2021-06-13 databases/postgresql95-client: PostgreSQL-9.5 has reached end-of-life
2021-06-13 databases/postgresql95-contrib: PostgreSQL-9.5 has reached end-of-life
2021-06-13 databases/postgresql95-docs: PostgreSQL-9.5 has reached end-of-life
2021-06-13 databases/postgresql95-pgtcl: PostgreSQL-9.5 has reached end-of-life
2021-06-13 databases/postgresql95-plperl: PostgreSQL-9.5 has reached end-of-life
2021-06-13 databases/postgresql95-plpython: PostgreSQL-9.5 has reached end-of-life
2021-06-13 databases/postgresql95-pltcl: PostgreSQL-9.5 has reached end-of-life
2021-06-13 databases/postgresql95-server: PostgreSQL-9.5 has reached end-of-life
databases/pg_reorg: abandonware only for PostgreSQL 9.5
databases/pgespresso: functionality part of PostgreSQL 9.6 and later

Release notes:	https://www.postgresql.org/docs/devel/release-14.html

Also reintroduce parallel builds. Some components, namely plperl,
plpython, pltcl and contrib, fail to build properly when using parallel
builds. Something with static linking using `ar` that fails.
MAKE_JOBS_UNSAFE is set for these ports.

PostgreSQL 13.3, 12.7, 11.12, 10.17, and 9.6.22 Released!

The PostgreSQL Global Development Group has released an update to all supported
versions of our database system, including 13.3, 12.7, 11.12, 10.17, and
9.6.22. This release closes three security vulnerabilities and fixes over 45
bugs reported over the last three months.

Security fixes in this release:

CVE-2021-32027: Buffer overrun from integer overflow in array subscripting
                calculations

CVE-2021-32028: Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE

CVE-2021-32029: Memory disclosure in partitioned-table UPDATE ... RETURNING

Also plenty of bug fixes. See the release note for details.

Changes to the port:

Make sure we use the matching version of llvm. This fixes a problem with the
llvm version string not being monotonically increasing with the version
number. [1]

Better pkg message about checksums for postgresql 12+. [2] [4]

Adjust login class parameter to adhere to the documentation in rc.subr(8) [3]:
  The rc.conf parameter for the login class of the postgresql daemon has
  changed name from postgresql_class to postgresql_login_class, since
  rc.subr(8) states that the parameter should be named ${name}_login_class.

Allow parallel builds. [5]

Correct the directory name for the user postgres in pkg message. [6]

PR:		250824 [1], 253558 [2], 236060 [3], 233106 [4],  230656 [5]
PR:		226674 [6]
Submitted by:	Michael Zhilin [2], Michael Zhilin [3], Dmitry Chestnykh [4]
Submitted by:	Steve Wills [5], knezour [6]

Security:	76e0bb86-b4cb-11eb-b9c9-6cc21735f730
Security:	62da9702-b4cc-11eb-b9c9-6cc21735f730

Release notes:	https://www.postgresql.org/docs/release/

It is end-of-life upstreams. Please update to a later version.

The PostgreSQL Global Development Group has released an update to all supported
versions of our database system, including 13.2, 12.6, 11.11, 10.16, 9.6.21,
and 9.5.25. This release closes two security vulnerabilities and fixes over 80
bugs reported over the last three months.

Additionally, this is the final release of PostgreSQL 9.5. If you are running
PostgreSQL 9.5 in a production environment, we suggest that you make plans to
upgrade.

Release notes:	https://www.postgresql.org/about/news/postgresql-132-126-1111-1016-9621-and-9525-released-2165/
Security notes:	https://www.postgresql.org/support/security/
Security:	CVE-2021-3393, CVE-2021-20229

The PostgreSQL Global Development Group has released an update to all supported
versions of our database system, including 13.1, 12.5, 11.10, 10.15, 9.6.20 and
9.5.24.  This release closes three security vulnerabilities and fixes over 65
bugs reported over the last three months.

Due to the nature of CVE-2020-25695, we advise you to update as soon as possible.

Additionally, this is the second-to-last release of PostgreSQL 9.5. If you are
running PostgreSQL 9.5 in a production environment, we suggest that you make
plans to upgrade.

For the full list of changes, please review the release notes.

Security:	CVE-2020-25695: Multiple features escape "security restricted
				operation" sandbox

Security:	CVE-2020-25694: Reconnection can downgrade connection security
				settings

Security:	CVE-2020-25696: psql's \gset allows overwriting specially
				treated variables

Release notes:	https://www.postgresql.org/about/news/2077/

supported versions of our database system, including 12.4, 11.9, 10.14,
9.6.19, and 9.5.23.

This release closes two security vulnerabilities and fixes over 50 bugs
reported over the last three months.

Please plan to update at your earliest convenience.

Security Issues
---------------

* CVE-2020-14349: Uncontrolled search path element in logical replication.

Versions Affected: 10 - 12.

The PostgreSQL `search_path` setting determines schemas searched for
tables, functions, operators, etc. The CVE-2018-1058 fix caused most
PostgreSQL-provided client applications to sanitize `search_path`, but
logical replication continued to leave `search_path` unchanged. Users of
a replication publisher or subscriber database can create objects in the
`public` schema and harness them to execute arbitrary SQL functions
under the identity running replication, often a superuser. Installations
having adopted a documented secure schema usage pattern are not vulnerable.

The PostgreSQL project thanks Noah Misch for reporting this problem.

* CVE-2020-14350: Uncontrolled search path element in `CREATE EXTENSION`.

Versions Affected: 9.5 - 12. The security team typically does not test
unsupported versions, but this problem is quite old.

When a superuser runs certain `CREATE EXTENSION` statements, users may
be able to execute arbitrary SQL functions under the identity of that
superuser. The attacker must have permission to create objects in the
new extension's schema or a schema of a prerequisite extension.  Not all
extensions are vulnerable.

In addition to correcting the extensions provided with PostgreSQL, the
PostgreSQL Global Development Group is issuing guidance for third-party
extension authors to secure their own work.

The PostgreSQL project thanks Andres Freund for reporting this problem.

Security:	CVE-2020-14349, CVE-2020-14350