The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 18.2, 17.8, 16.12, 15.16, and 14.21. This release fixes 5 security vulnerabilities and over 65 bugs reported over the last several months. Release notes: https://www.postgresql.org/about/news/postgresql-182-178-1612-1516-and-1421-released-3235/ https://www.postgresql.org/docs/release/ Security: CVE-2026-2003: PostgreSQL oidvector discloses a few bytes of memory CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code CVE-2026-2006: PostgreSQL missing validation of multibyte character length executes arbitrary code CVE-2026-2007: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory Remove postgresql13* since it is now EoL.
- Strip shared library and binary executable
- Fix stage-qa
- Bump PORTREVISION for package change
postgresql{13,14,15,16,17,18}-server:
- Clean up Makefile: Remove unnecessary ";\"
- Sort PLIST: share/locale comes before DATADIR (share/postgresql)
postgresql{17,18}-plperl:
- Remove duplicate USES=perl5
- Add missing USE_PERL5=run
from postgresql{17,18}-plperl build log:
====> Running Q/A tests (stage-qa)
Error: /usr/local/lib/postgresql/bool_plperl.so is linked to /usr/local/lib/perl5/5.40/mach/CORE/libperl.so.5.40 from lang/perl5.40 but it is not declared as a dependency
PR: 290587
Approved by: girgen
The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 16.4, 15.8, 14.13, 13.16, and 12.20. This release fixes 1 security vulnerability and over 55 bugs reported over the last several months. PR: 279671 - make the rc script service jails aware PR: 279536 - remove LLVM max version restriction PR: 278887 - SETENV -> SETENVI for -contrib ports Release notes: https://www.postgresql.org/docs/release/
Commit b7f05445c00f has added WWW entries to port Makefiles based on WWW: lines in pkg-descr files. This commit removes the WWW: lines of moved-over URLs from these pkg-descr files. Approved by: portmgr (tcberner)
It has been common practice to have one or more URLs at the end of the ports' pkg-descr files, one per line and prefixed with "WWW:". These URLs should point at a project website or other relevant resources. Access to these URLs required processing of the pkg-descr files, and they have often become stale over time. If more than one such URL was present in a pkg-descr file, only the first one was tarnsfered into the port INDEX, but for many ports only the last line did contain the port specific URL to further information. There have been several proposals to make a project URL available as a macro in the ports' Makefiles, over time. This commit implements such a proposal and moves one of the WWW: entries of each pkg-descr file into the respective port's Makefile. A heuristic attempts to identify the most relevant URL in case there is more than one WWW: entry in some pkg-descr file. URLs that are not moved into the Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr files in order to preserve them. There are 1256 ports that had no WWW: entries in pkg-descr files. These ports will not be touched in this commit. The portlint port has been adjusted to expect a WWW entry in each port Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as deprecated. Approved by: portmgr (tcberner)
Release notes: https://www.postgresql.org/docs/devel/release-14.html Also reintroduce parallel builds. Some components, namely plperl, plpython, pltcl and contrib, fail to build properly when using parallel builds. Something with static linking using `ar` that fails. MAKE_JOBS_UNSAFE is set for these ports.
Reported by: lwhsu
Release notes: https://www.postgresql.org/about/news/2077/