround-potential-datalayout-mismatch-on-s390.patch 
- bsc#1179945: Re-enable icu for PostgreSQL 10.

-------------------------------------------------------------------
Tue Aug 24 13:09:36 UTC 2021 - Marcus Rueckert <mrueckert@suse.de>

- Upgrade to version 11.13:
  * https://www.postgresql.org/docs/11/release-11-13.html
  * CVE-2021-3677 (boo#1189748)
    The planner could create an incorrect plan in cases where two
    ProjectionPaths were stacked on top of each other. The only
    known way to trigger that situation involves parallel sort
    operations, but there may be other instances. The result would
    be crashes or incorrect query results. Disclosure of server
    memory contents is also possible.

-------------------------------------------------------------------
Fri Jul  2 07:50:45 UTC 2021 - Reinhard Max <max@suse.com>

- bsc#1187751: Make the dependency of postgresqlXX-server-devel on
  llvm and clang optional (postgresql-llvm-optional.patch).

-------------------------------------------------------------------
Tue May 11 16:20:41 UTC 2021 - Reinhard Max <max@suse.com>

- Upgrade to version 11.12:
  * https://www.postgresql.org/docs/11/release-11-12.html
  * CVE-2021-32027, bsc#1185924:
    Prevent integer overflows in array subscripting calculations.
  * CVE-2021-32028, bsc#1185925: Fix mishandling of “junk”
    columns in INSERT ... ON CONFLICT ... UPDATE target lists.
  * CVE-2021-32029, bsc#1185926: Fix possibly-incorrect
    computation of UPDATE ... RETURNING
    "pg_psql_temporary_savepoint" does not exist”.

- Don't use %_stop_on_removal, because it was meant to be private
  and got removed from openSUSE. %_restart_on_update is also
  private, but still supported and needed for now (bsc#1183168).

-------------------------------------------------------------------
Mon Mar 15 19:29:39 UTC 2021 - Reinhard Max <max@suse.com>

- Re-enable build of the llvmjit subpackage on SLE, but it will
  only be delivered on PackageHub for now (boo#1183118).

-------------------------------------------------------------------
Tue Mar  9 13:52:19 UTC 2021 - Reinhard Max <max@suse.com>

- Remove leftover PreReq on chkconfig, we stopped using it long
  time ago.

-------------------------------------------------------------------
Fri Feb 19 15:30:08 UTC 2021 - Reinhard Max <max@suse.com>

- boo#1179945: Disable icu for PostgreSQL 10 (and older) on TW.

-------------------------------------------------------------------
Wed Feb 10 15:33:08 UTC 2021 - Reinhard Max <max@suse.com>

Upgrade to version 11.11:
  * https://www.postgresql.org/docs/11/release-11-11.html  
  * Reindexing might be needed after applying this update.
  * CVE-2021-3393, bsc#1182040: Fix information leakage in
    constraint-violation error messages.
  * Obsoletes postgresql-icu68.patch.

-------------------------------------------------------------------
Mon Dec 14 16:19:53 UTC 2020 - Callum Farmer <gmbr3@opensuse.org>

- Add postgresql-icu68.patch: fix build with ICU 68

-------------------------------------------------------------------
Fri Nov 20 11:51:37 UTC 2020 - Reinhard Max <max@suse.com>

- bsc#1178961: %ghost the symlinks to pg_config and ecpg.
- boo#1179765: BuildRequire libpq5 and libecpg6 when not building
  them to avoid dangling symlinks in the devel package.

-------------------------------------------------------------------
Wed Nov 11 12:08:53 UTC 2020 - Reinhard Max <max@suse.com>

- Upgrade to version 11.10:
  * CVE-2020-25695, bsc#1178666: Block DECLARE CURSOR ... WITH HOLD
    and firing of deferred triggers within index expressions and
    materialized view queries.
  * CVE-2020-25694, bsc#1178667:
    a) Fix usage of complex connection-string parameters in pg_dump,
    pg_restore, clusterdb, reindexdb, and vacuumdb.
    b) When psql's \connect command re-uses connection parameters,
    ensure that all non-overridden parameters from a previous
    connection string are re-used.
  * CVE-2020-25696, bsc#1178668: Prevent psql's \gset command from
    modifying specially-treated variables.
  * Fix recently-added timetz test case so it works when the USA
    is not observing daylight savings time.
    (obsoletes postgresql-timetz.patch)
  * https://www.postgresql.org/about/news/2111/
  * https://www.postgresql.org/docs/11/release-11-10.html

-------------------------------------------------------------------
Tue Nov  3 13:54:38 UTC 2020 - Reinhard Max <max@suse.com>

- Fix a DST problem in the test suite: postgresql-timetz.patch
  https://postgr.es/m/16689-57701daa23b377bf@postgresql.org

-------------------------------------------------------------------
Thu Aug 13 14:33:16 UTC 2020 - Reinhard Max <max@suse.com>

- update to 11.9:
  * CVE-2020-14349, bsc#1175193: Set a secure search_path in
    logical replication walsenders and apply workers
  * CVE-2020-14350, bsc#1175194: Make contrib modules' installation
    scripts more secure.
  * https://www.postgresql.org/docs/11/release-11-9.html
- Remove postgresql-regress.patch, it does not apply anymore and
  it does not seem to be needed anymore.
- Pack the /usr/lib/postgresql symlink only into the main package.

-------------------------------------------------------------------
Tue Jun 16 12:21:43 UTC 2020 - Reinhard Max <max@suse.com>

- Let postgresqlXX conflict with postgresql-noarch < 12.0.1 to get
  a clean and complete cutover to the new packaging schema.

-------------------------------------------------------------------
Wed Jun  3 17:35:11 UTC 2020 - Reinhard Max <max@suse.com>

- update to 11.8 (bsc#1171924).
  https://www.postgresql.org/about/news/2038/
  https://www.postgresql.org/docs/11/release-11-8.html
- Unify the spec file to work across all current PostgreSQL
  versions to simplify future maintenance.
- Move from the "libs" build flavour to a "mini" package that will
  only be used inside the build service and not get shipped, to
  avoid confusion with the debuginfo packages (bsc#1148643).

-------------------------------------------------------------------
Sat Feb 15 03:10:12 UTC 2020 - Marcus Rueckert <mrueckert@suse.de>

- update to 11.7: (CVE-2020-1720) 
  https://www.postgresql.org/about/news/2011/
  https://www.postgresql.org/docs/11/release-11-7.html

-------------------------------------------------------------------
Mon Jan 27 09:10:34 UTC 2020 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Disable explicitly armv8 CRC for %arm, as we use some armv8
  workers for armv6/7 builds which is confusing configure script

-------------------------------------------------------------------
Fri Dec 20 14:58:51 UTC 2019 - Marcus Rueckert <mrueckert@suse.de>

- update to 11.6:
  https://www.postgresql.org/about/news/1994/
  https://www.postgresql.org/docs/11/release-11-6.html

-------------------------------------------------------------------
Tue Oct 22 16:56:44 UTC 2019 - Marcus Rueckert <mrueckert@suse.de>

- add requires to the server-devel package for the libs that are
  returned by pg_config --libs

-------------------------------------------------------------------
Tue Oct 22 12:22:35 UTC 2019 - Marcus Rueckert <mrueckert@suse.de>

- disable building of the libraries here. Will now be provided from
  the 12.0 package

-------------------------------------------------------------------
Mon Aug 12 13:20:15 UTC 2019 - Reinhard Max <max@suse.com>

- Update to 11.5:
  * https://www.postgresql.org/about/news/1960/
  * https://www.postgresql.org/docs/11/release-11-5.html
  * CVE-2019-10208, bsc#1145092: TYPE in pg_temp executes arbitrary
    SQL during SECURITY DEFINER execution.
  * CVE-2019-10209, bsc#1145091: Memory disclosure in cross-type
    comparison for hashed subplan.

-------------------------------------------------------------------
Fri Aug  2 08:54:10 UTC 2019 - Martin Liška <mliska@suse.cz>

- Use FAT LTO objects in order to provide proper static library.

-------------------------------------------------------------------
Fri Jun 21 13:27:15 UTC 2019 - Marcus Rueckert <mrueckert@suse.de>

- update to 11.4:
  * https://www.postgresql.org/docs/11/release-11-4.html
  * https://www.postgresql.org/about/news/1949/
  * CVE-2019-10164 bsc#1138034: Stack-based buffer overflow via
    setting a password

-------------------------------------------------------------------
Fri May 10 09:52:48 UTC 2019 - Reinhard Max <max@suse.com>

- Update to 11.3:
  * https://www.postgresql.org/docs/11/release-11-3.html
  * https://www.postgresql.org/about/news/1939/
  * CVE-2019-10130, bsc#1134689: Prevent row-level security
    policies from being bypassed via selectivity estimators.
  * CVE-2019-10129, bsc#1134684: Avoid access to already-freed
    memory during partition routing error reports.

-------------------------------------------------------------------
Tue Feb 19 15:42:31 UTC 2019 - Reinhard Max <max@suse.com>

- Update to 11.2:
  * https://www.postgresql.org/docs/11/release-11-2.html
  * https://www.postgresql.org/about/news/1920/
  * By default, panic instead of retrying after fsync() failure,
    to avoid possible data corruption.
  * Fix handling of unique indexes with INCLUDE columns on
    partitioned tables.
  * Ensure that NOT NULL constraints of a partitioned table are
    honored within its partitions.
  * Numerous other bug fixes.
- Overhaul README.SUSE

-------------------------------------------------------------------
Fri Jan 11 13:23:20 UTC 2019 - Reinhard Max <max@suse.com>

- The release tags between the main package build and libs might
  be different, but that's not a problem, so we can relax the tight
  dependency of server-devel on devel.
- Adjust the line between headers going to devel and server-devel.
  Now everything under /usr/include/pgsql/server is in server-devel
  and the rest of /usr/include/pgsql is in devel (bsc#1120035).

-------------------------------------------------------------------
Mon Dec  3 12:29:23 UTC 2018 - Marcus Rueckert <mrueckert@suse.de>

- move the server-devel package definition into the buildmain
  section

-------------------------------------------------------------------
Tue Nov 20 09:29:51 UTC 2018 - Guillaume GARDET <guillaume.gardet@opensuse.org>

- Add sha256 file to list of sources
- Update v11.1 files from upstream

-------------------------------------------------------------------
Thu Nov  8 15:08:59 UTC 2018 - Reinhard Max <max@suse.com>

- Update to 11.1:
  * CVE-2018-16850, bsc#1114837: Improper quoting of transition
    table names when pg_dump emits CREATE TRIGGER can cause
    privilege escalation
  * Numerous bug fixes, see the release notes:
    https://www.postgresql.org/docs/current/release-11-1.html
  * Remove unneeded library dependencies from PGXS.

-------------------------------------------------------------------
Mon Oct 22 11:51:50 UTC 2018 - Reinhard Max <max@suse.com>

- Update to 11.0.
  * https://www.postgresql.org/about/news/1894/
  * https://www.postgresql.org/docs/11/static/release-11.html
- Improvements to partitioning functionality, including:
  * Add support for partitioning by a hash key
  * Add support for PRIMARY KEY, FOREIGN KEY, indexes, and triggers
    on partitioned tables.
  * Allow creation of a “default” partition for storing data that
    does not match any of the remaining partitions.
  * UPDATE statements that change a partition key column now cause
    affected rows to be moved to the appropriate partitions.
  * Improve SELECT performance through enhanced partition
    elimination strategies during query planning and execution.
- Improvements to parallelism, including:
  * CREATE INDEX can now use parallel processing while building a
    B-tree index.
  * Parallelization is now possible in CREATE TABLE ... AS, CREATE
    MATERIALIZED VIEW, and certain queries using UNION.
  * Parallelized hash joins and parallelized sequential scans now
    perform better.
- SQL stored procedures that support embedded transactions.
- Optional Just-in-Time (JIT) compilation for some SQL code,
  speeding evaluation of expressions (new subpackage: -llvmjit).
- Window functions now support all framing options shown in the
  SQL:2011 standard, including RANGE distance PRECEDING/FOLLOWING,
  GROUPS mode, and frame exclusion options.
- Covering indexes can now be created, using the INCLUDE clause of
  CREATE INDEX.
- Many other useful performance improvements, including the ability
  to avoid a table rewrite for ALTER TABLE ... ADD COLUMN with a
  non-null column default.
- Split a new -server-devel subpackage from -devel.

-------------------------------------------------------------------
Fri Aug 10 16:00:58 UTC 2018 - mrueckert@suse.de

- update to 11 beta3
  https://www.postgresql.org/docs/11/static/release-11.html
  https://www.postgresql.org/about/news/1878/
  CVE-2018-10925 CVE-2018-10915

-------------------------------------------------------------------
Mon Jul  2 17:04:43 UTC 2018 - mrueckert@suse.de

- initial package

Places

File postgresql11.changes of Package postgresql11 (Revision c9dc9eed261fd3790e3022c96875c189)

Places