)]}' { "log": [ { "commit": "867c6a147df1e5f75e1ffb889a6884ad1b26770c", "tree": "ac9dc397bb9414f7b22c750bf191d5e34cfb01aa", "parents": [ "217874dcc08c9db165e2a827a96726039ee925d4" ], "author": { "name": "FairyFar", "email": "fairyfar@msn.com", "time": "Wed Sep 02 15:39:49 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Sep 02 10:39:49 2026 +0300" }, "message": "Fix assert failure triggered by \"CREATE INDEX CONCURRENTLY\" (#1845)\n\nWhen resource group is enabled, StartTransaction() may take a catalog\nsnapshot while assigning a resource group, leaving a valid xmin in MyProc.\nThat fails the assertion in set_indexsafe_procflags() that the process must\nnot advertise an xmin when running \"CREATE INDEX CONCURRENTLY\".\n\nFix it at the point the invariant lives: set_indexsafe_procflags() now\ninvalidates any stale catalog snapshot before asserting, so every\nREINDEX CONCURRENTLY phase clears the xmin ahead of setting PROC_IN_SAFE_IC." }, { "commit": "217874dcc08c9db165e2a827a96726039ee925d4", "tree": "71adaea184b99fcc4425e2351db2112d08e59854", "parents": [ "c80d6cf7b9762370030b519db0b526aed228e9d2" ], "author": { "name": "liuxiaoyu", "email": "45345701+MisterRaindrop@users.noreply.github.com", "time": "Tue Sep 01 15:41:58 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Sep 01 15:41:58 2026 +0800" }, "message": "Add contrib/datalake_fdw: Apache Iceberg lake tables as an extension (#1842)\n\nMakes an Iceberg table usable as an ordinary Cloudberry table, with no\nkernel changes:\n\n CREATE SERVER cat FOREIGN DATA WRAPPER iceberg_catalog_fdw\n OPTIONS (type \u0027rest\u0027, uri \u0027...\u0027, warehouse \u0027s3://bkt/wh\u0027);\n CREATE USER MAPPING FOR CURRENT_USER SERVER cat OPTIONS (...);\n CREATE SERVER vol FOREIGN DATA WRAPPER iceberg_volume_fdw\n OPTIONS (base_path \u0027s3://bkt/prefix\u0027);\n\n CREATE TABLE t (a int, b text) USING iceberg\n WITH (catalog \u003d \u0027cat\u0027, volume \u003d \u0027vol\u0027);\n\nThe module registers a table access method and the two wrappers above,\nand recognises lake tables through ProcessUtility_hook and\nobject_access_hook. The table -\u003e server mapping is kept in pg_depend on\nthe coordinator and every segment, so DROP SERVER is refused while a\nlake table references it. Credentials live only in USER MAPPING.\n\nAn earlier revision added kernel syntax instead -- CREATE ICEBERG TABLE\nand two new catalogs, with a catversion bump. Review preferred reaching\nthe same place through mechanisms PostgreSQL already has, so that work\nwas reverted and this replaces it; nothing in src/backend changes.\n\nThis is a skeleton: CREATE TABLE and DROP TABLE work end to end against\na stub metadata engine, and everything that would touch data reports\n\"iceberg: \u003coperation\u003e is not supported yet\". DROP TABLE leaves the lake\ndata alone unless the table was created with purge_on_drop \u003d true.\n\nOff by default behind --enable-datalake-fdw. It is not compiled into the\nRPM: CI installs the shipped server and builds the extension against it\nwith PGXS, the way anyone outside the project would. The module must be\nin shared_preload_libraries; _PG_init refuses to load any other way.\n\nKnown limits: a full pg_dump of a database containing a lake table fails\n(dumping contents means scanning; a schema-level dump round-trips),\nALTER SERVER ... RENAME on a referenced server is refused because the\nmapping stores names, and every ALTER TABLE form except OWNER TO is\nrefused while the access method is unfinished." }, { "commit": "c80d6cf7b9762370030b519db0b526aed228e9d2", "tree": "813a9e5cf8ff16cbb3906639a663a7cdf78a611a", "parents": [ "408575cc4c6ce65c0734d834299cade68521232c" ], "author": { "name": "ZTE-EBASE", "email": "EBASE.Mars@zte.com.cn", "time": "Tue Sep 01 04:25:18 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 31 23:25:18 2026 +0300" }, "message": "Fix putIntoUnackQueueRing function logic for Intercontect interfaces (#1931)\n\nFix putIntoUnackQueueRing function logic for Intercontect interfaces\n\nwhat\nThere are several logic issues in the putIntoUnackQueueRing function.\nDefect 1: Redundant idx calculation (Severity: Low-Medium)\nDefect 2: Misuse of TIMER_SPAN_LOSS (Severity: Medium)\nDefect 3: Redundant conditional judgment (Severity: Very Low)\n\nwhy\nFor Defect 1 (Redundant idx calculation):\n\nPerformance waste: Each call executes one extra integer division and modulo operation (~5-10ns per call)\nPoor maintainability: If someone modifies one formula but forgets the other, it introduces hard-to-debug bugs\nCode confusion: Readers wonder \"why calculate twice?\"\nMisleading logs: Line 7054\u0027s log shows the first calculation, but line 7058\u0027s result is actually used\nFor Defect 2 (TIMER_SPAN_LOSS misuse):\n\nTime alignment bias: Expected 5ms boundary alignment, actual 2.5ms alignment\nImprecise retransmission timing: May cause packets to trigger retransmission too early or too late\nDegraded flow control performance: Affects accuracy of timeout-based mechanisms\nSubtle bug: Not immediately obvious during testing but impacts long-term stability\nFor Defect 3 (Redundant conditional):\n\n---------\n\nCo-authored-by: 王平10304955 \u003cwang.ping20@zte.com.cn\u003e" }, { "commit": "408575cc4c6ce65c0734d834299cade68521232c", "tree": "0edc102e5da05c1279e7ea074d8df5b71a1249e2", "parents": [ "bff5db9a2f4c5b25485572438d2c618a838e9a56" ], "author": { "name": "Hao Wu", "email": "gfphoenix78@gmail.com", "time": "Thu Aug 13 20:35:24 2026 +0800" }, "committer": { "name": "Hao Wu", "email": "gfphoenix78@gmail.com", "time": "Mon Aug 31 11:43:23 2026 +0800" }, "message": "Fix spurious global xmin \u003e xmin error on rollback\n\nGetSnapshotData() on a QE computes xmin under ProcArrayLock but\nreads/advances DistributedLogShared-\u003eoldestXmin afterwards, in a\ndifferent lock domain. In that window a concurrent backend can advance\nthe shared oldestXmin past this snapshot\u0027s xmin: when the transaction\nwhose local xid equals xmin aborts, its distributed-log entry keeps\ndistribXid \u003d\u003d 0, so DistributedLog_AdvanceOldestXmin()\u0027s forward scan\nskips over it instead of stopping, bumping oldestXmin beyond xmin. The\nresulting globalxmin \u003e xmin then tripped a hard elog(ERROR) and failed\nthe query (seen intermittently in the partition_prune regression test).\n\nThe aborted xid is invisible to this snapshot anyway, and the\nvisibility horizon only needs to be a valid lower bound, so a horizon\nat our own xmin loses nothing. Clamp globalxmin to xmin instead of\nerroring -- always safe, and consistent with the clamp already done in\nDistributedLog_GetOldestXmin().\n" }, { "commit": "bff5db9a2f4c5b25485572438d2c618a838e9a56", "tree": "de5fbfbbc92ddb4914e5a8b8d262e8dc0d4e8556", "parents": [ "4d209d23b45b146f9970f652a74a11b562091d6c" ], "author": { "name": "Konstantin Glukhov", "email": "KGlukhov@Hotmail.com", "time": "Wed Aug 26 10:50:09 2026 +0900" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Sat Aug 29 08:48:55 2026 +0800" }, "message": "Fix missing libicu-devel dependency in sandbox image\n\nAdd libicu-devel to devops/sandbox/Dockerfile.main.rockylinux9.\nThe sandbox build was failing because this dependency was\nmissing from the image.\nsandbox build requires libicu-devel\n" }, { "commit": "4d209d23b45b146f9970f652a74a11b562091d6c", "tree": "00c62fa612a9add146035f2d16f2f08bd1e201bd", "parents": [ "eaf8e2569bd30691bf84ee78718e5154ecd3c5fd" ], "author": { "name": "Vaibhav Srivastava", "email": "vaibhavsri1712@gmail.com", "time": "Mon Aug 24 13:57:15 2026 +0530" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Fri Aug 28 20:08:03 2026 +0800" }, "message": "docs: fix typo implmentation -\u003e implementation" }, { "commit": "eaf8e2569bd30691bf84ee78718e5154ecd3c5fd", "tree": "c6082658b54fb152be4ef91d0a3ed1dabd3ff6ec", "parents": [ "aab01f6941ed2aa3e85d1ee694219a00dc85e7a1" ], "author": { "name": "Alena Rybakina", "email": "58230554+Alena0704@users.noreply.github.com", "time": "Thu Aug 27 18:16:19 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Aug 27 18:16:19 2026 +0300" }, "message": "Add predefined role pg_manage_resource_groups (#1795)\n\nIn Cloudberry/Greenplum only a superuser can manage resource groups.\nIn managed-service deployments superuser cannot be granted to the\nclient, so the cloud admin has no way to tune their own CPU and\nmemory limits.\n\nAdd a predefined role pg_manage_resource_groups (OID 6300) in\npg_authid.dat, following the upstream convention used by pg_monitor\nand pg_read_all_data. Members of this role can CREATE, ALTER and DROP\nresource groups and call pg_resgroup_move_query() without being a\nsuperuser. Delegation is done with standard SQL:\n\n GRANT pg_manage_resource_groups TO \u003cuser\u003e;\n\nThe regression and isolation2 tests exercise the new role via GRANT.\nThe basic CREATE/ALTER/DROP test cases in the regression test are\nadapted from open-gpdb/gpdb commit 3ac99962ad2.\n\nCo-authored-by: Andrey Borodin \u003cx4mmm@yandex-team.ru\u003e" }, { "commit": "aab01f6941ed2aa3e85d1ee694219a00dc85e7a1", "tree": "d1adcb8aefb68bcce94dd0394a85cf8e38e986b0", "parents": [ "e66d65ce4c900961985e8ba767fbaa8363ccfce7" ], "author": { "name": "reshke", "email": "reshke@double.cloud", "time": "Wed Aug 19 12:02:31 2026 +0000" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Thu Aug 27 13:10:10 2026 +0500" }, "message": "Partially re-apply https://github.com/postgres/postgres/commit/63f01980560adb57524f8b004b8f47de7e29cc38\n" }, { "commit": "e66d65ce4c900961985e8ba767fbaa8363ccfce7", "tree": "7b8f9504191dcb374bff8c5c0eddf6d1728049c8", "parents": [ "a4d181e67d5a1a6633219206f4f17632eac0d0d8" ], "author": { "name": "Tomas Vondra", "email": "tomas.vondra@postgresql.org", "time": "Mon Aug 19 00:04:41 2024 +0200" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Thu Aug 27 13:10:10 2026 +0500" }, "message": "Fix DROP DATABASE for databases with many ACLs\n\nCommit c66a7d75e652 modified DROP DATABASE so that if interrupted, the\ndatabase is known to be in an invalid state and can only be dropped.\nThis is done by setting a flag using an in-place update, so that it\u0027s\nnot lost in case of rollback.\n\nFor databases with many ACLs, this may however fail like this:\n\n ERROR: wrong tuple length\n\nThis happens because with many ACLs, the pg_database.datacl attribute\ngets TOASTed. The dropdb() code reads the tuple from the syscache, which\nmeans it\u0027s detoasted. But the in-place update expects the tuple length\nto match the on-disk tuple.\n\nFixed by reading the tuple from the catalog directly, not from syscache.\n\nReport and fix by Ayush Tiwari. Backpatch to 12. The DROP DATABASE fix\nwas backpatched to 11, but 11 is EOL at this point.\n\nReported-by: Ayush Tiwari\nAuthor: Ayush Tiwari\nReviewed-by: Tomas Vondra\nBackpatch-through: 12\nDiscussion: https://postgr.es/m/CAJTYsWWNkCt+-UnMhg\u003dBiCD3Mh8c2JdHLofPxsW3m2dkDFw8RA@mail.gmail.com\n" }, { "commit": "a4d181e67d5a1a6633219206f4f17632eac0d0d8", "tree": "0ab433c2b21a69f4c03c7fadc8e12913d9a0fb20", "parents": [ "ca01a13a5765128971a8682a15cabfcb27530bd3" ], "author": { "name": "Kirill Reshke", "email": "reshke@double.cloud", "time": "Wed Aug 19 07:38:54 2026 +0500" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Thu Aug 27 13:10:10 2026 +0500" }, "message": "Re-apply DROP DATABASE getting interrupted fix and adapt for MPP\n\nIn CBDB, DROP database is hazardous in few kill-9 scenarios. Most of them are already fixed in PostgreSQL, so bring this fix to our fork. Additional change here required to move DROP DATABASE on QE dispatch AFTER marking database as invalid on QD, otherwise we can get in case where QD did not mark database as invalid, and allows connections, while QE already removed datadirs. FAULT-INJECTION test hits this (without code fix)\n\nThis is re-apply of https://git.postgresql.org/cgit/postgresql.git/commit/?id\u003dc66a7d75e652801043ece99b6a8f89fd9513eaaa with additional cbdb fixes \u0026 tests\n\nUntil now, when DROP DATABASE got interrupted in the wrong moment, the removal\nof the pg_database row would also roll back, even though some irreversible\nsteps have already been taken. E.g. DropDatabaseBuffers() might have thrown\nout dirty buffers, or files could have been unlinked. But we continued to\nallow connections to such a corrupted database.\n\nTo fix this, mark databases invalid with an in-place update, just before\nstarting to perform irreversible steps. As we can\u0027t add a new column in the\nback branches, we use pg_database.datconnlimit \u003d -2 for this purpose.\n\nAn invalid database cannot be connected to anymore, but can still be\ndropped.\n\nUnfortunately we can\u0027t easily add output to psql\u0027s \\l to indicate that some\ndatabase is invalid, it doesn\u0027t fit in any of the existing columns.\n\nAdd tests verifying that a interrupted DROP DATABASE is handled correctly in\nthe backend and in various tools.\n\nIn cloudberry, we also move segment DDL dispach after pg_database tuple\ntransaction commit, otherwise, if killed, segments will already drop\nthier datadirs, while QD not.\n\nReported-by: Evgeny Morozov \u003cpostgresql3@realityexists.net\u003e\nAuthor: Andres Freund \u003candres@anarazel.de\u003e\nCo-authored-by: reshke \u003creshke@double.cloud\u003e (Cloudberry part)\nReviewed-by: Daniel Gustafsson \u003cdaniel@yesql.se\u003e\nReviewed-by: Thomas Munro \u003cthomas.munro@gmail.com\u003e\nDiscussion: https://postgr.es/m/20230509004637.cgvmfwrbht7xm7p6@awork3.anarazel.de\nDiscussion: https://postgr.es/m/20230314174521.74jl6ffqsee5mtug@awork3.anarazel.de\nBackpatch: 11-, bug present in all supported versions\n" }, { "commit": "ca01a13a5765128971a8682a15cabfcb27530bd3", "tree": "c1548a1a018e8ddc10a3653afd7f823ba55634a3", "parents": [ "496632bfc4e27f280db6eff6b99266786e65c55f" ], "author": { "name": "reshke", "email": "reshke@double.cloud", "time": "Tue Aug 25 19:17:29 2026 +0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 25 19:17:29 2026 +0500" }, "message": "Fix extnesible SMGR API violation in ao_truncate replay (#1925)" }, { "commit": "496632bfc4e27f280db6eff6b99266786e65c55f", "tree": "bf6be7e9f1fc14a5543d6bf6ab2f79d9c50018e4", "parents": [ "aff8645f1ca7ed8ce1ac97b85ac866da452393e0" ], "author": { "name": "zhaoxi", "email": "oracleloyal@gmail.com", "time": "Thu Aug 20 11:20:00 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Tue Aug 25 16:51:37 2026 +0800" }, "message": "Keep the pax schedule entries that other tests depend on for timing\n\nTwo of the entries removed from the PAX schedules were not only test\ncoverage: they also acted as quiescent points that later, timing-\nsensitive tests rely on. Removing them made those tests fail in CI,\nso restore them.\n\ncontrib/pax_storage/src/test/isolation2:\n\n terminate_in_gang_creation The schedule comment directly above this\n entry says the case contains fault\n injection and must be put in a separate\n test group. It is also the only removed\n isolation2 entry that ran before\n workfile_mgr_test, whose first action is\n an immediate cluster restart. Without it,\n workfile_mgr_test\u0027s \"gpstop -ari\" returns\n exit code 2 and the cluster does not come\n back, so the following queries report two\n segments instead of four. Restoring the\n entry makes pax-ic-isolation2-opt-on pass\n again.\n\ncontrib/pax_storage/src/test/regress:\n\n parallel_schedule Restore the schedule unchanged, together\n with the eight test files it references\n (roleattributes, init_privs, drop_operator,\n password, dbsize, sysviews, gp_foreign_data\n and oidjoins). gp_foreign_data ran as a\n group of its own immediately before the\n group holding \"indexing\", and \"indexing\"\n runs two CREATE INDEX CONCURRENTLY\n statements, one of which fails with a\n division by zero on purpose. With the\n earlier groups shortened, that statement\n now reports synchronous replication\n messages the expected file does not carry.\n Restoring only gp_foreign_data was not\n enough, so the whole schedule change is\n reverted rather than guessed at.\n\nThe statement-level trimming in src/test/regress, the removal of the 103\nstorage-independent files under contrib/pax_storage, and the\ngreenplum_schedule reduction are unchanged, so the bulk of the deletion\nis kept: greenplum_schedule stays at 307 tests.\n\nThis is kept as a separate commit on purpose, so it can be reverted on\nits own if the CI evidence changes.\n" }, { "commit": "aff8645f1ca7ed8ce1ac97b85ac866da452393e0", "tree": "7e1ffc20c5b47f42e5854f588aed2bec82b70dd2", "parents": [ "48f8f026a7feca538738a96ab5b23c27e8dffaf1" ], "author": { "name": "zhaoxi", "email": "oracleloyal@gmail.com", "time": "Wed Aug 19 14:05:00 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Tue Aug 25 16:51:37 2026 +0800" }, "message": "Trim redundant regression cases and oversized test fixtures\n\nSeveral regression files carry large blocks of cases whose coverage is\nalready provided by other cases in the same file, and fixtures sized far\nbeyond what the assertions actually need. Removing them shortens the\ntest run without dropping any distinct behaviour under test.\n\nsrc/test/regress:\n\n qp_olap_window Every functional label (window function x frame\n clause x partition clause) was repeated 16 times\n with only the projected column list permuted, which\n produces the same plan and the same result shape.\n Keep four variants per label: 2977 -\u003e 1104\n statements, 24035 -\u003e 8875 lines.\n\n qp_olap_windowerr The same error paths (division by zero, invalid\n preceding/following size, negative frame offset)\n are repeated once per aggregate. Keep one\n aggregate per error class: 440 -\u003e 213 statements.\n All 24 distinct ERROR messages are still produced.\n\n qp_dropped_cols The decimal axis duplicates the numeric axis\n exactly, decimal being an alias of numeric, so drop\n it: 4000 -\u003e 3426 statements.\n\n qp_gist_indexes2 The compression axis does not interact with the\n GiST index behaviour under test; drop it:\n 522 -\u003e 320 statements.\n\n cbdb_parallel Shrink the parallel bitmap heap scan fixtures from\n 10,000,000 rows to 1,000,000 and 2,000,000, and\n from 5,000,000 to 1,000,000. The plan shapes being\n asserted do not depend on the row counts.\n\nsrc/test/isolation2:\n\n uao/fast_analyze Drop three doubling steps from the data pyramid,\n 4,608,000 -\u003e 1,152,000 rows. The test only checks\n that the sample scan touches a bounded number of\n blocks, which the smaller table already exceeds.\n\ncontrib/pax_storage/src/test:\n\n The PAX suites carry verbatim copies of 103 test files that do not\n exercise PAX storage at all: the gp_interconnect_* family (11 files),\n qp_* query-processing cases (20), FTS and recovery cases (4), and\n further storage-independent cases. All of them already run in the\n main suites. Remove the files together with their schedule entries:\n\n regress/greenplum_schedule 397 -\u003e 307 tests\n regress/parallel_schedule 183 -\u003e 175 tests\n isolation2/isolation2_schedule 146 -\u003e 141 tests\n\nNo schedule is left with a dangling reference, no remaining test depends\non an object created by a removed one, and no test file becomes\nunreferenced by the removal.\n\nVerified on a three-segment demo cluster built with --enable-pax by\nrunning each suite before and after the change in both optimizer modes\nwith default_table_access_method\u003dpax: the change introduces no new\nfailures, and the PAX regress suite drops from 575 to 477 executed\ntests.\n" }, { "commit": "48f8f026a7feca538738a96ab5b23c27e8dffaf1", "tree": "ceaa6f786573c86011144768c88df42af37b367d", "parents": [ "1a5641bbb86a99ccecc44ca921bab81d3cf39f1d" ], "author": { "name": "zhangwenchao", "email": "656540940@qq.com", "time": "Mon Jun 22 18:51:34 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Tue Aug 25 13:52:34 2026 +0800" }, "message": "Fix use-after-free in CXformSplitWindowFunc\n\nCXformSplitWindowFunc::Transform() builds a local and a global\nCLogicalSequenceProject, and each constructor takes ownership of one\nreference to the window\u0027s distribution spec (pds), order specs\n(pdrgpos) and frames (pdrgpwf). Only a single AddRef() was issued for\neach object, so once both SequenceProjects and the original are\nreleased the reference count underflows and the objects are freed\nwhile still in use.\n\nThe dangling memory later surfaces as a corrupt (unaligned) scalar\nDXL node while translating a table scan filter, crashing the\ncoordinator with SIGSEGV at CTranslatorDXLToScalar.cpp:111 during\nDXL-to-PlStmt translation. This reproduces on window-function queries\n(e.g. TPC-DS query 44) when optimizer_force_split_window_function is\non; the transform is only enabled under that GUC, which is why the\ncrash disappears when it is off.\n\nAdd the missing AddRef() for pds, pdrgpos and pdrgpwf before building\nthe global SequenceProject, and for the Select operator and its scalar\ncomparison before reusing them in the global Select, so every owner\nholds its own reference.\n" }, { "commit": "1a5641bbb86a99ccecc44ca921bab81d3cf39f1d", "tree": "a5ae37d659f3200ad0516cea69a9b300efa04149", "parents": [ "b1e80d96a1d59984fd4dd34d87b97be63997c320" ], "author": { "name": "reshke", "email": "reshke@double.cloud", "time": "Mon Aug 24 14:37:09 2026 +0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Aug 24 14:37:09 2026 +0500" }, "message": "Fix extnesible SMGR API violation in register_dirty_segment_ao (#1918)\n\n$subj, in CBDB we allow extension to hijack all SMGR calls via\ninterface, but register_dirty_segment_ao didn\u0027t follow the memo.\nExntension that need this is Yezzey" }, { "commit": "b1e80d96a1d59984fd4dd34d87b97be63997c320", "tree": "3a82b494554a025bfd2addf684d41396fabfb85a", "parents": [ "977f63daf7727351eee5945576cde8414ba793c1" ], "author": { "name": "Jianghua Yang", "email": "yjhjstz@gmail.com", "time": "Mon Aug 24 10:23:32 2026 +0800" }, "committer": { "name": "Jianghua.yjh", "email": "yjhjstz@gmail.com", "time": "Sun Aug 23 21:14:36 2026 -0700" }, "message": "fix(orca): avoid crash on ordered-set aggregate without direct args\n\nThere is a crash when use mode() for ORCA.\n```\n$ psql\ngpadmin\u003d# create table test_mode (a int, b text);\nCREATE TABLE\ngpadmin\u003d# explain select mode() within group (order by b) from test_mode limit 10;\nserver closed the connection unexpectedly\n\tThis probably means the server terminated abnormally\n\tbefore or while processing the request.\nThe connection to the server was lost. Attempting reset: Failed.\n!\u003e \\q\n\n```\n\nReason: CUtils::FHasOrderedAggToSplit() unconditionally dereferenced the\ndirect-args child of an ordered-set aggregate. That child exists but is\nempty for mode(), the only built-in ordered-set aggregate with no direct\nargument, so the access tripped a GPOS_ASSERT in debug builds and caused\na SIGSEGV in release builds during ORCA query preprocessing.\n\nGuard the ordered aggregate child accesses and bail out early when the\nargs, direct-args, or order children are empty. This leaves mode() as a\nregular ordered-set Aggref for ORCA to plan, instead of trying to split\nit into the gp_percentile-specific rewrite.\n\nAdd sql regress cases covering mode().\n" }, { "commit": "977f63daf7727351eee5945576cde8414ba793c1", "tree": "f4e347db71f50cb3b772a6ebaa1431959a0a6b47", "parents": [ "d8805f1451d073d391e767452c1cf781249833dc" ], "author": { "name": "Jianghua Yang", "email": "yjhjstz@gmail.com", "time": "Fri Aug 21 00:36:30 2026 +0800" }, "committer": { "name": "Jianghua.yjh", "email": "yjhjstz@gmail.com", "time": "Sun Aug 23 14:26:32 2026 -0700" }, "message": "[ORCA] Narrow CTE Producer columns in CXformGbAggWithMDQA2Join\n\nWhen rewriting a GbAgg with multiple distinct-qualified aggregates\n(MDQAs) into a join of single-DQA aggregates, the transform declared\nevery column the child expression could produce on the CTE Producer.\nOn the partitioned-table path the over-declared columns included\nunreferenced and system columns whose usage state is EUnknown/EUnused,\nwhich fails the assertion \"col_ref-\u003eGetUsage() !\u003d CColRef::EUnknown\"\nin CPhysicalCTEProducer::PcrsRequired on assert builds and crashes\nwith SIGSEGV in MakeDXLTableDescr on release builds:\n\n CREATE TABLE mdqa_part(a int, b int, c int, d int)\n DISTRIBUTED BY (a)\n PARTITION BY RANGE(a) (START (0) END (100) EVERY (50),\n DEFAULT PARTITION other);\n SET optimizer_enable_multiple_distinct_aggs \u003d on;\n SELECT a, count(DISTINCT b), count(DISTINCT c)\n FROM mdqa_part WHERE b BETWEEN 0 AND 2 GROUP BY a;\n\nFix by restricting the CTE Producer/Consumer columns to the columns\nthe GbAgg actually needs: group-by keys plus aggregate-argument\nreferences, clipped to what the child can produce. Besides fixing the\ncrash, this also simplifies MDQA plans on non-partitioned tables: the\nnarrowed producer no longer carries unused and system columns, and\nORCA can now place a single Redistribute Motion below the producer\ninstead of one per consumer.\n\nPorted from warehouse-pg/warehouse-pg#149, minidump changes omitted.\n" }, { "commit": "d8805f1451d073d391e767452c1cf781249833dc", "tree": "f62a5e094b04fbceb2a3ed0ac1930b18263c4f48", "parents": [ "8fdd5caec7105e0f522ad9931d137b8211eb7eaa" ], "author": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Aug 20 11:30:51 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Sat Aug 22 07:47:53 2026 +0800" }, "message": "Fix duplicate --with-zstd configure declaration\n\nThe REL_16 (PG16) merge added an upstream PostgreSQL --with-zstd\nblock on top of the existing Greenplum one, leaving two\nPGAC_ARG_BOOL(with, zstd, ...) declarations in configure.ac.\n\nThe two AC_ARG_WITH expansions interact through ${with_zstd+set}:\nthe first block (default \"no\") sets with_zstd, so the second block\n(default \"yes\") sees it already set and becomes a no-op. The\neffective default therefore flipped from \"yes\" to \"no\", so a plain\n./configure disabled zstd and gpcontrib/zstd no longer built by\ndefault -- a regression from REL_2_STABLE.\n\nDrop the upstream default-\"no\" declaration and keep the single\nGreenplum block (default \"yes\"), moving the -I/-D/-L flag injection\ninto it so the later AC_CHECK_LIB/AC_CHECK_HEADER probes still\nresolve zstd in non-standard prefixes. This mirrors the parallel\n--with-lz4 block. The generated configure is updated to match.\n\nAssisted-by: Claude Code\n" }, { "commit": "8fdd5caec7105e0f522ad9931d137b8211eb7eaa", "tree": "efa8e32aee2dd0b94e3eaada076452776947c812", "parents": [ "0180e48b8c1c5ad9a0b432b0a69e6f76d93a285f" ], "author": { "name": "Zhang Wenchao", "email": "zhangwenchao@apache.org", "time": "Mon Jun 22 18:24:29 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Aug 20 15:47:26 2026 +0800" }, "message": "[ORCA] Support hash partitioning in ORCA\n\nGPORCA previously rejected any query touching a hash-partitioned table\nand fell back to the Postgres planner. Enable GPORCA to plan such\nqueries, with static partition pruning for equality predicates and\ndynamic (join-driven) partition elimination.\n\nHow:\n- CTranslatorRelcacheToDXL: stop raising \"hash partitioning\" for a\n single-column, single-level hash partition key and let the strategy\n flow into GPORCA. Composite keys, partitioning by expression and\n multi-level partitioning still fall back to the planner.\n- IMDRelation: add ErelpartitionHash (\u0027h\u0027) to the partition-type enum.\n- CExpressionPreprocessor: a hash leaf\u0027s qual is a\n satisfies_hash_partition() call with no btree-interval form, so\n PcnstrFromChildPartition now returns NULL instead of asserting. Add\n FHashPartitionPruned(): substitute the query\u0027s equality constants for\n the partition-key columns into that call and evaluate it with the\n constant-expression evaluator; a leaf whose call folds to false cannot\n hold a matching row and is pruned. This reuses PostgreSQL\u0027s exact\n hashing (seed, per-column proc, combine), so selection is identical.\n- CConstExprEvaluatorDXL: allow folding any column-free immutable\n expression (e.g. satisfies_hash_partition over constants), not only\n (const cmp const). Volatile/stable and column-referencing expressions\n are still rejected.\n\nDynamic partition elimination needs no hash-specific code: once hash\ntables become CLogicalDynamicGet the existing CPhysicalPartitionSelector\npath is partition-type agnostic, and CPartPruneStepsBuilder resolves the\nstrategy from the partition\u0027s own hash opfamily.\n\nORCA vs Postgres planner behavior:\n- Partition selection and results are identical. For the supported\n single-column, single-level hash key, an equality predicate prunes to\n exactly the same surviving partition(s) as the Postgres planner and\n returns the same rows row-for-row. When a single partition survives,\n both narrow dispatch to that one segment (Gather Motion 1:1).\n- Unchanged: composite keys, partitioning by expression and multi-level\n partitioning still fall back to the Postgres planner, and range/list\n pruning is unaffected.\n\nAuthored-by: Zhang Wenchao \u003czhangwenchao@apache.org\u003e\n" }, { "commit": "0180e48b8c1c5ad9a0b432b0a69e6f76d93a285f", "tree": "276c446f0b13cf168c446e796cd73b82542e33d1", "parents": [ "2f17c3a5d84f6556c03cb8efea01359b1aafcd85" ], "author": { "name": "reshke", "email": "reshke@double.cloud", "time": "Wed Aug 19 09:18:38 2026 +0000" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Aug 20 13:40:46 2026 +0800" }, "message": "Add makefile and preprocessin guards for --without-zstd configure\n" }, { "commit": "2f17c3a5d84f6556c03cb8efea01359b1aafcd85", "tree": "820c40cd4f66c07adf1d50372f342e200b2d910f", "parents": [ "99c62cffc17ed623ea4c687da91c3bca96237493" ], "author": { "name": "reshke", "email": "reshke@double.cloud", "time": "Wed Aug 19 20:33:10 2026 +0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Aug 19 20:33:10 2026 +0500" }, "message": "Fix: gpstart waits for coordinator to finish recovery before connecting (#1898)\n\nIn CBDB3 after the upstream PG16 rebase on commit 7ff23c6d\n PMSIGNAL_RECOVERY_STARTED is now sent during crash recovery too.\n\nWith hot_standby\u003doff (the default), this causes postmaster to write\nPM_STATUS_STANDBY to the pidfile as soon as recovery begins, and\npg_ctl -w treats standby as success. \ngpstart then hits FATAL \"Hot standby mode is disabled\".\n\nAdd a shared simple helper that polls dbconn.connect\nwith a 5s interval up to 300s, retrying only on recovery-related FATAL\nmessages (not accepting connections / not yet accepting connections)" }, { "commit": "99c62cffc17ed623ea4c687da91c3bca96237493", "tree": "84cb20fe0bd14c0102501edbddc99bffd958bf30", "parents": [ "6b9df409a5d8fbb852906d255e039f90b69b0ba3" ], "author": { "name": "reshke", "email": "reshke@double.cloud", "time": "Tue Aug 18 23:58:09 2026 +0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 18 23:58:09 2026 +0500" }, "message": "Fix JOIN motion type selection for join quals containing outer refs (#1895)\n\nIn some cases planner failed to mark join qual restrict clauses as ones referring outer query levels. This makes join motion planning code to make wrong query: it uses redistribute motion in cases it shouldn\u0027t. \nIn this simple reproduces this leads to motion plan node rescan (this is execute-time ERROR normally). Note that for `generate_series(1,1) t1` it would work, because our parametrized plan would execute only once. \n\n```\n\nCREATE TABLE t2(i int);\nCREATE TABLE t3(i int);\n\nINSERT INTO t2 SELECT generate_series(1,10);\nINSERT INTO t3 SELECT generate_series(1,10);\n\nselect * from generate_series(1,2) t1, lateral (select t3.i from t2 join t3 on t2.i \u003d t3.i + t1 order by 1) z;\n\n\n\nERROR: illegal rescan of motion node: invalid plan (nodeMotion.c:1368) (seg1 slice1 127.0.1.1:7003 pid\u003d879693) (nodeMotion.c:1368)\nHINT: Likely caused by bad NL-join, try setting enable_nestloop to off\n\n\nreshke\u003d# explain select * from generate_series(1,1) t1, lateral (select t3.i from t2 join t3 on t2.i \u003d t3.i + t1 order by 1) z;\n QUERY PLAN\n----------------------------------------------------------------------------------------------------------------------\n Gather Motion 3:1 (slice1; segments: 3) (cost\u003d10000623579.03..10000785868.61 rows\u003d9273690 width\u003d8)\n -\u003e Nested Loop (cost\u003d10000623579.03..10000662219.41 rows\u003d3091230 width\u003d8)\n -\u003e Function Scan on generate_series t1 (cost\u003d0.00..0.01 rows\u003d1 width\u003d4)\n -\u003e Materialize (cost\u003d623579.02..646763.25 rows\u003d3091230 width\u003d4)\n -\u003e Sort (cost\u003d623579.02..631307.10 rows\u003d3091230 width\u003d4)\n Sort Key: t3.i\n -\u003e Hash Join (cost\u003d756.25..290348.30 rows\u003d3091230 width\u003d4)\n Hash Cond: ((t3.i + t1.t1) \u003d t2.i)\n -\u003e Redistribute Motion 3:3 (slice2; segments: 3) (cost\u003d0.00..997.00 rows\u003d32100 width\u003d4)\n Hash Key: (t3.i + t1.t1)\n -\u003e Seq Scan on t3 (cost\u003d0.00..355.00 rows\u003d32100 width\u003d4)\n -\u003e Hash (cost\u003d355.00..355.00 rows\u003d32100 width\u003d4)\n -\u003e Seq Scan on t2 (cost\u003d0.00..355.00 rows\u003d32100 width\u003d4)\n Optimizer: Postgres query optimizer\n(14 rows)\n```\n\n\nAs we can see, Redistribute Motion uses `Hash Key: (t3.i + t1.t1)` which is parametrized by outer rel (t1). \n\nWith fix:\n\n```\nreshke\u003d# explain select * from generate_series(1,1) t1, lateral (select t3.i from t2 join t3 on t2.i \u003d t3.i + t1 order by 1) z;\n QUERY PLAN\n-------------------------------------------------------------------------------------------------------------------\n Nested Loop (cost\u003d10000000117.94..10000000129.99 rows\u003d963 width\u003d8)\n -\u003e Function Scan on generate_series t1 (cost\u003d0.00..0.01 rows\u003d1 width\u003d4)\n -\u003e Materialize (cost\u003d117.94..125.16 rows\u003d963 width\u003d4)\n -\u003e Sort (cost\u003d117.94..120.34 rows\u003d963 width\u003d4)\n Sort Key: t3.i\n -\u003e Hash Join (cost\u003d33.90..70.21 rows\u003d963 width\u003d4)\n Hash Cond: (t2.i \u003d (t3.i + t1.t1))\n -\u003e Materialize (cost\u003d0.00..21.87 rows\u003d963 width\u003d4)\n -\u003e Gather Motion 3:1 (slice1; segments: 3) (cost\u003d0.00..17.05 rows\u003d963 width\u003d4)\n -\u003e Seq Scan on t2 (cost\u003d0.00..4.21 rows\u003d321 width\u003d4)\n -\u003e Hash (cost\u003d21.87..21.87 rows\u003d963 width\u003d4)\n -\u003e Materialize (cost\u003d0.00..21.87 rows\u003d963 width\u003d4)\n -\u003e Gather Motion 3:1 (slice2; segments: 3) (cost\u003d0.00..17.05 rows\u003d963 width\u003d4)\n -\u003e Seq Scan on t3 (cost\u003d0.00..4.21 rows\u003d321 width\u003d4)\n Optimizer: Postgres query optimizer\n(15 rows)\n\n```\n\nThe before-plan is better in term of performance, expect it is not valid ;). We receive executor-time error becuase of motion rescan. The after-fix plan is worse, but can be executed correctly. In fact, the sole thing this PR do is correctly use infrastructure committed at 00e25afe119c\n\nin fact, I think pushing down join below the motion is possible, so some types of plans. But this is separate problem, in this PR I merely try to fix ERROR: illegal rescan of motion node" }, { "commit": "6b9df409a5d8fbb852906d255e039f90b69b0ba3", "tree": "de6b2799bcb9635025d7834a97fae65975204a56", "parents": [ "c8f13cb98e7c50d42f768060352caafb1b1c2402" ], "author": { "name": "Kirill Reshke", "email": "reshke@double.cloud", "time": "Fri Aug 14 23:42:43 2026 +0500" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Backport adaptations\n" }, { "commit": "c8f13cb98e7c50d42f768060352caafb1b1c2402", "tree": "19251fffb60c65ad2fc2c392a3079886a1ef2394", "parents": [ "86b4be4e78c1b66f406c844d06b37f956c8c8139" ], "author": { "name": "Nathan Bossart", "email": "nathan@postgresql.org", "time": "Mon Aug 10 06:38:25 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "psql: Don\u0027t do backquote expansion in \\unrestrict.\n\nThis oversight in commit 71ea0d6795 allows a malicious server to\ninject shell commands into plain-text dump output that are run at\nrestore time on the machine running psql. To fix, interpret all\ntext after \\unrestrict until the end of the line as its argument.\n\nReported-by: Lucas Velgus \u003cvelgusgus599@gmail.com\u003e\nReported-by: Filip Janus \u003cfjanus@redhat.com\u003e\nReported-by: Daniel Bakker \u003cdaniel@jackds.nl\u003e\nAuthor: Nathan Bossart \u003cnathandbossart@gmail.com\u003e\nReviewed-by: Robert Haas \u003crobertmhaas@gmail.com\u003e\nReviewed-by: Noah Misch \u003cnoah@leadboat.com\u003e\nSecurity: CVE-2026-18408\nBackpatch-through: 14\n" }, { "commit": "86b4be4e78c1b66f406c844d06b37f956c8c8139", "tree": "b0bc6f63c65a13f4b3e6718f20940f874253c5db", "parents": [ "359474ad38b7bb892c5ab36a11d3867b6d7ddcab" ], "author": { "name": "Jacob Champion", "email": "jchampion@postgresql.org", "time": "Mon Aug 10 06:38:25 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "pgcrypto: Add option to revert to prior decryption behavior\n\nThe previous commit raises an ERROR during PGP operations if OpenSSL\ndoes not support the cipher in use. However, any existing messages\ncreated with faulty encryption will no longer be accessible via\npgp_[sym|pub]_decrypt().\n\nTo help users out of this situation, add a new ignore-cipher-failure\noption which reverts to the broken behavior during decryption only. A\nfaulty encryption wrapper, created by an OpenSSL configuration that does\nnot support the cipher, can then be stripped back off by that same\nOpenSSL in order to safely reencrypt it. (Note that when OpenSSL does\nsupport the cipher, corrupted messages will not be decrypted regardless\nof the ignore-cipher-failure setting; this is unchanged.)\n\nThe new tests add a corrupted Blowfish message for both public- and\nsymmetric-key decryption, resulting in the following test matrix:\n\n- Blowfish supported, default behavior: fails to decrypt\n- Blowfish supported, ignore-cipher-failure: fails to decrypt\n- Blowfish unsupported, default behavior: fails to load cipher\n- Blowfish unsupported, ignore-cipher-failure: strips faulty encryption\n\nThe previous commit\u0027s change to the pubkey tests is expanded similarly:\ncorrectly encrypted messages cannot be decrypted by an OpenSSL that does\nnot support the cipher, regardless of the option\u0027s setting, though the\nfailure mode will change.\n\nSuggested-by: Noah Misch \u003cnoah@leadboat.com\u003e\nReviewed-by: Daniel Gustafsson \u003cdaniel@yesql.se\u003e\nReviewed-by: Noah Misch \u003cnoah@leadboat.com\u003e\nSecurity: CVE-2026-14663\nBackpatch-through: 14\n" }, { "commit": "359474ad38b7bb892c5ab36a11d3867b6d7ddcab", "tree": "8bef0672add0a1e7ecf9cfdb1a64f40fc8e6ab36", "parents": [ "02397f95193dc61c7a12a013d1a818d31ad7d167" ], "author": { "name": "Daniel Gustafsson", "email": "dgustafsson@postgresql.org", "time": "Mon Aug 10 06:38:25 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Fix errorhandling for PGP encryption\n\nPGP encryption was using px_cipher_encrypt without checking if any\nerror was returned. When OpenSSL is running in FIPS mode, or when\nthe legacy provider hasn\u0027t been loaded, not all ciphers which are\nsupported by the PGP code are available and fail the init step in\npx_cipher_encrypt. Since the PGP encryption failed to notice this\nit XORed the non-encrypted block with the plaintext, effectively\ndisabling the encryption.\n\nThis was found due to a report of PGP encryption not respecting\nthe pgcrypto.builtin_crypto_enabled flag and allowing Blowfish\nand DES. This however turned out to be a false positive, since\nthe PGP code only use ciphers from OpenSSL and not the built in\nciphers.\n\nBug: #19457\nReported-by: Shishir Sharma \u003cansh01072001@gmail.com\u003e\nReviewed-by: Jacob Champion \u003cjacob.champion@enterprisedb.com\u003e\nDiscussion: https://postgr.es/m/19457-4bab15c17aea36c7@postgresql.org\nSecurity: CVE-2026-14663\nBackpatch-through: 14\n" }, { "commit": "02397f95193dc61c7a12a013d1a818d31ad7d167", "tree": "816108bb635e9fa6e12e3a78e768e8654ef27856", "parents": [ "906a1cc4f5ea8f0b405f69f9720b61c968a41697" ], "author": { "name": "Tom Lane", "email": "tgl@sss.pgh.pa.us", "time": "Mon Aug 10 06:38:25 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Save/restore more lexer state when skipping text due to \\if.\n\nWhen we implemented \\if ... \\endif in psql, we arranged to\nsave/restore the lexer\u0027s parenthesis depth counter across any chunk\nof input that we\u0027re ignoring. At the time, that was sufficient,\nbecause no other part of PsqlScanState could need to be restored to\nits prior value. However, commit e717a9a18 and follow-ons added\nmore state fields that ought to be restored to their prior values.\nA problem would only be observed if someone tries to \\if out a\nportion of a CREATE FUNCTION/PROCEDURE command that is relevant to\nBEGIN/END matching, which seems like a pretty unusual usage, so the\nlack of field reports isn\u0027t surprising. Nonetheless it\u0027s a bug.\n\nTo fix, replace the simple counter field in ConditionalStack\nentries with a pointer to a struct defined by psqlscan_int.h.\n(In the back branches, keep the old field and associated functions\nto minimize the risk of API/ABI breakage, even though it seems\nunlikely that any third-party code is using this. Making the\nnew struct private to psqlscan-related code should prevent API/ABI\nissues for future additions of this type.)\n\nIn itself this is only a minor bug fix, but it\u0027s prerequisite\ninfrastructure for the fix for CVE-2026-6464, which will add\nanother such field.\n\nAuthor: Tom Lane \u003ctgl@sss.pgh.pa.us\u003e\nReviewed-by: Noah Misch \u003cnoah@leadboat.com\u003e\nBackpatch-through: 14\nSecurity: CVE-2026-6464\n" }, { "commit": "906a1cc4f5ea8f0b405f69f9720b61c968a41697", "tree": "92ba8a44b2b454cfa3de8e53aea7e648310a7f2c", "parents": [ "08910980be7268e77c21b81aa1eef1060f7e9b97" ], "author": { "name": "Nathan Bossart", "email": "nathan@postgresql.org", "time": "Mon Aug 10 06:38:25 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Invalidate plan cache after role changes.\n\nRole membership, role attribute, and database ownership changes may\nimpact the expected behavior of row-level security policies, but\ncurrently the plan cache doesn\u0027t take notice. To fix, register\nsyscache callbacks on pg_auth_members, pg_authid, and pg_database\nthat invalidate the role-dependent plans. Changes to other\ndatabases\u0027 pg_database rows are ignored.\n\nReported-by: Ilya Staroverov \u003ci.staroverov@ftdata.ru\u003e\nReported-by: Shinya Kato \u003cshinya11.kato@gmail.com\u003e\nAuthor: Ilya Staroverov \u003ci.staroverov@ftdata.ru\u003e\nAuthor: Shinya Kato \u003cshinya11.kato@gmail.com\u003e\nCo-authored-by: Nathan Bossart \u003cnathandbossart@gmail.com\u003e\nReviewed-by: Tom Lane \u003ctgl@sss.pgh.pa.us\u003e\nSecurity: CVE-2026-14666\nBackpatch-through: 14\n" }, { "commit": "08910980be7268e77c21b81aa1eef1060f7e9b97", "tree": "60e3c1d3c292702846204d9020d110c51e38db63", "parents": [ "0f2c1c498f997f8df629cc6490fbc9ac79145103" ], "author": { "name": "Nathan Bossart", "email": "nathan@postgresql.org", "time": "Mon Aug 10 06:38:25 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Check for USAGE privilege on the composite type in ALTER TABLE OF.\n\nThis omission allowed roles without USAGE on a type to create\ntables that depend on it, which could prevent the owner from\nchanging the type later.\n\nReported-by: Nathan Bossart \u003cnathandbossart@gmail.com\u003e\nAuthor: Nathan Bossart \u003cnathandbossart@gmail.com\u003e\nReviewed-by: Robert Haas \u003crobertmhaas@gmail.com\u003e\nSecurity: CVE-2026-6470\nBackpatch-through: 14\n" }, { "commit": "0f2c1c498f997f8df629cc6490fbc9ac79145103", "tree": "7cf6b6e9c52a3170085c150f3d1bffbcde40acf2", "parents": [ "114cfbf829b13ccd6c91410fd09b453f825c2999" ], "author": { "name": "Nathan Bossart", "email": "nathan@postgresql.org", "time": "Mon Aug 10 06:38:24 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Check for USAGE privilege on the subtype in CREATE TYPE AS RANGE.\n\nThis omission allowed roles without USAGE on a type to create range\ntypes that depend on it, which could prevent the owner from\nchanging the type later.\n\nReported-by: Jingzhou Fu \u003cfuboat@outlook.com\u003e\nAuthor: Nathan Bossart \u003cnathandbossart@gmail.com\u003e\nReviewed-by: Noah Misch \u003cnoah@leadboat.com\u003e\nReviewed-by: Robert Haas \u003crobertmhaas@gmail.com\u003e\nSecurity: CVE-2026-6470\nBackpatch-through: 14\n" }, { "commit": "114cfbf829b13ccd6c91410fd09b453f825c2999", "tree": "f7a27229cdb947e1d0a72962b3ea0df96abbcad7", "parents": [ "4e78d1ed9551008be18816691309d3f0da328f7f" ], "author": { "name": "Nathan Bossart", "email": "nathan@postgresql.org", "time": "Mon Aug 10 06:38:24 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Avoid overflow in Levenshtein distance calculations.\n\nlevenshtein() and levenshtein_less_equal() let the caller specify\nthe insertion, deletion, and substitution costs, and\nfuzzystrmatch\u0027s corresponding SQL functions accept any 32-bit\ninteger for each. Since the distances are calculated with 32-bit\narithmetic, large costs can cause overflows, thereby producing\nnonsensical results. Certain inputs to levenshtein_less_equal()\ncan even cause out-of-bounds writes. To fix, use 64-bit arithmetic\ninstead, and error whenever the final result won\u0027t fit in the\nreturned 32-bit integer.\n\nWe may want to teach these functions to reject negative costs, too,\nbut that didn\u0027t seem appropriate for a security fix, and therefore\nit is left as a future exercise.\n\nReported-by: Ben Morris in collaboration with Claude and Anthropic Research\nAuthor: Nathan Bossart \u003cnathandbossart@gmail.com\u003e\nReviewed-by: Dean Rasheed \u003cdean.a.rasheed@gmail.com\u003e\nSecurity: CVE-2026-15742\nBackpatch-through: 14\n" }, { "commit": "4e78d1ed9551008be18816691309d3f0da328f7f", "tree": "77ee395b46209ef3987acdfce9ea28f970dbb5b2", "parents": [ "d363cc829764c04b504eb4680dbb7f6719709ce1" ], "author": { "name": "Robert Haas", "email": "rhaas@postgresql.org", "time": "Mon Aug 10 06:38:24 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Cross-check the type of a portal running EXECUTE or FETCH.\n\nWhen an EXECUTE or FETCH statement is executed, there are two portals:\nan outer portal that is created for the EXECUTE or FETCH statement itself,\nand an inner portal for the statement being executed on its behalf.\nBefore this commit, nothing checked that these two portals agreed on\nthe tuple descriptor of the rows being returned. This can be leveraged\nto disclose server memory contents and achieve arbitrary code execution.\n\nTo prevent that, we can make use of an existing safety mechanism,\nadded by Tom Lane in commit 2f48ede080f42b97b594fb14102c82ca1001b80c,\nwhich allows a tuplestore DestReceiver to be informed of the tupleDesc\nrequired by the caller, and which will cause an ERROR to occur if\nthat doesn\u0027t match the tupleDesc of what emerges from the executor\n(modulo dropped columns, which aren\u0027t an issue in the case at hand).\n\nReported-by: Ben Morris in collaboration with Claude and Anthropic Research\nReported-by: Peter Geoghegan \u003cpg@bowt.ie\u003e\nReviewed-by: Michael Paquier \u003cmichael@paquier.xyz\u003e\nSecurity: CVE-2026-16239\n" }, { "commit": "d363cc829764c04b504eb4680dbb7f6719709ce1", "tree": "db184d95415cf7f87c1a78be4961424fdfccd471", "parents": [ "c19e6ebfbfada808a8759f0c887beadc85f71069" ], "author": { "name": "Noah Misch", "email": "noah@leadboat.com", "time": "Mon Aug 10 06:38:24 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Empty search_path in amcheck.\n\nA grantee of amcheck function EXECUTE privilege could execute arbitrary\nfunctions as the owners of expression indexes that depend on the search\npath. An expression like (lower(col)) was not vulnerable, because\nlower() is resolved at CREATE INDEX time. However, an expression\ncalling an sql-language or plpgsql-language function often was\nvulnerable, even if it used search_path only to find objects in\npg_catalog. The amcheck documentation has been warning about data\ndisclosure after such a GRANT, not about function execution.\n\nThis might cause new amcheck errors when index expressions rely on a\nbroader search_path. Such indexes have seen errors during auto-analyze\nsince CVE-2018-1058 commit 582edc369cdbd348d68441fc50fa26a84afd0c1a, and\nv17 amcheck always worked this way. Hence, the risk is low.\n\nLeave a comment on the one other sandbox entrance that doesn\u0027t empty\nsearch_path. In its case, the choice was valid.\n\nBack-patch to v14 (all supported versions), but v17 was safe already.\nCommit 2af07e2f749a9208ca1ed84fa1d8fe0e75833288 (v17) unintentionally\nblocked the attack, and commit d70b17636ddf1ea2c71d1c7bc477372b36ccb66b\n(v18) unintentionally removed that protection. Hence, this adds to v17\njust a test and a comment. While emptying search_path became more\nwidespread in commit 2af07e2f749a9208ca1ed84fa1d8fe0e75833288 (v17),\nnone of its other changes blocked an attack available in v16, even when\nconsidering GRANT. For example, brin_summarize_range() has had an owner\ncheck that GRANT does not override.\n\nReported-by: 王跃林 \u003cviolin0613@tju.edu.cn\u003e\nReported-by: Jacob Brazeal \u003cjacob.brazeal@gmail.com\u003e\nBackpatch-through: 14\nSecurity: CVE-2026-14673\n" }, { "commit": "c19e6ebfbfada808a8759f0c887beadc85f71069", "tree": "31dae4ee345263dc4f4d978af7318200d86191bc", "parents": [ "ad77f063dfe436e4faee7f2a74b56015e17d0d15" ], "author": { "name": "Nathan Bossart", "email": "nathan@postgresql.org", "time": "Mon Aug 10 06:38:24 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Use value of scram_iterations in mock_scram_secret().\n\nPresently, mock_scram_secret() always uses\nSCRAM_SHA_256_DEFAULT_ITERATIONS, which poses an observable\nresponse discrepancy hazard when scram_iterations is set to\nsomething else. To fix, use the value of the configuration\nparameter instead, and document that unauthenticated users can\ndiscover the existence of roles with passwords created with\ndifferent iteration counts.\n\nReported-by: Radim Marek \u003cradim@boringsql.com\u003e\nAuthor: Nathan Bossart \u003cnathandbossart@gmail.com\u003e\nReviewed-by: Michael Paquier \u003cmichael@paquier.xyz\u003e\nReviewed-by: Heikki Linnakangas \u003chlinnaka@iki.fi\u003e\nReviewed-by: Jacob Champion \u003cchampion.p@gmail.com\u003e\nSecurity: CVE-2026-14672\nBackpatch-through: 16\n" }, { "commit": "ad77f063dfe436e4faee7f2a74b56015e17d0d15", "tree": "929b42c5762f073a8f927ae43f91e9684e68a4da", "parents": [ "3f8a14a6f0f34b03c0a58dfee3aa0f06334031f3" ], "author": { "name": "Nathan Bossart", "email": "nathan@postgresql.org", "time": "Mon Aug 10 06:38:24 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Obstruct EXTRACT() field name deparse injection.\n\nThe parser accepts any string as an EXTRACT() field name, but\ndeparsing does not quote and escape it accordingly. To fix, quote\nand escape the field name during deparsing as needed. It might be\na good idea to validate the field name during parsing and\ndeparsing, too, but that is left as a future exercise.\n\nReported-by: Ben Morris in collaboration with Claude and Anthropic Research\nAuthor: Nathan Bossart \u003cnathandbossart@gmail.com\u003e\nReviewed-by: Tom Lane \u003ctgl@sss.pgh.pa.us\u003e\nReviewed-by: Etsuro Fujita \u003cetsuro.fujita@gmail.com\u003e\nSecurity: CVE-2026-15741\nBackpatch-through: 14\n" }, { "commit": "3f8a14a6f0f34b03c0a58dfee3aa0f06334031f3", "tree": "2d22f128cd6de8b282427fc9b7e966e7fa0efb37", "parents": [ "b7b51eb02842c24dd205ae2da9582b3c67a5eb57" ], "author": { "name": "Michael Paquier", "email": "michael@paquier.xyz", "time": "Mon Aug 10 06:38:24 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "ecpg: Fix out-of-bound writes due to processing of invalid bytea data\n\nECPG assumes that any bytea data it receives from a backend starts with\n\u0027\\x\u0027 as its first two bytes, but a check was missed to enforce that. A\nrogue server sending some garbage bytea data would be able to crash a\nclient, resulting in a client-side DoS, in the most common cases.\n\nReported-by: ylwangtju \u003cylwangtju@qq.com\u003e\nBackpatch-through: 14\nSecurity: CVE-2026-16241\n" }, { "commit": "b7b51eb02842c24dd205ae2da9582b3c67a5eb57", "tree": "6e901c3e25b44684f8eff3da34c759347e279b35", "parents": [ "03b846c528230cec057c1769d19e0b87fe9caf10" ], "author": { "name": "Heikki Linnakangas", "email": "heikki.linnakangas@iki.fi", "time": "Mon Aug 10 06:38:24 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Use palloc_array() in pltcl and plperl to avoid overflow\n\nSome of these could overflow on 32-bit systems with the right input.\nConvert all cases where we called palloc() with multiplication to fix\nthem. Not all of them were bugs, but it\u0027s better to be safe than\nsorry.\n\nReported-by: Tulya Project, Team Dhiutsa, Bitecope Technologies Private Ltd\nBackpatch-through: 14\nSecurity: CVE-2026-14677\n" }, { "commit": "03b846c528230cec057c1769d19e0b87fe9caf10", "tree": "3a64c3d60d449dfcd08f83486a1275d13ec0d09a", "parents": [ "1e1c24ca72c0c4e682a24f04f5e5f12629bbc7f2" ], "author": { "name": "Heikki Linnakangas", "email": "heikki.linnakangas@iki.fi", "time": "Mon Aug 10 06:38:24 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Fix pg_trgm\u0027s picksplit function with all-true datums\n\nThe CACHESIGN.sign field is a BITVECP, not a TRGM, so you should not\nuse GETSIGN() on it. You don\u0027t get a compiler warning because the\nGETSIGN() macro includes a cast. It resulted in a bogus read beyond\nend of buffer, which would cause bad split decisions or a crash if\nyou\u0027re very unlucky.\n\nReported-by: Mehmet D. INCE \u003cmehmet@mehmetince.net\u003e\nBackpatch-through: 14\nSecurity: CVE-2026-14678\n" }, { "commit": "1e1c24ca72c0c4e682a24f04f5e5f12629bbc7f2", "tree": "329932646d492fa50d55dabf68033f0603033a77", "parents": [ "f340892f897dc451edd4f9d285cba0486a41a33e" ], "author": { "name": "Tom Lane", "email": "tgl@sss.pgh.pa.us", "time": "Mon Aug 10 06:38:23 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Return nulls honestly in aggregate \"combine\" functions.\n\nnumeric_combine() and several other state-combining functions for\naggregates cheated for the case of both inputs being NULL: they\nreturned a null pointer without bothering to mark it as a SQL NULL.\nThis was harmless in the expected usage where the result would be\npassed to the same combine function or a related aggregate final\nfunction. But it\u0027s bad news from a security standpoint, because\nnow that value can be passed to an internal-accepting function\neven if said function is strict. While a previous patch prevented\nsuch queries from being issued, it seems like good defense-in-depth\nto expend the few additional lines of code needed to do this properly.\nComparable functions such as array_agg_combine() already do so.\n\nReported-by: Amy Burnett (OpenAI Codex Security)\nAuthor: Tom Lane \u003ctgl@sss.pgh.pa.us\u003e\nBackpatch-through: 14\nSecurity: CVE-2026-14680\n" }, { "commit": "f340892f897dc451edd4f9d285cba0486a41a33e", "tree": "7943cb31599b6bda525b40b79be227c53f52e595", "parents": [ "a993285b38f4b3055658fa012e934fb4d1f64a40" ], "author": { "name": "Tom Lane", "email": "tgl@sss.pgh.pa.us", "time": "Mon Aug 10 06:38:23 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Reject calls from SQL to functions that take or return type internal.\n\nAllowing that is a security hole, since there are many different\nfunctions with different ideas of what their \"internal\" argument or\nresult is. We already had a defense against the easy case of\n\"\u0027foo\u0027::internal\", but that turns out to be insufficient. Lock down\nboth function and operator syntax. Also disallow attempts to cast to\nor from type internal; those would mostly fail anyway, but we have\ncreated some holes with features such as CoerceViaIO.\n\nReported-by: Amy Burnett (OpenAI Codex Security)\nAuthor: Tom Lane \u003ctgl@sss.pgh.pa.us\u003e\nReviewed-by: Robert Haas \u003crobertmhaas@gmail.com\u003e\nBackpatch-through: 14\nSecurity: CVE-2026-14680\n" }, { "commit": "a993285b38f4b3055658fa012e934fb4d1f64a40", "tree": "31770e73bb288c27aba9104bc07871b875f0906c", "parents": [ "5d2e262cbb4c18421b40d56d60cf039e4de22873" ], "author": { "name": "Tom Lane", "email": "tgl@sss.pgh.pa.us", "time": "Mon Aug 10 06:38:23 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Protect some fixed-size arrays that have FUNC_MAX_ARGS elements.\n\nThe maximum number of arguments allowed for an aggregate function\nis FUNC_MAX_ARGS-1 (since the underlying transfn and/or finalfn\nwill be called with one more argument). parse_func.c failed to\nenforce this, allowing construction of calls that would try to\npass FUNC_MAX_ARGS+1 to the underlying functions, resulting in\na memory stomp in the executor. Add correct checking there.\n\nSince it\u0027s possible that a bad call has been stored in a view or\nSQL function, also add checks in various aggregate-related and\nwindow-function-related code that there are not more than\nFUNC_MAX_ARGS arguments. These will also protect us against the\npossibility that we\u0027re trying to run a stored view that was made\nby a server executable with different FUNC_MAX_ARGS. (Arguably,\nthat scenario does not qualify as a security problem. But let\u0027s\njust tighten up all of this while we\u0027re here, rather than split\nhairs over whether an overrun is reachable.)\n\nLikewise check in compute_function_hashkey. Here the hazard is\ndirectly from a pg_proc row, but the scenario is the same.\n\nPL/Tcl has a similar issue with a fixed-size string buffer.\nLet\u0027s just replace that buffer with a Tcl_DString, removing the\nwhole issue and making the code look more like what\u0027s around it.\n\nThere are a lot of other FUNC_MAX_ARGS-sized arrays, but the rest\nhave nearby guards already, some with comments explicitly pointing\nout the hazard of FUNC_MAX_ARGS changing.\n\nI also used palloc_array() in a few related places in funcapi.c.\nThose aren\u0027t live hazards AFAICS, but nearby code has been\npalloc_array-ified already, so it seemed inconsistent to not use\nit here.\n\nReported-by: Masahiko Sawada \u003csawada.mshk@gmail.com\u003e\nAuthor: Tom Lane \u003ctgl@sss.pgh.pa.us\u003e\nReviewed-by: Masahiko Sawada \u003csawada.mshk@gmail.com\u003e\nBackpatch-through: 14\nSecurity: CVE-2026-14679\n" }, { "commit": "5d2e262cbb4c18421b40d56d60cf039e4de22873", "tree": "42442c137246740b30bc11daea5d9cbcdf5356d8", "parents": [ "500347b69f2bc95c3420235466670b20694f5a50" ], "author": { "name": "Tom Lane", "email": "tgl@sss.pgh.pa.us", "time": "Mon Aug 10 06:38:23 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "pg_dump: avoid assuming how long pg_proc.protrftypes can be.\n\nThe backend doesn\u0027t impose any particular limit on the length of this\narray, and since there could be entries for both input and output\narguments, it\u0027s feasible for the length to exceed FUNC_MAX_ARGS\neven without funny business. This could lead to crashes or worse.\n\nMoreover, pg_dump shouldn\u0027t rely on hard-coding FUNC_MAX_ARGS in the\nfirst place: it has no business assuming that the backend it\u0027s dumping\nfrom was compiled with the same value of FUNC_MAX_ARGS that it is.\nSo the stanza in dumpFunc() that allocates exactly FUNC_MAX_ARGS space\nfor the parsed OID array is fundamentally misguided. And it\u0027s broken\nin another way too: if there are exactly FUNC_MAX_ARGS OIDs, then\nparseOidArray won\u0027t zero-fill any entries, allowing the subsequent\nloop to run off the end of the array. A crash seems unlikely in\nthis variant, but garbage output is certain.\n\nTo fix, redesign parseOidArray\u0027s API so that it does the\narray-mallocing, which simplifies the callers anyway. While we\u0027re\nhere, tighten and modernize it a bit; in particular, split it into\nseparate functions for OIDs and integers, as was foreseen long ago.\nThis lets us get rid of the confusing type-punning involved in\nhaving IndxInfo.indkeys be declared as \"Oid *\" when it\u0027s really\npotentially-signed ints. Also, most of the callers expect an exact\nnumber of array entries, so make it verify that not just check for\n\"too many\".\n\nI noted while testing that this dumpFunc() stanza isn\u0027t even reached\nduring check-world. Add a function with transform to the regression\ntests to rectify that.\n\nReported-by: Masahiko Sawada \u003csawada.mshk@gmail.com\u003e\nAuthor: Tom Lane \u003ctgl@sss.pgh.pa.us\u003e\nReviewed-by: Masahiko Sawada \u003csawada.mshk@gmail.com\u003e\nBackpatch-through: 14\nSecurity: CVE-2026-19385\n" }, { "commit": "500347b69f2bc95c3420235466670b20694f5a50", "tree": "9c11eeb0ec35534acfb1eb464c37117fc4c68c1f", "parents": [ "fb9ce0c6e36b21e6f37f3addc0f0d625cfc4e01f" ], "author": { "name": "Tom Lane", "email": "tgl@sss.pgh.pa.us", "time": "Mon Aug 10 06:38:23 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Replace fixed-size, too-short array with a palloc\u0027d one.\n\nMatchNamedCall\u0027s arggiven array was declared FUNC_MAX_ARGS long,\nbut we may actually use up to pronallargs elements, and that can\nbe more than FUNC_MAX_ARGS if the function has OUT arguments\n(cf. ProcedureCreate). Convert it to a palloc\u0027d array.\n\nReported-by: Zheng Yu \u003czheng@depthfirst.com\u003e\nReported-by: ylwangtju \u003cylwangtju@qq.com\u003e\nAuthor: Tom Lane \u003ctgl@sss.pgh.pa.us\u003e\nReviewed-by: Michael Paquier \u003cmichael@paquier.xyz\u003e\nReviewed-by: Masahiko Sawada \u003csawada.mshk@gmail.com\u003e\nBackpatch-through: 14\nSecurity: CVE-2026-14679\n" }, { "commit": "fb9ce0c6e36b21e6f37f3addc0f0d625cfc4e01f", "tree": "e6a7b38632acfa21b5632c6391eac7f16378a9fd", "parents": [ "99de710c94d7edecd2236d3db487cab815227b8f" ], "author": { "name": "Tom Lane", "email": "tgl@sss.pgh.pa.us", "time": "Mon Aug 10 06:38:23 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Be more wary about constant\u0027s datatype in scalarineqsel().\n\nThe special case here for estimating conditions involving a ctid\ncolumn failed to check that the RHS constant is of type tid.\nWhile that\u0027d always be true for the built-in operators that\nreference this selectivity estimator, a maliciously constructed\noperator could provide a user-controlled Datum value that would\nget interpreted as an ItemPointer pointer. That at least risks\nSIGSEGV, and perhaps with a bit of sweat it could be used for\nserver memory disclosure.\n\nReported-by: Hcamael \u003cbaiyjrh@gmail.com\u003e\nAuthor: Tom Lane \u003ctgl@sss.pgh.pa.us\u003e\nReviewed-by: Noah Misch \u003cnoah@leadboat.com\u003e\nBackpatch-through: 14\nSecurity: CVE-2026-14668\n" }, { "commit": "99de710c94d7edecd2236d3db487cab815227b8f", "tree": "f86922e8b87d909718ed80276232ee0ff2d6cf4b", "parents": [ "c6a85d5abc8c487fc91dc8c1b3cb18f6345e7490" ], "author": { "name": "Tom Lane", "email": "tgl@sss.pgh.pa.us", "time": "Mon Aug 10 06:38:23 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Harden PL/Perl code against \"tied\" Perl arrays and hashes.\n\nTied arrays might report different sizes each time they are inspected.\nTo avoid generating a corrupt result array, fix plperl_array_to_datum()\nto read av_len() of each input array only once. If the input does\nappear to get shorter, we\u0027ll fill nulls for the now-missing entries,\nwhich seems fine. Conversely, if it gets longer, we\u0027ll ignore the new\nentries.\n\nplperl_to_hstore() assumed that Perl\u0027s hv_iterinit() returns the\nnumber of entries in the given Perl hash. Usually that\u0027s true,\nbut per the Perl docs, \"the return value is currently only meaningful\nfor hashes without tie magic\". That could potentially end in a memory\nstomp. We don\u0027t depend on that result value anywhere else, so don\u0027t\ndo so here either.\n\nReported-by: Hcamael \u003cbaiyjrh@gmail.com\u003e\nAuthor: Tom Lane \u003ctgl@sss.pgh.pa.us\u003e\nReviewed-by: Andrew Dunstan \u003candrew@dunslane.net\u003e\nBackpatch-through: 14\nSecurity: CVE-2026-14670\n" }, { "commit": "c6a85d5abc8c487fc91dc8c1b3cb18f6345e7490", "tree": "8ad1a0018fb0567b06ae6cd95b9c32168ec5cf3b", "parents": [ "c45ec66f0c41707c9fc0a3c9beb40bb3f0277797" ], "author": { "name": "Masahiko Sawada", "email": "msawada@postgresql.org", "time": "Mon Aug 10 06:38:23 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Fix potential buffer overrun in regexp match/split functions.\n\nsetup_regexp_matches() sizes the buffer used to convert matched\nsubstrings back from pg_wchar form at the smaller of maxlen*eml and\nthe original string\u0027s byte length, on the assumption that such a\nconversion cannot produce more bytes than the string it came\nfrom. That assumption holds only for validly encoded input. But\npg_mb2wchar_with_len() silently accepts bytes that are invalid in the\ndatabase encoding, turning each such byte into one pg_wchar, and\nconverting that back can take more bytes than the input did. A string\nmade of such bytes therefore overruns the conversion buffer by up to\nits own length, corrupting the following memory. regexp_match(),\nregexp_matches(), regexp_split_to_table() and regexp_split_to_array()\nare all affected.\n\nFix by dropping the tighter bound and always allocating maxlen*eml + 1\nbytes.\n\nReported-by: Francesco Verardi \u003cfrevadiscor89@gmail.com\u003e\nAuthor: Masahiko Sawada \u003csawada.mshk@gmail.com\u003e\nReviewed-by: Tom Lane \u003ctgl@sss.pgh.pa.us\u003e\nBackpatch-through: 14\nSecurity: CVE-2026-14664\n" }, { "commit": "c45ec66f0c41707c9fc0a3c9beb40bb3f0277797", "tree": "b1a9cbf6283e37cc9502ae0ff5cb29b5c8a2fa1c", "parents": [ "ab889cec1503726fb30afd402a13ceb4d855a14d" ], "author": { "name": "Tom Lane", "email": "tgl@sss.pgh.pa.us", "time": "Mon Aug 10 06:38:23 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Harden tsquery code against overflows.\n\nThe only overflow hazards I could find in tsquery construction\nare in QTN2QT(), which builds a flat tsquery datum from the\nQTNode tree representation used by tsquery_or, tsquery_rewrite,\nand allied functions. There are two:\n\n1. It seems theoretically possible for the outputs of cntsize() to\noverflow an int, so I widened them to size_t. There\u0027s no hazard\ncertainly in tsquery_or and friends, but tsquery_rewrite could expand\nthe query tree by large multiples (by replacing many identical\nsubtrees with a large replacement tree), so in a 64-bit machine\nwith plenty of available memory it should be possible to build a\nQTNode tree large enough to cause that. If these counters did\noverflow then we\u0027d under-allocate the output tsquery and have a heap\noverwrite problem. size_t is sufficient, since it\u0027s counting the size\nof a subset of an in-memory data structure. We also have to fix the\nTSQUERY_TOO_BIG() macro to not get confused if sumlen exceeds\nMaxAllocSize.\n\n2. fillQT() neglects to check that the new \"distance\" value for a\nQI_VAL item fits into the available 20-bit field. It\u0027s quite easy\nto reach this, for example by tsquery_or\u0027ing two near-megabyte-sized\ntsquerys. However, the result is only a corrupt tsquery that does\nnot represent the expected query, so perhaps this doesn\u0027t rise to\nthe level of a security bug. Nonetheless it should be fixed.\n\nNote: I followed the practice used in other tsquery code of checking\neach distance value as it\u0027s assigned, which means that the last\noperand string could extend past the MAXSTRPOS boundary. This is a\nbit different from the pattern used for tsvectors, which insist that\nthe total data length not exceed MAXSTRPOS and thereby avoid making\nper-item checks. Perhaps that should be harmonized sometime, but for\nnow it\u0027s okay for the two types to do this differently as long as\neach one is self-consistent.\n\nAuthor: Tom Lane \u003ctgl@sss.pgh.pa.us\u003e\nReviewed-by: Amit Langote \u003camitlangote09@gmail.com\u003e\nBackpatch-through: 14\nSecurity: CVE-2026-14662\n" }, { "commit": "ab889cec1503726fb30afd402a13ceb4d855a14d", "tree": "2fb3479eba0e9f5870b0653c26d4b1aaab601e8d", "parents": [ "51967d33cb2ab3263e3ca43676c176f23ee9b47c" ], "author": { "name": "Tom Lane", "email": "tgl@sss.pgh.pa.us", "time": "Mon Aug 10 06:38:23 2026 -0700" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Aug 17 18:15:38 2026 +0500" }, "message": "Harden tsvector code against overflows.\n\nThe core of this patch is to prevent array_to_tsvector() from\ngenerating invalid tsvectors. It did not check for overly-long\nlexemes (so that WordEntry.len fields could overflow), nor did it\ncheck that the total \"datalen\" fits within MAXSTRPOS (so that\nWordEntry.pos fields could overflow, and the number of entries\nin the tsvector could be much more than the normal limit).\nWhile the field overflows couldn\u0027t do anything much worse than\nproduce a corrupted tsvector value, a sufficiently large number\nof tsvector entries could cause integer overflows in later\nprocessing, such as tsvectorout.\n\nAnother important fix is to prevent tsvectorrecv() from accepting\ninvalid tsvectors. The main problem there is that it did not\nreject empty-string lexemes. Hence, even though it did (mostly)\nenforce the MAXSTRPOS limit, it could still produce a result\nwith an unreasonable number of tsvector entries, if they were\nprimarily empty strings.\n\nAlso, fix tsvectorout\u0027s calculation of its required output\nbuffer size: it was multiplying the string lengths by\npg_database_encoding_max_length() for no reason. That contributed\nto the risk of integer overflow there. With valid tsvector input,\nthere\u0027s no risk, but there\u0027s still no reason to make the output\nbuffer several times bigger than needed.\n\nI also tried to make a couple of related routines more robust,\nand spent some effort on improving the comments in ts_type.h.\nAlso, standardize on a single spelling of the \"string is too long\nfor tsvector\" message, using %zu instead of an assortment of formats.\nThese changes aren\u0027t security per se but came out of inspecting the\ncode for problems.\n\nReported-by: Yuhang Wu \u003cyuhang@depthfirst.com\u003e and Zhenpeng Lin\nReported-by: Zheng Yu \u003czheng@depthfirst.com\u003e\nReported-by: Hcamael \u003cbaiyjrh@gmail.com\u003e\nAuthor: Tom Lane \u003ctgl@sss.pgh.pa.us\u003e\nReviewed-by: Amit Langote \u003camitlangote09@gmail.com\u003e\nBackpatch-through: 14\nSecurity: CVE-2026-14662\n" }, { "commit": "51967d33cb2ab3263e3ca43676c176f23ee9b47c", "tree": "aadb9e291077957bc6c0e859b26ab433cf46d078", "parents": [ "182cc62d16ac56dd18e86f73749105507bb4874e" ], "author": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Fri Jul 31 11:00:48 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Aug 13 17:35:08 2026 +0800" }, "message": "CI: bump GitHub Actions to Node.js 24 runtimes\n\nGitHub Actions runners now force actions declaring Node.js 20 onto\nNode.js 24 and emit a deprecation annotation on every job. Node.js\n20 support is removed entirely after June 2026, so the workflows\nneed actions whose action.yml declares \"using: node24\".\n\nVersion transitions applied across all workflow files:\n\n actions/upload-artifact v4 -\u003e v7 (27 call sites)\n actions/download-artifact v4 -\u003e v8 (11 call sites)\n actions/checkout v4 -\u003e v7 (9 call sites)\n actions/setup-java v3 -\u003e v5 (1 call site)\n\nAssisted-by: Claude Code\n" }, { "commit": "182cc62d16ac56dd18e86f73749105507bb4874e", "tree": "72220de74f1d11874aaaff4094249bc89270fdf2", "parents": [ "78153b4d53a77c42cc9c6c858045688b6e735f7b" ], "author": { "name": "reshke", "email": "reshke@double.cloud", "time": "Tue Aug 11 21:29:16 2026 +0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Aug 11 21:29:16 2026 +0500" }, "message": "Fix various c23 compile errors (#1879)\n\n* Fix c23 compile error by using proxy functions" }, { "commit": "78153b4d53a77c42cc9c6c858045688b6e735f7b", "tree": "558879c7e99f747a6a09a608e3b3857d233e5fd4", "parents": [ "3d1c8cdf79af159e82cf22c0f08b1f343996efe8" ], "author": { "name": "roseduan", "email": "roseduan520@gmail.com", "time": "Sun Aug 09 17:34:13 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Aug 09 17:34:13 2026 +0800" }, "message": "Feature: dispatch T_CustomScanState in CBDB parallel walkers (#1855)\n\nThree GP-side walkers used during parallel setup —\nEstimateGpParallelDSMEntrySize, InitializeGpParallelWorkers,\nInitializeGpParallelDSMEntry — cased on other scan/join states but\nskipped T_CustomScanState. A parallel_aware CustomScan therefore\nsilently under-sized its DSM and failed to attach in workers, with\nno diagnostic.\n\nAdd T_CustomScanState arms that dispatch to\nExecCustomScan{Estimate,InitializeDSM,InitializeWorker}, gated on\nparallel_aware to match the other node types in these switches.\n\nAlso handle T_CustomScanState in planstate_walk_kids. Upstream\nplanstate_tree_walker walks only css-\u003ecustom_ps for a\nCustomScanState; the CBDB walker previously fell through to\ndefault (lefttree/righttree), skipping custom_ps children under\nstateful walkers (cdbexplain_*, getMotionState, ...). The new\ncase walks custom_ps first, then lefttree/righttree if set, with\nan Assert that a CustomScanState never populates both — otherwise\nthe child would be walked twice." }, { "commit": "3d1c8cdf79af159e82cf22c0f08b1f343996efe8", "tree": "30a48eecaf8306182c71b4103f777be99bb9742e", "parents": [ "cff04912925b404b09ff899e496301078b1b5b3e" ], "author": { "name": "Jianghua Yang", "email": "yjhjstz@gmail.com", "time": "Tue Aug 04 19:17:46 2026 +0800" }, "committer": { "name": "Jianghua.yjh", "email": "yjhjstz@gmail.com", "time": "Wed Aug 05 21:19:18 2026 +0800" }, "message": "ORCA: fix CTE column-pruning misalignment across consumers\n\nWhen a CTE has multiple consumers requiring different column subsets,\nthe producer\u0027s shared-scan output is pruned to the union of all\nconsumers\u0027 required columns (CTranslatorDXLToExpr::PruneCTEs). But each\nconsumer independently decided its own output columns in\nCPhysicalCTEConsumer from its own per-column GetUsage(). A consumer that\nconsiders all of its columns used (e.g. SELECT a.*) kept every column\nwith an identity index map, while the producer emitted only the pruned\nunion. The consumer then read the shared tuple by stale positions,\nproducing wrong results (a join key read from the wrong slot -\u003e LEFT\nJOIN yields NULLs) and \"invalid attnum N for relation shareX_refY\"\nduring EXPLAIN.\n\nDrive the consumer\u0027s kept columns from the producer\u0027s finalized used\nmask (CLogicalCTEProducer::UsedMask) -- the single source of truth --\nso every consumer exposes exactly the producer\u0027s surviving columns.\nWhen the producer was not pruned the mask is NULL and behavior is\nunchanged.\n\nAdd a regression test (cte_prune_multi_consumer) covering multi-consumer\nCTEs where a SELECT * consumer is referenced directly with a join key.\nIt asserts the EXPLAIN no longer errors and returns correct results;\nthe ORCA path is exercised with shared scans and matches the Postgres\nplanner.\n" }, { "commit": "cff04912925b404b09ff899e496301078b1b5b3e", "tree": "aafe838f3e9b9dbda3aa88a4418dbb3fd8226bcb", "parents": [ "18d2ba7083bfc59160c24cc895c4a71c981a6ae9" ], "author": { "name": "nix-oss", "email": "spacex.h.6000@gmail.com", "time": "Sun Jul 26 09:28:39 2026 +0000" }, "committer": { "name": "Jianghua.yjh", "email": "yjhjstz@gmail.com", "time": "Wed Aug 05 07:13:00 2026 +0800" }, "message": "Fix inverted cpuset assignment in getCpuSetByRole()\n\nPreviously, the function returned the wrong cpuset for coordinator and\nsegment roles when the cpuset string contained a semicolon separator\n(e.g., \"0-7;0-15\").\n\n- Coordinator now receives the first part (before \u0027;\u0027)\n- Segment now receives the second part (after \u0027;\u0027)\n- Added unit tests covering both branches with different values\n- Added Apache license header to the new test file\n\nFixes #1862\n" }, { "commit": "18d2ba7083bfc59160c24cc895c4a71c981a6ae9", "tree": "926061d92bf53e4b8491a0b59593b29490e6ad79", "parents": [ "7bc2fa7883854398a063ae39c2199b517e44b858" ], "author": { "name": "reshke", "email": "reshke@double.cloud", "time": "Sun Aug 02 19:11:31 2026 +0500" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun Aug 02 19:11:31 2026 +0500" }, "message": "Fix test modules compile-time issues (#1878)\n\nFix heap_checksum compile-time issue" }, { "commit": "7bc2fa7883854398a063ae39c2199b517e44b858", "tree": "5d869a8f3e6c170c473cc75ac7e416035717bf65", "parents": [ "50d36d9f6d1c552ddb9d0dd96044d274f9909577" ], "author": { "name": "Alena Rybakina", "email": "alenka.rybakina@gmail.com", "time": "Thu Jul 30 01:15:16 2026 +0300" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Sat Aug 01 08:13:20 2026 +0800" }, "message": "Feature: add TRY_CONVERT extension\n\nTRY_CONVERT(source_value, default_value) casts source_value to the type\nof default_value and returns default_value whenever the cast fails,\nwhich is the behaviour of TRY_CAST in SQL Server. Without it a single\nmalformed value makes the whole query fail, and the plpgsql workarounds\nthat catch the error per row are several times slower.\n\n TRY_CONVERT(\u002742\u0027::text, NULL::int2) -- returns 42::int2\n TRY_CONVERT(\u002742d\u0027::text, NULL::int2) -- returns NULL::int2\n TRY_CONVERT(\u002742d\u0027::text, 1234::int2) -- returns 1234::int2\n\nThe conversion to use is resolved the same way the parser resolves an\nexplicit cast in coerce_type(): a pg_cast entry, an I/O conversion or a\nbinary-compatible relabel, followed by the length coercion of the\ntarget type. Casts between array types and casts to domain types are\nnot supported and are reported as query errors, the same as a cast that\ndoes not exist at all; only a failure caused by the converted data is\nturned into the default value.\n\nThe cast itself runs inside a PG_TRY() block, since the datatype input\nfunctions of Cloudberry cannot yet report a conversion failure without\nthrowing.\n\nThe extension is marked trusted, so the owner of a database can install\nit without being a superuser.\n\nCo-authored-by: Vladimir Rachkin \u003cvova@kpnn.ru\u003e\nSee: PR#901 \u003chttps://github.com/apache/cloudberry/pull/901\u003e\n" }, { "commit": "50d36d9f6d1c552ddb9d0dd96044d274f9909577", "tree": "993f2193abf04bb10227da503f5c99b051f9c615", "parents": [ "d482b426f08c3b95fb56e00c7bd5ce086d3ee27b" ], "author": { "name": "GongXun", "email": "gongxun0928@gmail.com", "time": "Thu Jul 30 14:17:04 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Fri Jul 31 11:03:39 2026 +0800" }, "message": "diskquota: avoid flaky gpstop -ari in max_monitored_databases test\n\nImmediate restart forces crash recovery; with hot_standby\u003doff the\npidfile briefly reports standby and pg_ctl -w returns early, so\ngpstart can fail with \"Hot standby mode is disabled\". Use fast\nrestart like the other diskquota tests; POSTMASTER GUCs only need a\nnormal restart.\n" }, { "commit": "d482b426f08c3b95fb56e00c7bd5ce086d3ee27b", "tree": "cea04f4782d8ce5598d1fa78bfa9ec589a921031", "parents": [ "76c101f86ee0d2108a7928436307b1c526bff4f7" ], "author": { "name": "Jianghua Yang", "email": "yjhjstz@gmail.com", "time": "Wed Jul 29 21:19:33 2026 +0800" }, "committer": { "name": "Jianghua.yjh", "email": "yjhjstz@gmail.com", "time": "Thu Jul 30 11:10:11 2026 +0800" }, "message": "regress: ANALYZE nametbl to stabilize index_including IOS plan\n\nThe nametbl covering-index test only did VACUUM FREEZE with no ANALYZE, so\nwith no column statistics GPORCA used default cardinalities and the plan\nflipped between Index Only Scan and Index Scan across environments. Add\nANALYZE nametbl so the intended Index Only Scan plan is deterministic under\nboth optimizer\u003doff and optimizer\u003don.\n" }, { "commit": "76c101f86ee0d2108a7928436307b1c526bff4f7", "tree": "a471eb41313d793ce051bcbdc1d2b9db1c22c262", "parents": [ "32ee49e6d9f9a1fc47f2b399d5a3caf67b56938a" ], "author": { "name": "Jianghua Yang", "email": "yjhjstz@gmail.com", "time": "Wed Jul 29 19:16:48 2026 +0800" }, "committer": { "name": "Jianghua.yjh", "email": "yjhjstz@gmail.com", "time": "Thu Jul 30 11:10:11 2026 +0800" }, "message": "PAX regress: refresh ORCA (optimizer\u003don) expected outputs for AO-like index routing\n\nRefresh the *_optimizer.out expected files to match GPORCA plans under\ndefault_table_access_method\u003dpax with optimizer\u003don, where PAX index paths\nnow surface as Bitmap/Seq scans instead of Index/Index Only Scan.\n\nAdd index_including_optimizer.out: nametbl is a PAX table, so the Postgres\nplanner (optimizer\u003doff) emits a Bitmap plan (base index_including.out) while\nGPORCA (optimizer\u003don) still emits an Index Only Scan over the covering index.\nThe two optimizers diverge, so opt\u003don needs its own expected file.\n\nRefreshed: aggregates, bfv_joins, create_index, incremental_sort, inherit,\njoin, misc_functions, partition_prune, partition_pruning, privileges,\nrowtypes, select, subselect_gp, union (_optimizer.out).\n" }, { "commit": "32ee49e6d9f9a1fc47f2b399d5a3caf67b56938a", "tree": "59d0868e4797093664cea5ac3b312d57af1b9b9d", "parents": [ "63aeed33c060d7ffb4bc70fda53369128d686fbe" ], "author": { "name": "Jianghua Yang", "email": "yjhjstz@gmail.com", "time": "Wed Jul 29 16:35:31 2026 +0800" }, "committer": { "name": "Jianghua.yjh", "email": "yjhjstz@gmail.com", "time": "Thu Jul 30 11:10:11 2026 +0800" }, "message": "PAX regress: refresh expected outputs for AO-like index routing\n" }, { "commit": "63aeed33c060d7ffb4bc70fda53369128d686fbe", "tree": "e920cd8f60c7ffb47496a42f219ff54bfed2c0a2", "parents": [ "e97b91909c29ae8a984a81f707c4245b134b2c9f" ], "author": { "name": "Jianghua Yang", "email": "yjhjstz@gmail.com", "time": "Fri May 22 01:25:09 2026 +0800" }, "committer": { "name": "Jianghua.yjh", "email": "yjhjstz@gmail.com", "time": "Thu Jul 30 11:10:11 2026 +0800" }, "message": "PAX regress: refresh expected outputs for AO-like index routing\n\nWith PAX relations now treated as AO-like in get_index_paths() (see\npreceding commit), a btree index over a PAX table no longer produces\nIndex Scan / Index Only Scan plans -- only Bitmap Heap/Index Scan (or\nSeq Scan) paths survive. Regenerate the affected PAX regression\nexpected outputs to match.\n\nValidated by running the PAX regress suite (parallel_schedule +\ngreenplum_schedule) with default_table_access_method\u003dpax; the refreshed\nfiles reflect the actual planner output.\n" }, { "commit": "e97b91909c29ae8a984a81f707c4245b134b2c9f", "tree": "e6b784233391d41f1c6833ca95859f1da676dd63", "parents": [ "076422712c53c634e01cda00d8730b3b0b2b2ef2" ], "author": { "name": "GongXun", "email": "gongxun0928@gmail.com", "time": "Mon Jul 27 03:02:51 2026 +0800" }, "committer": { "name": "Max Yang", "email": "79948451+my-ship-it@users.noreply.github.com", "time": "Wed Jul 29 11:07:17 2026 +0800" }, "message": "PAX: fix SIGSEGV in SUM stats merge during DELETE on minmax columns\n\nWhen a PAX table has minmax_columns that also support SUM statistics\n(e.g. int, bigint, numeric), repeated DELETE operations can crash a\nsegment with SIGSEGV inside datumCopy() during the visibility-map\nstatistics refresh path.\n\nTwo bugs were identified in MicroPartitionStats::MergeRawInfo() and\nMergeTo():\n\n1. Wrong type metadata in FromValue(): The serialized SUM value was\n deserialized using the column physical type (typlen/typbyval)\n instead of the SUM aggregate return type (rettyplen/rettypbyval).\n For example, sum(bigint) returns numeric, so the stored SUM datum\n must be interpreted as numeric, not as int8. Using the wrong type\n metadata produces an invalid Datum that may crash in datumCopy().\n\n2. Swapped arguments in datumCopy(): The call passed (value, typlen,\n typbyval) but the wrapper signature is datumCopy(value, typByVal,\n typLen). This caused pass-by-value vs pass-by-reference confusion,\n leading to memory corruption.\n\nAdd regression test (delete_sum_stats) covering DELETE + INSERT +\nDELETE on int, bigint, and numeric columns with minmax_columns enabled.\n\nFixes #1767\n" }, { "commit": "076422712c53c634e01cda00d8730b3b0b2b2ef2", "tree": "19b17798d914dacb4358ebb9b2c21a1977e90a2d", "parents": [ "4910d42b3660e7d56618e7c8283a239f15bcc66d" ], "author": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Mon Jul 27 17:55:02 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 27 17:55:02 2026 +0800" }, "message": "CI: consolidate Rocky 8/9/10 workflows into single matrix-driven file\n\nReplace three separate Rocky Linux CI workflow files with one\nmatrix-driven workflow that runs build + test across Rocky 8, 9, 10.\n\nKey changes:\n- New file: .github/workflows/build-cloudberry-rocky.yml\n- Remove: build-cloudberry.yml (Rocky 9), build-cloudberry-rocky8.yml,\n build-cloudberry-rocky10.yml\n- PR trigger: all three Rocky versions now run on every PR (was only\n Rocky 9 before; Rocky 8/10 only triggered on push to main)\n- Remove scheduled cron trigger (push + PR coverage is sufficient)\n- Test matrix: union of all test suites across versions; every test\n now runs on every Rocky version, including ic-recovery, ic-diskquota,\n ic-orca-parallel, and gp_relsizes_stats\n- Container images and --releasever now resolved dynamically via\n matrix.rocky_version\n- Artifact names consistently suffixed with -rocky${{ version }}\n\nSee: http://github.com/apache/cloudberry/discussions/1696\nAssisted-by: Deepseek" }, { "commit": "4910d42b3660e7d56618e7c8283a239f15bcc66d", "tree": "22c15ab0c2a34101828e6bf5a4265c4cee47e543", "parents": [ "1daae25e0e95fe17d7e96cb7995ebabc8b95cd60" ], "author": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Mon Jul 27 15:02:23 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 27 15:02:23 2026 +0800" }, "message": "CI: consolidate Ubuntu 22.04/24.04 workflows into single matrix-driven file\n\nReplace two separate Ubuntu DEB CI workflow files with one\nmatrix-driven workflow that runs build + test across Ubuntu\n22.04 and 24.04.\n\nKey changes:\n- Rewrite: .github/workflows/build-deb-cloudberry.yml\n- Remove: build-deb-cloudberry-ubuntu24.04.yml\n- PR trigger: both Ubuntu versions now run on every PR (was only\n 22.04 before; 24.04 only triggered on push to main)\n- Remove scheduled cron trigger (push + PR coverage is sufficient)\n- Build/deb-install-test jobs use strategy.matrix.ubuntu_version\n [\u002722.04\u0027, \u002724.04\u0027]; test-deb job receives ubuntu_version via\n prepare-test-matrix-deb cross-product expansion\n- Container images dynamically resolved via\n matrix.ubuntu_version (cbdb-build-ubuntu${version}-latest)\n- Job naming: Ubuntu 22.04 keeps original names (no suffix) for\n .asf.yaml compatibility; Ubuntu 24.04 appends \"(Ubuntu 24.04)\"\n- Artifact names consistently suffixed with -ubuntu${version}\n- Fix: remove broken matrix.name reference in deb-install-test\n artifact upload (was referencing a non-existent matrix axis)\n\nSee: http://github.com/apache/cloudberry/discussions/1696\nAssisted-by: DeepSeek" }, { "commit": "1daae25e0e95fe17d7e96cb7995ebabc8b95cd60", "tree": "e6e7782fbd8ac5de122910904210f2b1673727c3", "parents": [ "83022b58b2f4e62fb8fd2ebf9137b5c29e4fcb5b" ], "author": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Mon Jul 27 13:54:41 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jul 27 13:54:41 2026 +0800" }, "message": "Packaging: Enable RPM package relocation via --prefix\n\nRework the RPM packaging so Cloudberry can be installed to a custom\nlocation and so multiple major versions can coexist, aligning the\nbehavior with Greenplum\u0027s packaging model.\n\nRelocation (rpm --prefix):\n- Split the hardcoded install path into base_dir + name components and\n set Prefix to the base directory (/usr/local) so RPM\u0027s relocate\n engine can substitute it correctly.\n- Move the convenience symlink out of %files and create it in %post\n using RPM_INSTALL_PREFIX, so it follows the actual --prefix (with a\n fallback to the default base_dir). %postun removes the symlink only\n when it still points to the version being erased.\n- Disable build-id links so they are not emitted outside the\n relocatable prefix.\n\nMajor-version coexistence:\n- Embed the major version in the package Name\n (apache-cloudberry-db-incubating-\u003cmajor\u003e), derived from %{version},\n so different major versions register as distinct packages and can be\n installed side by side (dnf) or under separate prefixes (rpm -i).\n- Obsolete the previous unversioned package name on upgrade; this does\n not match the versioned names, so majors still coexist.\n- In %post, move the generic symlink only when the existing target is\n the same major version, leaving other majors untouched. The version\n is parsed from the target directory name rather than by sourcing\n environment files or executing installed binaries.\n- Keep the published file name in the historical format (without the\n \"-\u003cmajor\u003e\" segment) by renaming artifacts in build-rpm.sh; the file\n name does not affect the Name/Version stored in the RPM header.\n\nPackaging correctness and hardening:\n- Stop changing installed files to gpadmin ownership in %post; the\n package tree stays root-owned.\n- Do not expose bundled private shared libraries (libpq.so.5, etc.) as\n Provides, and do not require them from the system; they ship in the\n package and are resolved via RPATH.\n- Validate that version/release macros are supplied, mark\n cloudberry-env.sh as %config(noreplace), copy the tree with cp -a to\n preserve hidden files and attributes, add coreutils scriptlet\n dependencies, add python3 to the el9 runtime requires, and update the\n license tag to the SPDX identifier Apache-2.0.\n\nCI workflows:\n- Query the installed package by glob (rpm -qa \u0027apache-...*\u0027) instead of\n the fixed name, since the registered Name now carries the major.\n- Keep locating the published artifact by its historical file name,\n which build-rpm.sh restores after the build.\n\nAssisted-by: Claude Code\nAssisted-by: DeepSeek" }, { "commit": "83022b58b2f4e62fb8fd2ebf9137b5c29e4fcb5b", "tree": "74ad0aaf2ca85870bcb6306771da050e65ea2cd7", "parents": [ "9c3d48edf52777fbe41b310edb485e9ae8989ef5" ], "author": { "name": "Sagittarius", "email": "101273427+MutableFire@users.noreply.github.com", "time": "Thu Jul 23 08:55:47 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jul 23 13:55:47 2026 +0800" }, "message": "Enhancement: Remove redundant return statements in UDP interconnect code\n\nIn C, reaching the closing brace of a void function implicitly returns\ncontrol to the caller. Explicit \u0027return;\u0027 statements in these positions\nare unnecessary noise that clutters the code. Removing them aligns the\ncode with common C style guidelines and improves readability.\n\n---------\n\nCo-authored-by: Leonid \u003c63977577+leborchuk@users.noreply.github.com\u003e" }, { "commit": "9c3d48edf52777fbe41b310edb485e9ae8989ef5", "tree": "3a2c79841ec5214642ca684774a17db2d19419f8", "parents": [ "837f80823a33f42a646ede95c7e20d890837fff6" ], "author": { "name": "roseduan", "email": "roseduan520@gmail.com", "time": "Wed Jul 22 11:10:54 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Jul 22 11:10:54 2026 +0800" }, "message": "Fix: pg_task / pg_task_run_history column reorder with catversion bump (#1817)\n\nSome non-varlen fields (int32 nodeport, bool active in pg_task;\ntimestamptz start_time / end_time in pg_task_run_history) were\ndeclared after CATALOG_VARLEN, which trips LLVM bitcode emission\nduring JIT compilation.\n\nMove them ahead of the varlen block. Because this rearranges the\non-disk pg_attribute layout, bump CATALOG_VERSION_NO so an upgraded\nbinary refuses to start against a pre-reorder cluster instead of\ncrashing at runtime with SIGSEGV in heap_form_tuple on the first\nCREATE TASK.\n\nAdjust ruleutils.c pg_get_dynamic_table_schedule() to fetch the\nschedule via heap_getattr() since \u0026task-\u003eschedule on the Form\nstruct is no longer valid for varlen-section fields." }, { "commit": "837f80823a33f42a646ede95c7e20d890837fff6", "tree": "9e5fb9f8c858f6c06fb04088a915b9f1b954c312", "parents": [ "d32715185e961bae45460c2ec7a7bba892592ae0" ], "author": { "name": "Jianghua.yjh", "email": "yjhjstz@gmail.com", "time": "Tue Jul 21 16:39:29 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jul 21 16:39:29 2026 +0800" }, "message": "ORCA: don\u0027t push LOJ ON-pred onto its own outer in PushThruOuterChild (#1836)\n\n* ORCA: don\u0027t emit NIJ ON-pred edges into the Select above DPv2 join trees\n\nWhen two non-inner joins in an NAry join have structurally identical ON\npredicates, ORCA could silently drop or misplace predicates, producing\nwrong results:\n\n select x.c1, y2.c1 from x left join y1 on x.c1\n left join y2 on x.c1\n where y2.c1 is null;\n\nreturned 0 rows instead of the two null-padded FALSE rows, because a\ncopy of the ON pred ended up as a scan filter on x.\n\nRoot cause: CJoinOrderDPv2\u0027s m_expression_to_edge_map is keyed on\nstructural equality (CExpression::HashValue / CUtils::Equals). With two\nstructurally identical ON preds, RecursivelyMarkEdgesAsUsed can only\never mark one of the duplicate edges as used, so\nAddSelectNodeForRemainingEdges treated the other edge as a leftover\nWHERE predicate and emitted it into a Select on top of the join tree.\nThe normalizer then legitimately pushed that Select onto the LOJ\u0027s own\nouter child, filtering out rows that outer-join semantics require to be\nnull-padded. (The map is only populated when a WHERE predicate\nreferences an NIJ right child, which is why the WHERE clause is needed\nto trigger the bug.)\n\nFix at the source: skip ON-pred edges (m_loj_num \u003e 0) when collecting\nremaining edges. An NIJ\u0027s ON predicate is always applied by the join\nitself when its right child is placed (IsRightChildOfNIJ), so an\n\"unused\" ON-pred edge can only be a bookkeeping artifact of the\nstructural-equality map and must never be duplicated above the join.\n\nAn earlier attempt fixed this downstream, by stripping conjuncts that\nstructurally match the LOJ\u0027s ON pred in CNormalizer::PushThruOuterChild.\nThat layer cannot distinguish the leaked ON-pred copy from legitimate,\nstructurally identical conjuncts arriving from above, and silently\ndeleted user predicates:\n\n select * from x left join y on x.c1 where x.c1; -- 3 rows, not 1\n select 1 from a t1\n left join (a t2 left join a t3 on t2.id \u003d 1)\n on t2.id \u003d 1; -- lost the\n -- Index Cond on\n -- t2 and the ON\n -- pred entirely\n\nWith this fix, the original repro returns the correct 2 rows with no\nscan filter on x, the queries above return planner-identical results,\nand the nested-LOJ query regains Index Cond: (id \u003d 1) on t2.\n\nAdd the repro as a regression test in bfv_joins." }, { "commit": "d32715185e961bae45460c2ec7a7bba892592ae0", "tree": "9a5f7ff8c96fddca742bc0afe978c9986f7d2cc2", "parents": [ "6e3051b4393f3353808090af6f52c579472f0587" ], "author": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Jul 16 15:44:45 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Mon Jul 20 11:36:15 2026 +0800" }, "message": "CI: add Rocky Linux 10 to package convenience binaries matrix\n\nAdd Rocky Linux 10 (rocky10) as a supported target in the\npackage-convenience-binaries workflow, covering both x86_64 and\narm64 architectures.\n\nBuild job:\n- using apache/incubator-cloudberry:cbdb-build-rocky10-latest\n\nInstall-test job:\n- using apache/incubator-cloudberry:cbdb-test-rocky10-latest\n" }, { "commit": "6e3051b4393f3353808090af6f52c579472f0587", "tree": "4557e1060291fa02a0c1c81ca2be1ac615266397", "parents": [ "813779c8d4c4d0e359b8018d0838538f46c00937" ], "author": { "name": "zhangwenchao", "email": "656540940@qq.com", "time": "Mon Mar 02 16:44:30 2026 +0800" }, "committer": { "name": "Max Yang", "email": "79948451+my-ship-it@users.noreply.github.com", "time": "Wed Jul 15 11:17:28 2026 +0800" }, "message": "Fix assertion failure in getNdvBySegHeapTuple for empty partitions.\n\nWhen merging leaf partition statistics for a partitioned table,\ngetNdvBySegHeapTuple could hit Assert(valuetype \u003d\u003d FLOAT8OID) if a\npartition had relTuples \u003d\u003d 0 and its pg_statistic entry lacked a valid\nSTATISTIC_KIND_NDV_BY_SEGMENTS slot (or the slot had an unexpected\nelement type).\n\nThe original guard condition only handled two cases:\n 1. Non-empty partition with NDV value \u003d\u003d 0\n 2. Non-empty partition without NDV_BY_SEGMENTS\nIt missed the case where an empty partition (relTuples \u003d\u003d 0) has a\npg_statistic entry but no valid FLOAT8OID NDV_BY_SEGMENTS slot,\ncausing the code to fall through to the assertion.\n\nFix by checking valuetype !\u003d FLOAT8OID upfront: skip empty partitions\ngracefully, and mark non-empty partitions as invalid.\n\nAuthored-by: Zhang Wenchao \u003czhangwenchao@apache.org\u003e\n" }, { "commit": "813779c8d4c4d0e359b8018d0838538f46c00937", "tree": "0ae366b212a7427654b211117c4f22fa53915a88", "parents": [ "7f5c3620ce6499713875b5ea9a259da173dd9e64" ], "author": { "name": "Jianghua Yang", "email": "yjhjstz@gmail.com", "time": "Fri Jul 10 18:10:38 2026 +0800" }, "committer": { "name": "Max Yang", "email": "79948451+my-ship-it@users.noreply.github.com", "time": "Tue Jul 14 15:42:02 2026 +0800" }, "message": "ORCA: restore non-ASCII column aliases for all target entry kinds\n\nORCA represents names as wide characters; when the database LC_CTYPE\ncannot decode a multibyte name (e.g. LC_CTYPE\u003d\u0027C\u0027 with a UTF-8 alias),\nclib::Vswprintf substitutes the generic \"UNKNOWN\" string and the\nDXL-to-PlStmt translator restores the original name from the query\ntree (commit 6b19c44262b). That restore only ran for Var target\nentries, so with the optimizer enabled\n\n SELECT \u0027한글\u0027 AS \"한글\";\n\nreturned a column named UNKNOWN: constants, aggregates, set operation\nand set-returning-function outputs never took the repair path.\n\nThe old repair walked the entire query tree with\nupdate_unknown_locale_walker matching on (resorigtbl, resno). That\nmatch key is ambiguous: TargetEntries nested inside Aggref arguments\nor SubLink subqueries can collide with it, either clobbering an\nalready-restored name (empty column header for the first of two\naggregates) or restoring a name from the wrong query level.\n\nReplace the walker with restore_unknown_locale_resname, which scans\nonly the top-level query targetList for the non-junk entry with the\nsame resno. Only the topmost plan node is translated with a context\nthat carries the original query, and its projection list produces the\nquery output columns in order, so the positional top-level match is\nexact. A legitimate alias literally named \"UNKNOWN\" self-matches and\nthe restore is a no-op. Call it for every entry translated by\nTranslateDXLProjList, for the inlined Append targetlist (UNION ALL),\nand for the ProjectSet targetlists built by SetupAliasParameter\n(set-returning functions).\n\nExtend gp_locale with alias cases for constants, expressions,\naggregates, UNION ALL, set-returning functions, a subquery containing\na same-position column, and a legitimate \"UNKNOWN\" alias.\n" }, { "commit": "7f5c3620ce6499713875b5ea9a259da173dd9e64", "tree": "2cd26fb1202a08372a13576d0bed434445ed766d", "parents": [ "e4805bda61dc56588ea1ce6ef3312d6e3e114b72" ], "author": { "name": "Smyatkin Maxim", "email": "smyatkinmaxim@gmail.com", "time": "Tue Jul 14 08:37:01 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Tue Jul 14 13:37:01 2026 +0800" }, "message": "Fix infinite loop in replaceStringInfoString (#1750)\n\nThe function had a few problems:\n- replace \u003d\"a\" and replacement\u003d\"ab\" would give an infinite loop leading\n to OOM. We have a similar case in pg_dump: replace\u003d\"range\",\n replacement\u003d\"multirange\"\n- Copying the whole string each time there is a match\n- Empty replace pattern also leads to infinite loop\n\nWe can still do better: for example count number of matches and do a\nsingle allocation, or even run the replacement inplace. But it\u0027s\nprobably not worth it." }, { "commit": "e4805bda61dc56588ea1ce6ef3312d6e3e114b72", "tree": "f7d5bf1a9fbbafc22e266cec46596eef00c021cd", "parents": [ "7e4978e2e960526afe8b8c0135148626beb7741b" ], "author": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Mon Jul 13 14:06:30 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Tue Jul 14 10:32:17 2026 +0800" }, "message": "CI: fix SonarQube action to use ASF-approved pinned version\n\nThe sonarqube workflow failed because `@v6` of both\nSonarSource/sonarqube-scan-action and its install-build-wrapper\nsub-action are not in the ASF allowed actions list.\n\nPin both actions to commit 713881670b6b3676cda39549040e2d88c70d582e\n(v8.2.0), the latest approved version from\napache/infrastructure-actions/actions.yml that has no expiry\nconstraint.\n" }, { "commit": "7e4978e2e960526afe8b8c0135148626beb7741b", "tree": "3bcdb41d8fe0efd4ffd4b3a2deb83d8d556d4b0c", "parents": [ "6414a9aedb910c092b00c7aac0fca71336f1d312" ], "author": { "name": "Hao Wu", "email": "gfphoenix78@gmail.com", "time": "Fri Jul 03 14:37:22 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Jul 09 10:32:59 2026 +0800" }, "message": "Fix subselect_gp2 intermittent failure due to parallel test conflict\n\nsubselect_gp and subselect_gp2 run in the same parallel test group.\nsubselect_gp dropped and recreated tables named subselect_t1/t2, which\nare also created by subselect_gp2. The race caused subselect_gp2\u0027s\nSELECT to fail with \"relation does not exist\" after a successful INSERT.\n\nRename the tables in subselect_gp2 to subselect_gp2_t1/t2 to eliminate\nthe naming conflict. Update all copies of the test across regress,\nsinglenode_regress, vectorization, and pax_storage test suites.\n" }, { "commit": "6414a9aedb910c092b00c7aac0fca71336f1d312", "tree": "36bc21701a847986152673975ce32c617edffaf9", "parents": [ "98fda2fb31979c012b8631fe321cb73af6a4ce8e" ], "author": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Wed Jul 01 18:47:55 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Mon Jul 06 17:43:24 2026 +0800" }, "message": "Fix singlenode AOCO compression test for zlib\n\nThe singlenode AOCO_Compression test asserted an exact on-disk size\n(712 bytes / 36.75), which depends on the zlib version. Rocky Linux\n10\u0027s zlib produced 728 bytes / 35.95 and failed the diff. Ignore the\ndetailed output here.\n\nAssisted-by: Claude Code\n" }, { "commit": "98fda2fb31979c012b8631fe321cb73af6a4ce8e", "tree": "7f9797759387d6394492fd7ab747ad2b6b963d48", "parents": [ "e938d9b3b4f4c2149d02147475038e99f63c47dd" ], "author": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Wed Jul 01 18:47:08 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Mon Jul 06 17:43:24 2026 +0800" }, "message": "Fix egrep deprecation warning in maskout.sh\n\npg_hint_plan\u0027s maskout.sh filtered plan output through `egrep`. On\nRocky Linux 10 that prints \"egrep is obsolescent; using grep -E\" to\nstderr, which leaked into the rowhints test output and broke the\nregression diff. Use `grep -E` directly.\n\nAssisted-by: Claude Code\n" }, { "commit": "e938d9b3b4f4c2149d02147475038e99f63c47dd", "tree": "a51fc5c0b794071f93d65546bdca82648630299d", "parents": [ "79423b6bcb343231e220c230dfac57180efe983c" ], "author": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Wed Jul 01 16:05:21 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Mon Jul 06 17:43:24 2026 +0800" }, "message": "Fix unit test build under GCC 14\n\ngpopt_mock.c uses PG_FUNCTION_ARGS and PG_RETURN_VOID() but only\nincluded postgres.h. On GCC 14 (Rocky Linux 10) the undeclared macros\nbecame hard errors (-Wimplicit-function-declaration, -Wimplicit-int)\nrather than warnings. Include fmgr.h, the canonical header for these\nfunction-manager macros.\n\nAssisted-by: Claude Code\n" }, { "commit": "79423b6bcb343231e220c230dfac57180efe983c", "tree": "11fd830b8e66c0c52e25b7b1a9b9aa2c3826bbc6", "parents": [ "f8dc6279a08fc64c4b9fe0a48e62622c25cee32c" ], "author": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Wed Jul 01 14:42:08 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Mon Jul 06 17:43:24 2026 +0800" }, "message": "Fix RPM artifact checks for double-digit EL\n\nThe RPM verify/copy steps in the build workflows broke on el10:\n\n- The OS major version was parsed with `[0-9]`, capturing only \"1\"\n from VERSION_ID\u003d\"10\" and looking for an el1 RPM. Use `[0-9]+`.\n- `rpm -qlp ... | grep -q` raced with pipefail: grep closed the pipe\n on the first match, rpm died with SIGPIPE, and the pipeline was\n reported as failed. Drop `-q` and redirect grep so the whole list\n is consumed.\n\nApplied to build-cloudberry.yml, build-cloudberry-rocky8.yml and\nbuild-dbg-cloudberry.yml.\n\nAssisted-by: Claude Code\n" }, { "commit": "f8dc6279a08fc64c4b9fe0a48e62622c25cee32c", "tree": "228c457d3c55b4433d7493cefa3e7a9dc7f02e59", "parents": [ "95a300f360fdd3b1fcbed502dfb21d4af82ca7a6" ], "author": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Wed Jul 01 12:25:54 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Mon Jul 06 17:43:24 2026 +0800" }, "message": "Fix Cloudberry build scripts for Rocky Linux 10\n\nTwo el10 build breakages, neither PostgreSQL-version specific:\n\n- configure-cloudberry.sh printed version info via `ag`\n (the_silver_searcher), which is not packaged for el10. Use\n `grep -E`, which is always available.\n- build-rpm.sh failed in %install because check-rpaths on el10 treats\n the product\u0027s absolute RUNPATH (/usr/local/cloudberry-db/lib) as a\n fatal invalid rpath. Export QA_RPATHS to demote the standard,\n invalid and empty rpath findings to warnings.\n\nAssisted-by: Claude Code\n" }, { "commit": "95a300f360fdd3b1fcbed502dfb21d4af82ca7a6", "tree": "3b73ea8a92075ed4438e106107b4653774968b07", "parents": [ "a4ece882be877e23ae3e1ea3981b39e43788d40e" ], "author": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Wed Jul 01 12:10:05 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Mon Jul 06 17:43:24 2026 +0800" }, "message": "CI: add Rocky Linux 10 build and test CI workflow\n\nAdd build-cloudberry-rocky10.yml based on build-cloudberry.yml to\nvalidate Apache Cloudberry on Rocky Linux 10.\n\n- Use cbdb-build-rocky10-latest and cbdb-test-rocky10-latest images\n- Pin dnf install to `--releasever\u003d10`\n- Trigger on push, workflow-file PRs (paths filter), a weekly Monday\n 02:00 UTC schedule, and manual dispatch, mirroring the rocky8 workflow\n- Tag workflow, job, and report names with \"(Rocky 10)\" to distinguish\n steps from other workflows\n\nAssisted-by: Claude Code\n" }, { "commit": "a4ece882be877e23ae3e1ea3981b39e43788d40e", "tree": "9deefd29090bec46cdb8ec2487e1a0b3871cab96", "parents": [ "a3236b6f79d23f7dc079129c4109395c35e0cfc7" ], "author": { "name": "echonesis", "email": "echonesis@gmail.com", "time": "Fri Jun 26 18:02:00 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Fri Jun 26 22:57:41 2026 +0800" }, "message": "Correct grammar in rules.sgml\n\nCorrect grammar in rules.sgml based on code review comments.\n" }, { "commit": "a3236b6f79d23f7dc079129c4109395c35e0cfc7", "tree": "f72bbcc5f732bb1c45130105a378a2d4c2631d1e", "parents": [ "cdf09de0e92741ef8ac1a23c0e9d1e395179e3df" ], "author": { "name": "echonesis", "email": "echonesis@gmail.com", "time": "Fri Jun 26 16:07:46 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Fri Jun 26 22:57:41 2026 +0800" }, "message": "Doc: Fix typos\n\nFix typos in documentation.\n" }, { "commit": "cdf09de0e92741ef8ac1a23c0e9d1e395179e3df", "tree": "bbac5ff1070cdd287f5d1ef7d8e6b8d47a922be9", "parents": [ "569828acb12a5c0337145743e2e20723628d4201" ], "author": { "name": "Vladislav Shchetinin", "email": "v.shchetinin.v@gmail.com", "time": "Mon Jun 22 11:25:51 2026 +0300" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Jun 25 18:05:33 2026 +0800" }, "message": "Feat: Adapt gp_relsizes_stats for Cloudberry\n" }, { "commit": "569828acb12a5c0337145743e2e20723628d4201", "tree": "fc17f8da7ce1143c8bb201b2a41f4b6e15ec4b67", "parents": [ "499314536ccee58576660e195b6937cd0a7c7a78" ], "author": { "name": "Ovchinnikov Andrew", "email": "63587191+AndrewOvvv@users.noreply.github.com", "time": "Tue Jun 02 18:38:54 2026 +0300" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Jun 25 18:05:33 2026 +0800" }, "message": "Feat: Import gp_relsizes_stats into gpcontrib from greenplum\n" }, { "commit": "499314536ccee58576660e195b6937cd0a7c7a78", "tree": "fcfa55eee8ec346ce07afc90d33eecb456081d56", "parents": [ "4a2eb2fd4cb015d30e53c9a4f32354d2b9a368ea" ], "author": { "name": "liushengsong", "email": "lss602726449@gmail.com", "time": "Tue Jun 23 10:34:36 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Jun 25 15:15:24 2026 +0800" }, "message": "Fix flaky vacuum_progress_column/row: remove inline DDL and wait_for_mirror_down\n\nRemove inline CREATE OR REPLACE FUNCTION wait_for_mirror_down and its\nSELECT calls from vacuum_progress tests. The DDL dispatch to segments\ncreated distributed transactions that advanced DistributedLogShared-\u003e\noldestXmin past compact XIDs, causing the new vacuum worker in\npost-cleanup to see stale segments as recyclable (heap_blks_vacuumed\u003d9,\nindex_vacuum_count\u003d2 instead of 0/0).\n\nThe wait_for_mirror_down function is already defined in setup.sql,\nso the inline definition was redundant and harmful.\n" }, { "commit": "4a2eb2fd4cb015d30e53c9a4f32354d2b9a368ea", "tree": "211cb0cfdc11a87909287809b740aa69d0bae5dc", "parents": [ "3fad47560e15e6be3a6a27780cacf5790eb0ec04" ], "author": { "name": "liushengsong", "email": "lss602726449@gmail.com", "time": "Mon Jun 22 18:15:02 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Jun 25 15:15:24 2026 +0800" }, "message": "Fix rowtypes MERGE16_FIXME: use complex_t and fix record_in tupdesc double-release\n\nCloudberry has a built-in scalar \u0027complex\u0027 type whose complex_in doesn\u0027t\nsupport PG16\u0027s soft-error API. Rename to \u0027complex_t\u0027 composite type in\nrowtypes tests to avoid conflict.\n\nFix record_in double ReleaseTupleDesc bug: remove 6 redundant\nReleaseTupleDesc calls before \u0027goto fail\u0027, since the fail label already\nreleases tupdesc. The double-release caused SIGSEGV on malformed\ncomposite type input via pg_input_is_valid.\n" }, { "commit": "3fad47560e15e6be3a6a27780cacf5790eb0ec04", "tree": "ac182d8c08f2e6d9822de97a441d249b16771578", "parents": [ "177f3a59f1467c63da7d135332b66b59ffc635d8" ], "author": { "name": "liushengsong", "email": "lss602726449@gmail.com", "time": "Thu Jun 18 11:16:59 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Jun 25 15:15:24 2026 +0800" }, "message": "Fix flaky resgroup_cpu_max_percent: average all CPU samples\n\nverify_cpu_usage() only used the first sample (all_info[0]) instead of\naveraging all collected samples, making it sensitive to single-sample\nfluctuations on busy CI machines. Use the mean of all samples as the\nfunction comment originally intended.\n" }, { "commit": "177f3a59f1467c63da7d135332b66b59ffc635d8", "tree": "f934de30195e5237c07c9a74bcff90c87181fc0c", "parents": [ "98d659121ec0c5a17b6508df4440495838507b65" ], "author": { "name": "liushengsong", "email": "lss602726449@gmail.com", "time": "Mon Jun 22 10:14:07 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Jun 25 15:15:24 2026 +0800" }, "message": "Re-enable select_throttle and workfile_mgr_test in singlenode\n\nRe-enable segwalrep/select_throttle in isolation2_schedule and\nworkfile_mgr_test in singlenode. Fix gpstop -ari to -arf for singlenode\nmode where immediate shutdown causes crash recovery and blocks\nconnections.\n" }, { "commit": "98d659121ec0c5a17b6508df4440495838507b65", "tree": "b1bddb7db4a6fe4fd22feabe94b1bb4c7d76b1c6", "parents": [ "e11b95342805bfc675cb28d903247165eff56fea" ], "author": { "name": "liushengsong", "email": "lss602726449@gmail.com", "time": "Mon Jun 22 10:13:59 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Jun 25 15:15:24 2026 +0800" }, "message": "Fix singlenode prevent_ao_wal test: enable pg_waldump and fix expected output\n\nEnable pg_waldump validation in singlenode prevent_ao_wal test (was\ndisabled by MERGE16_FIXME). Broaden matchignore to handle both \"fatal\"\nand \"error\" messages from pg_waldump. Add missing blank lines in\nexpected output after pg_waldump command output.\n" }, { "commit": "e11b95342805bfc675cb28d903247165eff56fea", "tree": "15335c23a59abdabd0e4e2a58702c6a49e1556e1", "parents": [ "f95d668caf526cbee7266aaaabbd46516bb16263" ], "author": { "name": "liushengsong", "email": "lss602726449@gmail.com", "time": "Wed Jun 17 16:25:23 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Jun 25 15:15:24 2026 +0800" }, "message": "Remove MERGE16_FIXME comment in extract_directory\n\nThe forceoverwrite check is unnecessary here because\nverify_dir_is_empty_or_create already handles non-empty directories\nbefore tar extraction begins.\n" }, { "commit": "f95d668caf526cbee7266aaaabbd46516bb16263", "tree": "3e92c20d80f7a57297b51151c1e15f9209806a48", "parents": [ "649b46491c1e53153a5193ed13817bdd02156847" ], "author": { "name": "liushengsong", "email": "lss602726449@gmail.com", "time": "Wed Jun 17 16:15:34 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Jun 25 15:15:24 2026 +0800" }, "message": "Remove MERGE16_FIXME: delete dead requiredPerms stripping code in exec_mpp_query\n\nThe commented-out code stripped write permissions from RTEs on non-root\nslices. This is unnecessary because InitPlan already skips permission\nchecks on non-writer segments (execMain.c:1821). Additionally, PG16\nmoved requiredPerms from RTE to RTEPermissionInfo, making the original\ncode incompatible.\n" }, { "commit": "649b46491c1e53153a5193ed13817bdd02156847", "tree": "eaff36e904e5b0d7d1e72988c71ecb37d2217519", "parents": [ "2f682fe7cbeda969b796ba04d368afd5f1909121" ], "author": { "name": "liushengsong", "email": "lss602726449@gmail.com", "time": "Mon Jun 22 10:13:41 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Jun 25 15:15:24 2026 +0800" }, "message": "Re-enable pgstat temp file reporting and fix SIGSEGV in ReportTemporaryFileUsage\n\nRe-enable temporary file size reporting to pgstat and the associated\nAssert in FileClose. Fix a SIGSEGV in ReportTemporaryFileUsage that\noccurred during process exit when the resource owner was already\nreleased.\n" }, { "commit": "2f682fe7cbeda969b796ba04d368afd5f1909121", "tree": "3ab10123bdba71a5598d0ccec669c9ccd648854c", "parents": [ "4b6618f501cc1f187443fa6386cb873d8d8a6bf8" ], "author": { "name": "liushengsong", "email": "lss602726449@gmail.com", "time": "Tue Jun 16 10:03:11 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Jun 25 15:15:24 2026 +0800" }, "message": "Fix PAX alter_distribution_policy test: use matchsubs to mask cluster.c line number\n" }, { "commit": "4b6618f501cc1f187443fa6386cb873d8d8a6bf8", "tree": "2d616c514614c72d6915a1ac74b5d61024400efe", "parents": [ "3fd1fbacb90e63ba749bca6d8912ea5b190c9cfd" ], "author": { "name": "liushengsong", "email": "lss602726449@gmail.com", "time": "Mon Jun 15 14:42:07 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Jun 25 15:15:24 2026 +0800" }, "message": "Fix MERGE16_FIXME: add UNSAFE_HAS_SUBPLAN flag for qual pushdown\n\nThe subplan check in check_output_expressions was incorrectly using\nUNSAFE_NOTIN_PARTITIONBY_CLAUSE, which only prevents normal pushdown\nbut still allows the qual to be pushed as a window run condition.\nSubplans in output expressions should completely block pushdown in\nCloudberry\u0027s distributed execution model.\n\nAdd a dedicated UNSAFE_HAS_SUBPLAN flag and include it in the fully\nunsafe set in qual_is_pushdown_safe, so quals referencing output\ncolumns containing subplans are never pushed down.\n" }, { "commit": "3fd1fbacb90e63ba749bca6d8912ea5b190c9cfd", "tree": "42aa7224310f46160b272eada2dd5d47ef51b939", "parents": [ "fd4141c3f84bb006da55f33d98bfdf1faa2444e4" ], "author": { "name": "liushengsong", "email": "lss602726449@gmail.com", "time": "Mon Jun 15 10:19:45 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Jun 25 15:15:24 2026 +0800" }, "message": "Remove MERGE16_FIXME in PartitionSelector and dead declarations\n\nThe CreatePartitionPruneState() call in nodePartitionSelector.c is\ncorrect -- PartitionSelector only needs the pruning data structure,\nnot the initial pruning and subplan map renumbering that\nExecInitPartitionPruning() adds on top. Remove the incorrect FIXME.\n\nAlso remove two dead declarations in execPartition.h:\n- ExecCreatePartitionPruneState: renamed to CreatePartitionPruneState\n in PG15 (commit 297daa9d435), declaration was never cleaned up\n- ExecFindInitialMatchingSubPlans: folded into ExecFindMatchingSubPlans\n in the same refactor, declaration was never cleaned up\n" }, { "commit": "fd4141c3f84bb006da55f33d98bfdf1faa2444e4", "tree": "74c081f9bf056e382e5f8835b26b96f432fdaf9c", "parents": [ "befb2bf5b182a2f509c008c5421506261b1a1e67" ], "author": { "name": "liushengsong", "email": "lss602726449@gmail.com", "time": "Fri Jun 12 17:52:06 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Thu Jun 25 15:15:24 2026 +0800" }, "message": "Remove unnecessary vacuum_set_xid_limits calls for AO/AOCO tables\n\nAO/AOCO tables have no per-tuple xmin/xmax -- visibility is managed\nvia visibility map at segment level, not per-tuple transaction IDs.\nThe freeze limits computed by vacuum_set_xid_limits are meaningless\nfor AO tables. Worse, passing MultiXactCutoff to vac_update_relstats\n(vacuum) or swap_relation_files (CLUSTER) incorrectly sets relminmxid\non AO tables (whose relminmxid should remain InvalidMultiXactId),\ncausing them to unnecessarily participate in database-wide datminmxid\ncalculation.\n\nFix by:\n- vacuum_ao.c: remove vacuum_set_xid_limits call, pass Invalid values\n directly to vac_update_relstats\n- appendonlyam_handler.c / aocsam_handler.c: remove vacuum_set_xid_limits\n call in copy_for_cluster, return Invalid values to caller\n- cluster.c: relax MultiXactId assert to allow InvalidMultiXactId,\n and reset relminmxid to InvalidMultiXactId for AO tables (matching\n the existing relfrozenxid override)\n\nvacuum_set_xid_limits was a pre-PG16 API kept only for AO callers.\nWith all callers removed, delete the function and its declaration.\n" }, { "commit": "befb2bf5b182a2f509c008c5421506261b1a1e67", "tree": "933dd107c7dc79a4c1cdd3e4ab0ba70e23d874d4", "parents": [ "49ce8e8ad8569947028426d6e775ac25873c8a18" ], "author": { "name": "Jianghua.yjh", "email": "yjhjstz@gmail.com", "time": "Thu Jun 25 12:43:27 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 25 12:43:27 2026 +0800" }, "message": "ORCA: align CBitSet vec_size for grouping-set bitsets (#1754)\n\n* ORCA: align CBitSet vec_size for grouping-set bitsets\n\nCreateGroupingSetsForRollup / Cube and the GROUPING_SET_EMPTY case in\nGetColumnAttnosForGroupBy were constructing their accumulator/seed\nCBitSets via the default ctor (vec_size \u003d 256), then Union\u0027ing in\nper-grouping-set bitsets built with vec_size \u003d num_cols. CBitSet::Union\njust splices in any missing CBitSetLinks wholesale, so the accumulator\nended up with a link at offset 0 (vec_size 256) plus a stray link at\noffset num_cols (vec_size num_cols) covering the high tleSortGroupRef.\nCBitSet::Get then computed the offset using the destination\u0027s\nm_vector_size \u003d 256 and never consulted the stray link, while\nCBitSetIter happily walked both -- so Get(k) disagreed with the iterator\nfor any k \u003e\u003d num_cols.\n\nIn CreateDXLProjectNullsForGroupingSets this caused tleSortGroupRefs \u003e\u003d\nnum_cols to be misclassified as non-grouping columns and NULL\u0027d out,\neven in grouping sets that included them. Visible as:\n\n select generate_series(1, a) g, a+b ab\n from (values (1,1),(2,2)) t(a,b)\n group by rollup(a, ab) order by 1,2;\n\nreturning 0 rows instead of 6 -- the rollup(a, ab) branch projected the\na column as NULL, so generate_series(1, NULL) produced no rows.\n\nFix by passing num_cols when constructing the accumulator and seed\nbitsets so all participants in the Union share m_vector_size.\n\nAdd the repro to groupingsets.sql.\n\n* ORCA: assert matching CBitSet vec_size and cover cube() in test" }, { "commit": "49ce8e8ad8569947028426d6e775ac25873c8a18", "tree": "3a5f912adb7233f3cd8ff80c0611d9c1f8e31860", "parents": [ "08e3fc294fcb0dcfe51732d60e127164ba8212fb" ], "author": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Tue Jun 23 17:36:11 2026 +0800" }, "committer": { "name": "Dianjin Wang", "email": "wangdianjin@gmail.com", "time": "Wed Jun 24 17:39:26 2026 +0800" }, "message": "Doc: Fix CloudBerry -\u003e Cloudberry typo in READMEs\n\nThe project name \"Cloudberry\" was incorrectly capitalized as\n\"CloudBerry\" in two README files under contrib/. Correct the\ncapitalization to match the canonical project name.\n\nAlso, update the legacy brand `Cloudberry Database` to `Apache\nCloudberry`.\n" }, { "commit": "08e3fc294fcb0dcfe51732d60e127164ba8212fb", "tree": "d8dbcca838986f3b1c4a2d6ec40143f52571081e", "parents": [ "9fb2426f9ff99b437b6cc136a38c9fc493d47bbf" ], "author": { "name": "Sagittarius", "email": "101273427+MutableFire@users.noreply.github.com", "time": "Mon Jun 22 12:52:18 2026 +0300" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Jun 22 17:52:18 2026 +0800" }, "message": "Add views for getting cumulative IC stats (#1772)\n\nMain changes:\n* `gp_interconnect_stats` — aggregated statistics across all segments;\n* `gp_interconnect_stats_per_segment` — statistics grouped by segment;\n* `gp_interconnect_stats_per_segment_per_host` — statistics grouped by host and segment.\n\nBased on the implementation from OpenGPDB ([open‑gpdb/gpdb#109](https://github.com/open-gpdb/gpdb/pull/109))." }, { "commit": "9fb2426f9ff99b437b6cc136a38c9fc493d47bbf", "tree": "318af1af9335f41d2cbecc7ae0d3f375d58d8a29", "parents": [ "3a64dbce00df4ef7801aad253a1a9cbe49b23626" ], "author": { "name": "lqriu", "email": "104130571+lqriu@users.noreply.github.com", "time": "Thu Jun 18 14:47:31 2026 +0800" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Thu Jun 18 14:47:31 2026 +0800" }, "message": "Feature: add reject_partition_fullscan extension (#1713)\n\nAdd a gpcontrib debug extension that rejects full scans on partitioned\nables when partition pruning is ineffective.\n\nThe extension is built only with enable_debug_extensions\u003dyes and supports\nPlanner and ORCA plans, including Append, MergeAppend, PartitionSelector,\nand DynamicScan cases." }, { "commit": "3a64dbce00df4ef7801aad253a1a9cbe49b23626", "tree": "ae719d3b56a2185ad9119d43c3c20cc090736b12", "parents": [ "b70df45d6bfe6f9ca8d5ad0ce86dfcba80ba7581" ], "author": { "name": "reshke", "email": "reshke@double.cloud", "time": "Sat Jun 06 13:18:59 2026 +0000" }, "committer": { "name": "reshke", "email": "reshkekirill@gmail.com", "time": "Mon Jun 15 12:43:21 2026 +0500" }, "message": "Adapt cloudberry regression suite for regression changes\n" } ], "next": "b70df45d6bfe6f9ca8d5ad0ce86dfcba80ba7581" }