Check for nondeterministic collations before assuming that an equality condition on a collatable type implies uniqueness (Richard Guo) § §

Numerous planner optimizations assume that, for example, at most one table row can satisfy WHERE x = 'abc' if there is a unique index on x. However this conclusion is unsafe in general if the index and the WHERE clause have different collations attached. It is safe when both collations are deterministic, because that property essentially requires that equality of two strings means bitwise equality. But nondeterministic collations don't act that way, so that optimizing on the assumption of unique matches can give wrong query answers if either the WHERE clause or the index has a nondeterministic collation.

Fix incorrect handling of NEW generated columns in rule actions and rule qualifications (Richard Guo, Dean Rasheed) §

Previously, such column references would produce NULL in INSERT cases, or be equivalent to the OLD value in UPDATE cases.

Fix spurious “generated columns are not supported in COPY FROM WHERE conditions” errors (Tom Lane) §

Use of a system column in a COPY FROM WHERE condition could sometimes incorrectly report this error.

Fix CREATE TABLE ... LIKE ... INCLUDING STATISTICS for cases where the source table has dropped column(s) (Julien Tachoires) §

In such cases, extended statistics objects could be copied incorrectly, or the command could give an incorrect error.

Allow ALTER INDEX ... ATTACH PARTITION to mark the parent index valid if appropriate (Sami Imseih) §

There are edge cases in which a partitioned index might remain marked as invalid even when all its leaf indexes are valid. This change provides a mechanism whereby a user can correct such a situation without resorting to manual catalog updates.

Fix ALTER FOREIGN DATA WRAPPER to not drop the wrapper object's dependency on its handler function (Jeff Davis) §

Disallow making a composite type be a member of itself via a multirange (Heikki Linnakangas) §

We already forbade such cases when the intermediate type is a domain, array, composite type, or range; but multiranges were overlooked.

Fix datum-image comparisons to be insensitive to sign-extension variations (David Rowley) §

This fixes some situations that previously led to “could not find memoization table entry” errors or wrong query results.

Fix incorrect logic for hashed IN/NOT IN with non-strict equality operator (Chengpeng Yan) §

The previous coding could crash or give wrong answers. All built-in data types have strict equality operators, so that this issue could only arise with an extension data type.

Truncate overly-long locale-specific numeric symbols in to_char() (Tom Lane) §

If a locale specified a currency symbol, thousands separator, or decimal or sign symbol more than 8 bytes long, a buffer overrun was possible. No such locales exist in the real world, and it's impractical for an unprivileged attacker to install a malicious locale definition underneath a Postgres server; but for safety's sake check for overlength symbols and truncate if needed.

Prevent buffer overruns when parsing an affix file for an Ispell dictionary (Tom Lane) § §

A corrupt or malicious affix file could crash the server. This is not considered a security issue because text search configuration files are presumed trustworthy, but it still seems worth fixing.

Guard against integer overflow in calculations of frame start and end positions for window aggregates (Richard Guo) §

Very large user-specified offsets (close to INT64_MAX) could result in errors or incorrect query results.

Fix buffer overread when pglz_decompress() receives corrupt input (Andrew Dunstan) §

It was possible to read a few bytes past the end of the input, which in very unlucky cases might cause a crash.

Ensure that tuplestore data structures are internally consistent even after an error (Tom Lane) §

The code was previously careless about this, which is fine most of the time but is problematic for the tuplestore backing a WITH HOLD cursor. In v15 and before this leads to easily-reproducible crashes; later branches are not known to be vulnerable, but it seems best to preserve consistency in all.

Fix premature NULL lag reporting in pg_stat_replication (Shinya Kato) §

The lag columns frequently read as NULL even while replication activity was happening.

Avoid rare flush failure when working with non-WAL-logged GiST indexes (Tomas Vondra) §

A non-logged GiST index could nonetheless sometimes produce “xlog flush request n/nnnn is not satisfied” errors, due to incorrect selection of a “fake LSN” to represent an insertion point.

Fix underestimate of required size of DSA page maps for odd-size segments (Paul Bunn) §

This miscalculation led to out-of-bounds accesses and hence server crashes.

Fix possible server crash when processing extended statistics on expressions of extension data types (Michael Paquier) §

NULL pointer dereferences were possible if the data type's typanalyze function does not compute any useful statistics. No in-core typanalyze function behaves that way, but extensions could.

Fix race condition between WAL replay of checkpoints and multixact ID creations (Heikki Linnakangas) §

A standby server following WAL from a primary of an older minor version could get into a crash-and-restart loop complaining about “could not access status of transaction”.

Prevent indefinite wait in shutdown of a walsender process (Anthonin Bonnefoy) § §

At shutdown of a cluster that is publishing logical replication data, the walsender waits for all pending WAL to be written out. But it did not correctly request that to happen, so that in some cases this could become an indefinite wait.

Ensure that changes to tables' free space maps are persisted during recovery (Alexey Makhmutov) §

Previously, while WAL replay did update the free space map while replaying operations that should change it, the map page buffer did not get marked dirty if checksums are enabled, so that the changes might never get written out. On a standby server, over time this would result in a map wildly at variance with the table's actual contents. While the map is only used as a hint, this condition could cause significant performance degradation for some period of time after the standby server is promoted to be active, until most of the map has been repaired by updates.

Fix crashes in some ecpg functions when called without any established connection (Shruthi Gowda) §

In pg_upgrade, take care to use the correct protocol version when connecting to older source servers (Jacob Champion) §

This could be problematic when attempting to upgrade from a pre-2018 server.

Fix contrib/ltree to cope when case-folding changes a string's byte length (Jeff Davis) §

Previously, lquery patterns specifying case-insensitive matching might fail to match labels they should match.

In contrib/pg_stat_statements, don't leak memory if an error occurs while parsing the pgss_query_texts.stat file (Heikki Linnakangas) §

In contrib/postgres_fdw, avoid crash due to premature cleanup of a failed connection (Etsuro Fujita) §

If a remote connection fails abort cleanup, we can't use it any longer. But delay closing the connection object until end of transaction, because there might still be references to it within data structures such as open cursors.

Update time zone data files to tzdata release 2026b (Tom Lane) §

British Columbia (America/Vancouver) will be on year-round UTC-07 (effectively, permanent DST) beginning in November 2026. This release assumes that their TZ abbreviation will be MST from that time forward. That seems likely to change, but it's unclear what new abbreviation will be used. Also a historical correction for Moldova: they have followed EU DST transition times since 2022.